diff --git a/.github/workflows/firebase-deploy-test.yml b/.github/workflows/firebase-deploy-test.yml
index 430eee3..22f513a 100644
--- a/.github/workflows/firebase-deploy-test.yml
+++ b/.github/workflows/firebase-deploy-test.yml
@@ -56,6 +56,9 @@ jobs:
           echo "REDIRECT_URI=https://datapipe-test.web.app/oauth2/callback" >> .env
           echo "TOKEN_ENCRYPTION_KEY=${{ secrets.FIRESTORE_KEY_TEST }}" >> .env
           echo "NEXT_PUBLIC_OSF_ENV=" >> .env
+          # Google Drive client secret for the deployed test site. Client id and
+          # redirect uri are non-secret and live in functions/.env.datapipe-test.
+          echo "GDRIVE_CLIENT_SECRET=${{ secrets.TEST_GDRIVE_CLIENT_SECRET }}" >> .env
       - name: Install dependencies and build functions
         working-directory: functions
         run: |
diff --git a/.gitignore b/.gitignore
index 99fca49..d59302a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -135,6 +135,8 @@ yarn-error.log*
 
 # local env files
 .env*.local
+# ...except the committed emulator/CI overrides (never deployed by Firebase)
+!functions/.env.local
 
 # vercel
 .vercel
diff --git a/functions/.env.datapipe-test b/functions/.env.datapipe-test
index 6f272c1..285c4e1 100644
--- a/functions/.env.datapipe-test
+++ b/functions/.env.datapipe-test
@@ -1,7 +1,22 @@
-GDRIVE_API_BASE=http://127.0.0.1:3579
-GDRIVE_TOKEN_URL=http://127.0.0.1:3580/token
-GDRIVE_AUTHORIZE_URL=http://127.0.0.1:3580/authorize
-GDRIVE_CLIENT_ID=test-client-id
-GDRIVE_CLIENT_SECRET=test-client-secret
-GDRIVE_REDIRECT_URI=http://localhost:3000/oauth2/connect
+# Real config for the DEPLOYED datapipe-test site.
+#
+# Firebase loads this file both on `firebase deploy` and in the emulator.
+# Emulator runs additionally load .env.local, which overrides everything here
+# with local mock values -- so the mock Drive/token servers and test dummies
+# live in .env.local, NOT here. Anything in this file reaches the live site.
+#
+# The Google client secret is NOT here (this file is committed). It is
+# injected at deploy time from the TEST_GDRIVE_CLIENT_SECRET GitHub secret
+# (see .github/workflows/firebase-deploy-test.yml), and for a local
+# `firebase deploy` it comes from the git-ignored functions/.env.
+#
+# GDRIVE_AUTHORIZE_URL / GDRIVE_TOKEN_URL / GDRIVE_API_BASE are intentionally
+# unset so the code falls back to the real Google defaults.
+GDRIVE_CLIENT_ID=699904257039-6ruej6q9bopica806khlmsqj6jg4eg6c.apps.googleusercontent.com
+GDRIVE_REDIRECT_URI=https://datapipe-test.web.app/oauth2/connect
+
+# NOTE (pre-existing, unrelated to the gdrive fix): this dummy key overrides
+# the real FIRESTORE_KEY_TEST secret on the deployed test site because
+# .env.<project> beats .env. Left as-is to avoid orphaning already-encrypted
+# test tokens; worth revisiting as a separate change.
 TOKEN_ENCRYPTION_KEY=abababababababababababababababababababababababababababababababab
diff --git a/functions/.env.local b/functions/.env.local
new file mode 100644
index 0000000..16d4020
--- /dev/null
+++ b/functions/.env.local
@@ -0,0 +1,20 @@
+# Emulator-only overrides for local dev and the CI test suite.
+#
+# Firebase loads this file ONLY when running the emulators; it is never
+# included in `firebase deploy`. That is exactly why the Google Drive mock
+# values live here instead of in .env.datapipe-test -- keeping them out of
+# the deployed test site (see .env.datapipe-test for the real values).
+#
+# It is intentionally committed (see the `!functions/.env.local` exception
+# in the root .gitignore) so `npm test` / `firebase emulators:exec` work from
+# a fresh checkout, in CI and locally, with no extra setup. Every value here
+# is a non-secret test dummy. The oauth-connect / gdrive emulator tests
+# assert against these exact values and mock servers bind the fixed ports
+# below, so keep them in sync with those tests.
+GDRIVE_API_BASE=http://127.0.0.1:3579
+GDRIVE_TOKEN_URL=http://127.0.0.1:3580/token
+GDRIVE_AUTHORIZE_URL=http://127.0.0.1:3580/authorize
+GDRIVE_CLIENT_ID=test-client-id
+GDRIVE_CLIENT_SECRET=test-client-secret
+GDRIVE_REDIRECT_URI=http://localhost:3000/oauth2/connect
+TOKEN_ENCRYPTION_KEY=abababababababababababababababababababababababababababababababab