diff --git a/api/classification.py b/api/classification.py
index a2955bb..43aef85 100644
--- a/api/classification.py
+++ b/api/classification.py
@@ -9,8 +9,16 @@ import re
 from dataclasses import dataclass, field
 from pathlib import Path
 
+import os
+
 import yaml
 
+# Explicit override first — every other candidate below is a developer
+# workstation path, so in a container none of them exist and classification
+# validation fails outright. Set REPO_CLASSIFICATION_ALLOWED_PATH in any
+# deployment that does not carry a the-custodian checkout (CUST-WP-0067-T04).
+_ENV_ALLOWED = os.environ.get("REPO_CLASSIFICATION_ALLOWED_PATH")
+
 # Workstation checkout, railiance01 fleet checkout, then state-hub sibling fallback.
 _PRIMARY_ALLOWED = Path(
     "/home/worsch/the-custodian/canon/standards/repo-classification.allowed.yaml"
@@ -70,12 +78,21 @@ class ClassificationData:
 
 
 def _allowed_path() -> Path:
+    if _ENV_ALLOWED:
+        candidate = Path(_ENV_ALLOWED)
+        if candidate.is_file():
+            return candidate
+        raise FileNotFoundError(
+            f"REPO_CLASSIFICATION_ALLOWED_PATH is set to {candidate}, which is not a file"
+        )
     for candidate in (_PRIMARY_ALLOWED, _RAILIANCE_ALLOWED, _FALLBACK_ALLOWED):
         if candidate.is_file():
             return candidate
     raise FileNotFoundError(
         "repo-classification.allowed.yaml not found at "
-        f"{_PRIMARY_ALLOWED}, {_RAILIANCE_ALLOWED}, or {_FALLBACK_ALLOWED}"
+        f"{_PRIMARY_ALLOWED}, {_RAILIANCE_ALLOWED}, or {_FALLBACK_ALLOWED}. "
+        "Set REPO_CLASSIFICATION_ALLOWED_PATH when running without a "
+        "the-custodian checkout (for example in a container)."
     )