diff --git a/.env.example b/.env.example
index f5861a8..7e708cc 100644
--- a/.env.example
+++ b/.env.example
@@ -11,6 +11,9 @@ NISSE_LLM_TOKEN=replace-me
 NISSE_MATRIX_TOKEN=replace-me
 # gitea.token: the Gitea service account's scoped token (B2)
 NISSE_GITEA_TOKEN=replace-me
+# The end-to-end tests' scripted operator (nisse-testing-operator): scopes
+# write:issue and write:repository, write access to the sandbox only.
+NISSE_OPERATOR_TOKEN=replace-me
 # The live push test reads the sandbox's deploy key from the path in
 # tests/integration/nisse-test.yaml (gitea.push_key), not from here.
 
diff --git a/tests/integration/nisse-test.yaml b/tests/integration/nisse-test.yaml
index 7ad7fe3..03e515e 100644
--- a/tests/integration/nisse-test.yaml
+++ b/tests/integration/nisse-test.yaml
@@ -41,7 +41,9 @@ gitea:
   url: https://gitea.dongar.net
   token: ${NISSE_GITEA_TOKEN}
   repo: dongar/nisse-dev-testing-sandbox      # the sandbox, never a real project
-  operators: [dongar]
+  # nisse-testing-operator plays the operator in the end-to-end tests
+  # (NISSE_OPERATOR_TOKEN); an operator here and nowhere else.
+  operators: [dongar, nisse-testing-operator]
   # What pushes go by (D4): the sandbox's deploy key, whose private half CI
   # writes to this path from the NISSE_PUSH_KEY secret (locally: copy it
   # there). An HTTPS push token works too: push_user plus push_token.