diff --git a/src/agents/model-auth-markers.ts b/src/agents/model-auth-markers.ts
index dbd782de1e9..63a65970379 100644
--- a/src/agents/model-auth-markers.ts
+++ b/src/agents/model-auth-markers.ts
@@ -1,5 +1,6 @@
 import type { SecretRefSource } from "../config/types.secrets.js";
-import { loadPluginManifestRegistry } from "../plugins/manifest-registry.js";
+import { loadPluginManifestRegistryForInstalledIndex } from "../plugins/manifest-registry-installed.js";
+import { loadPluginRegistrySnapshot } from "../plugins/plugin-registry.js";
 import { listKnownProviderEnvApiKeyNames } from "./model-auth-env-vars.js";
 
 export const MINIMAX_OAUTH_MARKER = "minimax-oauth";
@@ -44,14 +45,20 @@ function listKnownEnvApiKeyMarkers(): Set<string> {
 }
 
 export function listKnownNonSecretApiKeyMarkers(): string[] {
-  knownNonSecretApiKeyMarkersCache ??= [
-    ...new Set([
-      ...CORE_NON_SECRET_API_KEY_MARKERS,
-      ...loadPluginManifestRegistry({ cache: true }).plugins.flatMap((plugin) =>
-        plugin.origin === "bundled" ? (plugin.nonSecretAuthMarkers ?? []) : [],
-      ),
-    ]),
-  ];
+  knownNonSecretApiKeyMarkersCache ??= (() => {
+    const index = loadPluginRegistrySnapshot({});
+    return [
+      ...new Set([
+        ...CORE_NON_SECRET_API_KEY_MARKERS,
+        ...loadPluginManifestRegistryForInstalledIndex({
+          index,
+          includeDisabled: true,
+        }).plugins.flatMap((plugin) =>
+          plugin.origin === "bundled" ? (plugin.nonSecretAuthMarkers ?? []) : [],
+        ),
+      ]),
+    ];
+  })();
   return [...knownNonSecretApiKeyMarkersCache];
 }
 
diff --git a/src/plugins/provider-auth-choices.test.ts b/src/plugins/provider-auth-choices.test.ts
index 877f4f9f968..aba142d1f07 100644
--- a/src/plugins/provider-auth-choices.test.ts
+++ b/src/plugins/provider-auth-choices.test.ts
@@ -1,9 +1,17 @@
-import { describe, expect, it, vi } from "vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
 
-const loadPluginManifestRegistry = vi.hoisted(() => vi.fn());
+const pluginRegistryMocks = vi.hoisted(() => ({
+  loadPluginManifestRegistryForInstalledIndex: vi.fn(),
+  loadPluginRegistrySnapshot: vi.fn(() => ({ plugins: [] })),
+}));
 
-vi.mock("./manifest-registry.js", () => ({
-  loadPluginManifestRegistry,
+vi.mock("./manifest-registry-installed.js", () => ({
+  loadPluginManifestRegistryForInstalledIndex:
+    pluginRegistryMocks.loadPluginManifestRegistryForInstalledIndex,
+}));
+
+vi.mock("./plugin-registry.js", () => ({
+  loadPluginRegistrySnapshot: pluginRegistryMocks.loadPluginRegistrySnapshot,
 }));
 
 import {
@@ -26,7 +34,7 @@ function createProviderAuthChoice(overrides: Record<string, unknown>) {
 }
 
 function setManifestPlugins(plugins: Array<Record<string, unknown>>) {
-  loadPluginManifestRegistry.mockReturnValue({
+  pluginRegistryMocks.loadPluginManifestRegistryForInstalledIndex.mockReturnValue({
     plugins,
   });
 }
@@ -53,6 +61,15 @@ function setSingleManifestProviderAuthChoices(
 }
 
 describe("provider auth choice manifest helpers", () => {
+  beforeEach(() => {
+    pluginRegistryMocks.loadPluginManifestRegistryForInstalledIndex.mockReset();
+    pluginRegistryMocks.loadPluginManifestRegistryForInstalledIndex.mockReturnValue({
+      plugins: [],
+    });
+    pluginRegistryMocks.loadPluginRegistrySnapshot.mockReset();
+    pluginRegistryMocks.loadPluginRegistrySnapshot.mockReturnValue({ plugins: [] });
+  });
+
   it("flattens manifest auth choices", () => {
     setSingleManifestProviderAuthChoices("openai", [
       createProviderAuthChoice({
diff --git a/src/plugins/provider-auth-choices.ts b/src/plugins/provider-auth-choices.ts
index c2ed3e7827a..405aee62c2d 100644
--- a/src/plugins/provider-auth-choices.ts
+++ b/src/plugins/provider-auth-choices.ts
@@ -2,8 +2,10 @@ import { resolveProviderIdForAuth } from "../agents/provider-auth-aliases.js";
 import type { OpenClawConfig } from "../config/types.openclaw.js";
 import { sanitizeForLog } from "../terminal/ansi.js";
 import { normalizePluginsConfig, resolveEffectiveEnableState } from "./config-state.js";
-import { loadPluginManifestRegistry, type PluginManifestRecord } from "./manifest-registry.js";
+import { loadPluginManifestRegistryForInstalledIndex } from "./manifest-registry-installed.js";
+import type { PluginManifestRecord } from "./manifest-registry.js";
 import type { PluginOrigin } from "./plugin-origin.types.js";
+import { loadPluginRegistrySnapshot } from "./plugin-registry.js";
 
 export type ProviderAuthChoiceMetadata = {
   pluginId: string;
@@ -179,11 +181,18 @@ function resolveManifestProviderAuthChoiceCandidates(params?: {
   env?: NodeJS.ProcessEnv;
   includeUntrustedWorkspacePlugins?: boolean;
 }): ProviderAuthChoiceCandidate[] {
-  const registry = loadPluginManifestRegistry({
+  const index = loadPluginRegistrySnapshot({
     config: params?.config,
     workspaceDir: params?.workspaceDir,
     env: params?.env,
   });
+  const registry = loadPluginManifestRegistryForInstalledIndex({
+    index,
+    config: params?.config,
+    workspaceDir: params?.workspaceDir,
+    env: params?.env,
+    includeDisabled: true,
+  });
   const normalizedConfig = normalizePluginsConfig(params?.config?.plugins);
   return registry.plugins.flatMap((plugin) => {
     if (