@@ -3075,13 +3075,19 @@ pub async fn build_sandbox_config_snapshot_from_inputs(
             &policy_credential_bindings,
         )?;
     }
+    let environment_overrides = super::provider::non_secret_provider_environment_overrides(
+        provider_profile_catalog,
+        provider_records,
+        sandbox,
+    );
     let provider_env_revision = compute_provider_env_revision_from_records_and_policy_bindings(
         provider_profile_catalog,
         provider_records,
         &policy_credential_bindings,
         policy
             .as_ref()
             .filter(|_| matches!(policy_source, PolicySource::Global)),
+        &environment_overrides,
     )?;
 
     let service_routes = super::service::configured_app_routes(state, sandbox).await?;
@@ -3381,6 +3387,7 @@ fn compute_provider_env_revision_from_records(
         records,
         &HashMap::new(),
         None,
+        &BTreeMap::new(),
     )
 }
 
@@ -3389,6 +3396,7 @@ fn compute_provider_env_revision_from_records_and_policy_bindings(
     records: &[super::provider::ProviderEnvironmentRecord],
     policy_bindings: &HashMap<String, Vec<StaticCredentialEndpointBinding>>,
     global_policy: Option<&ProtoSandboxPolicy>,
+    environment_overrides: &BTreeMap<String, String>,
 ) -> Result<u64, Status> {
     let mut hasher = Sha256::new();
     hasher.update(b"openshell-provider-env-revision-v4");
@@ -3432,6 +3440,18 @@ fn compute_provider_env_revision_from_records_and_policy_bindings(
         hasher.update(deterministic_policy_hash(policy).as_bytes());
     }
 
+    if !environment_overrides.is_empty() {
+        // Hash the same effective values that the environment snapshot installs.
+        // Length prefixes preserve boundaries, including explicitly empty values.
+        hasher.update(b"caller-non-secret-environment");
+        for (key, value) in environment_overrides {
+            hasher.update((key.len() as u64).to_le_bytes());
+            hasher.update(key.as_bytes());
+            hasher.update((value.len() as u64).to_le_bytes());
+            hasher.update(value.as_bytes());
+        }
+    }
+
     let digest = hasher.finalize();
     Ok(u64::from_le_bytes(digest[..8].try_into().map_err(
         |_| Status::internal("provider env revision digest too short"),
@@ -3898,6 +3918,7 @@ pub async fn build_provider_environment_snapshot(
 /// is resolved.
 struct ProviderEnvironmentTarget<'a> {
     spec: &'a openshell_core::proto::SandboxSpec,
+    environment_overrides: BTreeMap<String, String>,
     effective_policy: ProtoSandboxPolicy,
     policy_source: PolicySource,
     policy_credential_bindings: HashMap<String, Vec<StaticCredentialEndpointBinding>>,
@@ -3929,14 +3950,21 @@ fn provider_environment_target(
         &effective_policy,
         &policy_credential_bindings,
     )?;
+    let environment_overrides = super::provider::non_secret_provider_environment_overrides(
+        provider_profile_catalog,
+        provider_records,
+        sandbox,
+    );
     let provider_env_revision = compute_provider_env_revision_from_records_and_policy_bindings(
         provider_profile_catalog,
         provider_records,
         &policy_credential_bindings,
         matches!(policy_source, PolicySource::Global).then_some(&effective_policy),
+        &environment_overrides,
     )?;
     Ok(ProviderEnvironmentTarget {
         spec,
+        environment_overrides,
         effective_policy,
         policy_source,
         policy_credential_bindings,
@@ -3955,6 +3983,7 @@ pub async fn build_provider_environment_snapshot_from_inputs(
     let sandbox_id = inputs.sandbox.object_id().to_string();
     let ProviderEnvironmentTarget {
         spec,
+        environment_overrides,
         effective_policy,
         policy_source,
         policy_credential_bindings,
@@ -3992,20 +4021,12 @@ pub async fn build_provider_environment_snapshot_from_inputs(
             credential.token_grant_owners.clone_from(&owners);
         }
     }
-    // Sandbox template and spec values are caller-owned. Drop only non-secret
-    // profile defaults for those keys before sending the snapshot to either
-    // the canonical process or later execs. Credential keys keep their
-    // existing binding and placeholder precedence.
-    let caller_has_key = |key: &str| {
-        spec.environment.contains_key(key)
-            || spec
-                .template
-                .as_ref()
-                .is_some_and(|template| template.environment.contains_key(key))
-    };
-    provider_environment.environment.retain(|key, _| {
-        provider_environment.static_credential_keys.contains(key) || !caller_has_key(key)
-    });
+    // Retain effective non-secret values for both process environments and
+    // supervisor consumers such as metadata. Credential keys are excluded
+    // from overrides and keep their binding and placeholder precedence.
+    provider_environment
+        .environment
+        .extend(environment_overrides);
 
