diff --git a/.github/workflows/strix.yml b/.github/workflows/strix.yml
index eb90154eae..5107cde2e9 100644
--- a/.github/workflows/strix.yml
+++ b/.github/workflows/strix.yml
@@ -651,11 +651,11 @@ jobs:
           PROVIDER_MODE: ${{ steps.gate.outputs.provider_mode }}
         run: |
           set -euo pipefail
-          source "$TRUSTED_STRIX_SOURCE/scripts/ci/load_contextual_orchestrator_token.sh"
           if [ "$PROVIDER_MODE" != "contextual_orchestrator" ]; then
             echo '::error::Strix must use the contextual-orchestrator provider.'
             exit 1
           fi
+          source "$TRUSTED_STRIX_SOURCE/scripts/ci/load_contextual_orchestrator_token.sh"
           # Sanitize CR/LF before masking to prevent broken ::add-mask::
           # commands and potential workflow command injection.
           sanitized="$(printf '%s' "${CONTEXTUAL_ORCHESTRATOR_TOKEN:-}" | tr -d '\r\n')"
@@ -673,11 +673,11 @@ jobs:
           PROVIDER_MODE: ${{ steps.gate.outputs.provider_mode }}
         run: |
           set -euo pipefail
-          source "$TRUSTED_STRIX_SOURCE/scripts/ci/load_contextual_orchestrator_token.sh"
           if [ "$PROVIDER_MODE" != "contextual_orchestrator" ]; then
             echo '::error::Strix must use the contextual-orchestrator provider.'
             exit 1
           fi
+          source "$TRUSTED_STRIX_SOURCE/scripts/ci/load_contextual_orchestrator_token.sh"
           sanitized="$(printf '%s' "${CONTEXTUAL_ORCHESTRATOR_TOKEN:-}" | tr -d '\r\n')"
           trimmed="$(printf '%s' "$sanitized" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
           if [ -z "$trimmed" ]; then