diff --git a/workspace/tests/test_mcp_cli_multi_workspace.py b/workspace/tests/test_mcp_cli_multi_workspace.py
index 9ca4f434..b562951a 100644
--- a/workspace/tests/test_mcp_cli_multi_workspace.py
+++ b/workspace/tests/test_mcp_cli_multi_workspace.py
@@ -184,9 +184,14 @@ class TestPlatformAuthRegistry:
         assert b["Authorization"] == "Bearer tok-b"
         assert a["Origin"] == "https://example.test"
 
-    def test_auth_headers_with_no_arg_uses_legacy_path(self, monkeypatch):
+    def test_auth_headers_with_no_arg_uses_legacy_path(self, monkeypatch, tmp_path):
         import platform_auth
 
+        # Wipe the module-level token cache and redirect _token_file() to a
+        # non-existent path so the env var isolation is clean. Without this,
+        # the real /configs/.auth_token pollutes the result.
+        platform_auth.clear_cache()
+        monkeypatch.setattr(platform_auth, "_token_file", lambda: tmp_path / ".auth_token")
         monkeypatch.setenv("PLATFORM_URL", "https://example.test")
         monkeypatch.setenv("MOLECULE_WORKSPACE_TOKEN", "legacy-tok")
         # Multi-workspace registry populated, but auth_headers() with
@@ -199,10 +204,15 @@ class TestPlatformAuthRegistry:
         assert h["Authorization"] == "Bearer legacy-tok"
 
     def test_auth_headers_with_unknown_workspace_falls_back_to_legacy(
-        self, monkeypatch
+        self, monkeypatch, tmp_path
     ):
         import platform_auth
 
+        # Wipe the module-level token cache and redirect _token_file() to a
+        # non-existent path so the env var isolation is clean. Without this,
+        # the real /configs/.auth_token pollutes the result.
+        platform_auth.clear_cache()
+        monkeypatch.setattr(platform_auth, "_token_file", lambda: tmp_path / ".auth_token")
         monkeypatch.setenv("PLATFORM_URL", "https://example.test")
         monkeypatch.setenv("MOLECULE_WORKSPACE_TOKEN", "legacy-tok")
         platform_auth.register_workspace_token("ws-a", "tok-a")
diff --git a/workspace/tests/test_mcp_doctor.py b/workspace/tests/test_mcp_doctor.py
index 5b587d24..ed109bf9 100644
--- a/workspace/tests/test_mcp_doctor.py
+++ b/workspace/tests/test_mcp_doctor.py
@@ -166,9 +166,15 @@ def test_resolve_token_returns_value_and_label_for_env(monkeypatch):
     assert mcp_doctor._resolve_token_summary() == label
 
 
-def test_resolve_token_returns_none_when_missing(monkeypatch):
+def test_resolve_token_returns_none_when_missing(monkeypatch, tmp_path):
     monkeypatch.delenv("MOLECULE_WORKSPACE_TOKEN", raising=False)
     monkeypatch.delenv("MOLECULE_WORKSPACE_TOKEN_FILE", raising=False)
+    # The .auth_token file at /configs/.auth_token (present in container env)
+    # must not pollute the test. Patch configs_dir.resolve() to return a
+    # bare temp dir so the disk-file fallback in _resolve_token() has
+    # nothing to find.
+    import configs_dir
+    monkeypatch.setattr(configs_dir, "resolve", lambda: tmp_path)
     val, label = mcp_doctor._resolve_token()
     assert val is None
     assert label is None