diff --git a/src/llama_stack/cli/stack/run.py b/src/llama_stack/cli/stack/run.py
index 73d8d13d54..cd35b5659d 100644
--- a/src/llama_stack/cli/stack/run.py
+++ b/src/llama_stack/cli/stack/run.py
@@ -176,8 +176,17 @@ def _run_stack_run_cmd(self, args: argparse.Namespace) -> None:
             try:
                 config = parse_and_maybe_upgrade_config(config_dict)
                 # Create external_providers_dir if it's specified and doesn't exist
-                if config.external_providers_dir and not os.path.exists(str(config.external_providers_dir)):
-                    os.makedirs(str(config.external_providers_dir), exist_ok=True)
+                if config.external_providers_dir is not None:
+                    ext_dir = Path(config.external_providers_dir)
+                    if not ext_dir.exists():
+                        try:
+                            logger.info(f"Creating external providers directory: {ext_dir}")
+                            ext_dir.mkdir(parents=True, exist_ok=True)
+                        except (OSError, PermissionError) as e:
+                            self.parser.error(
+                                f"Failed to create external_providers_dir '{ext_dir}': {e}\n"
+                                f"Please ensure you have write permissions or specify a different path."
+                            )
             except AttributeError as e:
                 self.parser.error(f"failed to parse config file '{config_file}':\n {e}")
 
diff --git a/src/llama_stack/core/stack.py b/src/llama_stack/core/stack.py
index 2ed0eccd2a..c6ecf79b93 100644
--- a/src/llama_stack/core/stack.py
+++ b/src/llama_stack/core/stack.py
@@ -309,6 +309,9 @@ def _convert_string_to_proper_type(value: str) -> Any:
     # providers config should be typed this way.
     # TODO: we could try to load the config class and see if the config has a field with type 'str | None'
     # and then convert the empty string to None or not
+    # NOTE: Empty strings from env var defaults (e.g., ${VAR:=}) are converted to None.
+    # Code that uses these values MUST check for None explicitly (not just truthiness)
+    # to avoid converting None to the string "None" later.
     if value == "":
         return None