diff --git a/eval/tests/test_proposer_sandbox.py b/eval/tests/test_proposer_sandbox.py
index b2ce3b90a..a91166b27 100644
--- a/eval/tests/test_proposer_sandbox.py
+++ b/eval/tests/test_proposer_sandbox.py
@@ -169,6 +169,7 @@ def test_real_bubblewrap_candidate_lifecycle_cannot_replace_harness_or_read_toke
     harness = tmp_path / "trusted-harness.py"
     harness.write_text("trusted main evaluator\n")
     monkeypatch.setenv("GITNEXUS_BENCH_OPENAI_API_KEY", "canary-token")
+    monkeypatch.setenv("ONNXRUNTIME_NODE_INSTALL", "cuda12")
     attack = (
         "const fs=require('fs');\n"
         f"const target={json.dumps(str(harness))};\n"
@@ -177,6 +178,7 @@ def test_real_bubblewrap_candidate_lifecycle_cannot_replace_harness_or_read_toke
         "try { fs.appendFileSync('.git/config','[core]\\n\\tfsmonitor = forged\\n'); } catch {}\n"
         "fs.writeFileSync('receipt.json', JSON.stringify({visible, token:"
         "process.env.GITNEXUS_BENCH_OPENAI_API_KEY ?? null,"
+        "onnxInstall:process.env.ONNXRUNTIME_NODE_INSTALL ?? null,"
         "interfaces:Object.keys(require('os').networkInterfaces()).sort()}));\n"
     )
     (candidate / "attack.cjs").write_text(attack)
@@ -199,6 +201,7 @@ def test_real_bubblewrap_candidate_lifecycle_cannot_replace_harness_or_read_toke
     assert json.loads((candidate / "receipt.json").read_text()) == {
         "visible": False,
         "token": None,
+        "onnxInstall": "skip",
         "interfaces": ["lo"],
     }
     assert (core / "built.txt").read_text() == "runtime"
diff --git a/eval/tests/test_release_build.py b/eval/tests/test_release_build.py
index 5d9eb131d..7f00355d9 100644
--- a/eval/tests/test_release_build.py
+++ b/eval/tests/test_release_build.py
@@ -43,6 +43,7 @@ def test_candidate_build_rejects_symlinked_checkout_before_execution(monkeypatch
 
 def test_candidate_build_clears_tokens_and_mounts_only_candidate_writable(monkeypatch, tmp_path):
     calls = []
+    monkeypatch.setenv('ONNXRUNTIME_NODE_INSTALL', 'cuda12')
     monkeypatch.setattr(release_build, "preflight_bubblewrap", lambda: Path('/usr/bin/bwrap'))
     monkeypatch.setattr(release_build, "run_checked", lambda *a, **k: calls.append((a, k)))
     write_lockfiles(tmp_path)
@@ -54,7 +55,12 @@ def test_candidate_build_clears_tokens_and_mounts_only_candidate_writable(monkey
         at = command.index('--bind')
         assert command[at + 1:at + 3] == [str(tmp_path), '/workspace']
         assert command.count('--bind') == 1
-        assert [command[i + 1] for i, v in enumerate(command) if v == '--setenv'] == ['PATH', 'HOME']
+        environment = {command[i + 1]: command[i + 2] for i, v in enumerate(command) if v == '--setenv'}
+        assert environment == {
+            'PATH': release_build.SANDBOX_PATH,
+            'HOME': '/home/build',
+            'ONNXRUNTIME_NODE_INSTALL': 'skip',
+        }
         assert '--unshare-pid' in command and '--cap-drop' in command
 
 
diff --git a/eval/workflow_bench/release_build.py b/eval/workflow_bench/release_build.py
index d52cb7027..054fbeceb 100644
--- a/eval/workflow_bench/release_build.py
+++ b/eval/workflow_bench/release_build.py
@@ -82,6 +82,11 @@ def build_candidate(repo: Path) -> None:
             "--setenv",
             "HOME",
             "/home/build",
+            # CPU binaries ship in the npm package. Optional CUDA downloads
+            # cannot run during the network-isolated lifecycle phase.
+            "--setenv",
+            "ONNXRUNTIME_NODE_INSTALL",
+            "skip",
             "--chdir",
             "/workspace",
             "--",