diff --git a/.ebextensions/02_webhook_config.config b/.ebextensions/02_webhook_config.config
index 59cc87d..59f0df6 100644
--- a/.ebextensions/02_webhook_config.config
+++ b/.ebextensions/02_webhook_config.config
@@ -1,8 +1,10 @@
-# Sets the non-secret pointer the work-order webhook receiver reads to locate
-# the producer HMAC keyset; the keyset itself is fetched at runtime through
-# the instance role's cross-account grant. Do not set this property directly
+# Enables the dev receiver and sets the non-secret pointer it reads to locate
+# the producer HMAC keyset. The keyset itself is fetched at runtime through the
+# instance role's cross-account grant. Do not set these properties directly
 # with update-environment: directly set values take precedence over
 # .ebextensions and would silently turn this file into dead text.
 option_settings:
   aws:elasticbeanstalk:application:environment:
-    WorkOrderWebhook__SecretId: arn:aws:secretsmanager:us-east-1:011934824531:secret:workorder-ingest/shoc-webhook-hmac-puYTcB
\ No newline at end of file
+    WorkOrderWebhook__Enabled: "true"
+    WorkOrderWebhook__Region: us-east-1
+    WorkOrderWebhook__SecretId: arn:aws:secretsmanager:us-east-1:011934824531:secret:workorder-ingest/shoc-webhook-hmac-puYTcB
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 55528d1..60a995f 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -57,6 +57,16 @@ jobs:
             .artifacts/elastic-beanstalk/zip-contents.txt
           grep -Fxq ".ebextensions/02_webhook_config.config" \
             .artifacts/elastic-beanstalk/zip-contents.txt
+          unzip -p .artifacts/elastic-beanstalk/site.zip \
+            .ebextensions/02_webhook_config.config \
+            > .artifacts/elastic-beanstalk/webhook-config.txt
+          grep -Fxq '    WorkOrderWebhook__Enabled: "true"' \
+            .artifacts/elastic-beanstalk/webhook-config.txt
+          grep -Fxq '    WorkOrderWebhook__Region: us-east-1' \
+            .artifacts/elastic-beanstalk/webhook-config.txt
+          grep -Fxq \
+            '    WorkOrderWebhook__SecretId: arn:aws:secretsmanager:us-east-1:011934824531:secret:workorder-ingest/shoc-webhook-hmac-puYTcB' \
+            .artifacts/elastic-beanstalk/webhook-config.txt
 
   deploy:
     name: Deploy shoc-backend to Elastic Beanstalk dev
@@ -156,6 +166,27 @@ jobs:
       - name: Post-deploy smoke
         run: bash scripts/smoke-elastic-beanstalk.sh https://api.dev.seahaven.com
 
+      - name: Verify webhook secret source is operational
+        run: |
+          set -euo pipefail
+          response_file="$(mktemp)"
+          trap 'rm -f "$response_file"' EXIT
+          status="$(curl --silent --show-error \
+            --output "$response_file" \
+            --write-out '%{http_code}' \
+            --request POST \
+            --header 'Content-Type: application/json' \
+            --header "X-SH-Timestamp: $(date +%s)" \
+            --header 'X-SH-Key-Id: deployment-smoke-invalid-key' \
+            --header "X-SH-Signature: v1=$(printf '0%.0s' {1..64})" \
+            --data '{}' \
+            https://api.dev.seahaven.com/api/webhooks/work-orders)"
+          if [ "$status" != "401" ]; then
+            echo "Expected enabled webhook with an operational secret source to reject the invalid probe with 401; received $status." >&2
+            sed -n '1,20p' "$response_file" >&2
+            exit 1
+          fi
+
       - name: Restore previous application version on failure (schema is not reverted)
         if: failure()
         run: |