     let mut readiness_reason = provider_environment.readiness_reason;
 
@@ -14460,6 +14481,10 @@ mod tests {
             .environment
             .config
             .insert("CUSTOM_PROJECT".to_string(), "project".to_string());
+        profile
+            .environment
+            .config
+            .insert("CUSTOM_MISSING".to_string(), "missing".to_string());
         profile
             .environment
             .fixed
@@ -14492,17 +14517,39 @@ mod tests {
             .insert("CUSTOM_PROJECT".to_string(), "caller-project".to_string());
         spec.environment
             .insert("GITHUB_TOKEN".to_string(), "caller-token".to_string());
-        spec.template
-            .get_or_insert_with(Default::default)
-            .environment
-            .insert("CUSTOM_MODE".to_string(), String::new());
+        spec.environment
+            .insert("CUSTOM_MISSING".to_string(), " caller value ".to_string());
+        spec.environment
+            .insert("UNRELATED".to_string(), "caller-only".to_string());
+        let template = spec.template.get_or_insert_with(Default::default);
+        template.environment = HashMap::from([
+            ("CUSTOM_PROJECT".to_string(), "template-project".to_string()),
+            ("CUSTOM_MODE".to_string(), String::new()),
+        ]);
         state.store.put_message(&sandbox).await.unwrap();
 
