diff --git a/scripts/test-projects.test-support.mjs b/scripts/test-projects.test-support.mjs
index 7ba582b1395..bf1289a6945 100644
--- a/scripts/test-projects.test-support.mjs
+++ b/scripts/test-projects.test-support.mjs
@@ -259,6 +259,10 @@ const SOURCE_TEST_TARGETS = new Map([
     "src/plugins/provider-auth-choice.ts",
     ["src/commands/auth-choice.apply.plugin-provider.test.ts", "src/commands/auth-choice.test.ts"],
   ],
+  [
+    "src/secrets/provider-env-vars.ts",
+    ["src/secrets/provider-env-vars.dynamic.test.ts", "src/secrets/provider-env-vars.test.ts"],
+  ],
   [
     "src/memory-host-sdk/host/embedding-defaults.ts",
     ["src/memory-host-sdk/host/embeddings.test.ts"],
diff --git a/src/secrets/provider-env-vars.dynamic.test.ts b/src/secrets/provider-env-vars.dynamic.test.ts
index 103216954f1..ca92f270323 100644
--- a/src/secrets/provider-env-vars.dynamic.test.ts
+++ b/src/secrets/provider-env-vars.dynamic.test.ts
@@ -137,6 +137,27 @@ describe("provider env vars dynamic manifest metadata", () => {
     expect(loadPluginManifestRegistry).toHaveBeenCalledTimes(initialLoads);
   });
 
+  it("reuses the lazy default lookup cache for repeated provider env var reads", async () => {
+    loadPluginManifestRegistry.mockReturnValue({
+      plugins: [
+        {
+          id: "external-fireworks",
+          origin: "global",
+          providerAuthEnvVars: {
+            fireworks: ["FIREWORKS_ALT_API_KEY"],
+          },
+        },
+      ],
+      diagnostics: [],
+    });
+
+    expect(getProviderEnvVars("fireworks")).toEqual(["FIREWORKS_ALT_API_KEY"]);
+    const initialLoads = loadPluginManifestRegistry.mock.calls.length;
+    expect(initialLoads).toBeGreaterThan(0);
+    expect(getProviderEnvVars("fireworks")).toEqual(["FIREWORKS_ALT_API_KEY"]);
+    expect(loadPluginManifestRegistry).toHaveBeenCalledTimes(initialLoads);
+  });
+
   it("keeps workspace plugin env vars in default lookups", async () => {
     loadPluginManifestRegistry.mockReturnValue({
       plugins: [
diff --git a/src/secrets/provider-env-vars.ts b/src/secrets/provider-env-vars.ts
index 962e4140eab..bccfd7c5089 100644
--- a/src/secrets/provider-env-vars.ts
+++ b/src/secrets/provider-env-vars.ts
@@ -206,7 +206,7 @@ export function getProviderEnvVars(
   providerId: string,
   params?: ProviderEnvVarLookupParams,
 ): string[] {
-  const providerEnvVars = resolveProviderEnvVars(params);
+  const providerEnvVars = params ? resolveProviderEnvVars(params) : PROVIDER_ENV_VARS;
   const envVars = Object.hasOwn(providerEnvVars, providerId)
     ? providerEnvVars[providerId]
     : undefined;
diff --git a/test/scripts/test-projects.test.ts b/test/scripts/test-projects.test.ts
index d2e8ad04b4b..d6fdaa3b3e6 100644
--- a/test/scripts/test-projects.test.ts
+++ b/test/scripts/test-projects.test.ts
@@ -349,6 +349,16 @@ describe("scripts/test-projects changed-target routing", () => {
     });
   });
 
+  it("routes provider env var edits to focused secret tests", () => {
+    expect(resolveChangedTestTargetPlan(["src/secrets/provider-env-vars.ts"])).toEqual({
+      mode: "targets",
+      targets: [
+        "src/secrets/provider-env-vars.dynamic.test.ts",
+        "src/secrets/provider-env-vars.test.ts",
+      ],
+    });
+  });
+
   it("routes changed utils and shared files to their light scoped lanes", () => {
     const plans = buildVitestRunPlans(["--changed", "origin/main"], process.cwd(), () => [
       "src/shared/string-normalization.ts",