diff --git a/deploy/compose/.env.enterprise-sso.example b/deploy/compose/.env.enterprise-sso.example
index ad42c2f7..c864c6aa 100644
--- a/deploy/compose/.env.enterprise-sso.example
+++ b/deploy/compose/.env.enterprise-sso.example
@@ -1,9 +1,10 @@
 # Enterprise Directory overrides; merge into the deployment environment before release.
 # Generic OAuth defaults stay provider-neutral. No credentials belong in this file.
 CF_SSO_OAUTH_LOGIN_ID_CLAIM=userId
-# Namespace used by directory ACL rules, cf_sso_group_map rows and identity keys.
-# Keep the value stable for an existing deployment; consumers may choose their own.
-CF_ACL_PROVIDER=external
+# Tenant namespace used by directory ACL rules, cf_sso_group_map rows and
+# identity keys. Keep the value stable for an existing deployment.
+# CF_DIRECTORY_PROVIDER is preferred; CF_ACL_PROVIDER remains a legacy alias.
+CF_DIRECTORY_PROVIDER=external
 # Audience of the machine-authenticated Directory JWT (must match the Directory side).
 CF_DIRECTORY_AUDIENCE=eap-directory
 # Optional: enable ONLY after the trusted Directory /administrators machine endpoint
diff --git a/tests/test_admin_startup_hook.py b/tests/test_admin_startup_hook.py
index 4253878f..ac3ce759 100644
--- a/tests/test_admin_startup_hook.py
+++ b/tests/test_admin_startup_hook.py
@@ -59,7 +59,7 @@ def test_enterprise_default_admin_compatibility_remains_opt_in(self):
         # expected-account assertion is an operator opt-in in their own config.
         self.assertIn('CF_PROVIDER_ADMIN_EXPECTED_ACCOUNT=', env)
         self.assertNotIn('CF_PROVIDER_ADMIN_EXPECTED_ACCOUNT=admin', env)
-        self.assertIn('CF_ACL_PROVIDER=external', env)
+        self.assertIn('CF_DIRECTORY_PROVIDER=external', env)
         self.assertIn('CF_DIRECTORY_AUDIENCE=eap-directory', env)
 
     def test_nonroot_command_is_one_safely_quoted_shell_command(self):