diff --git a/apps/android/app/src/test/java/ai/openclaw/android/ui/GatewayConfigResolverTest.kt b/apps/android/app/src/test/java/ai/openclaw/android/ui/GatewayConfigResolverTest.kt
index 421f0b3ad6d..7dc2dd1a239 100644
--- a/apps/android/app/src/test/java/ai/openclaw/android/ui/GatewayConfigResolverTest.kt
+++ b/apps/android/app/src/test/java/ai/openclaw/android/ui/GatewayConfigResolverTest.kt
@@ -46,6 +46,13 @@ class GatewayConfigResolverTest {
     assertNull(resolved)
   }
 
+  @Test
+  fun resolveScannedSetupCodeRejectsJsonWithNonStringSetupCode() {
+    val qrJson = """{"setupCode":{"nested":"value"}}"""
+    val resolved = resolveScannedSetupCode(qrJson)
+    assertNull(resolved)
+  }
+
   private fun encodeSetupCode(payloadJson: String): String {
     return Base64.getUrlEncoder().withoutPadding().encodeToString(payloadJson.toByteArray(Charsets.UTF_8))
   }