diff --git a/src/secrets/runtime-nextcloud-talk-file-precedence.test.ts b/src/secrets/runtime-nextcloud-talk-file-precedence.test.ts
index ba9d6a9a867..e3e75bf80c7 100644
--- a/src/secrets/runtime-nextcloud-talk-file-precedence.test.ts
+++ b/src/secrets/runtime-nextcloud-talk-file-precedence.test.ts
@@ -1,63 +1,14 @@
-import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
-import type { AuthProfileStore } from "../agents/auth-profiles.js";
-import type { OpenClawConfig } from "../config/config.js";
-import { createEmptyPluginRegistry } from "../plugins/registry.js";
-import { setActivePluginRegistry } from "../plugins/runtime.js";
-import { loadBundledChannelSecretContractApi } from "./channel-contract-api.js";
+import { describe, expect, it } from "vitest";
+import "./runtime-nextcloud-talk.test-support.ts";
+import {
+  asConfig,
+  loadAuthStoreWithProfiles,
+  setupSecretsRuntimeSnapshotTestHooks,
+} from "./runtime.test-support.ts";
 
-const nextcloudTalkSecrets = loadBundledChannelSecretContractApi("nextcloud-talk");
-if (!nextcloudTalkSecrets?.collectRuntimeConfigAssignments) {
-  throw new Error("Missing Nextcloud Talk secret contract api");
-}
-
-vi.mock("../channels/plugins/bootstrap-registry.js", () => {
-  return {
-    getBootstrapChannelPlugin: (id: string) =>
-      id === "nextcloud-talk"
-        ? {
-            secrets: {
-              collectRuntimeConfigAssignments: nextcloudTalkSecrets.collectRuntimeConfigAssignments,
-            },
-          }
-        : undefined,
-    getBootstrapChannelSecrets: (id: string) =>
-      id === "nextcloud-talk"
-        ? {
-            collectRuntimeConfigAssignments: nextcloudTalkSecrets.collectRuntimeConfigAssignments,
-          }
-        : undefined,
-  };
-});
-
-function asConfig(value: unknown): OpenClawConfig {
-  return value as OpenClawConfig;
-}
-
-let clearConfigCache: typeof import("../config/config.js").clearConfigCache;
-let clearRuntimeConfigSnapshot: typeof import("../config/config.js").clearRuntimeConfigSnapshot;
-let clearSecretsRuntimeSnapshot: typeof import("./runtime.js").clearSecretsRuntimeSnapshot;
-let prepareSecretsRuntimeSnapshot: typeof import("./runtime.js").prepareSecretsRuntimeSnapshot;
-
-function loadAuthStoreWithProfiles(profiles: AuthProfileStore["profiles"]): AuthProfileStore {
-  return {
-    version: 1,
-    profiles,
-  };
-}
+const { prepareSecretsRuntimeSnapshot } = setupSecretsRuntimeSnapshotTestHooks();
 
