coder · zedkipp · Apr 27, 2026 · Apr 15, 2026 · Apr 23, 2026 · Apr 23, 2026
diff --git a/cli/testdata/coder_provisioner_list_--output_json.golden b/cli/testdata/coder_provisioner_list_--output_json.golden
@@ -7,7 +7,7 @@
     "last_seen_at": "====[timestamp]=====",
     "name": "test-daemon",
     "version": "v0.0.0-devel",
-    "api_version": "1.16",
+    "api_version": "1.17",
     "provisioners": [
       "echo"
     ],

diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -245,6 +245,7 @@ var (
 					rbac.ResourceWorkspaceAgentDevcontainers.Type:   {policy.ActionCreate},
 					// Provisionerd creates usage events
 					rbac.ResourceUsageEvent.Type: {policy.ActionCreate},
+					rbac.ResourceUserSecret.Type: {policy.ActionRead},
 				}),
 				User:    []rbac.Permission{},
 				ByOrgID: map[string]rbac.OrgPermissions{},
@@ -5753,7 +5754,7 @@ func (q *querier) ListUserSecretsWithValues(ctx context.Context, userID uuid.UUI
 	// This query returns decrypted secret values and must only be called
 	// from system contexts (provisioner, agent manifest). REST API
 	// handlers should use ListUserSecrets (metadata only).
-	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
+	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceUserSecret); err != nil {
 		return nil, err
 	}
 	return q.db.ListUserSecretsWithValues(ctx, userID)

diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
@@ -5618,7 +5618,7 @@ func (s *MethodTestSuite) TestUserSecrets() {
 		secret := testutil.Fake(s.T(), faker, database.UserSecret{UserID: user.ID})
 		dbm.EXPECT().ListUserSecretsWithValues(gomock.Any(), user.ID).Return([]database.UserSecret{secret}, nil).AnyTimes()
 		check.Args(user.ID).
-			Asserts(rbac.ResourceSystem, policy.ActionRead).
+			Asserts(rbac.ResourceUserSecret, policy.ActionRead).
 			Returns([]database.UserSecret{secret})
 	}))
 	s.Run("CreateUserSecret", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {

diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
@@ -1590,8 +1590,8 @@ func PresetParameter(t testing.TB, db database.Store, seed database.InsertPreset
 	return parameters
 }
 
-func UserSecret(t testing.TB, db database.Store, seed database.UserSecret) database.UserSecret {
-	userSecret, err := db.CreateUserSecret(genCtx, database.CreateUserSecretParams{
+func UserSecret(t testing.TB, db database.Store, seed database.UserSecret, mutators ...func(params *database.CreateUserSecretParams)) database.UserSecret {
+	params := database.CreateUserSecretParams{
 		ID:          takeFirst(seed.ID, uuid.New()),
 		UserID:      takeFirst(seed.UserID, uuid.New()),
 		Name:        takeFirst(seed.Name, "secret-name"),
@@ -1600,7 +1600,11 @@ func UserSecret(t testing.TB, db database.Store, seed database.UserSecret) datab
 		ValueKeyID:  seed.ValueKeyID,
 		EnvName:     takeFirst(seed.EnvName, "SECRET_ENV_NAME"),
 		FilePath:    takeFirst(seed.FilePath, "~/secret/file/path"),
-	})
+	}
+	for _, mut := range mutators {
+		mut(&params)
+	}
+	userSecret, err := db.CreateUserSecret(genCtx, params)
 	require.NoError(t, err, "failed to insert user secret")
 	return userSecret
 }

diff --git a/coderd/provisionerdserver/provisionerdserver.go b/coderd/provisionerdserver/provisionerdserver.go
@@ -591,6 +591,26 @@ func (s *server) acquireProtoJob(ctx context.Context, job database.ProvisionerJo
 			}
 		}
 
+		// Fetch user secrets for build-time injection, but only on start
+		// transitions where the workspace actually needs them.
+		var userSecrets []*sdkproto.UserSecretValue
+		if workspaceBuild.Transition == database.WorkspaceTransitionStart {
+			dbSecrets, err := s.Database.ListUserSecretsWithValues(ctx, owner.ID)
+			if err != nil {
+				return nil, failJob(fmt.Sprintf("get user secrets: %s", err))
+			}
+			for _, secret := range dbSecrets {
+				if secret.EnvName == "" && secret.FilePath == "" {
+					continue
+				}
+				userSecrets = append(userSecrets, &sdkproto.UserSecretValue{
+					EnvName:  secret.EnvName,
+					FilePath: secret.FilePath,
+					Value:    []byte(secret.Value),
+				})
+			}
+		}
+
 		transition, err := convertWorkspaceTransition(workspaceBuild.Transition)
 		if err != nil {
 			return nil, failJob(fmt.Sprintf("convert workspace transition: %s", err))
@@ -773,7 +793,8 @@ func (s *server) acquireProtoJob(ctx context.Context, job database.ProvisionerJo
 					TaskPrompt:                    task.Prompt,
 					TemplateVersionModulesFile:    versionModulesFile,
 				},
-				LogLevel: input.LogLevel,
+				LogLevel:    input.LogLevel,
+				UserSecrets: userSecrets,
 			},
 		}
 	case database.ProvisionerJobTypeTemplateVersionDryRun: