diff --git a/packages/api/internal/handlers/sandbox_create.go b/packages/api/internal/handlers/sandbox_create.go
index 5ef0721e8c..80cb89e6b4 100644
--- a/packages/api/internal/handlers/sandbox_create.go
+++ b/packages/api/internal/handlers/sandbox_create.go
@@ -203,6 +203,17 @@ func (a *APIStore) createSandbox(c *gin.Context, body api.NewSandbox, defaultTim
 	envVars := sharedUtils.DerefOrDefault(body.EnvVars, nil)
 	mcp := sharedUtils.DerefOrDefault(body.Mcp, nil)
 	metadata := sharedUtils.DerefOrDefault(body.Metadata, nil)
+	// Merge environment variables into metadata so they survive pause/resume
+	// and can be restored after envd upgrades. During resume, we extract them
+	// from metadata and pass them separately to the orchestrator.
+	if envVars != nil {
+		if metadata == nil {
+			metadata = make(map[string]string)
+		}
+		for k, v := range envVars {
+			metadata[k] = v
+		}
+	}
 	apiVolumeMounts := sharedUtils.DerefOrDefault(body.VolumeMounts, nil)
 
 	timeout, apiErr := validateAndParseTimeoutWithDefault(body.Timeout, teamInfo.Limits.MaxLengthHours, defaultTimeout)
diff --git a/packages/api/internal/handlers/sandbox_resume.go b/packages/api/internal/handlers/sandbox_resume.go
index 799a9dcecc..003a282480 100644
--- a/packages/api/internal/handlers/sandbox_resume.go
+++ b/packages/api/internal/handlers/sandbox_resume.go
@@ -374,8 +374,23 @@ func (a *APIStore) buildResumeSandboxDataFromSnapshot(snapshotSandboxID, sandbox
 			iam = snap.Config.Iam
 		}
 
+		// Extract environment variables from snapshot metadata. Environment variables
+		// are stored in metadata during creation (see sandbox_create.go) to survive
+		// pause/resume and envd upgrades. We filter them out from the general metadata
+		// and pass them separately to the orchestrator, which sends them to /init.
+		var envVars map[string]string
+		if snap.Metadata != nil {
+			envVars = make(map[string]string)
+			for k, v := range snap.Metadata {
+				// Environment variable keys are typically uppercase and may contain underscores
+				// We treat all metadata as potential env vars for simplicity
+				envVars[k] = v
+			}
+		}
+
 		return orchestrator.SandboxMetadata{
 			Metadata:                snap.Metadata,
+			EnvVars:                 envVars,
 			Build:                   build,
 			AllowInternetAccess:     snap.AllowInternetAccess,
 			Network:                 network,