diff --git a/docker/scripts/entrypoint.sh b/docker/scripts/entrypoint.sh
index a6bc7dd15b9..127446f03b6 100755
--- a/docker/scripts/entrypoint.sh
+++ b/docker/scripts/entrypoint.sh
@@ -17,18 +17,10 @@ if [ -n "$CLICKHOUSE_URL" ] && [ "$SKIP_CLICKHOUSE_MIGRATIONS" != "1" ]; then
   # Run ClickHouse migrations
   echo "Running ClickHouse migrations..."
   export GOOSE_DRIVER=clickhouse
-  
-  # Ensure secure=true is in the connection string
-  if echo "$CLICKHOUSE_URL" | grep -q "secure="; then
-    # secure parameter already exists, use as is
-    export GOOSE_DBSTRING="$CLICKHOUSE_URL"
-  elif echo "$CLICKHOUSE_URL" | grep -q "?"; then
-    # URL has query parameters, append secure=true
-    export GOOSE_DBSTRING="${CLICKHOUSE_URL}&secure=true"
-  else
-    # URL has no query parameters, add secure=true
-    export GOOSE_DBSTRING="${CLICKHOUSE_URL}?secure=true"
-  fi
+
+  # Goose derives TLS from the URL scheme. Strip any existing secure query
+  # parameter and only set secure=true for https URLs.
+  export GOOSE_DBSTRING="$(node -e 'const url = new URL(process.env.CLICKHOUSE_URL); url.searchParams.delete("secure"); if (url.protocol === "https:") { url.searchParams.set("secure", "true"); } process.stdout.write(url.toString());')"
   
   export GOOSE_MIGRATION_DIR=/triggerdotdev/internal-packages/clickhouse/schema
   /usr/local/bin/goose up
diff --git a/packages/cli-v3/src/entryPoints/dev-run-worker.ts b/packages/cli-v3/src/entryPoints/dev-run-worker.ts
index b7f621954c9..7c097292652 100644
--- a/packages/cli-v3/src/entryPoints/dev-run-worker.ts
+++ b/packages/cli-v3/src/entryPoints/dev-run-worker.ts
@@ -679,6 +679,7 @@ const zodIpc = new ZodIpcConnection({
       }
     },
     RESOLVE_WAITPOINT: async ({ waitpoint }) => {
+      taskContext.enable();
       _sharedWorkerRuntime?.resolveWaitpoints([waitpoint]);
     },
   },
diff --git a/packages/cli-v3/src/entryPoints/managed-run-worker.ts b/packages/cli-v3/src/entryPoints/managed-run-worker.ts
index ed8fc9be5e7..36e62b2e60c 100644
--- a/packages/cli-v3/src/entryPoints/managed-run-worker.ts
+++ b/packages/cli-v3/src/entryPoints/managed-run-worker.ts
@@ -665,6 +665,7 @@ const zodIpc = new ZodIpcConnection({
       }
     },
     RESOLVE_WAITPOINT: async ({ waitpoint }) => {
+      taskContext.enable();
       _sharedWorkerRuntime?.resolveWaitpoints([waitpoint]);
     },
   },
diff --git a/packages/core/src/v3/taskContext/index.test.ts b/packages/core/src/v3/taskContext/index.test.ts
index 34d169a177c..3a4f5dd0a90 100644
--- a/packages/core/src/v3/taskContext/index.test.ts
+++ b/packages/core/src/v3/taskContext/index.test.ts
@@ -83,4 +83,18 @@ describe("TaskContextAPI conversation id", () => {
 
     expect(api.attributes[SemanticInternalAttributes.GEN_AI_CONVERSATION_ID]).toBeUndefined();
   });
+
+  it("re-enables run attribution after disable()", () => {
+    const api = TaskContextAPI.getInstance();
+    api.setGlobalTaskContext({ ctx: FAKE_CTX, worker: FAKE_WORKER });
+
+    api.disable();
+
+    expect(api.isRunDisabled).toBe(true);
+
+    api.enable();
+
+    expect(api.isRunDisabled).toBe(false);
+    expect(api.attributes[SemanticInternalAttributes.RUN_ID]).toBe(FAKE_CTX.run.id);
+  });
 });
diff --git a/packages/core/src/v3/taskContext/index.ts b/packages/core/src/v3/taskContext/index.ts
index c4bbf25c972..79362b0cfe7 100644
--- a/packages/core/src/v3/taskContext/index.ts
+++ b/packages/core/src/v3/taskContext/index.ts
@@ -132,8 +132,12 @@ export class TaskContextAPI {
     this._runDisabled = true;
   }
 
-  public setGlobalTaskContext(taskContext: TaskContext): boolean {
+  public enable() {
     this._runDisabled = false;
+  }
+
+  public setGlobalTaskContext(taskContext: TaskContext): boolean {
+    this.enable();
     // Each run boot re-registers the global; clear any conversation id
     // left over from a previous run on this warm-restarted process so
     // attributes don't bleed across runs that don't call