diff --git a/README.md b/README.md
index 77ffe32..f79d5f5 100644
--- a/README.md
+++ b/README.md
@@ -279,10 +279,13 @@ hops local start --backend dory
 On start/activate, hops:
 
 - merges stock `~/.kube/dory-config` into `~/.kube/config` as context **`hops-dory`**
-  (override with `--name <name>` or `HOPS_DORY_NAME`; persisted in `~/.hops/local/dory-name`)
+  (override with `--dory-name <name>` or `HOPS_DORY_NAME`; persisted in `~/.hops/local/dory-name`)
 - runs `kubectl config use-context hops-dory`
 - creates/uses a docker context of the same name → `unix://$HOME/.dory/dory.sock`
 
+`--dory-name` is intentionally **not** `--name`. Workspace commands use `--name` for the
+Kubernetes namespace (`hops local up|down|status|open|gitops worktree --name alice`).
+
 So you should **not** need:
 
 ```bash
@@ -291,8 +294,9 @@ export DOCKER_HOST=unix://$HOME/.dory/dory.sock
 ```
 
 ```bash
-hops local start --backend dory              # name defaults to hops-dory
-hops local start --backend dory --name mine  # custom kube+docker context name
+hops local start --backend dory                    # dory name defaults to hops-dory
+hops local start --backend dory --dory-name mine   # custom kube+docker context name
+hops local up ./gitops/envs/local --name alice     # workspace ns only; does not rename Dory
 
 kubectl get nodes          # context hops-dory
 docker info                # context hops-dory
diff --git a/src/commands/local/backend/dory.rs b/src/commands/local/backend/dory.rs
index 48efcc5..1773a01 100644
--- a/src/commands/local/backend/dory.rs
+++ b/src/commands/local/backend/dory.rs
@@ -483,7 +483,7 @@ pub const DEFAULT_CONTEXT_NAME: &str = "hops-dory";
 const NAME_FILE: &str = "dory-name";
 const NAME_ENV: &str = "HOPS_DORY_NAME";
 
-/// Resolved context name: `--name` (persisted) > `HOPS_DORY_NAME` > file > `hops-dory`.
+/// Resolved context name: `--dory-name` (persisted) > `HOPS_DORY_NAME` > file > `hops-dory`.
 pub fn context_name() -> String {
     if let Ok(v) = std::env::var(NAME_ENV) {
         let t = v.trim();
@@ -515,12 +515,12 @@ pub fn persist_context_name(name: &str) -> Result<(), Box<dyn Error>> {
 fn validate_context_name(name: &str) -> Result<String, Box<dyn Error>> {
     let name = name.trim();
     if name.is_empty() {
-        return Err("--name must not be empty".into());
+        return Err("--dory-name must not be empty".into());
     }
     // kubectl context names: keep it simple (no path separators / whitespace).
     if name.contains(['/', '\\', ' ', '\t', '\n', ':']) {
         return Err(format!(
-            "invalid --name '{name}': use a simple token (e.g. hops-dory)"
+            "invalid --dory-name '{name}': use a simple token (e.g. hops-dory)"
         )
         .into());
     }
@@ -545,7 +545,7 @@ pub fn desktop_integration_enabled() -> bool {
 
 /// Wire Dory into the normal developer desktop:
 /// - merge stock `~/.kube/dory-config` into `~/.kube/config` as context **`hops-dory`**
-///   (or `--name` / `HOPS_DORY_NAME`)
+///   (or `--dory-name` / `HOPS_DORY_NAME`)
 /// - `kubectl config use-context <name>`
 /// - ensure/use a docker context of the same name pointing at `~/.dory/dory.sock`
 ///
diff --git a/src/commands/local/backend/mod.rs b/src/commands/local/backend/mod.rs
index e0b2098..bfa9ce8 100644
--- a/src/commands/local/backend/mod.rs
+++ b/src/commands/local/backend/mod.rs
@@ -230,7 +230,7 @@ impl FromStr for Backend {
 
 const BACKEND_FILE: &str = "backend";
 
-/// Persist the Dory desktop context name (`--name`, default hops-dory).