 describe("secrets runtime snapshot nextcloud talk file precedence", () => {
-  beforeAll(async () => {
-    ({ clearConfigCache, clearRuntimeConfigSnapshot } = await import("../config/config.js"));
-    ({ clearSecretsRuntimeSnapshot, prepareSecretsRuntimeSnapshot } = await import("./runtime.js"));
-  });
-
-  afterEach(() => {
-    setActivePluginRegistry(createEmptyPluginRegistry());
-    clearSecretsRuntimeSnapshot();
-    clearRuntimeConfigSnapshot();
-    clearConfigCache();
-  });
-
   it("treats top-level Nextcloud Talk botSecret and apiPassword refs as active when file paths are configured", async () => {
     const snapshot = await prepareSecretsRuntimeSnapshot({
       config: asConfig({
diff --git a/src/secrets/runtime-nextcloud-talk.test-support.ts b/src/secrets/runtime-nextcloud-talk.test-support.ts
new file mode 100644
index 00000000000..8c883dfa325
--- /dev/null
+++ b/src/secrets/runtime-nextcloud-talk.test-support.ts
@@ -0,0 +1,24 @@
+import { vi } from "vitest";
+import { loadBundledChannelSecretContractApi } from "./channel-contract-api.js";
+
+const nextcloudTalkSecrets = loadBundledChannelSecretContractApi("nextcloud-talk");
+if (!nextcloudTalkSecrets?.collectRuntimeConfigAssignments) {
+  throw new Error("Missing Nextcloud Talk secret contract api");
+}
+
+vi.mock("../channels/plugins/bootstrap-registry.js", () => ({
+  getBootstrapChannelPlugin: (id: string) =>
+    id === "nextcloud-talk"
+      ? {
+          secrets: {
+            collectRuntimeConfigAssignments: nextcloudTalkSecrets.collectRuntimeConfigAssignments,
+          },
+        }
+      : undefined,
+  getBootstrapChannelSecrets: (id: string) =>
+    id === "nextcloud-talk"
+      ? {
+          collectRuntimeConfigAssignments: nextcloudTalkSecrets.collectRuntimeConfigAssignments,
+        }
+      : undefined,
+}));
diff --git a/src/secrets/runtime-telegram-token-inheritance.test.ts b/src/secrets/runtime-telegram-token-inheritance.test.ts
index a9cd8e90394..a4ab7b9faab 100644
--- a/src/secrets/runtime-telegram-token-inheritance.test.ts
+++ b/src/secrets/runtime-telegram-token-inheritance.test.ts
@@ -1,63 +1,14 @@
-import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
-import type { AuthProfileStore } from "../agents/auth-profiles.js";
-import type { OpenClawConfig } from "../config/config.js";
-import { createEmptyPluginRegistry } from "../plugins/registry.js";
-import { setActivePluginRegistry } from "../plugins/runtime.js";
-import { loadBundledChannelSecretContractApi } from "./channel-contract-api.js";
+import { describe, expect, it } from "vitest";
+import "./runtime-telegram.test-support.ts";
+import {
+  asConfig,
+  loadAuthStoreWithProfiles,
+  setupSecretsRuntimeSnapshotTestHooks,
+} from "./runtime.test-support.ts";
 
-const telegramSecrets = loadBundledChannelSecretContractApi("telegram");
-if (!telegramSecrets?.collectRuntimeConfigAssignments) {
-  throw new Error("Missing Telegram secret contract api");
-}
-
-vi.mock("../channels/plugins/bootstrap-registry.js", () => {
-  return {
-    getBootstrapChannelPlugin: (id: string) =>
-      id === "telegram"
-        ? {
-            secrets: {
-              collectRuntimeConfigAssignments: telegramSecrets.collectRuntimeConfigAssignments,
-            },
-          }
-        : undefined,
-    getBootstrapChannelSecrets: (id: string) =>
-      id === "telegram"
-        ? {
-            collectRuntimeConfigAssignments: telegramSecrets.collectRuntimeConfigAssignments,
-          }
-        : undefined,
-  };
-});
-
-function asConfig(value: unknown): OpenClawConfig {
-  return value as OpenClawConfig;
-}
-
-let clearConfigCache: typeof import("../config/config.js").clearConfigCache;
-let clearRuntimeConfigSnapshot: typeof import("../config/config.js").clearRuntimeConfigSnapshot;
-let clearSecretsRuntimeSnapshot: typeof import("./runtime.js").clearSecretsRuntimeSnapshot;
-let prepareSecretsRuntimeSnapshot: typeof import("./runtime.js").prepareSecretsRuntimeSnapshot;
-
-function loadAuthStoreWithProfiles(profiles: AuthProfileStore["profiles"]): AuthProfileStore {
-  return {
-    version: 1,
-    profiles,
-  };
-}
+const { prepareSecretsRuntimeSnapshot } = setupSecretsRuntimeSnapshotTestHooks();
 
 describe("secrets runtime snapshot telegram token inheritance", () => {
-  beforeAll(async () => {
-    ({ clearConfigCache, clearRuntimeConfigSnapshot } = await import("../config/config.js"));
-    ({ clearSecretsRuntimeSnapshot, prepareSecretsRuntimeSnapshot } = await import("./runtime.js"));
-  });
-
-  afterEach(() => {
-    setActivePluginRegistry(createEmptyPluginRegistry());
-    clearSecretsRuntimeSnapshot();
-    clearRuntimeConfigSnapshot();
-    clearConfigCache();
-  });
-
   it("fails when enabled channel surfaces contain unresolved refs", async () => {
     await expect(
       prepareSecretsRuntimeSnapshot({
diff --git a/src/secrets/runtime-zalo-token-activity.test.ts b/src/secrets/runtime-zalo-token-activity.test.ts
index 3ca68c3b82c..2658979468c 100644
--- a/src/secrets/runtime-zalo-token-activity.test.ts
+++ b/src/secrets/runtime-zalo-token-activity.test.ts
@@ -1,63 +1,14 @@
-import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
-import type { AuthProfileStore } from "../agents/auth-profiles.js";
-import type { OpenClawConfig } from "../config/config.js";
-import { createEmptyPluginRegistry } from "../plugins/registry.js";
-import { setActivePluginRegistry } from "../plugins/runtime.js";
-import { loadBundledChannelSecretContractApi } from "./channel-contract-api.js";
+import { describe, expect, it } from "vitest";
+import "./runtime-zalo.test-support.ts";
+import {
+  asConfig,
+  loadAuthStoreWithProfiles,
+  setupSecretsRuntimeSnapshotTestHooks,
+} from "./runtime.test-support.ts";
 
