diff --git a/server.js b/server.js
index 74dd67d..37fe35b 100644
--- a/server.js
+++ b/server.js
@@ -1305,14 +1305,23 @@ fastify.get('/api/v1/apps/:app/runtime-status', async (request, reply) => {
   const server = prod.server || cfg.deploy_server || 'bruno';
   const deployDir = prod.deploy_dir || cfg.repo_dir;
   if (!deployDir) return reply.code(400).send({ error: 'no deploy_dir for app' });
+  // kua-vault wrap — compose files in this org use ${VAR} interpolations
+  // backed by vault-injected env (KUA_SESSIONS_ADMIN_TOKEN, AGENT_API_KEY,
+  // STRIPE_*, etc). Without the wrap, `docker compose config --services`
+  // emits empty/error output for most apps, which made /runtime-status
+  // return services: [] (the original symptom the coordinator session
+  // diagnosed). Mirrors the canonical kvPrefix pattern from deploy().
+  const kvPrefix = prod.vault
+    ? `kua-vault run --project ${prod.vault.project} --env ${prod.vault.env} --`
+    : '';
   try {
-    const svcRes = await runOnServer(server, `cd ${deployDir} && docker compose config --services`);
+    const svcRes = await runOnServer(server, `cd ${deployDir} && ${kvPrefix} docker compose config --services`);
     const services = (svcRes.stdout || '').split('\n').filter(Boolean);
     const out = [];
     let anyStale = false;
     for (const svc of services) {
-      const exp = await runOnServer(server, `cd ${deployDir} && docker compose images --quiet ${svc} 2>/dev/null | head -1`);
-      const cid = await runOnServer(server, `cd ${deployDir} && docker compose ps --quiet ${svc} 2>/dev/null | head -1`);
+      const exp = await runOnServer(server, `cd ${deployDir} && ${kvPrefix} docker compose images --quiet ${svc} 2>/dev/null | head -1`);
+      const cid = await runOnServer(server, `cd ${deployDir} && ${kvPrefix} docker compose ps --quiet ${svc} 2>/dev/null | head -1`);
       const expectedSha = (exp.stdout || '').trim();
       const containerId = (cid.stdout || '').trim();
       let running_image_sha = null, started_at = null, state = null, health = null;