diff --git a/src/config/redact-snapshot.raw.ts b/src/config/redact-snapshot.raw.ts
index 9f6f78a6724..ab063de8105 100644
--- a/src/config/redact-snapshot.raw.ts
+++ b/src/config/redact-snapshot.raw.ts
@@ -6,7 +6,10 @@ export function replaceSensitiveValuesInRaw(params: {
   sensitiveValues: string[];
   redactedSentinel: string;
 }): string {
-  const values = [...params.sensitiveValues].toSorted((a, b) => b.length - a.length);
+  // FIX #41247: Filter out empty strings to prevent RangeError
+  const values = [...params.sensitiveValues]
+    .filter((v) => v && v.length > 0)
+    .toSorted((a, b) => b.length - a.length);
   let result = params.raw;
   for (const value of values) {
     result = result.replaceAll(value, params.redactedSentinel);
diff --git a/src/gateway/server-cron.ts b/src/gateway/server-cron.ts
index 1f1cd1f5359..6a76e6043d1 100644
--- a/src/gateway/server-cron.ts
+++ b/src/gateway/server-cron.ts
@@ -292,7 +292,10 @@ export function buildGatewayCronService(params: {
         abortSignal,
         agentId,
         sessionKey: `cron:${job.id}`,
-        lane: "cron",
+        // FIX #41266: Use subagent lane to avoid deadlock with cron lane
+        // The outer enqueueRun already holds CommandLane.Cron; using "cron"
+        // here would cause deadlock since cron lane has concurrency=1.
+        lane: "subagent",
       });
     },
     sendCronFailureAlert: async ({ job, text, channel, to, mode, accountId }) => {