diff --git a/roles/test-e2e-playwright/defaults/main.yml b/roles/test-e2e-playwright/defaults/main.yml
index 89139adeee..a0f5f456d3 100644
--- a/roles/test-e2e-playwright/defaults/main.yml
+++ b/roles/test-e2e-playwright/defaults/main.yml
@@ -23,6 +23,11 @@
 #   mask the result of the deploy that actually ran.
 # Param test_e2e_playwright_skip_roles: roles excluded from the run.
 # Param test_e2e_playwright_keep: keep the sidecar and cluster after the run.
+# Param PLAYWRIGHT_MAPACHE_PASSWORD: password the provisioning spec sets on the
+#   mapache persona and every consumer spec logs in with. The inventory owns it
+#   rather than `secrets.credentials`, because a generated credential rotates
+#   between the matrix's two passes and pass 2 would then face the password
+#   pass 1 stored.
 # Param VARIANT_INDEX: 0-based matrix-deploy round id, pushed as an extra var by
 #   `cli/administration/deploy/development/deploy.py` when the matrix
 #   orchestrator runs. Defaults to 0 for dev / non-matrix invocations so
@@ -46,4 +51,6 @@ test_e2e_playwright_only_roles: "{{ lookup('deployment').running }}"
 test_e2e_playwright_skip_roles: []
 test_e2e_playwright_keep: false
 
+PLAYWRIGHT_MAPACHE_PASSWORD: ""
+
 VARIANT_INDEX: 0
diff --git a/roles/web-svc-design/defaults/main.yml b/roles/web-svc-design/defaults/main.yml
new file mode 100644
index 0000000000..34d35a3945
--- /dev/null
+++ b/roles/web-svc-design/defaults/main.yml
@@ -0,0 +1,5 @@
+---
+# Param DESIGN_BASE_COLOR: the base color a development inventory or the `base=`
+#   of a design sync puts into services.design.colors.base for that run. Empty
+#   here so both outrank it; the shipped palette comes from meta/services.yml.
+DESIGN_BASE_COLOR: ""