+/// Persist the Dory desktop context name (`--dory-name`, default hops-dory).
 pub fn persist_dory_context_name(name: &str) -> Result<(), Box<dyn Error>> {
     dory::persist_context_name(name)
 }
diff --git a/src/commands/local/mod.rs b/src/commands/local/mod.rs
index 0974414..bbd92d6 100644
--- a/src/commands/local/mod.rs
+++ b/src/commands/local/mod.rs
@@ -115,11 +115,14 @@ pub struct LocalArgs {
     #[arg(long, global = true, value_enum)]
     pub backend: Option<backend::Backend>,
 
-    /// Name for Dory desktop integration (kube context + docker context).
+    /// Dory desktop integration name (kube context + docker context).
     /// Defaults to `hops-dory`. Persisted under `~/.hops/local/dory-name`.
     /// Only used with `--backend dory` (or a persisted dory backend).
-    #[arg(long, global = true, value_name = "NAME")]
-    pub name: Option<String>,
+    ///
+    /// Named `--dory-name` (not `--name`) so it never collides with workspace
+    /// `--name` on `hops local up|down|status|open|gitops worktree`.
+    #[arg(long = "dory-name", global = true, value_name = "NAME")]
+    pub dory_name: Option<String>,
 }
 
 #[derive(Subcommand, Debug)]
@@ -163,7 +166,12 @@ pub enum LocalCommands {
 }
 
 pub fn run(args: &LocalArgs) -> Result<(), Box<dyn Error>> {
-    if let Some(name) = args.name.as_deref().map(str::trim).filter(|s| !s.is_empty()) {
+    if let Some(name) = args
+        .dory_name
+        .as_deref()
+        .map(str::trim)
+        .filter(|s| !s.is_empty())
+    {
         backend::persist_dory_context_name(name)?;
     }
 
@@ -431,4 +439,71 @@ mod tests {
             vec!["repo", "update", "crossplane-stable"]
         );
     }
+
+    /// Regression: workspace `--name` must not populate Dory's `--dory-name`.
+    /// Dual workspaces (`up --name alice` then `up --name bob`) used to rewrite
+    /// the desktop kube/docker context and delete the real `dory` context.
+    #[test]
+    fn workspace_name_does_not_set_dory_name() {
+        use clap::Parser;
+
+        #[derive(Parser, Debug)]
+        #[command(name = "hops-local-test")]
+        struct Cli {
+            #[command(flatten)]
+            local: LocalArgs,
+        }
+
+        let parsed = Cli::try_parse_from([
+            "hops-local-test",
+            "up",
+            "./gitops/envs/local",
+            "--name",
+            "alice",
+            "--once",
+            "--no-cluster",
+        ])
+        .expect("parse up --name alice");
+        assert!(
+            parsed.local.dory_name.is_none(),
+            "workspace --name must not set dory_name; got {:?}",
+            parsed.local.dory_name
+        );
+        match parsed.local.command {
+            LocalCommands::Up(up) => {
+                assert_eq!(up.name.as_deref(), Some("alice"));
+                assert!(up.once);
+                assert!(up.no_cluster);
+            }
+            other => panic!("expected Up, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn dory_name_flag_is_distinct_from_workspace_name() {
+        use clap::Parser;
+
+        #[derive(Parser, Debug)]
+        #[command(name = "hops-local-test")]
+        struct Cli {
+            #[command(flatten)]
+            local: LocalArgs,
+        }
+
+        let parsed = Cli::try_parse_from([
+            "hops-local-test",
+            "--dory-name",
+            "mine",
+            "up",
+            "./env",
+            "--name",
+            "bob",
+        ])
+        .expect("parse --dory-name mine up --name bob");
+        assert_eq!(parsed.local.dory_name.as_deref(), Some("mine"));
+        match parsed.local.command {
+            LocalCommands::Up(up) => assert_eq!(up.name.as_deref(), Some("bob")),
+            other => panic!("expected Up, got {other:?}"),
+        }
+    }
 }
diff --git a/src/commands/local/workbench/reconcile.rs b/src/commands/local/workbench/reconcile.rs
index 554c1a1..10b0337 100644
--- a/src/commands/local/workbench/reconcile.rs
+++ b/src/commands/local/workbench/reconcile.rs
@@ -443,7 +443,75 @@ fn sanitize_release_name(name: &str) -> String {
     s.trim_matches('-').chars().take(53).collect()
 }
 
-fn ensure_namespace_on_docs(yaml: &str, namespace: &str) -> Result<String, Box<dyn Error>> {
+/// Kinds that are cluster-scoped (never get a namespace stamp).
