diff --git a/apps/api/src/__tests__/integration/loadEnv.ts b/apps/api/src/__tests__/integration/loadEnv.ts
index bde681c999..06d84846ea 100644
--- a/apps/api/src/__tests__/integration/loadEnv.ts
+++ b/apps/api/src/__tests__/integration/loadEnv.ts
@@ -24,7 +24,7 @@ function thisDir(): string {
 
 // apps/api/src/__tests__/integration → monorepo root
 const envPath = path.resolve(thisDir(), '..', '..', '..', '..', '..', '.env.test');
-config({ path: envPath });
+config({ path: envPath, quiet: true });
 
 // Hard-coded defaults matching docker-compose.test.yml. These take effect
 // only if neither the host environment nor .env.test supplied a value
diff --git a/apps/api/src/config/normalizeNodeEnv.ts b/apps/api/src/config/normalizeNodeEnv.ts
index 8dcf5f204c..5fca3ec800 100644
--- a/apps/api/src/config/normalizeNodeEnv.ts
+++ b/apps/api/src/config/normalizeNodeEnv.ts
@@ -7,8 +7,8 @@
 //
 // This module MUST be imported before any module that reads NODE_ENV at import
 // time (e.g. routes/metrics.ts, routes/docs.ts, routes/portal/schemas.ts) — it
-// is imported in index.ts immediately after `dotenv/config`, so .env is loaded
-// first and every later import observes the canonical value.
+// is imported in index.ts immediately after dotenv's config() call, so .env
+// is loaded first and every later import observes the canonical value.
 
 /**
  * Returns the canonical NODE_ENV for a raw value, or null if it is not a
diff --git a/apps/api/src/db/index.ts b/apps/api/src/db/index.ts
index d29b0e837e..3dc7de54ae 100644
--- a/apps/api/src/db/index.ts
+++ b/apps/api/src/db/index.ts
@@ -1,7 +1,7 @@
 import { config } from 'dotenv';
 // Load .env from monorepo root (when running from apps/api) or cwd (when running from root)
-config({ path: '../../.env' });
-config(); // Also try cwd
+config({ path: '../../.env', quiet: true });
+config({ quiet: true }); // Also try cwd
 
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { sql, type SQL } from 'drizzle-orm';
diff --git a/apps/api/src/index.ts b/apps/api/src/index.ts
index 4b1cdd6d5e..3320f50185 100644
--- a/apps/api/src/index.ts
+++ b/apps/api/src/index.ts
@@ -1,4 +1,5 @@
-import 'dotenv/config';
+import { config as loadDotenv } from 'dotenv';
+loadDotenv({ quiet: true });
 // Canonicalize NODE_ENV before any module reads it (some routes/services gate
 // on `NODE_ENV === 'production'` at import time). Must stay directly after
 // dotenv so .env is loaded first. See #917 (L-6).
diff --git a/apps/api/src/worker.ts b/apps/api/src/worker.ts
index 7d772c82c0..8b19382432 100644
--- a/apps/api/src/worker.ts
+++ b/apps/api/src/worker.ts
@@ -90,7 +90,8 @@
  *      then the phases run (drain → workers → queues → eventbus → redis → db →
  *      sentry), mirroring index.ts's Part A semantics.
  */
-import 'dotenv/config';
+import { config as loadDotenv } from 'dotenv';
+loadDotenv({ quiet: true });
 import { createServer, type IncomingMessage, type ServerResponse, type Server } from 'node:http';
 import { sql } from 'drizzle-orm';
 import { AI_AGENTS_ENABLED, abuseSignalsEnabled, breezeRole, eventDispatchMode } from './config/env';
diff --git a/apps/api/vitest.config.rls-coverage.ts b/apps/api/vitest.config.rls-coverage.ts
index 82fa2e92e5..1de4bb055f 100644
--- a/apps/api/vitest.config.rls-coverage.ts
+++ b/apps/api/vitest.config.rls-coverage.ts
@@ -9,7 +9,7 @@ import { config } from 'dotenv';
 // and must never carry the truncate hazard.
 //
 // Run with: pnpm -F @breeze/api test:rls-coverage
-config({ path: '../../.env.test' });
+config({ path: '../../.env.test', quiet: true });
 
 export default defineConfig({
   test: {
diff --git a/apps/api/vitest.integration.config.ts b/apps/api/vitest.integration.config.ts
index c4d9af0926..82dc3c7831 100644
--- a/apps/api/vitest.integration.config.ts
+++ b/apps/api/vitest.integration.config.ts
@@ -2,7 +2,7 @@ import { defineConfig } from 'vitest/config';
 import { config } from 'dotenv';
 