         let snapshot = load_sandbox_provider_environment(&state, &sandbox, true, true)
             .await
             .unwrap();
-        assert!(!snapshot.environment.contains_key("CUSTOM_PROJECT"));
-        assert!(!snapshot.environment.contains_key("CUSTOM_MODE"));
+        assert_eq!(
+            snapshot
+                .environment
+                .get("CUSTOM_PROJECT")
+                .map(String::as_str),
+            Some("caller-project")
+        );
+        assert_eq!(
+            snapshot.environment.get("CUSTOM_MODE").map(String::as_str),
+            Some("")
+        );
+        assert_eq!(
+            snapshot
+                .environment
+                .get("CUSTOM_MISSING")
+                .map(String::as_str),
+            Some(" caller value ")
+        );
+        assert!(!snapshot.environment.contains_key("UNRELATED"));
         assert_eq!(
             snapshot.environment.get("CUSTOM_UNSET").map(String::as_str),
             Some("default")
@@ -14516,7 +14563,129 @@ mod tests {
                 .static_credential_bindings
                 .contains_key("GITHUB_TOKEN")
         );
-        assert_eq!(snapshot.non_secret_environment_keys, ["CUSTOM_UNSET"]);
+        assert_eq!(
+            snapshot.non_secret_environment_keys,
+            [
+                "CUSTOM_MISSING",
+                "CUSTOM_MODE",
+                "CUSTOM_PROJECT",
+                "CUSTOM_UNSET"
+            ]
+        );
+    }
+
+    #[tokio::test]
+    async fn caller_environment_revision_tracks_effective_non_secret_values() {
+        let state = test_server_state().await;
+        let mut provider = test_provider("work-gcp", "google-cloud");
+        provider.credentials.clear();
+        state.store.put_message(&provider).await.unwrap();
+        let sandbox = test_sandbox(
+            "sb-caller-revision",
+            "caller-revision",
+            ProtoSandboxPolicy::default(),
+            vec!["work-gcp".to_string()],
+        );
+        let mut inputs = load_sandbox_config_inputs(&state, sandbox).await.unwrap();
+        let mut revisions = Vec::new();
+        for (spec_value, template_value, unrelated, expected) in [
+            (None, None, "one", None),
+            (
+                None,
+                Some("template-project"),
+                "one",
+                Some("template-project"),
+            ),
+            (
+                Some("caller-project"),
+                Some("template-project"),
+                "one",
+                Some("caller-project"),
+            ),
+            (
+                Some("caller-project"),
+                Some("shadowed-project"),
+                "two",
+                Some("caller-project"),
+            ),
+            (Some(""), Some("template-project"), "one", Some("")),
+        ] {
+            let spec = inputs.sandbox.spec.as_mut().unwrap();
+            spec.environment = HashMap::from([("UNRELATED".to_string(), unrelated.to_string())]);
+            if let Some(value) = spec_value {
+                spec.environment
+                    .insert("GCP_PROJECT_ID".to_string(), value.to_string());
+            }
+            spec.template
+                .get_or_insert_with(Default::default)
+                .environment = template_value
+                .map(|value| HashMap::from([("GCP_PROJECT_ID".to_string(), value.to_string())]))
+                .unwrap_or_default();
+            let config = build_sandbox_config_snapshot_from_inputs(&state, &inputs)
+                .await
+                .unwrap();
+            let snapshot =
+                build_provider_environment_snapshot_from_inputs(&state, &inputs, true, true)
+                    .await
+                    .unwrap();
+            assert_eq!(config.provider_env_revision, snapshot.provider_env_revision);
+            let value = snapshot
+                .values
+                .iter()
+                .find(|value| value.name == "GCP_PROJECT_ID");
+            assert_eq!(value.map(|value| value.value.as_str()), expected);
+            if let Some(value) = value {
+                assert_eq!(
+                    value.classification,
+                    ProviderEnvironmentValueClassification::NonSecret as i32
+                );
+            }
+            revisions.push(snapshot.provider_env_revision);
+        }
+        assert_ne!(revisions[0], revisions[1]);
+        assert_ne!(revisions[1], revisions[2]);
+        assert_eq!(revisions[2], revisions[3]);
+        assert_ne!(revisions[2], revisions[4]);
+        assert_ne!(revisions[0], revisions[4]);
+    }
+
+    #[tokio::test]
+    async fn caller_environment_does_not_reclassify_expired_credentials_as_non_secret() {
+        let state = test_server_state().await;
+        let mut provider = test_provider("work-gcp", "google-cloud");
+        provider.credentials.clear();
+        state.store.put_message(&provider).await.unwrap();
+        let mut legacy_provider = test_provider("legacy-project", "legacy-custom");
+        legacy_provider.credentials =
+            HashMap::from([("GCP_PROJECT_ID".to_string(), "expired-secret".to_string())]);
+        legacy_provider.credential_expiration_times.insert(
+            "GCP_PROJECT_ID".to_string(),
+            openshell_core::time::timestamp_from_millis(1).unwrap(),
+        );
+        state.store.put_message(&legacy_provider).await.unwrap();
+        let mut sandbox = test_sandbox(
+            "sb-caller-expired",
+            "caller-expired",
+            ProtoSandboxPolicy::default(),
+            vec!["work-gcp".to_string(), "legacy-project".to_string()],
+        );
+        sandbox
+            .spec
+            .as_mut()
+            .unwrap()
+            .environment
+            .insert("GCP_PROJECT_ID".to_string(), "caller-project".to_string());
+
+        let snapshot = load_sandbox_provider_environment(&state, &sandbox, true, true)
+            .await
+            .unwrap();
+        assert!(!snapshot.environment.contains_key("GCP_PROJECT_ID"));
+        assert!(
+            !snapshot
+                .non_secret_environment_keys
+                .iter()
+                .any(|key| key == "GCP_PROJECT_ID")
+        );
     }
 