+fn is_cluster_scoped_kind(kind: &str) -> bool {
+    matches!(
+        kind,
+        "Namespace"
+            | "ClusterRole"
+            | "ClusterRoleBinding"
+            | "CustomResourceDefinition"
+            | "ClusterProviderConfig"
+            | "ClusterSecretStore"
+            | "PriorityClass"
+            | "StorageClass"
+            | "PersistentVolume"
+            | "MutatingWebhookConfiguration"
+            | "ValidatingWebhookConfiguration"
+    )
+}
+
+/// Workload / app kinds that live in the worktree app namespace when the chart
+/// did not set `metadata.namespace`. Shared identity MRs (Project, Role,
+/// HumanUser, …) set their own namespace in the chart and are **not** rewritten.
+fn is_app_workload_kind(api_version: &str, kind: &str) -> bool {
+    // Core / apps workloads
+    if matches!(
+        kind,
+        "Deployment"
+            | "StatefulSet"
+            | "DaemonSet"
+            | "ReplicaSet"
+            | "Job"
+            | "CronJob"
+            | "Service"
+            | "ServiceAccount"
+            | "ConfigMap"
+            | "Secret"
+            | "PersistentVolumeClaim"
+            | "NetworkPolicy"
+            | "Ingress"
+            | "HorizontalPodAutoscaler"
+            | "PodDisruptionBudget"
+            | "Role"
+            | "RoleBinding"
+    ) {
+        // k8s rbac Role/RoleBinding use rbac.authorization.k8s.io — not Zitadel Role
+        if kind == "Role" || kind == "RoleBinding" {
+            return api_version.starts_with("rbac.authorization.k8s.io/");
+        }
+        return true;
+    }
+    // External Secrets (worktree OIDC secret materialization)
+    if kind == "ExternalSecret" {
+        return true;
+    }
+    // Worktree-scoped Zitadel OIDC app + instance Features (Login V2 for this UI)
+    if kind == "Oidc" && api_version.contains("application.zitadel") {
+        return true;
+    }
+    if kind == "Features" && api_version.contains("instance.zitadel") {
+        return true;
+    }
+    false
+}
+
+/// Stamp worktree namespace only onto app workloads that lack `metadata.namespace`.
+///
+/// Shared identity resources (e.g. Project/Role/HumanUser with
+/// `projectNamespace: default`) keep the namespace declared by the chart.
+/// Never overwrites an already-set namespace.
+pub fn ensure_namespace_on_docs(yaml: &str, namespace: &str) -> Result<String, Box<dyn Error>> {
     let mut out = Vec::new();
     for doc in split_yaml_docs_owned(yaml) {
         if doc.trim().is_empty() {
@@ -454,18 +522,27 @@ fn ensure_namespace_on_docs(yaml: &str, namespace: &str) -> Result<String, Box<d
             let kind = root
                 .get(Value::String("kind".into()))
                 .and_then(|v| v.as_str())
-                .unwrap_or("");
-            let cluster_scoped = matches!(
-                kind,
-                "Namespace" | "ClusterRole" | "ClusterRoleBinding" | "CustomResourceDefinition"
-            );
-            if !cluster_scoped {
-                let meta_key = Value::String("metadata".into());
-                if let Some(meta) = root.get_mut(&meta_key).and_then(|v| v.as_mapping_mut()) {
-                    meta.insert(
-                        Value::String("namespace".into()),
-                        Value::String(namespace.to_string()),
-                    );
+                .unwrap_or("")
+                .to_string();
+            let api_version = root
+                .get(Value::String("apiVersion".into()))
+                .and_then(|v| v.as_str())
+                .unwrap_or("")
+                .to_string();
+            if is_cluster_scoped_kind(&kind) {
+                out.push(serde_yaml::to_string(&value)?);
+                continue;
+            }
+            let meta_key = Value::String("metadata".into());
+            if let Some(meta) = root.get_mut(&meta_key).and_then(|v| v.as_mapping_mut()) {
+                let ns_key = Value::String("namespace".into());
+                let has_ns = meta
