diff --git a/src/commands/gateway-status.test.ts b/src/commands/gateway-status.test.ts
index 46661268600..cfc6a14def5 100644
--- a/src/commands/gateway-status.test.ts
+++ b/src/commands/gateway-status.test.ts
@@ -149,6 +149,23 @@ function makeRemoteGatewayConfig(url: string, token = "rtok", localToken = "ltok
   };
 }
 
+function mockLocalTokenSecretRefConfig(secretId = "MISSING_GATEWAY_TOKEN") {
+  loadConfig.mockReturnValueOnce({
+    secrets: {
+      providers: {
+        default: { source: "env" },
+      },
+    },
+    gateway: {
+      mode: "local",
+      auth: {
+        mode: "token",
+        token: { source: "env", provider: "default", id: secretId },
+      },
+    },
+  } as unknown as ReturnType<typeof loadConfig>);
+}
+
 async function runGatewayStatus(
   runtime: ReturnType<typeof createRuntimeCapture>["runtime"],
   opts: { timeout: string; json?: boolean; ssh?: string; sshAuto?: boolean; sshIdentity?: string },
@@ -187,20 +204,7 @@ describe("gateway-status command", () => {
   it("surfaces unresolved SecretRef auth diagnostics in warnings", async () => {
     const { runtime, runtimeLogs, runtimeErrors } = createRuntimeCapture();
     await withEnvAsync({ MISSING_GATEWAY_TOKEN: undefined }, async () => {
-      loadConfig.mockReturnValueOnce({
-        secrets: {
-          providers: {
-            default: { source: "env" },
-          },
-        },
-        gateway: {
-          mode: "local",
-          auth: {
-            mode: "token",
-            token: { source: "env", provider: "default", id: "MISSING_GATEWAY_TOKEN" },
-          },
-        },
-      } as unknown as ReturnType<typeof loadConfig>);
+      mockLocalTokenSecretRefConfig();
 
       await runGatewayStatus(runtime, { timeout: "1000", json: true });
     });
@@ -228,20 +232,7 @@ describe("gateway-status command", () => {
         MISSING_GATEWAY_TOKEN: undefined,
       },
       async () => {
-        loadConfig.mockReturnValueOnce({
-          secrets: {
-            providers: {
-              default: { source: "env" },
-            },
-          },
-          gateway: {
-            mode: "local",
-            auth: {
-              mode: "token",
-              token: { source: "env", provider: "default", id: "MISSING_GATEWAY_TOKEN" },
-            },
-          },
-        } as unknown as ReturnType<typeof loadConfig>);
+        mockLocalTokenSecretRefConfig();
 
         await runGatewayStatus(runtime, { timeout: "1000", json: true });
       },