diff --git a/src/web-fetch/runtime.test.ts b/src/web-fetch/runtime.test.ts
index 685aede9d520..2723db4b24f7 100644
--- a/src/web-fetch/runtime.test.ts
+++ b/src/web-fetch/runtime.test.ts
@@ -3,6 +3,7 @@ import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vite
 import type { OpenClawConfig } from "../config/types.js";
 import type { PluginWebFetchProviderEntry } from "../plugins/types.js";
 import type { RuntimeWebFetchMetadata } from "../secrets/runtime-web-tools.types.js";
+import { withEnv } from "../test-utils/env.js";
 import {
   createWebFetchTestProvider,
   type WebFetchTestProviderParams,
@@ -95,7 +96,6 @@ describe("web fetch runtime", () => {
   });
 
   beforeEach(() => {
-    vi.unstubAllEnvs();
     resolvePluginWebFetchProvidersMock.mockReset();
     resolveRuntimeWebFetchProvidersMock.mockReset();
     resolvePluginWebFetchProvidersMock.mockReturnValue([]);
@@ -118,9 +118,9 @@ describe("web fetch runtime", () => {
       id: "AWS_SECRET_ACCESS_KEY",
     });
 
-    vi.stubEnv("FIRECRAWL_API_KEY", "");
-
-    expect(resolveWebFetchDefinition({ config })).toBeNull();
+    withEnv({ FIRECRAWL_API_KEY: "" }, () => {
+      expect(resolveWebFetchDefinition({ config })).toBeNull();
+    });
   });
 
   it("prefers the runtime-selected provider when metadata is available", async () => {
@@ -169,13 +169,14 @@ describe("web fetch runtime", () => {
   it("auto-detects providers from provider-declared env vars", () => {
     const provider = createFirecrawlProvider();
     resolvePluginWebFetchProvidersMock.mockReturnValue([provider]);
-    vi.stubEnv("FIRECRAWL_API_KEY", "firecrawl-env-key");
 
-    const resolved = resolveWebFetchDefinition({
-      config: {},
+    withEnv({ FIRECRAWL_API_KEY: "firecrawl-env-key" }, () => {
+      const resolved = resolveWebFetchDefinition({
+        config: {},
+      });
+
+      expect(requireResolvedWebFetch(resolved).provider.id).toBe("firecrawl");
     });
-
-    expect(requireResolvedWebFetch(resolved).provider.id).toBe("firecrawl");
   });
 
   it("auto-detects providers from configured fallback credentials", () => {