diff --git a/src/commands/onboard-non-interactive.lan-auto-token.test.ts b/src/commands/onboard-non-interactive.lan-auto-token.test.ts
index 6fc8d71af..cb3a26ae4 100644
--- a/src/commands/onboard-non-interactive.lan-auto-token.test.ts
+++ b/src/commands/onboard-non-interactive.lan-auto-token.test.ts
@@ -7,32 +7,13 @@ import { describe, expect, it } from "vitest";
 import { WebSocket } from "ws";
 
 import { PROTOCOL_VERSION } from "../gateway/protocol/index.js";
+import { getFreePort as getFreeTestPort } from "../gateway/test-helpers.js";
 import { rawDataToString } from "../infra/ws.js";
 import {
   GATEWAY_CLIENT_MODES,
   GATEWAY_CLIENT_NAMES,
 } from "../utils/message-provider.js";
 
-async function getFreePort(): Promise<number> {
-  return await new Promise((resolve, reject) => {
-    const srv = createServer();
-    srv.on("error", reject);
-    srv.listen(0, "127.0.0.1", () => {
-      const addr = srv.address();
-      if (!addr || typeof addr === "string") {
-        srv.close();
-        reject(new Error("failed to acquire free port"));
-        return;
-      }
-      const port = addr.port;
-      srv.close((err) => {
-        if (err) reject(err);
-        else resolve(port);
-      });
-    });
-  });
-}
-
 async function isPortFree(port: number): Promise<boolean> {
   if (!Number.isFinite(port) || port <= 0 || port > 65535) return false;
   return await new Promise((resolve) => {
@@ -48,7 +29,7 @@ async function getFreeGatewayPort(): Promise<number> {
   // Gateway uses derived ports (bridge/browser/canvas). Avoid flaky collisions by
   // ensuring the common derived offsets are free too.
   for (let attempt = 0; attempt < 25; attempt += 1) {
-    const port = await getFreePort();
+    const port = await getFreeTestPort();
     const candidates = [port, port + 1, port + 2, port + 4];
     const ok = (
       await Promise.all(candidates.map((candidate) => isPortFree(candidate)))
@@ -142,8 +123,9 @@ describe("onboard (non-interactive): lan bind auto-token", () => {
       path.join(os.tmpdir(), "clawdbot-onboard-lan-"),
     );
     process.env.HOME = tempHome;
-    delete process.env.CLAWDBOT_STATE_DIR;
-    delete process.env.CLAWDBOT_CONFIG_PATH;
+    const stateDir = path.join(tempHome, ".clawdbot");
+    process.env.CLAWDBOT_STATE_DIR = stateDir;
+    process.env.CLAWDBOT_CONFIG_PATH = path.join(stateDir, "clawdbot.json");
 
     const port = await getFreeGatewayPort();
     const workspace = path.join(tempHome, "clawd");
@@ -177,8 +159,9 @@ describe("onboard (non-interactive): lan bind auto-token", () => {
       runtime,
     );
 
-    const { CONFIG_PATH_CLAWDBOT } = await import("../config/config.js");
-    const cfg = JSON.parse(await fs.readFile(CONFIG_PATH_CLAWDBOT, "utf8")) as {
+    const { resolveConfigPath } = await import("../config/paths.js");
+    const configPath = resolveConfigPath(process.env, stateDir);
+    const cfg = JSON.parse(await fs.readFile(configPath, "utf8")) as {
       gateway?: {
         bind?: string;
         port?: number;
@@ -193,7 +176,13 @@ describe("onboard (non-interactive): lan bind auto-token", () => {
     expect(token.length).toBeGreaterThan(8);
 
     const { startGatewayServer } = await import("../gateway/server.js");
-    const server = await startGatewayServer(port, { controlUiEnabled: false });
+    const server = await startGatewayServer(port, {
+      controlUiEnabled: false,
+      auth: {
+        mode: "token",
+        token,
+      },
+    });
     try {
       const resNoToken = await connectReq({ url: `ws://127.0.0.1:${port}` });
       expect(resNoToken.ok).toBe(false);