diff --git a/agent.py b/agent.py
index 32d254b..537c6bd 100644
--- a/agent.py
+++ b/agent.py
@@ -518,14 +518,15 @@ class CustomerIntegrationEngineer(A2AAgent[CustomerIntegrationEngineerConfig, No
 
     @a2a.tool(description="Validate OpenAPI, JSON Schema, and webhook contracts with deterministic fixtures", timeout_seconds=120, idempotent=True, max_retries=0, cost_class="deterministic")
     async def validate_contract(self, ctx: RunContext[NoAuth], request: ValidateContractRequest) -> ValidateContractResult:
-        audit = [_audit("contract_validation_started", request.integration_id, {"contracts": len(request.contracts), "dry_run": request.dry_run})]
+        dry_run = _effective_dry_run(self, request.dry_run)
+        audit = [_audit("contract_validation_started", request.integration_id, {"contracts": len(request.contracts), "dry_run": dry_run})]
         await _emit(ctx, audit[-1])
         checks = [_validate_one_contract(contract) for contract in request.contracts]
         drift = any(check.status == "fail" for check in checks)
         report = {
             "integration_id": request.integration_id,
             "status": "fail" if drift and request.fail_on_drift else "pass",
-            "dry_run": request.dry_run,
+            "dry_run": dry_run,
             "generated_at": _now(),
             "checks": [c.model_dump(mode="json") for c in checks],
             "secret_handling": "secret_ref values only; raw credentials are rejected and redacted",