diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5163b725..9e326fc5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -43,6 +43,9 @@ jobs:
       # so the DB-availability probe passes and the integration tests run for real.
       EVOLITH_TRACKER_DB: "Host=localhost;Port=5432;Database=evolith_tracker;Username=evolith;Password=localdev"
       ConnectionStrings__DefaultConnection: "Host=localhost;Port=5432;Database=evolith_tracker;Username=evolith;Password=localdev"
+      # TenantProjectionDbContext (DS-07) reads MasterDataDb; unset it defaults to
+      # localhost/user "postgres" and auth fails. Share the CI Postgres like local.
+      ConnectionStrings__MasterDataDb: "Host=localhost;Port=5432;Database=evolith_tracker;Username=evolith;Password=localdev"
       DOTNET_NOLOGO: "true"
       DOTNET_CLI_TELEMETRY_OPTOUT: "true"
 
@@ -69,10 +72,20 @@ jobs:
         run: |
           dotnet tool install --global dotnet-ef
           export PATH="$PATH:$HOME/.dotnet/tools"
-          dotnet ef database update \
-            --project Tracker.Infrastructure \
-            --startup-project Tracker.Presentation \
-            --configuration Release
+          # Two DbContexts exist (DS-07 added TenantProjectionDbContext for the
+          # MasterData tenant-projection schema). `database update` is ambiguous
+          # without --context. Pass --connection explicitly so both apply against
+          # the CI Postgres regardless of design-time config resolution (the
+          # TenantProjection context otherwise falls back to localhost/postgres).
+          CI_CONN="Host=localhost;Port=5432;Database=evolith_tracker;Username=evolith;Password=localdev"
+          for ctx in TrackerDbContext TenantProjectionDbContext; do
+            dotnet ef database update \
+              --context "$ctx" \
+              --connection "$CI_CONN" \
+              --project Tracker.Infrastructure \
+              --startup-project Tracker.Presentation \
+              --configuration Release
+          done
 
       - name: Test
         run: dotnet test Tracker.sln --no-build -c Release --logger "trx;LogFileName=test-results.trx"
diff --git a/product/infra/helm/evolith-tracker-api/templates/deployment.yaml b/product/infra/helm/evolith-tracker-api/templates/deployment.yaml
index f88b26a5..a5717da8 100644
--- a/product/infra/helm/evolith-tracker-api/templates/deployment.yaml
+++ b/product/infra/helm/evolith-tracker-api/templates/deployment.yaml
@@ -47,6 +47,14 @@ spec:
                 secretKeyRef:
                   name: {{ include "evolith-tracker-api.fullname" . }}-db
                   key: ConnectionStrings__DefaultConnection
+            # MasterData/tenant-projection context (DS-07). Without this it defaults to
+            # localhost and the TenantProjectionMigrator crashloops. In-cluster (broker-less
+            # local) it shares the Tracker Postgres; a dedicated DB is a prod concern.
+            - name: ConnectionStrings__MasterDataDb
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "evolith-tracker-api.fullname" . }}-db
+                  key: ConnectionStrings__DefaultConnection
             {{- if .Values.coreApi.existingSecretName }}
             - name: CoreApi__ApiKey
               valueFrom:
diff --git a/product/infra/helm/evolith-tracker-api/values-local.yaml b/product/infra/helm/evolith-tracker-api/values-local.yaml
index 89c3cd38..b817f91a 100644
--- a/product/infra/helm/evolith-tracker-api/values-local.yaml
+++ b/product/infra/helm/evolith-tracker-api/values-local.yaml
@@ -12,10 +12,17 @@ replicaCount: 1
 
 # Point at the local in-cluster upstreams. These default to unreachable stubs
 # for a standalone Tracker deploy; the BFF still starts and /health is green.
+# Point at the REAL Core services running in the evolith-local namespace (same kind
+# cluster, cross-namespace via FQDN). The Core requires the API key (401 otherwise),
+# supplied from a secret in this namespace.
 coreApi:
-  baseUrl: http://evolith-core-api/api/v1
+  baseUrl: http://evolith-core-api-evolith-core-api.evolith-local.svc.cluster.local/api/v1
+  existingSecretName: tracker-core-auth
+  apiKeyKey: EVOLITH_API_KEY
 agentRuntime:
-  baseUrl: http://evolith-agent-runtime/v1
+  baseUrl: http://evolith-runtime-evolith-agent-runtime.evolith-local.svc.cluster.local/v1
+  existingSecretName: tracker-runtime-auth
+  apiKeyKey: AGENT_RUNTIME_API_KEY
 
 auth:
   provider: dev-bypass