diff --git a/.gitignore b/.gitignore
index 9dee879..98ceb5a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -36,3 +36,4 @@ src/ZB.MOM.WW.OtOpcUa.Server/config_cache.db
 
 # E2E sidecar config — NodeIds are specific to each dev's local seed (see scripts/e2e/README.md)
 scripts/e2e/e2e-config.json
+config_cache*.db
diff --git a/scripts/smoke/seed-abcip-smoke.sql b/scripts/smoke/seed-abcip-smoke.sql
index 7130d5a..f9c9e4d 100644
--- a/scripts/smoke/seed-abcip-smoke.sql
+++ b/scripts/smoke/seed-abcip-smoke.sql
@@ -55,6 +55,9 @@ INSERT dbo.ClusterNode(NodeId, ClusterId, RedundancyRole, Host, OpcUaPort, Dashb
 VALUES (@NodeId, @ClusterId, 'Primary', 'localhost', 4840, 5000,
         'urn:OtOpcUa:abcip-smoke-node', 200, 1, 'abcip-smoke');
 
+INSERT dbo.ClusterNodeCredential(NodeId, Kind, Value, Enabled, CreatedBy)
+VALUES (@NodeId, 'SqlLogin', 'sa', 1, 'abcip-smoke');
+
 DECLARE @Gen bigint;
 INSERT dbo.ConfigGeneration(ClusterId, Status, CreatedBy)
 VALUES (@ClusterId, 'Draft', 'abcip-smoke');
diff --git a/scripts/smoke/seed-ablegacy-smoke.sql b/scripts/smoke/seed-ablegacy-smoke.sql
index aed62f9..1da13d1 100644
--- a/scripts/smoke/seed-ablegacy-smoke.sql
+++ b/scripts/smoke/seed-ablegacy-smoke.sql
@@ -52,6 +52,9 @@ INSERT dbo.ClusterNode(NodeId, ClusterId, RedundancyRole, Host, OpcUaPort, Dashb
 VALUES (@NodeId, @ClusterId, 'Primary', 'localhost', 4840, 5000,
         'urn:OtOpcUa:ablegacy-smoke-node', 200, 1, 'ablegacy-smoke');
 
+INSERT dbo.ClusterNodeCredential(NodeId, Kind, Value, Enabled, CreatedBy)
+VALUES (@NodeId, 'SqlLogin', 'sa', 1, 'ablegacy-smoke');
+
 DECLARE @Gen bigint;
 INSERT dbo.ConfigGeneration(ClusterId, Status, CreatedBy)
 VALUES (@ClusterId, 'Draft', 'ablegacy-smoke');
diff --git a/scripts/smoke/seed-modbus-smoke.sql b/scripts/smoke/seed-modbus-smoke.sql
index e78efb5..a2be86d 100644
--- a/scripts/smoke/seed-modbus-smoke.sql
+++ b/scripts/smoke/seed-modbus-smoke.sql
@@ -65,6 +65,14 @@ INSERT dbo.ClusterNode(NodeId, ClusterId, RedundancyRole, Host, OpcUaPort, Dashb
 VALUES (@NodeId, @ClusterId, 'Primary', 'localhost', 4840, 5000,
         'urn:OtOpcUa:modbus-smoke-node', 200, 1, 'modbus-smoke');
 
+-- Bind the SQL login this smoke test connects as to the node identity. The
+-- sp_GetCurrentGenerationForCluster + sp_UpdateClusterNodeGenerationState
+-- sprocs raise RAISERROR('Unauthorized: caller %s is not bound to NodeId %s')
+-- when this row is missing. `Kind='SqlLogin'` / `Value='sa'` matches the
+-- container's SA user; rotate Value for real deployments using a non-SA login.
+INSERT dbo.ClusterNodeCredential(NodeId, Kind, Value, Enabled, CreatedBy)
+VALUES (@NodeId, 'SqlLogin', 'sa', 1, 'modbus-smoke');
+
 -- 2. Draft generation.
 DECLARE @Gen bigint;
 INSERT dbo.ConfigGeneration(ClusterId, Status, CreatedBy)
diff --git a/scripts/smoke/seed-s7-smoke.sql b/scripts/smoke/seed-s7-smoke.sql
index 9a347cc..6a0e723 100644
--- a/scripts/smoke/seed-s7-smoke.sql
+++ b/scripts/smoke/seed-s7-smoke.sql
@@ -56,6 +56,9 @@ INSERT dbo.ClusterNode(NodeId, ClusterId, RedundancyRole, Host, OpcUaPort, Dashb
 VALUES (@NodeId, @ClusterId, 'Primary', 'localhost', 4840, 5000,
         'urn:OtOpcUa:s7-smoke-node', 200, 1, 's7-smoke');
 
+INSERT dbo.ClusterNodeCredential(NodeId, Kind, Value, Enabled, CreatedBy)
+VALUES (@NodeId, 'SqlLogin', 'sa', 1, 's7-smoke');
+
 DECLARE @Gen bigint;
 INSERT dbo.ConfigGeneration(ClusterId, Status, CreatedBy)
 VALUES (@ClusterId, 'Draft', 's7-smoke');