diff --git a/src/plugins/provider-auth-choice.ts b/src/plugins/provider-auth-choice.ts
index 36d554f8eb9..75dcde3b831 100644
--- a/src/plugins/provider-auth-choice.ts
+++ b/src/plugins/provider-auth-choice.ts
@@ -17,6 +17,10 @@ import {
   pickAuthMethod,
   resolveProviderMatch,
 } from "./provider-auth-choice-helpers.js";
+import {
+  resolveManifestProviderAuthChoice,
+  type ProviderAuthChoiceMetadata,
+} from "./provider-auth-choices.js";
 import { applyAuthProfileConfig } from "./provider-auth-helpers.js";
 import { resolveProviderInstallCatalogEntry } from "./provider-install-catalog.js";
 import { createVpsAwareOAuthHandlers } from "./provider-oauth-flow.js";
@@ -154,6 +158,20 @@ async function loadPluginProviderRuntime() {
   return await providerAuthChoiceDeps.loadPluginProviderRuntime();
 }
 
+function resolveManifestAuthChoiceScope(params: {
+  authChoice: string;
+  config: OpenClawConfig;
+  workspaceDir: string;
+  env?: NodeJS.ProcessEnv;
+}): ProviderAuthChoiceMetadata | undefined {
+  return resolveManifestProviderAuthChoice(params.authChoice, {
+    config: params.config,
+    workspaceDir: params.workspaceDir,
+    env: params.env,
+    includeUntrustedWorkspacePlugins: false,
+  });
+}
+
 export const __testing = {
   resetDepsForTest(): void {
     providerAuthChoiceDeps = defaultProviderAuthChoiceDeps;
@@ -258,6 +276,12 @@ export async function applyAuthChoiceLoadedPluginProvider(
   let enabledConfig = params.config;
   const { resolvePluginProviders, resolveProviderPluginChoice, runProviderModelSelectedHook } =
     await loadPluginProviderRuntime();
+  const manifestAuthChoice = resolveManifestAuthChoiceScope({
+    authChoice: params.authChoice,
+    config: nextConfig,
+    workspaceDir,
+    env: params.env,
+  });
   const installCatalogEntry = resolveProviderInstallCatalogEntry(params.authChoice, {
     config: nextConfig,
     workspaceDir,
@@ -282,6 +306,12 @@ export async function applyAuthChoiceLoadedPluginProvider(
     workspaceDir,
     env: params.env,
     mode: "setup",
+    ...(manifestAuthChoice
+      ? {
+          onlyPluginIds: [manifestAuthChoice.pluginId],
+          providerRefs: [manifestAuthChoice.providerId],
+        }
+      : {}),
   });
   let resolved = resolveProviderPluginChoice({
     providers,
@@ -313,6 +343,12 @@ export async function applyAuthChoiceLoadedPluginProvider(
       workspaceDir,
       env: params.env,
       mode: "setup",
+      ...(manifestAuthChoice
+        ? {
+            onlyPluginIds: [manifestAuthChoice.pluginId],
+            providerRefs: [manifestAuthChoice.providerId],
+          }
+        : {}),
     });
     resolved = resolveProviderPluginChoice({
       providers,