diff --git a/.github/workflows/deploy-Dataspace.yml b/.github/workflows/deploy-Dataspace.yml
index 31f46e48..6d769c6a 100644
--- a/.github/workflows/deploy-Dataspace.yml
+++ b/.github/workflows/deploy-Dataspace.yml
@@ -201,6 +201,10 @@ jobs:
       TEST_PASSWORD_1: ${{ secrets.TEST_PASSWORD_1 }}
       TEST_EMAIL_2: ${{ secrets.TEST_EMAIL_2 }}
       TEST_PASSWORD_2: ${{ secrets.TEST_PASSWORD_2 }}
+      # api-smoke authenticates against Keycloak via ROPC. `dataspace` is a
+      # confidential client, so without this the token request returns 401
+      # and the job fails its preflight.
+      KEYCLOAK_CLIENT_SECRET: ${{ secrets.KEYCLOAK_CLIENT_SECRET }}
 
   # dev only: smoke tests are the real quality gate here. Only once they pass
   # does this release become the thing a future rollback would target.