diff --git a/.github/workflows/install-sh-smoke.yml b/.github/workflows/install-sh-smoke.yml
index e0149c951..6fb1fbbfb 100644
--- a/.github/workflows/install-sh-smoke.yml
+++ b/.github/workflows/install-sh-smoke.yml
@@ -229,8 +229,12 @@ jobs:
           echo "Running install.sh --archive against the published tarball..."
           # docker exec without -t leaves stdin without a TTY, which install.sh's
           # safe_read helper detects and falls through to defaults on every prompt.
-          docker exec "${container_name}" \
-            bash -lc "cd /smoke && bash install.sh --archive /smoke/${tarball} --disable-auto-updates"
+          # PULSE_INSTALL_ALLOW_DOCKER=1 opts the smoke harness past install.sh's
+          # Docker-environment refusal — install.sh treats the test container as
+          # a normal systemd host, which is the exact contract this gate exists
+          # to validate.
+          docker exec -e PULSE_INSTALL_ALLOW_DOCKER=1 "${container_name}" \
+            bash -lc "cd /smoke && PULSE_INSTALL_ALLOW_DOCKER=1 bash install.sh --archive /smoke/${tarball} --disable-auto-updates"
 
           echo "Waiting for pulse.service to become active..."
           for i in $(seq 1 60); do
diff --git a/install.sh b/install.sh
index 84e9640ea..8010e1182 100755
--- a/install.sh
+++ b/install.sh
@@ -780,6 +780,13 @@ check_docker_environment() {
        grep -q docker /proc/self/cgroup 2>/dev/null || \
        [[ -f /run/.containerenv ]] || \
        [[ "${container:-}" == "docker" ]]; then
+        # The install.sh smoke gate exercises the documented systemd install
+        # path inside a privileged systemd-in-Docker test container. That is
+        # the one legitimate case for bypassing this guard.
+        if [[ "${PULSE_INSTALL_ALLOW_DOCKER:-}" == "1" ]]; then
+            print_warn "Docker environment detected but PULSE_INSTALL_ALLOW_DOCKER=1 set; continuing."
+            return 0
+        fi
         print_error "Docker environment detected"
         echo "Please use the Docker image directly: docker run -d -p 7655:7655 $(repo_docker_image_ref latest)"
         echo "See: $(repo_docker_docs_url)"