diff --git a/.github/workflows/_test-unit-services-base.yml b/.github/workflows/_test-unit-services-base.yml
index f5bd0e2ea6..d53a9e8822 100644
--- a/.github/workflows/_test-unit-services-base.yml
+++ b/.github/workflows/_test-unit-services-base.yml
@@ -61,10 +61,11 @@ jobs:
     timeout-minutes: ${{ inputs.timeout-minutes }}
     # Environment is derived from the enable-* flags, not caller-controllable.
     # This prevents callers from passing arbitrary environment names to bypass secret scoping.
+    # Note: Postgres service container always starts (GHA limitation), so any Redis job
+    # also needs Postgres secrets → uses integration-redis-postgres, not integration-redis.
     environment: >-
       ${{
-        (inputs.enable-redis && inputs.enable-postgres) && 'integration-redis-postgres' ||
-        inputs.enable-redis && 'integration-redis' ||
+        inputs.enable-redis && 'integration-redis-postgres' ||
         inputs.enable-postgres && 'integration-postgres' ||
         ''
       }}
diff --git a/.github/workflows/test-unit-caching-redis.yml b/.github/workflows/test-unit-caching-redis.yml
index 4475dbf1b7..ca274324f2 100644
--- a/.github/workflows/test-unit-caching-redis.yml
+++ b/.github/workflows/test-unit-caching-redis.yml
@@ -33,3 +33,6 @@ jobs:
       REDIS_HOST: ${{ secrets.REDIS_HOST }}
       REDIS_PORT: ${{ secrets.REDIS_PORT }}
       REDIS_PASSWORD: ${{ secrets.REDIS_PASSWORD }}
+      DATABASE_URL: ${{ secrets.DATABASE_URL }}
+      POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}