diff --git a/lib/core/documents/__tests__/document-service.test.ts b/lib/core/documents/__tests__/document-service.test.ts
index ff7ffa54..db29c588 100644
--- a/lib/core/documents/__tests__/document-service.test.ts
+++ b/lib/core/documents/__tests__/document-service.test.ts
@@ -43,9 +43,8 @@ function makeClient(storageOverrides: Record<string, unknown> = {}) {
   }
 }
 
-// Keep createServiceClient mock since ensureDocumentsBucket still uses it
-vi.mock('@/lib/supabase/server', () => ({
-  createServiceClient: vi.fn(async () => makeClient()),
+vi.mock('@/lib/auth/api-keys', () => ({
+  createServiceClientNoCookies: vi.fn(() => makeClient()),
 }))
 
 import { uploadDocument, createNewVersion, verifyIntegrity, _resetBucketVerified } from '../document-service'
diff --git a/lib/core/documents/document-service.ts b/lib/core/documents/document-service.ts
index 362a4165..afebcf56 100644
--- a/lib/core/documents/document-service.ts
+++ b/lib/core/documents/document-service.ts
@@ -1,5 +1,5 @@
 import type { SupabaseClient } from '@supabase/supabase-js'
-import { createServiceClient } from '@/lib/supabase/server'
+import { createServiceClientNoCookies } from '@/lib/auth/api-keys'
 import { eventBus } from '@/lib/events'
 import type { DocumentAttachment, DocumentUploadSource } from '@/types'
 
@@ -21,15 +21,19 @@ export function _resetBucketVerified() {
 /**
  * Ensure the 'documents' storage bucket exists, creating it if missing.
  * Runs once per process lifetime (same pattern as ensureInitialized).
+ *
+ * Uses a cookieless service-role client for bucket admin operations
+ * (getBucket/createBucket require service-role). This avoids the cookie
+ * dependency that hangs in API-key auth contexts (e.g. MCP server).
  */
 async function ensureDocumentsBucket(): Promise<void> {
   if (bucketVerified) return
 
-  const supabase = await createServiceClient()
-  const { data: bucket } = await supabase.storage.getBucket('documents')
+  const serviceClient = createServiceClientNoCookies()
+  const { data: bucket } = await serviceClient.storage.getBucket('documents')
 
   if (!bucket) {
-    await supabase.storage.createBucket('documents', {
+    await serviceClient.storage.createBucket('documents', {
       public: false,
       fileSizeLimit: 52428800, // 50 MB
     })