diff --git a/crates/openshell-driver-docker/src/lib.rs b/crates/openshell-driver-docker/src/lib.rs
index 0d139ebf2..cfd6c7490 100644
--- a/crates/openshell-driver-docker/src/lib.rs
+++ b/crates/openshell-driver-docker/src/lib.rs
@@ -2251,7 +2251,9 @@ fn build_environment_for_oci_user(
 
     environment.remove(openshell_core::sandbox_env::SANDBOX_TOKEN);
     environment.remove(openshell_core::sandbox_env::SANDBOX_TOKEN_FILE);
-    // Ignore image-provided Podman probe attestations.
+    // Protected identity keys must be explicit even when unset: an omitted
+    // key can inherit image ENV, while an empty driver-owned value masks image
+    // metadata until the driver has an authoritative value to supply.
     environment.insert(
         openshell_core::sandbox_env::OCI_WORKSPACE_IDENTITY.to_string(),
         String::new(),
diff --git a/crates/openshell-driver-podman/src/container.rs b/crates/openshell-driver-podman/src/container.rs
index 853e6ed15..9f6378dec 100644
--- a/crates/openshell-driver-podman/src/container.rs
+++ b/crates/openshell-driver-podman/src/container.rs
@@ -583,9 +583,9 @@ fn build_env(
 
     env.remove(openshell_core::sandbox_env::SANDBOX_TOKEN);
     env.remove(openshell_core::sandbox_env::SANDBOX_TOKEN_FILE);
-    // The final spec overwrites this only after a successful immutable-image
-    // probe. An explicit empty value prevents image ENV from forging the
-    // attestation contract on the /sandbox compatibility path.
+    // Protected identity keys must be explicit even when unset: an omitted
+    // key can inherit image ENV, while an empty driver-owned value masks image
+    // metadata until the driver has an authoritative value to supply.
     env.insert(
         openshell_core::sandbox_env::OCI_WORKSPACE_IDENTITY.into(),
         String::new(),