diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 10145d7..4bc502a 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -27,4 +27,15 @@ jobs:
         run: uv run pytest -m "not integration"
 
       - name: Integration tests
-        run: uv run pytest -m integration
+        # Live-path credentials come from repo Actions secrets; the tests
+        # skip-guard on these, so a missing secret or unreachable service
+        # degrades to "skipped", never a failure on unrelated work.
+        env:
+          NISSE_LLM_BASE_URL: ${{ secrets.NISSE_LLM_BASE_URL }}
+          NISSE_LLM_TOKEN: ${{ secrets.NISSE_LLM_TOKEN }}
+          NISSE_ROLE_EXECUTOR: ${{ secrets.NISSE_ROLE_EXECUTOR }}
+          NISSE_MATRIX_HOMESERVER: ${{ secrets.NISSE_MATRIX_HOMESERVER }}
+          NISSE_MATRIX_USER_ID: ${{ secrets.NISSE_MATRIX_USER_ID }}
+          NISSE_MATRIX_TOKEN: ${{ secrets.NISSE_MATRIX_TOKEN }}
+          NISSE_MATRIX_TEST_ROOM_ID: ${{ secrets.NISSE_MATRIX_TEST_ROOM_ID }}
+        run: uv run pytest -m integration -rs