diff --git a/packages/sdk/src/workflows/runner.ts b/packages/sdk/src/workflows/runner.ts
index 25966c818..2a3310a33 100644
--- a/packages/sdk/src/workflows/runner.ts
+++ b/packages/sdk/src/workflows/runner.ts
@@ -1545,6 +1545,13 @@ export class WorkflowRunner {
   }
 
   private async provisionAgents(config: RelayYamlConfig): Promise<void> {
+    // Cloud launcher already compiled and seeded relayfile ACLs before the
+    // sandbox started.  Skip in-sandbox provisioning — the relayfile API has
+    // no POST /v1/workspaces route, so attempting it causes a fatal 404.
+    if (process.env.RELAY_CLOUD_PROVISIONING_DONE === '1') {
+      return;
+    }
+
     this.agentTokens.clear();
     await this.stopProvisionedMounts();
 
diff --git a/scripts/e2e-test.sh b/scripts/e2e-test.sh
index 26bda404a..6ada51f22 100755
--- a/scripts/e2e-test.sh
+++ b/scripts/e2e-test.sh
@@ -145,7 +145,7 @@ if [ ! -f "$PROJECT_DIR/dist/src/cli/index.js" ]; then
   log_info "Building project..."
   npm run build
 else
-  log_info "Build exists, skipping (run 'npm run build' to rebuild)"
+  log_info "Build exists, skipping initial rebuild (Phase 4 will rebuild before SDK lifecycle)"
 fi
 
 # Phase 1: Broker startup smoke test
@@ -305,6 +305,8 @@ fi
 
 # Phase 4: SDK lifecycle test (spawn/list/release)
 log_phase "Phase 4: SDK Agent Lifecycle"
+log_info "Rebuilding before SDK lifecycle test to ensure dist matches current source..."
+npm run build > /dev/null
 if ! node "$PROJECT_DIR/scripts/e2e-sdk-lifecycle.mjs" \
   --name "$AGENT_NAME" \
   --cli "claude" \