diff --git a/src/infra/tsdown-config.test.ts b/src/infra/tsdown-config.test.ts
index ac1a8c87272..25893d13e73 100644
--- a/src/infra/tsdown-config.test.ts
+++ b/src/infra/tsdown-config.test.ts
@@ -81,6 +81,13 @@ function readGatewayRunLoopSource(): string {
   return readFileSync(new URL("../cli/gateway-cli/run-loop.ts", import.meta.url), "utf8");
 }
 
+function readPiModelDiscoveryCacheSource(): string {
+  return readFileSync(
+    new URL("../agents/pi-embedded-runner/model-discovery-cache.ts", import.meta.url),
+    "utf8",
+  );
+}
+
 describe("tsdown config", () => {
   it("keeps core, plugin runtime, plugin-sdk, bundled root plugins, and bundled hooks in one dist graph", () => {
     const distGraph = requireUnifiedDistGraph();
@@ -105,6 +112,7 @@ describe("tsdown config", () => {
       "plugins/provider-discovery.runtime",
       "plugins/provider-runtime.runtime",
       "plugins/runtime/index",
+      "plugins/synthetic-auth.runtime",
       "web-fetch/runtime",
       "plugin-sdk/compat",
       "plugin-sdk/index",
@@ -149,6 +157,20 @@ describe("tsdown config", () => {
     );
   });
 
+  it("keeps PI model discovery synthetic auth refs behind one stable runtime dist entry", () => {
+    const distGraph = requireUnifiedDistGraph();
+    const importSpecifiers = [
+      ...readPiModelDiscoveryCacheSource().matchAll(
+        /from ["']([^"']*synthetic-auth\.runtime\.js)["']/gu,
+      ),
+    ].map((match) => match[1]);
+
+    expect(importSpecifiers).toEqual(["../../plugins/synthetic-auth.runtime.js"]);
+    expect(entrySources(distGraph)["plugins/synthetic-auth.runtime"]).toBe(
+      "src/plugins/synthetic-auth.runtime.ts",
+    );
+  });
+
   it("keeps Telegram ingress worker behind one root stable dist entry", () => {
     const distGraph = requireUnifiedDistGraph();
 
diff --git a/tsdown.config.ts b/tsdown.config.ts
index 06941873b5d..fb8ed496577 100644
--- a/tsdown.config.ts
+++ b/tsdown.config.ts
@@ -239,6 +239,7 @@ function buildCoreDistEntries(): Record<string, string> {
     "server-close.runtime": "src/gateway/server-close.runtime.ts",
     "plugins/hook-runner-global": "src/plugins/hook-runner-global.ts",
     "plugins/memory-state": "src/plugins/memory-state.ts",
+    "plugins/synthetic-auth.runtime": "src/plugins/synthetic-auth.runtime.ts",
     "subagent-registry.runtime": "src/agents/subagent-registry.runtime.ts",
     "task-registry-control.runtime": "src/tasks/task-registry-control.runtime.ts",
     "agents/pi-model-discovery-runtime": "src/agents/pi-model-discovery-runtime.ts",