diff --git a/bin/ci/setup-arch.sh b/bin/ci/setup-arch.sh
index 9c9f07e..3f8b571 100755
--- a/bin/ci/setup-arch.sh
+++ b/bin/ci/setup-arch.sh
@@ -43,6 +43,10 @@ test -L /usr/local/bin/baudbot
 baudbot --version
 HELP_OUT=$(baudbot --help)
 echo "$HELP_OUT" | grep -q "baudbot"
+# varlock installed for agent user
+test -x /home/baudbot_agent/.varlock/bin/varlock
+# Agent can load env (smoke test — varlock validates schema + .env)
+sudo -u baudbot_agent bash -c 'export PATH="$HOME/.varlock/bin:$HOME/opt/node-v22.14.0-linux-x64/bin:$PATH" && cd ~ && varlock load --path ~/.config/'
 echo "  ✓ install.sh verification passed"
 
 echo "=== Installing test dependencies ==="
diff --git a/bin/ci/setup-ubuntu.sh b/bin/ci/setup-ubuntu.sh
index 67aa6ed..5a4e3fb 100755
--- a/bin/ci/setup-ubuntu.sh
+++ b/bin/ci/setup-ubuntu.sh
@@ -54,6 +54,10 @@ test -L /usr/local/bin/baudbot
 baudbot --version
 HELP_OUT=$(baudbot --help)
 echo "$HELP_OUT" | grep -q "baudbot"
+# varlock installed for agent user
+test -x /home/baudbot_agent/.varlock/bin/varlock
+# Agent can load env (smoke test — varlock validates schema + .env)
+sudo -u baudbot_agent bash -c 'export PATH="$HOME/.varlock/bin:$HOME/opt/node-v22.14.0-linux-x64/bin:$PATH" && cd ~ && varlock load --path ~/.config/'
 echo "  ✓ install.sh verification passed"
 
 echo "=== Installing test dependencies ==="
diff --git a/setup.sh b/setup.sh
index cd0fc1f..384db5f 100755
--- a/setup.sh
+++ b/setup.sh
@@ -191,10 +191,13 @@ echo "=== Installing Slack bridge dependencies ==="
 (cd "$REPO_DIR/slack-bridge" && npm install)
 
 echo "=== Installing varlock ==="
-if command -v varlock &>/dev/null; then
-  echo "varlock already installed, skipping"
+# varlock must be available to the agent user (start.sh adds ~/.varlock/bin to PATH).
+# Install as agent user so it lands in the right home directory.
+AGENT_VARLOCK="$BAUDBOT_HOME/.varlock/bin/varlock"
+if [ -x "$AGENT_VARLOCK" ]; then
+  echo "varlock already installed for baudbot_agent, skipping"
 else
-  curl -sSfL https://varlock.dev/install.sh | sh -s
+  sudo -u baudbot_agent bash -c 'curl -sSfL https://varlock.dev/install.sh | sh -s'
 fi
 
 echo "=== Deploying from source to runtime ==="