     #[tokio::test]
 
@@ -38,7 +38,7 @@ use openshell_policy::ProviderPolicyLayer;
 use openshell_providers::LEGACY_VERTEX_PRIVATE_KEY_ENV;
 use prost::Message;
 use sha2::{Digest, Sha256};
-use std::collections::{HashMap, HashSet};
+use std::collections::{BTreeMap, HashMap, HashSet};
 use tonic::Status;
 use tracing::warn;
 
@@ -2253,6 +2253,57 @@ fn validate_provider_environment_records_unique_at(
     Ok(())
 }
 
+/// Effective caller values for declared non-secret destinations only. Reserve
+/// credential keys even when their values are missing, expired, or withheld.
+pub(super) fn non_secret_provider_environment_overrides(
+    catalog: &EffectiveProviderProfileCatalog,
+    records: &[ProviderEnvironmentRecord],
+    sandbox: &Sandbox,
+) -> BTreeMap<String, String> {
+    let Some(spec) = sandbox.spec.as_ref() else {
+        return BTreeMap::new();
+    };
+    let mut destinations = HashSet::new();
+    let mut credential_keys = reserved_bootstrap_credential_keys();
+    for record in records {
+        let provider = &record.provider;
+        credential_keys.extend(provider.credentials.keys().cloned());
+        credential_keys.extend(provider.credential_handles.keys().cloned());
+        for state in &record.refresh_states {
+            credential_keys.insert(state.credential_key.clone());
+            credential_keys.extend(state.additional_output_keys.values().cloned());
+        }
+        if let Some(profile) = get_provider_type_profile_for_scope(
+            catalog,
+            &provider.r#type,
+            &provider.profile_workspace,
+        ) {
+            destinations.extend(profile.environment.config.keys().cloned());
+            destinations.extend(profile.environment.fixed.keys().cloned());
+            credential_keys.extend(
+                profile
+                    .credentials
+                    .iter()
+                    .flat_map(|credential| credential.accepted_stored_keys())
+                    .map(str::to_string),
+            );
+            credential_keys.extend(broker_only_provider_credential_keys(&profile.to_proto()));
+        }
+    }
+    destinations
+        .into_iter()
+        .filter(|key| is_valid_env_key(key) && !credential_keys.contains(key))
+        .filter_map(|key| {
+            let value = spec.environment.get(&key).or_else(|| {
+                spec.template
+                    .as_ref()
+                    .and_then(|template| template.environment.get(&key))
+            })?;
+            Some((key, value.clone()))
+        })
+        .collect()
+}
+
 fn provider_profile_environment_values(
     catalog: &EffectiveProviderProfileCatalog,
     provider: &Provider,
 
@@ -172,6 +172,13 @@ as placeholders for proxy-time resolution.
 | `CLOUD_ML_REGION` | from `region` config | GCP region |
 | `GCP_LOCATION` | from `region` config | Alternative region var |
 
+For each non-secret variable, a sandbox create-time value overrides its template
+value, which overrides the provider default. The metadata project-ID endpoint
+uses the effective `GCP_PROJECT_ID`, including an explicitly empty value. A caller
+can supply it even when the provider has no `project_id` config. OpenShell resolves
+aliases independently; set both `GCP_PROJECT_ID` and `GOOGLE_CLOUD_PROJECT` when
+overriding the project so SDKs that read different variables agree.
+
 ## Using with GCP APIs
 
 The metadata emulator serves tokens with the `cloud-platform` OAuth2 scope,