diff --git a/packages/memory-host-sdk/src/host/embeddings-gemini.test.ts b/packages/memory-host-sdk/src/host/embeddings-gemini.test.ts
index 44bd508d3b7..3a6566ebf76 100644
--- a/packages/memory-host-sdk/src/host/embeddings-gemini.test.ts
+++ b/packages/memory-host-sdk/src/host/embeddings-gemini.test.ts
@@ -1,6 +1,5 @@
 import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
 import * as authModule from "../../../../src/agents/model-auth.js";
-import { mockPublicPinnedHostname } from "./test-helpers/ssrf.js";
 
 vi.mock("../../../../src/infra/net/fetch-guard.js", () => ({
   fetchWithSsrFGuard: async (params: {
@@ -101,7 +100,6 @@ async function createProviderWithFetch(
   options: Partial<Parameters<typeof createGeminiEmbeddingProvider>[0]> & { model: string },
 ) {
   installFetchMock(fetchMock as unknown as typeof globalThis.fetch);
-  mockPublicPinnedHostname();
   mockResolvedProviderKey();
   const { provider } = await createGeminiEmbeddingProvider({
     config: {} as never,
diff --git a/src/acp/client.test.ts b/src/acp/client.test.ts
index 89778da9ea5..f8b1c08c312 100644
--- a/src/acp/client.test.ts
+++ b/src/acp/client.test.ts
@@ -3,6 +3,24 @@ import path from "node:path";
 import type { RequestPermissionRequest } from "@agentclientprotocol/sdk";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { createTrackedTempDirs } from "../test-utils/tracked-temp-dirs.js";
+
+vi.mock("../secrets/provider-env-vars.js", () => ({
+  listKnownProviderAuthEnvVarNames: () => ["OPENAI_API_KEY", "GITHUB_TOKEN", "HF_TOKEN"],
+  omitEnvKeysCaseInsensitive: (
+    baseEnv: NodeJS.ProcessEnv,
+    keys: Iterable<string>,
+  ): NodeJS.ProcessEnv => {
+    const denied = new Set([...keys].map((key) => key.trim().toUpperCase()).filter(Boolean));
+    const env = { ...baseEnv };
+    for (const key of Object.keys(env)) {
+      if (denied.has(key.toUpperCase())) {
+        delete env[key];
+      }
+    }
+    return env;
+  },
+}));
+
 import {
   buildAcpClientStripKeys,
   resolveAcpClientSpawnEnv,
diff --git a/src/image-generation/runtime.test.ts b/src/image-generation/runtime.test.ts
index aec5191d45f..b8bffe8da65 100644
--- a/src/image-generation/runtime.test.ts
+++ b/src/image-generation/runtime.test.ts
@@ -353,13 +353,10 @@ describe("image-generation runtime", () => {
       return [];
     });
 
-    const promise = generateImage({ cfg: {} as OpenClawConfig, prompt: "draw a cat" });
-
-    await expect(promise).rejects.toThrow("No image-generation model configured.");
-    await expect(promise).rejects.toThrow(
-      'Set agents.defaults.imageGenerationModel.primary to a provider/model like "vision-one/paint-v1".',
+    await expect(
+      generateImage({ cfg: {} as OpenClawConfig, prompt: "draw a cat" }),
+    ).rejects.toThrow(
+      'No image-generation model configured. Set agents.defaults.imageGenerationModel.primary to a provider/model like "vision-one/paint-v1". If you want a specific provider, also configure that provider\'s auth/API key first (vision-one: VISION_ONE_API_KEY; vision-two: VISION_TWO_API_KEY).',
     );
-    await expect(promise).rejects.toThrow("vision-one: VISION_ONE_API_KEY");
-    await expect(promise).rejects.toThrow("vision-two: VISION_TWO_API_KEY");
   });
 });
diff --git a/src/video-generation/runtime.test.ts b/src/video-generation/runtime.test.ts
index f08a4ff3923..c4d993b4875 100644
--- a/src/video-generation/runtime.test.ts
+++ b/src/video-generation/runtime.test.ts
@@ -757,12 +757,10 @@ describe("video-generation runtime", () => {
     ]);
     mocks.getProviderEnvVars.mockReturnValue(["MOTION_ONE_API_KEY"]);
 
-    const promise = generateVideo({ cfg: {} as OpenClawConfig, prompt: "animate a cat" });
-
-    await expect(promise).rejects.toThrow("No video-generation model configured.");
-    await expect(promise).rejects.toThrow(
-      'Set agents.defaults.videoGenerationModel.primary to a provider/model like "motion-one/animate-v1".',
+    await expect(
+      generateVideo({ cfg: {} as OpenClawConfig, prompt: "animate a cat" }),
+    ).rejects.toThrow(
+      'No video-generation model configured. Set agents.defaults.videoGenerationModel.primary to a provider/model like "motion-one/animate-v1". If you want a specific provider, also configure that provider\'s auth/API key first (motion-one: MOTION_ONE_API_KEY).',
     );
-    await expect(promise).rejects.toThrow("motion-one: MOTION_ONE_API_KEY");
   });
 });
diff --git a/test/helpers/media-generation/runtime-module-mocks.ts b/test/helpers/media-generation/runtime-module-mocks.ts
index 521000d10ab..145f428c31c 100644
--- a/test/helpers/media-generation/runtime-module-mocks.ts
+++ b/test/helpers/media-generation/runtime-module-mocks.ts
@@ -72,14 +72,10 @@ vi.mock("../../../src/config/model-input.js", () => ({
 vi.mock("../../../src/logging/subsystem.js", () => ({
   createSubsystemLogger: mediaRuntimeMocks.createSubsystemLogger,
 }));
-vi.mock("../../../src/secrets/provider-env-vars.js", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("../../../src/secrets/provider-env-vars.js")>();
-  return {
-    ...actual,
-    getProviderEnvVars: mediaRuntimeMocks.getProviderEnvVars,
-    resolveProviderAuthEnvVarCandidates: mediaRuntimeMocks.resolveProviderAuthEnvVarCandidates,
-  };
-});
+vi.mock("../../../src/secrets/provider-env-vars.js", () => ({
+  getProviderEnvVars: mediaRuntimeMocks.getProviderEnvVars,
+  resolveProviderAuthEnvVarCandidates: mediaRuntimeMocks.resolveProviderAuthEnvVarCandidates,
+}));
 
 vi.mock("../../../src/image-generation/model-ref.js", () => ({
   parseImageGenerationModelRef: mediaRuntimeMocks.parseImageGenerationModelRef,