diff --git a/src/agents/models-config.providers.qianfan.test.ts b/src/agents/models-config.providers.qianfan.test.ts
index e7161c9e873..3d5979f890d 100644
--- a/src/agents/models-config.providers.qianfan.test.ts
+++ b/src/agents/models-config.providers.qianfan.test.ts
@@ -1,4 +1,4 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { beforeAll, describe, expect, it, vi } from "vitest";
 
 async function resetProviderRuntimeState() {
   const [
@@ -15,26 +15,21 @@ async function resetProviderRuntimeState() {
   resetProviderRuntimeHookCacheForTest();
 }
 
+let createProviderAuthResolver: typeof import("./models-config.providers.secrets.js").createProviderAuthResolver;
+
 async function loadSecretsModule() {
   vi.doUnmock("../plugins/manifest-registry.js");
   vi.doUnmock("../plugins/provider-runtime.js");
   vi.doUnmock("../secrets/provider-env-vars.js");
   vi.resetModules();
   await resetProviderRuntimeState();
-  return import("./models-config.providers.secrets.js");
+  ({ createProviderAuthResolver } = await import("./models-config.providers.secrets.js"));
 }
 
-beforeEach(async () => {
-  vi.doUnmock("../plugins/manifest-registry.js");
-  vi.doUnmock("../plugins/provider-runtime.js");
-  vi.doUnmock("../secrets/provider-env-vars.js");
-  vi.resetModules();
-  await resetProviderRuntimeState();
-});
+beforeAll(loadSecretsModule);
 
 describe("Qianfan provider", () => {
-  it("resolves QIANFAN_API_KEY markers through provider auth lookup", async () => {
-    const { createProviderAuthResolver } = await loadSecretsModule();
+  it("resolves QIANFAN_API_KEY markers through provider auth lookup", () => {
     const resolveAuth = createProviderAuthResolver(
       {
         QIANFAN_API_KEY: "test-key", // pragma: allowlist secret
diff --git a/src/agents/models-config.providers.vercel-ai-gateway.test.ts b/src/agents/models-config.providers.vercel-ai-gateway.test.ts
index 2f746cd333c..ea3a7c67e17 100644
--- a/src/agents/models-config.providers.vercel-ai-gateway.test.ts
+++ b/src/agents/models-config.providers.vercel-ai-gateway.test.ts
@@ -1,25 +1,25 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { beforeAll, describe, expect, it, vi } from "vitest";
+
+let NON_ENV_SECRETREF_MARKER: typeof import("./model-auth-markers.js").NON_ENV_SECRETREF_MARKER;
+let createProviderAuthResolver: typeof import("./models-config.providers.secrets.js").createProviderAuthResolver;
 
 async function loadModules() {
   vi.doUnmock("../plugins/manifest-registry.js");
   vi.doUnmock("../plugins/provider-runtime.js");
   vi.doUnmock("../secrets/provider-env-vars.js");
   vi.resetModules();
-  return Promise.all([
+  const [markersModule, secretsModule] = await Promise.all([
     import("./model-auth-markers.js"),
     import("./models-config.providers.secrets.js"),
   ]);
+  NON_ENV_SECRETREF_MARKER = markersModule.NON_ENV_SECRETREF_MARKER;
+  createProviderAuthResolver = secretsModule.createProviderAuthResolver;
 }
 
-beforeEach(() => {
-  vi.doUnmock("../plugins/manifest-registry.js");
-  vi.doUnmock("../plugins/provider-runtime.js");
-  vi.doUnmock("../secrets/provider-env-vars.js");
-});
+beforeAll(loadModules);
 
 describe("vercel-ai-gateway provider resolution", () => {
-  it("resolves AI_GATEWAY_API_KEY through provider auth lookup", async () => {
-    const [, { createProviderAuthResolver }] = await loadModules();
+  it("resolves AI_GATEWAY_API_KEY through provider auth lookup", () => {
     const resolveAuth = createProviderAuthResolver(
       {
         AI_GATEWAY_API_KEY: "vercel-gateway-test-key", // pragma: allowlist secret
@@ -34,8 +34,7 @@ describe("vercel-ai-gateway provider resolution", () => {
     });
   });
 
-  it("prefers env keyRef markers over runtime plaintext in auth profiles", async () => {
-    const [, { createProviderAuthResolver }] = await loadModules();
+  it("prefers env keyRef markers over runtime plaintext in auth profiles", () => {
     const resolveAuth = createProviderAuthResolver({} as NodeJS.ProcessEnv, {
       version: 1,
       profiles: {
@@ -56,8 +55,7 @@ describe("vercel-ai-gateway provider resolution", () => {
     });
   });
 
-  it("uses non-env markers for non-env keyRef vercel profiles", async () => {
-    const [{ NON_ENV_SECRETREF_MARKER }, { createProviderAuthResolver }] = await loadModules();
+  it("uses non-env markers for non-env keyRef vercel profiles", () => {
     const resolveAuth = createProviderAuthResolver({} as NodeJS.ProcessEnv, {
       version: 1,
       profiles: {
diff --git a/src/agents/models-config.providers.volcengine-byteplus.test.ts b/src/agents/models-config.providers.volcengine-byteplus.test.ts
index af00c70fead..d6a9aca74f8 100644
--- a/src/agents/models-config.providers.volcengine-byteplus.test.ts
+++ b/src/agents/models-config.providers.volcengine-byteplus.test.ts
@@ -1,20 +1,18 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { beforeAll, describe, expect, it, vi } from "vitest";
+
+let createProviderAuthResolver: typeof import("./models-config.providers.secrets.js").createProviderAuthResolver;
 
 async function loadSecretsModule() {
   vi.doUnmock("../plugins/manifest-registry.js");
   vi.doUnmock("../secrets/provider-env-vars.js");
   vi.resetModules();
-  return import("./models-config.providers.secrets.js");
+  ({ createProviderAuthResolver } = await import("./models-config.providers.secrets.js"));
 }
 
