diff --git a/agent-container.py b/agent-container.py
index 4bc8eb4..a2a13b7 100755
--- a/agent-container.py
+++ b/agent-container.py
@@ -167,6 +167,12 @@ class AgentContainer:
             )
             self.remove_container()
 
+        if self.container_exists() and not self._container_env_matches():
+            logger.info(
+                "Recreating container: it predates the AGENT_CONTAINER env marker"
+            )
+            self.remove_container()
+
         if not self.container_exists():
             self.create_container()
 
@@ -390,6 +396,10 @@ class AgentContainer:
                 "create",
                 "--name",
                 self.container_name,
+                # Lets tools/scripts running inside detect that they are in
+                # an agent container (rather than a bare host).
+                "--env",
+                "AGENT_CONTAINER=1",
                 "--network",
                 "host",
                 "--user",
@@ -423,6 +433,26 @@ class AgentContainer:
         ).stdout.strip()
         return bool(container_image) and container_image == current_image
 
+    def _container_env_matches(self) -> bool:
+        """Whether the existing container was created with the env vars the
+        current script sets at create time. Containers predating the
+        AGENT_CONTAINER marker keep running without it, so in-container
+        detection (see the install-in-container skill) fails. Comparing
+        against Config.Env catches that."""
+        env = subprocess.run(
+            [
+                "docker",
+                "container",
+                "inspect",
+                "-f",
+                "{{.Config.Env}}",
+                self.container_name,
+            ],
+            capture_output=True,
+            text=True,
+        ).stdout
+        return "AGENT_CONTAINER=1" in env
+
     def start_container(self) -> bool:
         subprocess.run(
             ["docker", "start", self.container_name],