diff --git a/scripts/run_tests.sh b/scripts/run_tests.sh
index bc0b4e6b98..7db21c42d6 100755
--- a/scripts/run_tests.sh
+++ b/scripts/run_tests.sh
@@ -138,7 +138,8 @@ done
 #     HERMES_GIT_SHA build-arg the workflow bakes in).
 #
 # These are test-infrastructure knobs, not credentials — same class as the
-# HERMES_RUN_SLOW_PET_TESTS / HERMES_E2E_BROWSER opt-ins already forwarded.
+# HERMES_RUN_SLOW_PET_TESTS / HERMES_E2E_BROWSER / HERMES_RUN_E2E opt-ins
+# forwarded below.
 # Keep this an explicit allowlist (no HERMES_TEST_* glob) so the "no
 # credential can leak" property stays auditable at a glance.
 TEST_ENV=()
@@ -179,6 +180,7 @@ exec env -i \
   PYTHONUTF8=1 \
   ${HERMES_RUN_SLOW_PET_TESTS:+HERMES_RUN_SLOW_PET_TESTS="$HERMES_RUN_SLOW_PET_TESTS"} \
   ${HERMES_E2E_BROWSER:+HERMES_E2E_BROWSER="$HERMES_E2E_BROWSER"} \
+  ${HERMES_RUN_E2E:+HERMES_RUN_E2E="$HERMES_RUN_E2E"} \
   ${EXTRA_PYTHONPATH:+PYTHONPATH="$EXTRA_PYTHONPATH"} \
   ${EXTRA_PYTEST_PLUGINS:+PYTEST_PLUGINS="$EXTRA_PYTEST_PLUGINS"} \
   "$PYTHON" "$SCRIPT_DIR/run_tests_parallel.py" "$@"
diff --git a/tests/agent/test_iron_proxy_e2e.py b/tests/agent/test_iron_proxy_e2e.py
index 37c3936c0d..8204384977 100644
--- a/tests/agent/test_iron_proxy_e2e.py
+++ b/tests/agent/test_iron_proxy_e2e.py
@@ -4,9 +4,10 @@ Spins up the REAL iron-proxy binary (auto-installed if not present), routes
 a curl request through it against a local fake upstream, and verifies that
 the Authorization header was swapped from a proxy token to a real secret.
 
-Gated on the network. Skipped by default in CI unless the user explicitly
-opts in with --run-e2e or HERMES_RUN_E2E=1.  This is intentional — the test
-downloads ~16MB and requires both `openssl` and `curl` to be present.
+Gated on the network: skipped unless HERMES_RUN_E2E=1 (no CI lane sets it;
+it is a manual smoke, see website/docs/developer-guide/egress-internals.md).
+This is intentional — the test downloads ~16MB and requires both `openssl`
+and `curl` to be present.
 """
 
 from __future__ import annotations