diff --git a/packages/cli/src/commands/validate.ts b/packages/cli/src/commands/validate.ts
index c7bdb4f..64c1cde 100644
--- a/packages/cli/src/commands/validate.ts
+++ b/packages/cli/src/commands/validate.ts
@@ -1,8 +1,10 @@
 import { resolve } from "node:path";
 import { resolveProjectConfig, UserError, validateProjectConfig } from "@openagentpack/sdk";
+import { ensureCredentials } from "../credentials.ts";
 import { log } from "../logger.ts";
 
 export async function validateCommand(options: { file: string }) {
+	ensureCredentials();
 	const configPath = resolve(options.file);
 	log.info(`Validating ${configPath}...`);
 	const { config } = await resolveProjectConfig(options.file);
diff --git a/packages/cli/tests/unit/cli-contracts.test.ts b/packages/cli/tests/unit/cli-contracts.test.ts
index 08b1ead..4545123 100644
--- a/packages/cli/tests/unit/cli-contracts.test.ts
+++ b/packages/cli/tests/unit/cli-contracts.test.ts
@@ -113,9 +113,10 @@ vaults:
 	return configPath;
 }
 
-async function runAgents(args: string[], env: Record<string, string> = {}) {
-	const proc = Bun.spawn([process.execPath, "run", "bin/agents.ts", ...args], {
-		cwd: REPO_ROOT,
+async function runAgents(args: string[], env: Record<string, string> = {}, cwd = REPO_ROOT) {
+	const entry = cwd === REPO_ROOT ? "bin/agents.ts" : join(REPO_ROOT, "bin/agents.ts");
+	const proc = Bun.spawn([process.execPath, "run", entry, ...args], {
+		cwd,
 		stdout: "pipe",
 		stderr: "pipe",
 		env: {
@@ -430,6 +431,33 @@ test("validate reports reference errors through the core runtime", async () => {
 	expect(result.stderr).toContain("references unknown environment 'ghost'");
 });
 
+test("validate loads .env before resolving provider placeholders", async () => {
+	const dir = await makeTempDir();
+	await Bun.write(
+		join(dir, "agents.yaml"),
+		`version: "1"
+
+providers:
+  qoder:
+    api_key: \${QODER_PAT}
+
+defaults:
+  provider: qoder
+
+agents:
+  assistant:
+    model: ultimate
+    instructions: "You are helpful."
+`,
+	);
+	await Bun.write(join(dir, ".env"), "QODER_PAT=test-token\n");
+
+	const result = await runAgents(["validate", "--file", "agents.yaml"], { QODER_PAT: "" }, dir);
+
+	expect(result.exitCode).toBe(0);
+	expect(result.stderr).toContain("Configuration is valid");
+});
+
 test("models list keeps missing config guidance in the core runtime", async () => {
 	const result = await runAgents(["models", "list", "--file", "/missing/agents.yaml"]);