diff --git a/.github/workflows/mantis-slack-desktop-smoke.yml b/.github/workflows/mantis-slack-desktop-smoke.yml
index b6ede3f0ff3..0505ae464c8 100644
--- a/.github/workflows/mantis-slack-desktop-smoke.yml
+++ b/.github/workflows/mantis-slack-desktop-smoke.yml
@@ -22,6 +22,14 @@ on:
         required: false
         default: false
         type: boolean
+      crabbox_provider:
+        description: Crabbox provider for the desktop lease
+        required: false
+        default: aws
+        type: choice
+        options:
+          - aws
+          - hetzner
 
 permissions:
   contents: write
@@ -185,6 +193,7 @@ jobs:
           OPENCLAW_QA_MANTIS_CRABBOX_COORDINATOR_TOKEN: ${{ secrets.OPENCLAW_QA_MANTIS_CRABBOX_COORDINATOR_TOKEN }}
           CRABBOX_ACCESS_CLIENT_ID: ${{ secrets.CRABBOX_ACCESS_CLIENT_ID }}
           CRABBOX_ACCESS_CLIENT_SECRET: ${{ secrets.CRABBOX_ACCESS_CLIENT_SECRET }}
+          CRABBOX_PROVIDER: ${{ inputs.crabbox_provider }}
           KEEP_VM: ${{ inputs.keep_vm }}
           SCENARIO_ID: ${{ inputs.scenario_id }}
         shell: bash
@@ -215,12 +224,14 @@ jobs:
           keep_args=()
           if [[ "$KEEP_VM" == "true" ]]; then
             keep_args=(--keep-lease)
+          else
+            keep_args=(--no-keep-lease)
           fi
 
           pnpm openclaw qa mantis slack-desktop-smoke \
             --repo-root "$candidate_repo" \
             --output-dir "$output_rel" \
-            --provider hetzner \
+            --provider "$CRABBOX_PROVIDER" \
             --class standard \
             --idle-timeout 45m \
             --ttl 120m \
diff --git a/docs/concepts/mantis.md b/docs/concepts/mantis.md
index 825dc99b13e..6bfd68ca49c 100644
--- a/docs/concepts/mantis.md
+++ b/docs/concepts/mantis.md
@@ -156,6 +156,7 @@ Useful Slack desktop flags:
 
 - `--lease-id <cbx_...>` reruns against a machine where an operator already logged in to Slack Web through VNC.
 - `--gateway-setup` starts a persistent OpenClaw Slack gateway in the VM instead of only running the bot-to-bot QA lane.
+- `--keep-lease` keeps the gateway VM open for VNC inspection after success; `--no-keep-lease` stops it after collecting artifacts.
 - `--slack-url <url>` opens a specific Slack Web URL. Without it, Mantis derives `https://app.slack.com/client/<team>/<channel>` from Slack `auth.test` when the SUT bot token is available.
 - `--slack-channel-id <id>` controls the Slack channel allowlist used by gateway setup.
 - `OPENCLAW_MANTIS_SLACK_BROWSER_PROFILE_DIR` controls the persistent Chrome profile inside the VM. The default is `$HOME/.config/openclaw-mantis/slack-chrome-profile`, so a manual Slack Web login survives reruns on the same lease.
@@ -194,8 +195,10 @@ runs `pnpm openclaw qa mantis slack-desktop-smoke --gateway-setup` against that
 candidate, opens Slack Web in the VNC browser, records the desktop, generates a
 motion-trimmed preview with `crabbox media preview`, uploads the full artifact
 directory, and optionally posts the inline evidence comment on the target PR.
-Use this lane when you want "a Linux desktop with Slack and a claw running"
-instead of only a bot-to-bot Slack transcript.
+It defaults to AWS for the desktop lease and exposes a manual provider input so
+operators can switch to Hetzner when AWS capacity is slow or unavailable. Use
+this lane when you want "a Linux desktop with Slack and a claw running" instead
+of only a bot-to-bot Slack transcript.
 
 Every PR-publishing scenario writes `mantis-evidence.json` next to its report.
 This schema is the handoff between scenario code and GitHub comments:
diff --git a/extensions/qa-lab/src/mantis/cli.ts b/extensions/qa-lab/src/mantis/cli.ts
index dc51f86c62b..f89d3171673 100644
--- a/extensions/qa-lab/src/mantis/cli.ts
+++ b/extensions/qa-lab/src/mantis/cli.ts
@@ -273,6 +273,7 @@ export function registerMantisCli(qa: Command) {
     .option("--idle-timeout <duration>", "Crabbox idle timeout")
     .option("--ttl <duration>", "Crabbox maximum lease lifetime")
     .option("--keep-lease", "Keep a lease created by this run after a passing smoke")
+    .option("--no-keep-lease", "Stop a lease created by this run after a passing smoke")
     .option("--gateway-setup", "Start a persistent OpenClaw Slack gateway inside the VNC VM")
     .option("--slack-url <url>", "Slack web URL to open in the visible browser")
     .option("--slack-channel-id <id>", "Slack channel id for gateway setup allowlist")
diff --git a/extensions/qa-lab/src/mantis/slack-desktop-smoke.runtime.test.ts b/extensions/qa-lab/src/mantis/slack-desktop-smoke.runtime.test.ts
index ab1413c3cf9..d950e08515b 100644
--- a/extensions/qa-lab/src/mantis/slack-desktop-smoke.runtime.test.ts
+++ b/extensions/qa-lab/src/mantis/slack-desktop-smoke.runtime.test.ts
@@ -237,6 +237,7 @@ describe("mantis Slack desktop smoke runtime", () => {
         PATH: process.env.PATH,
       },
       gatewaySetup: true,
+      keepLease: false,
       now: () => new Date("2026-05-04T14:00:00.000Z"),
       outputDir: ".artifacts/qa-e2e/mantis/slack-desktop-convex",
       repoRoot,
@@ -264,6 +265,9 @@ describe("mantis Slack desktop smoke runtime", () => {
       "https://example.convex.site/qa-credentials/v1/acquire",
       "https://example.convex.site/qa-credentials/v1/release",
     ]);
+    expect(
+      commands.some((entry) => entry.command === "/tmp/crabbox" && entry.args[0] === "stop"),
+    ).toBe(true);
     const summary = JSON.parse(await fs.readFile(result.summaryPath, "utf8")) as {
       slackUrl: string;
     };