diff --git a/scripts/run_tests.sh b/scripts/run_tests.sh
index 0db80ffb13..4445d6d542 100755
--- a/scripts/run_tests.sh
+++ b/scripts/run_tests.sh
@@ -123,6 +123,32 @@ for _win_var in USERPROFILE HOMEDRIVE HOMEPATH LOCALAPPDATA APPDATA SYSTEMROOT T
   fi
 done
 
+# ── Test-runner knobs (computed before we drop env) ────────────────────────
+# The runner's own documented environment knobs must survive the hermetic
+# `env -i` below, or they are silent no-ops for anyone invoking this script:
+#
+#   * HERMES_TEST_WORKERS / PATHS / FILE_TIMEOUT / FILE_RETRIES / SLICE are
+#     read by run_tests_parallel.py at argparse-default time — inside the
+#     stripped environment.
+#   * HERMES_TEST_IMAGE is read by tests/docker/conftest.py to skip its
+#     session-scoped `docker build`. CI's docker.yml sets it to the image
+#     the build step just loaded; stripping it made every per-file pytest
+#     subprocess rebuild the 5GB image from a cold builder cache instead
+#     (~4 min per worker per run, and the rebuilt image lacked the
+#     HERMES_GIT_SHA build-arg the workflow bakes in).
+#
+# These are test-infrastructure knobs, not credentials — same class as the
+# HERMES_RUN_SLOW_PET_TESTS / HERMES_E2E_BROWSER opt-ins already forwarded.
+# Keep this an explicit allowlist (no HERMES_TEST_* glob) so the "no
+# credential can leak" property stays auditable at a glance.
+TEST_ENV=()
+for _test_var in HERMES_TEST_IMAGE HERMES_TEST_WORKERS HERMES_TEST_PATHS \
+  HERMES_TEST_FILE_TIMEOUT HERMES_TEST_FILE_RETRIES HERMES_TEST_SLICE; do
+  if [ -n "${!_test_var:-}" ]; then
+    TEST_ENV+=("$_test_var=${!_test_var}")
+  fi
+done
+
 # ── Run in hermetic env ──────────────────────────────────────────────────────
 # env -i: start with empty environment, opt-in only what we need.
 # No credential var can leak — you'd have to explicitly add it here.
@@ -144,6 +170,7 @@ exec env -i \
   PATH="$PATH" \
   HOME="$HOME" \
   ${WIN_ENV[@]+"${WIN_ENV[@]}"} \
+  ${TEST_ENV[@]+"${TEST_ENV[@]}"} \
   TZ=UTC \
   LANG=C.UTF-8 \
   LC_ALL=C.UTF-8 \