 // Load test environment variables
-config({ path: '../../.env.test' });
+config({ path: '../../.env.test', quiet: true });
 
 export default defineConfig({
   test: {
diff --git a/e2e-tests/live-signup/monitor.ts b/e2e-tests/live-signup/monitor.ts
index abe9f2d908..7f46f19177 100644
--- a/e2e-tests/live-signup/monitor.ts
+++ b/e2e-tests/live-signup/monitor.ts
@@ -11,7 +11,7 @@ import { registerViaUi } from './phases/uiFlow';
 import { simulatePaymentAndAssertActivation } from './phases/simulatePayment';
 import { purgePartner, sweepStaleCanaries } from './phases/cleanup';
 
-loadEnv({ path: join(dirname(fileURLToPath(import.meta.url)), '.env') });
+loadEnv({ path: join(dirname(fileURLToPath(import.meta.url)), '.env'), quiet: true });
 
 function arg(name: string): string | undefined {
   const hit = process.argv.find((a) => a.startsWith(`--${name}=`));
diff --git a/e2e-tests/perf-harness/run-perf.ts b/e2e-tests/perf-harness/run-perf.ts
index bf7ecdcf8a..6dee7f6ecc 100644
--- a/e2e-tests/perf-harness/run-perf.ts
+++ b/e2e-tests/perf-harness/run-perf.ts
@@ -44,7 +44,7 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 // Load parent .env (same convention as the Playwright suite) if present.
 const parentEnv = path.resolve(__dirname, '..', '..', '.env');
-if (existsSync(parentEnv)) loadEnv({ path: parentEnv });
+if (existsSync(parentEnv)) loadEnv({ path: parentEnv, quiet: true });
 
 function env(name: string, fallback: string): string {
   const v = process.env[name];
diff --git a/ee/workspace/package.json b/ee/workspace/package.json
index fe17181329..c7f52c3d0e 100644
--- a/ee/workspace/package.json
+++ b/ee/workspace/package.json
@@ -15,18 +15,18 @@
   "dependencies": {
     "@breeze/extension-sdk": "workspace:*",
     "@breeze/extension-web-sdk": "workspace:*",
+    "@breeze/shared": "workspace:*",
     "drizzle-orm": "0.45.2",
     "hono": "4.13.5",
     "mailparser": "^3.9.14",
     "v9u-smb2": "^1.0.6",
-    "zod": "4.4.3",
-    "@breeze/shared": "workspace:*"
+    "zod": "4.4.3"
   },
   "devDependencies": {
     "@breeze/extension-testkit": "workspace:*",
     "@types/mailparser": "^3.4.6",
     "@types/node": "^26.4.1",
-    "dotenv": "16.6.1",
+    "dotenv": "17.4.2",
     "happy-dom": "^20.11.0",
     "postgres": "3.4.9",
     "tsup": "8.5.1",
diff --git a/ee/workspace/vitest.integration.config.ts b/ee/workspace/vitest.integration.config.ts
index 563216b595..026a47e8fc 100644
--- a/ee/workspace/vitest.integration.config.ts
+++ b/ee/workspace/vitest.integration.config.ts
@@ -7,7 +7,7 @@ import { config } from 'dotenv';
 // DATABASE_URL_APP directly via the job env, and locally the suites fall
 // back to the shared :5433 test-stack defaults baked into each
 // *.integration.test.ts.
-config({ path: '../../.env.test' });
+config({ path: '../../.env.test', quiet: true });
 
 export default defineConfig({
   test: {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 9bd2458d48..2d9776d5c9 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1284,8 +1284,8 @@ importers:
         specifier: ^26.4.1
         version: 26.4.1
       dotenv:
-        specifier: 16.6.1
-        version: 16.6.1
+        specifier: 17.4.2
+        version: 17.4.2
       happy-dom:
         specifier: ^20.11.0
         version: 20.11.1