diff --git a/platform-gitops/argo-workflows/cluster-templates/cwft-mctl-agents-investigate.yaml b/platform-gitops/argo-workflows/cluster-templates/cwft-mctl-agents-investigate.yaml
index 1e6eb6a40..746b45230 100644
--- a/platform-gitops/argo-workflows/cluster-templates/cwft-mctl-agents-investigate.yaml
+++ b/platform-gitops/argo-workflows/cluster-templates/cwft-mctl-agents-investigate.yaml
@@ -809,11 +809,11 @@ spec:
           # that mctl-api only counts. enforce connects MCP with the run
           # token and fails the run if the exchange fails. Needs mctl-api
           # with the exchange enabled and an agent image with run_token.py;
-          # an older image ignores it. Enforce since observe showed every
-          # exchange succeed and the shadow scope refuse nothing; the pod's
-          # REST clients still use MCTL_TOKEN (mctlhq/mctl-agents#752).
+          # an older image ignores it. Back to observe: investigate runs
+          # submitted without an execution_id cannot be bound to a run token,
+          # so enforce failed them (mctlhq/mctl-agents#752).
           - name: MCTL_RUN_TOKEN_MODE
-            value: enforce
+            value: observe
           - name: MCTL_RUN_TOKEN_SA_TOKEN_FILE
             value: /var/run/secrets/mctl-api/token
           # Usage-writer token (mctlhq/.github#50): the only credential the