diff --git a/.github/workflows/base-mainnet-deploy.yml b/.github/workflows/base-mainnet-deploy.yml
index 4f039104e..11d408b2d 100644
--- a/.github/workflows/base-mainnet-deploy.yml
+++ b/.github/workflows/base-mainnet-deploy.yml
@@ -30,10 +30,11 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Preflight Base mainnet signer and RPC
+      - name: Preflight Base mainnet signer, RPC, and verification
         env:
-          BASE_RPC_URL: ${{ secrets.BASE_RPC_URL }}
+          BASE_RPC_URL: ${{ secrets.BASE_RPC_URL || 'https://mainnet.base.org' }}
           PRIVATE_KEY: ${{ secrets.DEPLOYER_PRIVATE_KEY || secrets.PRIVATE_KEY }}
+          BASESCAN_API_KEY: ${{ secrets.BASESCAN_API_KEY }}
         run: |
           node <<'NODE'
           const { JsonRpcProvider, Wallet, formatEther } = require('ethers');
@@ -41,8 +42,14 @@ jobs:
           async function main() {
             const rpc = process.env.BASE_RPC_URL;
             const key = process.env.PRIVATE_KEY;
-            if (!rpc) throw new Error('BASE_RPC_URL secret is required');
-            if (!key) throw new Error('DEPLOYER_PRIVATE_KEY or PRIVATE_KEY secret is required');
+            const verifyKey = process.env.BASESCAN_API_KEY;
+
+            if (!key) {
+              throw new Error('DEPLOYER_PRIVATE_KEY or PRIVATE_KEY GitHub Actions secret is required');
+            }
+            if (!verifyKey) {
+              throw new Error('BASESCAN_API_KEY GitHub Actions secret is required before broadcast');
+            }
 
             const provider = new JsonRpcProvider(rpc);
             const network = await provider.getNetwork();
@@ -55,6 +62,7 @@ jobs:
             console.log(`Base mainnet chainId verified: ${network.chainId}`);
             console.log(`Deployer address: ${wallet.address}`);
             console.log(`Deployer balance: ${formatEther(balance)} ETH`);
+            console.log('BaseScan verification credential: configured');
             if (balance === 0n) throw new Error('Deployer has no ETH for gas');
           }
 
@@ -72,7 +80,7 @@ jobs:
 
       - name: Deploy AgentExecutor to Base mainnet
         env:
-          BASE_RPC_URL: ${{ secrets.BASE_RPC_URL }}
+          BASE_RPC_URL: ${{ secrets.BASE_RPC_URL || 'https://mainnet.base.org' }}
           PRIVATE_KEY: ${{ secrets.DEPLOYER_PRIVATE_KEY || secrets.PRIVATE_KEY }}
           DESTINATION_ADDRESS: ${{ secrets.DESTINATION_ADDRESS }}
         run: npm run deploy:base
@@ -87,7 +95,7 @@ jobs:
 
       - name: Verify on BaseScan
         env:
-          BASE_RPC_URL: ${{ secrets.BASE_RPC_URL }}
+          BASE_RPC_URL: ${{ secrets.BASE_RPC_URL || 'https://mainnet.base.org' }}
           ETHERSCAN_API_KEY: ${{ secrets.BASESCAN_API_KEY }}
         run: npx hardhat verify --network base "$CONTRACT_ADDRESS"