diff --git a/.github/workflows/deploy-dev.yml b/.github/workflows/deploy-dev.yml
index 4a1b5795d3..b3bb1a813c 100644
--- a/.github/workflows/deploy-dev.yml
+++ b/.github/workflows/deploy-dev.yml
@@ -161,6 +161,15 @@ jobs:
         env:
           DEV_HELM_VALUES_PRIVATE: ${{ secrets.DEV_HELM_VALUES_PRIVATE }}
 
+      - name: Materialize hosted-MCP allowlist overlay (runner-only)
+        # Per-instance hostedMcp.hiddenEntryUserAllowlist, kept out of the repo
+        # like the overlay above. Unset, it writes an empty overlay and the
+        # chart default ({}) applies.
+        run: |
+          printf '%s\n' "${DEV_HELM_HIDDENMCP_ALLOWLIST}" > "$RUNNER_TEMP/allowlist.yaml"
+        env:
+          DEV_HELM_HIDDENMCP_ALLOWLIST: ${{ secrets.DEV_HELM_HIDDENMCP_ALLOWLIST }}
+
       # clawdbot-gateway is parked (agents.clawdbot.enabled: false since #1051),
       # and the chart then renders no gateway Deployment at all. Building it
       # anyway cost 3.3 of the ~6.4 build minutes per deploy and pushed a
@@ -178,6 +187,7 @@ jobs:
               -f k8s/helm/commonly/values.yaml \
               -f k8s/helm/commonly/values-dev.yaml \
               -f "$RUNNER_TEMP/values-private.yaml" \
+              -f "$RUNNER_TEMP/allowlist.yaml" \
               --show-only templates/agents/clawdbot-deployment.yaml 2>&1 >/dev/null); then
             echo "enabled=true" >> "$GITHUB_OUTPUT"
           elif printf '%s' "$err" | grep -q 'could not find template'; then
@@ -285,6 +295,7 @@ jobs:
             -f k8s/helm/commonly/values.yaml \
             -f k8s/helm/commonly/values-dev.yaml \
             -f "$RUNNER_TEMP/values-private.yaml" \
+            -f "$RUNNER_TEMP/allowlist.yaml" \
             --set backend.image.tag="$TAG" \
             --set frontend.image.tag="$TAG" \
             "${GATEWAY_TAG[@]}" \
diff --git a/k8s/helm/commonly/values-dev.yaml b/k8s/helm/commonly/values-dev.yaml
index 92aa993591..8ee330143d 100644
--- a/k8s/helm/commonly/values-dev.yaml
+++ b/k8s/helm/commonly/values-dev.yaml
@@ -450,14 +450,6 @@ hostedMcp:
     # The 10-27 prod walk failed before Airtable's consent screen ("invalid client_id
     # or mismatched redirect_uri"). Hidden until TASK-318 lands and a walk passes.
     - airtable
-  # Mongo User _id(s) permitted to walk each hidden hosted-MCP entry (#2649).
-  hiddenEntryUserAllowlist:
-    atlassian:
-      - "6a47891ee025ce2e0ca1d30b"
-    sentry:
-      - "6a47891ee025ce2e0ca1d30b"
-    airtable:
-      - "6a47891ee025ce2e0ca1d30b"
   googleCalendar:
     enabled: false