diff --git a/platform/service/distribution_builder.go b/platform/service/distribution_builder.go
index 824b24c..f951438 100644
--- a/platform/service/distribution_builder.go
+++ b/platform/service/distribution_builder.go
@@ -508,7 +508,7 @@ EOF
   ldflags="$ldflags -X browser.local/run/config.BuildServerInstanceID=$SERVER_INSTANCE_ID"
   ldflags="$ldflags -X browser.local/run/config.BuildPluginID=$PLUGIN_ID"
   ldflags="$ldflags -X browser.local/run/config.BuildComponentKind=$COMPONENT_KIND"
-  ldflags="$ldflags -X browser.local/run/config.BuildComponentKey=$PROFILE_KEY"
+  ldflags="$ldflags -X browser.local/run/config.BuildComponentKey="
   ldflags="$ldflags -X browser.local/run/config.BuildKeyGeneration=$KEY_GENERATION"
   ldflags="$ldflags -X browser.local/run/config.BuildVersion=$TARGET_RELEASE"
   progress 48 'build_compile: downloading Go modules'
diff --git a/platform/service/distribution_builder_test.go b/platform/service/distribution_builder_test.go
index 445b7a3..d683833 100644
--- a/platform/service/distribution_builder_test.go
+++ b/platform/service/distribution_builder_test.go
@@ -203,6 +203,9 @@ func TestDockerDistributionBuilderKeepsSecretInIsolatedInput(t *testing.T) {
 			if bytes.Contains(script, []byte(secret)) {
 				t.Fatal("build script must not embed the component auth key")
 			}
+			if bytes.Contains(script, []byte("BuildComponentKey=$PROFILE_KEY")) || !bytes.Contains(script, []byte("BuildComponentKey=")) {
+				t.Fatalf("Run build script must not use lifecycle profile as component identity: %s", script)
+			}
 			for _, ordered := range [][2]string{{"find /workspace/source -mindepth 1 -maxdepth 1 ! -name pax_global_header", "run_command_dir=\"$(find /workspace/build/run-source -type d -path '*/cmd/run' -print -quit)\""}, {"run_command_dir=\"$(find /workspace/build/run-source -type d -path '*/cmd/run' -print -quit)\"", "run_module_dir=\"${run_command_dir%/cmd/run}\""}, {"run_module_dir=\"${run_command_dir%/cmd/run}\"", "mkdir -p \"$run_module_dir/config\""}, {"mkdir -p \"$run_module_dir/config\"", "workspace_seed_generated.go"}, {"workspace_seed_generated.go", "cd \"$run_module_dir\""}, {"cd \"$run_module_dir\"", "go build -trimpath -ldflags"}} {
 				if bytes.Index(script, []byte(ordered[0])) >= bytes.Index(script, []byte(ordered[1])) {
 					t.Fatalf("Run build script must prepare source before injecting config and compiling: %q before %q", ordered[0], ordered[1])
@@ -227,6 +230,7 @@ func TestDockerDistributionBuilderKeepsSecretInIsolatedInput(t *testing.T) {
 		ServerInstanceID: "server-one",
 		PluginID:         "game.scum",
 		RunEndpointID:    "server-run-server-one",
+		ProfileKey:       "run-local",
 		TargetOS:         "windows",
 		TargetArch:       "amd64",
 		TargetRelease:    "release-one",