-const zaloSecrets = loadBundledChannelSecretContractApi("zalo");
-if (!zaloSecrets?.collectRuntimeConfigAssignments) {
-  throw new Error("Missing Zalo secret contract api");
-}
-
-vi.mock("../channels/plugins/bootstrap-registry.js", () => {
-  return {
-    getBootstrapChannelPlugin: (id: string) =>
-      id === "zalo"
-        ? {
-            secrets: {
-              collectRuntimeConfigAssignments: zaloSecrets.collectRuntimeConfigAssignments,
-            },
-          }
-        : undefined,
-    getBootstrapChannelSecrets: (id: string) =>
-      id === "zalo"
-        ? {
-            collectRuntimeConfigAssignments: zaloSecrets.collectRuntimeConfigAssignments,
-          }
-        : undefined,
-  };
-});
-
-function asConfig(value: unknown): OpenClawConfig {
-  return value as OpenClawConfig;
-}
-
-let clearConfigCache: typeof import("../config/config.js").clearConfigCache;
-let clearRuntimeConfigSnapshot: typeof import("../config/config.js").clearRuntimeConfigSnapshot;
-let clearSecretsRuntimeSnapshot: typeof import("./runtime.js").clearSecretsRuntimeSnapshot;
-let prepareSecretsRuntimeSnapshot: typeof import("./runtime.js").prepareSecretsRuntimeSnapshot;
-
-function loadAuthStoreWithProfiles(profiles: AuthProfileStore["profiles"]): AuthProfileStore {
-  return {
-    version: 1,
-    profiles,
-  };
-}
+const { prepareSecretsRuntimeSnapshot } = setupSecretsRuntimeSnapshotTestHooks();
 
 describe("secrets runtime snapshot zalo token activity", () => {
-  beforeAll(async () => {
-    ({ clearConfigCache, clearRuntimeConfigSnapshot } = await import("../config/config.js"));
-    ({ clearSecretsRuntimeSnapshot, prepareSecretsRuntimeSnapshot } = await import("./runtime.js"));
-  });
-
-  afterEach(() => {
-    setActivePluginRegistry(createEmptyPluginRegistry());
-    clearSecretsRuntimeSnapshot();
-    clearRuntimeConfigSnapshot();
-    clearConfigCache();
-  });
-
   it("treats top-level Zalo botToken refs as active even when tokenFile is configured", async () => {
     const snapshot = await prepareSecretsRuntimeSnapshot({
       config: asConfig({
diff --git a/src/secrets/runtime-zalo.test-support.ts b/src/secrets/runtime-zalo.test-support.ts
new file mode 100644
index 00000000000..ad0823026da
--- /dev/null
+++ b/src/secrets/runtime-zalo.test-support.ts
@@ -0,0 +1,24 @@
+import { vi } from "vitest";
+import { loadBundledChannelSecretContractApi } from "./channel-contract-api.js";
+
+const zaloSecrets = loadBundledChannelSecretContractApi("zalo");
+if (!zaloSecrets?.collectRuntimeConfigAssignments) {
+  throw new Error("Missing Zalo secret contract api");
+}
+
+vi.mock("../channels/plugins/bootstrap-registry.js", () => ({
+  getBootstrapChannelPlugin: (id: string) =>
+    id === "zalo"
+      ? {
+          secrets: {
+            collectRuntimeConfigAssignments: zaloSecrets.collectRuntimeConfigAssignments,
+          },
+        }
+      : undefined,
+  getBootstrapChannelSecrets: (id: string) =>
+    id === "zalo"
+      ? {
+          collectRuntimeConfigAssignments: zaloSecrets.collectRuntimeConfigAssignments,
+        }
+      : undefined,
+}));