-beforeEach(() => {
-  vi.doUnmock("../plugins/manifest-registry.js");
-  vi.doUnmock("../secrets/provider-env-vars.js");
-});
+beforeAll(loadSecretsModule);
 
 describe("Volcengine and BytePlus providers", () => {
-  it("shares VOLCANO_ENGINE_API_KEY across volcengine auth aliases", async () => {
-    const { createProviderAuthResolver } = await loadSecretsModule();
+  it("shares VOLCANO_ENGINE_API_KEY across volcengine auth aliases", () => {
     const resolveAuth = createProviderAuthResolver(
       {
         VOLCANO_ENGINE_API_KEY: "test-key", // pragma: allowlist secret
@@ -34,8 +32,7 @@ describe("Volcengine and BytePlus providers", () => {
     });
   });
 
-  it("shares BYTEPLUS_API_KEY across byteplus auth aliases", async () => {
-    const { createProviderAuthResolver } = await loadSecretsModule();
+  it("shares BYTEPLUS_API_KEY across byteplus auth aliases", () => {
     const resolveAuth = createProviderAuthResolver(
       {
         BYTEPLUS_API_KEY: "test-key", // pragma: allowlist secret
@@ -55,8 +52,7 @@ describe("Volcengine and BytePlus providers", () => {
     });
   });
 
-  it("reuses env keyRef markers from auth profiles for paired providers", async () => {
-    const { createProviderAuthResolver } = await loadSecretsModule();
+  it("reuses env keyRef markers from auth profiles for paired providers", () => {
     const resolveAuth = createProviderAuthResolver({} as NodeJS.ProcessEnv, {
       version: 1,
       profiles: {
diff --git a/src/agents/models-config.write-serialization.test.ts b/src/agents/models-config.write-serialization.test.ts
index c0666a7fb54..d8d2101a980 100644
--- a/src/agents/models-config.write-serialization.test.ts
+++ b/src/agents/models-config.write-serialization.test.ts
@@ -1,6 +1,6 @@
 import fs from "node:fs/promises";
 import path from "node:path";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
 import {
   CUSTOM_PROXY_MODELS_CONFIG,
   installModelsConfigTestHooks,
@@ -14,18 +14,20 @@ installModelsConfigTestHooks();
 
 let ensureOpenClawModelsJson: typeof import("./models-config.js").ensureOpenClawModelsJson;
 
-beforeEach(async () => {
-  vi.resetModules();
+beforeAll(async () => {
+  vi.doMock("./models-config.plan.js", () => ({
+    planOpenClawModelsJson: (...args: unknown[]) => planOpenClawModelsJsonMock(...args),
+  }));
+  ({ ensureOpenClawModelsJson } = await import("./models-config.js"));
+});
+
+beforeEach(() => {
   planOpenClawModelsJsonMock
     .mockReset()
     .mockImplementation(async (params: { cfg?: typeof CUSTOM_PROXY_MODELS_CONFIG }) => ({
       action: "write",
       contents: `${JSON.stringify({ providers: params.cfg?.models?.providers ?? {} }, null, 2)}\n`,
     }));
-  vi.doMock("./models-config.plan.js", () => ({
-    planOpenClawModelsJson: (...args: unknown[]) => planOpenClawModelsJsonMock(...args),
-  }));
-  ({ ensureOpenClawModelsJson } = await import("./models-config.js"));
 });
 
 describe("models-config write serialization", () => {
diff --git a/src/agents/pi-model-discovery.synthetic-auth.test.ts b/src/agents/pi-model-discovery.synthetic-auth.test.ts
index f8f1612840e..d2634a6f455 100644
--- a/src/agents/pi-model-discovery.synthetic-auth.test.ts
+++ b/src/agents/pi-model-discovery.synthetic-auth.test.ts
@@ -1,7 +1,7 @@
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
 import { saveAuthProfileStore } from "./auth-profiles.js";
 
 const resolveRuntimeSyntheticAuthProviderRefs = vi.hoisted(() => vi.fn(() => ["claude-cli"]));
@@ -30,6 +30,8 @@ vi.mock("../plugins/provider-runtime.js", () => ({
   resolveExternalAuthProfilesWithPlugins: () => [],
 }));
 
+let discoverAuthStorage: typeof import("./pi-model-discovery.js").discoverAuthStorage;
+
 async function withAgentDir(run: (agentDir: string) => Promise<void>): Promise<void> {
   const agentDir = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-pi-synthetic-auth-"));
   try {
@@ -40,8 +42,11 @@ async function withAgentDir(run: (agentDir: string) => Promise<void>): Promise<v
 }
 
 describe("pi model discovery synthetic auth", () => {
+  beforeAll(async () => {
+    ({ discoverAuthStorage } = await import("./pi-model-discovery.js"));
+  });
+
   beforeEach(() => {
-    vi.resetModules();
     resolveRuntimeSyntheticAuthProviderRefs.mockClear();
     resolveProviderSyntheticAuthWithPlugin.mockClear();
   });
@@ -60,7 +65,6 @@ describe("pi model discovery synthetic auth", () => {
         agentDir,
       );
 
-      const { discoverAuthStorage } = await import("./pi-model-discovery.js");
       const authStorage = discoverAuthStorage(agentDir);
 
       expect(resolveRuntimeSyntheticAuthProviderRefs).toHaveBeenCalled();