diff --git a/scripts/istio/build_context b/scripts/istio/build_context
index 95e0930..99cac18 100755
--- a/scripts/istio/build_context
+++ b/scripts/istio/build_context
@@ -1,16 +1,24 @@
 #!/bin/bash
 set -euo pipefail
 
-SERVICE_ID=$(echo "$CONTEXT" | jq -r '.service.id')
-SERVICE_SLUG=$(echo "$CONTEXT" | jq -r '.service.slug')
-ACTION_ID=$(echo "$CONTEXT" | jq -r '.id')
-ACTION_NAME=$(echo "$CONTEXT" | jq -r '.slug')
-APPLICATION_ID=$(echo "$CONTEXT" | jq -r '.tags.application_id // ""')
+# This np CLI version does NOT expose the action's own id/slug/parameters
+# through the $CONTEXT built by `--build-context` - that JSON only carries
+# related entities (scope/application/namespace/account, per its --include
+# list, which doesn't even have "service" as an option). The action's own
+# identity and submitted create-form values arrive as flat ACTION_* env
+# vars instead, set directly by `np service workflow exec` (confirmed live
+# via a real failed action: ACTION_PARAMETERS_BASE_DOMAIN etc. were present
+# and correct while $CONTEXT had none of this).
+SERVICE_ID="$ACTION_SERVICE_ID"
+SERVICE_SLUG="$ACTION_SERVICE_SLUG"
+ACTION_ID="$ACTION_ID"
+ACTION_NAME="$ACTION_SLUG"
+APPLICATION_ID="${ACTION_TAGS_APPLICATION_ID:-}"
 
-BASE_DOMAIN=$(echo "$CONTEXT" | jq -r '.service.attributes.base_domain // .parameters.base_domain // ""')
-STRIP_PREFIX=$(echo "$CONTEXT" | jq -r '.service.attributes.strip_prefix // .parameters.strip_prefix // "true"')
-PATH_PREFIX=$(echo "$CONTEXT" | jq -r '.service.attributes.path_prefix // .parameters.path_prefix // ""')
-SCOPE_SLUG=$(echo "$CONTEXT" | jq -r '.service.attributes.scope // .parameters.scope // ""')
+BASE_DOMAIN="${ACTION_PARAMETERS_BASE_DOMAIN:-}"
+STRIP_PREFIX="${ACTION_PARAMETERS_STRIP_PREFIX:-true}"
+PATH_PREFIX="${ACTION_PARAMETERS_PATH_PREFIX:-}"
+SCOPE_SLUG="${ACTION_PARAMETERS_SCOPE:-}"
 
 [[ -z "$BASE_DOMAIN" ]]  && { echo "ERROR: base_domain is required in service attributes"; exit 1; }
 [[ -z "$PATH_PREFIX" ]]  && { echo "ERROR: path_prefix is required in service attributes"; exit 1; }
diff --git a/scripts/istio/fetch_provider_data b/scripts/istio/fetch_provider_data
index f3fcbbe..ceece1a 100755
--- a/scripts/istio/fetch_provider_data
+++ b/scripts/istio/fetch_provider_data
@@ -3,11 +3,16 @@
 # Fetch Provider Data: Retrieves Kubernetes namespace from the container orchestration provider.
 # Queries provider data based on service dimensions and exports K8S_NAMESPACE for downstream scripts.
 
-NRN=$(echo "$CONTEXT" | jq -r .entity_nrn)
+# $CONTEXT (from --build-context) doesn't carry the action's own entity_nrn
+# or service dimensions on this np CLI version - use the flat ACTION_* env
+# vars the workflow executor sets directly instead (see build_context for
+# how this was confirmed against a real action).
+NRN="${ACTION_ENTITY_NRN:-}"
 
-DIMENSIONS=$(echo "$CONTEXT" | jq .service.dimensions)
-
-DIMENSION_FILTER=$(echo "$DIMENSIONS" | jq -r 'to_entries | map("\(.key):\(.value)") | join(",")')
+DIMENSION_FILTER=""
+if [ -n "${ACTION_SERVICE_DIMENSIONS_ENVIRONMENT:-}" ]; then
+  DIMENSION_FILTER="environment:${ACTION_SERVICE_DIMENSIONS_ENVIRONMENT}"
+fi
 
 if [ -z "$DIMENSION_FILTER" ] || [ "$DIMENSION_FILTER" = "" ]; then
   PROVIDER_DATA=$(np provider list --categories container-orchestration --nrn "$NRN" --format json | jq -r ".results[0]")