diff --git a/live/terragrunt.hcl b/live/terragrunt.hcl
index e0ccdc2..bbe4cc7 100644
--- a/live/terragrunt.hcl
+++ b/live/terragrunt.hcl
@@ -58,8 +58,14 @@ variable "kube_context" {
 }
 
 provider "kubernetes" {
-  config_path    = var.kubeconfig_path != "" ? var.kubeconfig_path : null
-  config_context = var.kube_context != "" ? var.kube_context : null
+  # KUBECONFIG is set unconditionally at job level for the external-runner case
+  # (see .gitea/workflows/terraform.yml "Prepare kubeconfig"); on an in-cluster
+  # runner that file is never written (no KUBECONFIG_B64), so fileexists() must
+  # gate this - a non-empty path alone isn't enough, else the provider tries to
+  # read a file that was never created and falls over instead of using the pod
+  # ServiceAccount / in-cluster config.
+  config_path    = var.kubeconfig_path != "" && fileexists(var.kubeconfig_path) ? var.kubeconfig_path : null
+  config_context = var.kubeconfig_path != "" && fileexists(var.kubeconfig_path) ? var.kube_context : null
 }
 
 # Vault: static VAULT_TOKEN if provided, else in-cluster k8s auth by the runner SA.