diff --git a/install.sh b/install.sh
index b4dde97..b0f304e 100755
--- a/install.sh
+++ b/install.sh
@@ -289,7 +289,11 @@ S_ACCESS_TOKEN_SECRET=$S_ACCESS_TOKEN_SECRET
 S_SETUP_TOKEN=$S_SETUP_TOKEN
 S_E_BASE_URL=http://e-server:8096
 S_E_PUBLIC_URL=http://$SERVER_IP:$E_PORT
-S_E_KEY_ID=customer-e
+# Product E's internal API is protected by the same control-plane verifier
+# configured as PRODUCT_E_CONTROL_PLANE_KEY_ID.  S must therefore sign its
+# S->E requests with that verifier key id (the shared secret is also shared).
+# Keep this aligned so first-run license activation does not receive 401.
+S_E_KEY_ID=customer-s
 S_E_INTERNAL_SECRET=$S_INTERNAL_SHARED_SECRET
 # S's private backend client talks to E on the internal Docker network. This
 # does not weaken E's production mTLS control-plane connection below.