diff --git a/src/cmd/root.rs b/src/cmd/root.rs
index 8304bd0b..f2d7d33c 100644
--- a/src/cmd/root.rs
+++ b/src/cmd/root.rs
@@ -146,6 +146,11 @@ impl EntityType {
             EntityType::Agent(AgentCommand {
                 subcommand: AgentSubcommand::Profiles(_),
             }) => false,
+            // Local Docker only: images, networks, containers and the
+            // persistent home volume. `build --profile` reads a local profile.
+            EntityType::Agent(AgentCommand {
+                subcommand: AgentSubcommand::Docker(_),
+            }) => false,
             // File-only agent profiles require no Stashbase authentication.
             // Remote fallback is validated after the profile and local overrides
             // have been resolved.
@@ -223,4 +228,19 @@ mod tests {
             assert!(!cli.entity_type.requires_api_key(), "{args:?}");
         }
     }
+
+    #[test]
+    fn agent_docker_commands_do_not_require_an_api_key() {
+        for args in [
+            vec!["stashbase", "agent", "docker", "build"],
+            vec!["stashbase", "agent", "docker", "build", "--profile", "demo"],
+            vec!["stashbase", "agent", "docker", "status"],
+            vec!["stashbase", "agent", "docker", "cleanup"],
+            vec!["stashbase", "agent", "docker", "doctor"],
+            vec!["stashbase", "agent", "docker", "shell"],
+        ] {
+            let cli = Cli::try_parse_from(&args).unwrap();
+            assert!(!cli.entity_type.requires_api_key(), "{args:?}");
+        }
+    }
 }