diff --git a/src/com/homelab/stages/syncArgoApp.groovy b/src/com/homelab/stages/syncArgoApp.groovy
index 55930e1..7a09e39 100644
--- a/src/com/homelab/stages/syncArgoApp.groovy
+++ b/src/com/homelab/stages/syncArgoApp.groovy
@@ -16,17 +16,29 @@ package com.homelab.stages
 // empty (bootstrap token not generated yet), fail loudly here with a
 // clear message rather than a confusing curl auth error.
 //
+// The emptiness check has to happen inside the shell script, not as a
+// Groovy `env.ARGOCD_TOKEN` check before it — env.X in Groovy is
+// Jenkins' own pipeline-level environment map (build parameters,
+// environment{} blocks, withEnv, etc.), which a container-scoped env:
+// entry in a podTemplate YAML never populates. The container's real OS
+// environment does have it (visible to sh, which inherits the
+// container's actual process environment) — checking env.ARGOCD_TOKEN
+// in Groovy was always going to see null regardless of whether the
+// Secret/ESO/Vault chain was correctly wired, which is exactly what
+// happened: every fix to the secret chain made no difference because
+// the check itself was looking in the wrong place.
+//
 // Expects in config:
 //   argo_app_name    the Application's metadata.name, e.g. demo-go-app
 //   argo_server_url  e.g. http://argocd-admin-prd-server.argocd.svc.cluster.local
 def run(Map config) {
     stage(stageName('Sync ArgoCD Application')) {
         container('docker-cli') {
-            if (!env.ARGOCD_TOKEN?.trim()) {
-                log.error('ARGOCD_TOKEN is empty — the jenkins-ci account token has not been generated yet. See secretstores/argocd-jenkins-ci-token.yaml for the one-time bootstrap steps.')
-                error('Skipping ArgoCD sync: no token available.')
-            }
             sh """
+                if [ -z "\$ARGOCD_TOKEN" ]; then
+                    echo "ARGOCD_TOKEN is empty — the jenkins-ci account token has not been generated yet. See secretstores/argocd-jenkins-ci-token.yaml for the one-time bootstrap steps." >&2
+                    exit 1
+                fi
                 apk add --no-cache curl >/dev/null
                 curl -sf -X POST \\
                   -H "Authorization: Bearer \$ARGOCD_TOKEN" \\