diff --git a/.github/workflows/agent-e2e-smoke.yml b/.github/workflows/agent-e2e-smoke.yml
index 0269c9ef8..338742c36 100644
--- a/.github/workflows/agent-e2e-smoke.yml
+++ b/.github/workflows/agent-e2e-smoke.yml
@@ -42,6 +42,8 @@ jobs:
     # ubuntu: the fast per-PR gate. The earlier claude hang was MCP-mode's
     # MCP-server subprocess (not a platform issue) — the smoke now runs the agent
     # in skills mode (no MCP), which works on Linux.
+    # Fork PRs do not receive secrets so E2E_WS_TOKEN is empty; skip rather than fail.
+    if: ${{ env.E2E_WS_TOKEN != '' }}
     runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
diff --git a/workspace/frontend/app/[workspaceId]/page.tsx b/workspace/frontend/app/[workspaceId]/page.tsx
index 5b67d9f8c..d374ce4cd 100644
--- a/workspace/frontend/app/[workspaceId]/page.tsx
+++ b/workspace/frontend/app/[workspaceId]/page.tsx
@@ -40,9 +40,20 @@ function WorkspaceLoadingSplash() {
   );
 }
 
+// Share the cookie across openagents.org subdomains, but fall back to a
+// host-only cookie anywhere else. A browser silently drops a cookie whose
+// Domain attribute it is not a member of, so hardcoding the attribute means no
+// cookie at all on a self-hosted deployment.
+function workspaceCookieDomain(hostname: string): string {
+  return hostname === 'openagents.org' || hostname.endsWith('.openagents.org')
+    ? ';domain=.openagents.org'
+    : '';
+}
+
 function setWorkspaceCookie(slug: string, token: string) {
   const maxAge = 30 * 24 * 60 * 60;
-  const shared = `path=/;max-age=${maxAge};secure;samesite=lax;domain=.openagents.org`;
+  const domain = workspaceCookieDomain(window.location.hostname);
+  const shared = `path=/;max-age=${maxAge};secure;samesite=lax${domain}`;
   document.cookie = `oa_workspace=${encodeURIComponent(JSON.stringify({ slug, token }))};${shared}`;
   document.cookie = `oa_has_workspace=1;${shared}`;
 }