diff --git a/.secrets.baseline b/.secrets.baseline
index 4f98a314a46..1edb5986e7c 100644
--- a/.secrets.baseline
+++ b/.secrets.baseline
@@ -11012,7 +11012,7 @@
         "filename": "extensions/irc/src/accounts.ts",
         "hashed_secret": "920f8f5815b381ea692e9e7c2f7119f2b1aa620a",
         "is_verified": false,
-        "line_number": 24
+        "line_number": 23
       }
     ],
     "extensions/irc/src/client.test.ts": [
@@ -11107,14 +11107,14 @@
         "filename": "extensions/nextcloud-talk/src/accounts.ts",
         "hashed_secret": "920f8f5815b381ea692e9e7c2f7119f2b1aa620a",
         "is_verified": false,
-        "line_number": 31
+        "line_number": 28
       },
       {
         "type": "Secret Keyword",
         "filename": "extensions/nextcloud-talk/src/accounts.ts",
         "hashed_secret": "71f8e7976e4cbc4561c9d62fb283e7f788202acb",
         "is_verified": false,
-        "line_number": 169
+        "line_number": 147
       }
     ],
     "extensions/nextcloud-talk/src/channel.ts": [
@@ -12164,28 +12164,28 @@
         "filename": "src/config/env-substitution.test.ts",
         "hashed_secret": "f2b14f68eb995facb3a1c35287b778d5bd785511",
         "is_verified": false,
-        "line_number": 80
+        "line_number": 85
       },
       {
         "type": "Secret Keyword",
         "filename": "src/config/env-substitution.test.ts",
         "hashed_secret": "ec417f567082612f8fd6afafe1abcab831fca840",
         "is_verified": false,
-        "line_number": 100
+        "line_number": 105
       },
       {
         "type": "Secret Keyword",
         "filename": "src/config/env-substitution.test.ts",
         "hashed_secret": "520bd69c3eb1646d9a78181ecb4c90c51fdf428d",
         "is_verified": false,
-        "line_number": 101
+        "line_number": 106
       },
       {
         "type": "Secret Keyword",
         "filename": "src/config/env-substitution.test.ts",
         "hashed_secret": "f136444bf9b3d01a9f9b772b80ac6bf7b6a43ef0",
         "is_verified": false,
-        "line_number": 282
+        "line_number": 360
       }
     ],
     "src/config/io.write-config.test.ts": [
@@ -12700,7 +12700,7 @@
         "filename": "src/line/bot-handlers.test.ts",
         "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
         "is_verified": false,
-        "line_number": 101
+        "line_number": 102
       }
     ],
     "src/line/bot-message-context.test.ts": [
@@ -12909,14 +12909,14 @@
         "filename": "src/telegram/monitor.test.ts",
         "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
         "is_verified": false,
-        "line_number": 432
+        "line_number": 450
       },
       {
         "type": "Secret Keyword",
         "filename": "src/telegram/monitor.test.ts",
         "hashed_secret": "5934c4d4a4fa5d66ddb3d3fc0bba84996c17a5b7",
         "is_verified": false,
-        "line_number": 479
+        "line_number": 603
       }
     ],
     "src/telegram/webhook.test.ts": [
@@ -13011,5 +13011,5 @@
       }
     ]
   },
-  "generated_at": "2026-03-07T21:15:22Z"
+  "generated_at": "2026-03-07T21:29:08Z"
 }
diff --git a/src/gateway/credentials.test.ts b/src/gateway/credentials.test.ts
index bb251682715..7dc12c84aa2 100644
--- a/src/gateway/credentials.test.ts
+++ b/src/gateway/credentials.test.ts
@@ -501,6 +501,6 @@ describe("resolveGatewayCredentialsFromValues", () => {
       tokenPrecedence: "config-first",
       passwordPrecedence: "config-first", // pragma: allowlist secret
     });
-    expect(resolved).toEqual({ token: "real-token-value", password: "real-password" });
+    expect(resolved).toEqual({ token: "real-token-value", password: "real-password" }); // pragma: allowlist secret
   });
 });
diff --git a/src/media-understanding/providers/image.test.ts b/src/media-understanding/providers/image.test.ts
index 948f4c74d11..80737f3f410 100644
--- a/src/media-understanding/providers/image.test.ts
+++ b/src/media-understanding/providers/image.test.ts
@@ -4,7 +4,7 @@ const completeMock = vi.fn();
 const minimaxUnderstandImageMock = vi.fn();
 const ensureOpenClawModelsJsonMock = vi.fn(async () => {});
 const getApiKeyForModelMock = vi.fn(async () => ({
-  apiKey: "oauth-test",
+  apiKey: "oauth-test", // pragma: allowlist secret
   source: "test",
   mode: "oauth",
 }));
@@ -82,7 +82,7 @@ describe("describeImageWithModel", () => {
     expect(requireApiKeyMock).toHaveBeenCalled();
     expect(setRuntimeApiKeyMock).toHaveBeenCalledWith("minimax-portal", "oauth-test");
     expect(minimaxUnderstandImageMock).toHaveBeenCalledWith({
-      apiKey: "oauth-test",
+      apiKey: "oauth-test", // pragma: allowlist secret
       prompt: "Describe the image.",
       imageDataUrl: `data:image/png;base64,${Buffer.from("png-bytes").toString("base64")}`,
       modelBaseUrl: "https://api.minimax.io/anthropic",