diff --git a/tests/lasuite-drive/recipe_meta.py b/tests/lasuite-drive/recipe_meta.py
index f0cd877..48b6a7a 100644
--- a/tests/lasuite-drive/recipe_meta.py
+++ b/tests/lasuite-drive/recipe_meta.py
@@ -59,6 +59,13 @@ def EXTRA_ENV(ctx):
         # postgres, redis, collabora ~1GB, onlyoffice ~2GB). Bump so abra waits long enough for
         # convergence; kept under DEPLOY_TIMEOUT (1800) so Python never kills abra mid-wait.
         "TIMEOUT": "1500",
+        # abra's pinned-version `app new` regenerates the .env from generation hints and DROPS
+        # SECRET_COLLABORA_P_VERSION (not a generatable secret — the .env.sample ships its
+        # version line manually). Without it every secret-touching abra command for the app
+        # FATAs "missing version for secret? (collabora_p)" → the base deploy goes RED at
+        # install. env_set runs after app_new, so re-asserting the shipped version pin here
+        # restores the sample's contract.
+        "SECRET_COLLABORA_P_VERSION": "v1",
     }
 
 
diff --git a/tests/unit/test_meta.py b/tests/unit/test_meta.py
index 97df527..287b424 100644
--- a/tests/unit/test_meta.py
+++ b/tests/unit/test_meta.py
@@ -171,6 +171,22 @@ def test_extra_env_dict_and_callable_forms(tmp_path):
     assert meta_mod.extra_env(meta2, ctx2) == {}  # unset EXTRA_ENV resolves to {}
 
 
+TESTS_DIR = os.path.join(os.path.dirname(__file__), "..")
+
+
+def test_lasuite_drive_extra_env_carries_collabora_p_version():
+    """(REGRESSION, 2026-10-25) abra's pinned-version `app new` regenerates the .env from
+    generation hints and drops SECRET_COLLABORA_P_VERSION (the .env.sample ships it manually),
+    so every secret-touching abra command for the app FATAs "missing version for secret?
+    (collabora_p)" and the cold base deploy goes RED at install. The per-recipe EXTRA_ENV must
+    re-assert the shipped version pin (env_set runs after app_new). Pin it here so abra/upstream
+    drift that loses it again surfaces as a red unit test, not a weekly red build."""
+    meta = meta_mod.load("lasuite-drive", tests_dir=TESTS_DIR)
+    ctx = meta_mod.hook_ctx("lasuite-drive-pr0-abc123.ci.commoninternet.net", meta)
+    extra = meta_mod.extra_env(meta, ctx)
+    assert extra.get("SECRET_COLLABORA_P_VERSION") == "v1"
+
+
 # ---- P3: uniform ctx hook convention -------------------------------------------------------------