diff --git a/.github/workflows/openclaw-performance.yml b/.github/workflows/openclaw-performance.yml
index aa63889148b0..e4a30f09da7d 100644
--- a/.github/workflows/openclaw-performance.yml
+++ b/.github/workflows/openclaw-performance.yml
@@ -45,7 +45,7 @@ on:
       kova_ref:
         description: openclaw/Kova Git ref to install
         required: false
-        default: b20d3b35118841db050a14f241098169aff4b9a2
+        default: 886a0005269de56632491cfac89bf55256fff778
         type: string
       dispatch_id:
         description: Optional parent workflow dispatch identifier
@@ -105,7 +105,7 @@ jobs:
             include_filters: "scenario:agent-cold-warm-message"
             expected_release_entries: "agent-cold-warm-message:mock-openai-provider"
     env:
-      KOVA_REF: ${{ inputs.kova_ref || 'b20d3b35118841db050a14f241098169aff4b9a2' }}
+      KOVA_REF: ${{ inputs.kova_ref || '886a0005269de56632491cfac89bf55256fff778' }}
       KOVA_HOME: ${{ github.workspace }}/.artifacts/kova/home/${{ matrix.lane }}
       PERFORMANCE_HELPER_DIR: ${{ github.workspace }}/.artifacts/performance-workflow
       REPORT_DIR: ${{ github.workspace }}/.artifacts/kova/reports/${{ matrix.lane }}
@@ -283,7 +283,7 @@ jobs:
           chmod 0755 "$HOME/.local/bin/kova"
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
-      - name: Allow live auth for OpenAI candidate state
+      - name: Prepare live OpenAI candidate state
         if: ${{ steps.lane.outputs.run == 'true' && matrix.live == 'true' }}
         shell: bash
         run: |
@@ -301,6 +301,19 @@ jobs:
           // This ephemeral checkout must honor the lane's explicit --auth live selection.
           state.auth.mode = "default";
           state.auth.reason = "Honor the workflow lane's explicit run-level auth selection.";
+          state.setup = [
+            ...(state.setup ?? []),
+            {
+              id: "force-openclaw-agent-runtime",
+              title: "Force OpenClaw Agent Runtime",
+              intent: "Keep live provider requests inside the OpenClaw harness for timeline evidence.",
+              afterPhase: "provision",
+              commands: [
+                "ocm @{env} -- config set models.providers.openai.agentRuntime.id openclaw"
+              ],
+              evidence: ["OpenAI provider runtime is pinned to the OpenClaw harness"]
+            }
+          ];
           fs.writeFileSync(file, `${JSON.stringify(state, null, 2)}\n`, "utf8");
           NODE
 
diff --git a/test/scripts/openclaw-performance-workflow.test.ts b/test/scripts/openclaw-performance-workflow.test.ts
index b95cc90fed7a..ffb53adf9894 100644
--- a/test/scripts/openclaw-performance-workflow.test.ts
+++ b/test/scripts/openclaw-performance-workflow.test.ts
@@ -55,7 +55,7 @@ describe("OpenClaw performance workflow", () => {
 
   it("pins the Kova evaluator that reads agent payloads", () => {
     const workflow = readFileSync(WORKFLOW, "utf8");
-    const kovaRef = "b20d3b35118841db050a14f241098169aff4b9a2";
+    const kovaRef = "886a0005269de56632491cfac89bf55256fff778";
 
     expect(workflow).toContain(`default: ${kovaRef}`);
     expect(workflow).toContain(`inputs.kova_ref || '${kovaRef}'`);
@@ -188,8 +188,8 @@ describe("OpenClaw performance workflow", () => {
     expect(sanity.run).not.toContain("--include scenario:fresh-install");
   });
 
-  it("makes the live lane honor explicit live auth in the ephemeral Kova checkout", () => {
-    const override = findStep("Allow live auth for OpenAI candidate state");
+  it("makes the live lane use live auth through the OpenClaw runtime", () => {
+    const override = findStep("Prepare live OpenAI candidate state");
 
     expect(override.if).toContain("matrix.live == 'true'");
     expect(override.run).toContain("states/mock-openai-provider.json");
@@ -201,6 +201,12 @@ describe("OpenClaw performance workflow", () => {
     expect(override.run).toContain(
       'state.auth.reason = "Honor the workflow lane\'s explicit run-level auth selection."',
     );
+    expect(override.run).toContain('id: "force-openclaw-agent-runtime"');
+    expect(override.run).toContain('afterPhase: "provision"');
+    expect(override.run).toContain(
+      "ocm @{env} -- config set models.providers.openai.agentRuntime.id openclaw",
+    );
+    expect(override.run).not.toContain("agents.defaults.agentRuntime");
   });
 
   it("runs the trusted lane evidence validator before tolerating gate failures", () => {