+                    .get(&ns_key)
+                    .and_then(|v| v.as_str())
+                    .map(|s| !s.is_empty())
+                    .unwrap_or(false);
+                if !has_ns && is_app_workload_kind(&api_version, &kind) {
+                    meta.insert(ns_key, Value::String(namespace.to_string()));
                 }
             }
         }
@@ -661,6 +738,114 @@ spec:
         let _ = std::fs::remove_dir_all(&dir);
     }
 
+    #[test]
+    fn ensure_namespace_stamps_workload_missing_ns_only() {
+        let yaml = r#"
+apiVersion: v1
+kind: Service
+metadata:
+  name: e2e-ui-ui
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: e2e-ui-ui
+  namespace: already-set
+---
+apiVersion: project.zitadel.m.crossplane.io/v1alpha1
+kind: Project
+metadata:
+  name: e2e-ui
+  namespace: default
+---
+apiVersion: project.zitadel.m.crossplane.io/v1alpha1
+kind: Role
+metadata:
+  name: e2e-role-user
+  namespace: default
+---
+apiVersion: user.zitadel.m.crossplane.io/v1alpha1
+kind: HumanUser
+metadata:
+  name: e2e-alice
+  namespace: default
+---
+apiVersion: application.zitadel.m.crossplane.io/v1alpha1
+kind: Oidc
+metadata:
+  name: e2e-ui-alice-web
+---
+apiVersion: instance.zitadel.m.crossplane.io/v1alpha1
+kind: Features
+metadata:
+  name: e2e-ui-login-v2
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: never-namespaced
+"#;
+        let out = ensure_namespace_on_docs(yaml, "alice").unwrap();
+        // Workload without ns → worktree
+        assert!(out.contains("name: e2e-ui-ui\n  namespace: alice") || out.contains("namespace: alice\n  name: e2e-ui-ui")
+            || (out.contains("kind: Service") && out.contains("namespace: alice")));
+        // Already set preserved
+        assert!(out.contains("namespace: already-set"));
+        // Shared identity preserved
+        let project_idx = out.find("kind: Project").unwrap();
+        let project_slice = &out[project_idx..project_idx + 200.min(out.len() - project_idx)];
+        assert!(
+            project_slice.contains("namespace: default"),
+            "Project must keep default ns, got: {project_slice}"
+        );
+        assert!(out.contains("name: e2e-role-user"));
+        assert!(out.contains("name: e2e-alice"));
+        // Oidc/Features missing ns → worktree (app-scoped)
+        let oidc_idx = out.find("kind: Oidc").unwrap();
+        let oidc_slice = &out[oidc_idx..];
+        assert!(
+            oidc_slice.contains("namespace: alice"),
+            "Oidc without ns should get worktree ns"
+        );
+        let feat_idx = out.find("kind: Features").unwrap();
+        assert!(
+            out[feat_idx..].contains("namespace: alice"),
+            "Features without ns should get worktree ns"
+        );
+        // Cluster-scoped: no namespace key forced
+        let cr_idx = out.find("kind: ClusterRole").unwrap();
+        let cr_doc = &out[cr_idx..];
+        // only this doc until end
+        assert!(
+            !cr_doc.lines().any(|l| l.trim() == "namespace: alice"),
+            "ClusterRole must not get worktree ns"
+        );
+    }
+
+    #[test]
+    fn ensure_namespace_dual_workspaces_preserve_shared_and_isolate_workloads() {
+        let shared = r#"
+apiVersion: project.zitadel.m.crossplane.io/v1alpha1
+kind: Project
+metadata:
+  name: e2e-ui
+  namespace: default
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: e2e-ui-ui
+"#;
+        let alice = ensure_namespace_on_docs(shared, "alice").unwrap();
+        let bob = ensure_namespace_on_docs(shared, "bob").unwrap();
+        assert!(alice.contains("namespace: default"));
+        assert!(bob.contains("namespace: default"));
+        assert!(alice.contains("namespace: alice"));
+        assert!(bob.contains("namespace: bob"));
+        assert!(!alice.contains("namespace: bob"));
+        assert!(!bob.contains("namespace: alice"));
+    }
+
     #[test]
     fn build_runtime_values_injects_delivery_host_path() {
         // Usual case: same worktree root for every app in the workspace.