diff --git a/tests/test_svc_realcombo.py b/tests/test_svc_realcombo.py
index 27c2a6d3..b1d3cad4 100644
--- a/tests/test_svc_realcombo.py
+++ b/tests/test_svc_realcombo.py
@@ -70,6 +70,9 @@ class RealComboTests(tsr.SvcAutoRecoverTests):
             return False
 
     def seed_real(self, name, port, binary):
+        # CI 运行器无 bwrap：RDM 沙箱 fail-closed 会拒启——硬关 exec 工具
+        #（产品提供的最高兜底，RDM_DISABLE_EXEC_TOOLS=1）后生命周期语义不变。
+        self.env["RDM_DISABLE_EXEC_TOOLS"] = "1"
         d = self.runtime(name)
         (d / "bin").mkdir(parents=True, exist_ok=True)
         (d / "data").mkdir(exist_ok=True)
@@ -150,6 +153,7 @@ class RealComboTests(tsr.SvcAutoRecoverTests):
         """全轨：materialize（真实 make build）→ 候选身份门禁 → release 切换 →
         伴生工作台 200 → 裸重启稳定。"""
         env = dict(self.env)
+        env["RDM_DISABLE_EXEC_TOOLS"] = "1"
         env.update({"SVC_RDM_SRC_DIR": str(self.root / "rdmcache"),
                     "SVC_RDM_ORIGIN": RDM_ORIGIN})
         result = self.svc("rcf", "deploy", "--from", "rdm", "--port", "9474", env=env)