diff --git a/extensions/line/src/accounts.ts b/extensions/line/src/accounts.ts
index 02c424c3159..4304386649b 100644
--- a/extensions/line/src/accounts.ts
+++ b/extensions/line/src/accounts.ts
@@ -5,7 +5,7 @@ import {
 } from "openclaw/plugin-sdk/account-id";
 import type { OpenClawConfig } from "openclaw/plugin-sdk/account-resolution";
 import { resolveAccountEntry } from "openclaw/plugin-sdk/account-resolution";
-import { tryReadSecretFileSync } from "openclaw/plugin-sdk/infra-runtime";
+import { tryReadSecretFileSync } from "openclaw/plugin-sdk/core";
 import type {
   LineAccountConfig,
   LineConfig,
diff --git a/extensions/telegram/src/account-inspect.ts b/extensions/telegram/src/account-inspect.ts
index 47c6183fb8b..b599e2870da 100644
--- a/extensions/telegram/src/account-inspect.ts
+++ b/extensions/telegram/src/account-inspect.ts
@@ -1,7 +1,7 @@
 import { resolveAccountWithDefaultFallback } from "openclaw/plugin-sdk/account-resolution";
 import type { OpenClawConfig } from "openclaw/plugin-sdk/config-runtime";
 import { coerceSecretRef } from "openclaw/plugin-sdk/config-runtime";
-import { tryReadSecretFileSync } from "openclaw/plugin-sdk/infra-runtime";
+import { tryReadSecretFileSync } from "openclaw/plugin-sdk/core";
 import { resolveDefaultSecretProviderAlias } from "openclaw/plugin-sdk/provider-auth";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/routing";
 import {
diff --git a/extensions/telegram/src/token.ts b/extensions/telegram/src/token.ts
index 011dab257b5..4f38d1a9f63 100644
--- a/extensions/telegram/src/token.ts
+++ b/extensions/telegram/src/token.ts
@@ -1,7 +1,7 @@
 import { resolveNormalizedAccountEntry } from "openclaw/plugin-sdk/account-resolution";
 import type { BaseTokenResolution } from "openclaw/plugin-sdk/channel-contract";
 import type { OpenClawConfig } from "openclaw/plugin-sdk/config-runtime";
-import { tryReadSecretFileSync } from "openclaw/plugin-sdk/infra-runtime";
+import { tryReadSecretFileSync } from "openclaw/plugin-sdk/core";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/routing";
 import { normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import type { TelegramAccountConfig } from "../runtime-api.js";
diff --git a/extensions/tlon/src/urbit/base-url.ts b/extensions/tlon/src/urbit/base-url.ts
index 61674b23321..e917949e0a9 100644
--- a/extensions/tlon/src/urbit/base-url.ts
+++ b/extensions/tlon/src/urbit/base-url.ts
@@ -1,4 +1,4 @@
-import { isBlockedHostnameOrIp } from "openclaw/plugin-sdk/infra-runtime";
+import { isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 
 export type UrbitBaseUrlValidation =
   | { ok: true; baseUrl: string; hostname: string }