diff --git a/crates/socket-patch-cli/tests/common/cache_env.rs b/crates/socket-patch-cli/tests/common/cache_env.rs
index cde80a5e1..020b69d75 100644
--- a/crates/socket-patch-cli/tests/common/cache_env.rs
+++ b/crates/socket-patch-cli/tests/common/cache_env.rs
@@ -318,8 +318,9 @@ fn scrub_parent_vars(cmd: &mut Command, parent: Vec<OsString>, ambient: fn(&str)
 
 // ── Ambient-env scrub for the vlt suites ──────────────────────────────
 
-/// True for an ambient variable the real-vlt suites strip from every child
-/// (vlt and the CLI under test) before [`isolate`]:
+/// True for an ambient variable the real-vlt suites strip from every vlt
+/// child before [`isolate`] (a `socket-patch` child built with
+/// `hermetic::command` takes [`scrub_ambient_vlt_tool_env`] instead):
 ///
 /// * every `VLT_*` — vlt reads each config option from `VLT_<OPTION>`
 ///   (`VLT_REGISTRY`, `VLT_REGISTRIES`, `VLT_CACHE`, `VLT_STORE_LINKER`);
@@ -343,6 +344,18 @@ pub fn scrub_ambient_vlt_env(cmd: &mut Command) {
     scrub_parent_vars(cmd, parent_var_names(), is_ambient_vlt_var);
 }
 
+/// [`is_ambient_vlt_var`] minus `SOCKET_*`.
+fn is_ambient_vlt_tool_var(name: &str) -> bool {
+    !name.starts_with("SOCKET_") && is_ambient_vlt_var(name)
+}
+
+/// [`scrub_ambient_vlt_env`] minus `SOCKET_*`, for a `socket-patch` child
+/// built with `hermetic::command`: the builder already handled `SOCKET_*`,
+/// and removing them again would undo the opt-outs it forces on.
+pub fn scrub_ambient_vlt_tool_env(cmd: &mut Command) {
+    scrub_parent_vars(cmd, parent_var_names(), is_ambient_vlt_tool_var);
+}
+
 // ── Self-tests ────────────────────────────────────────────────────────
 //
 // Integration-test crates do not get `cfg(test)`, so — exactly as in
@@ -454,6 +467,24 @@ mod cache_env_selftests {
         }
     }
 
+    /// The CLI-child variant keeps every `SOCKET_*`, so it never undoes
+    /// the opt-outs `hermetic::command` forces on, and still strips the
+    /// vlt, npm and Python config.
+    #[test]
+    fn ambient_vlt_tool_scrub_leaves_socket_vars_to_the_hermetic_builder() {
+        for name in [
+            "SOCKET_TELEMETRY_DISABLED",
+            "SOCKET_NO_UPDATE_CHECK",
+            "SOCKET_NO_CONFIG",
+            "SOCKET_API_TOKEN",
+        ] {
+            assert!(!is_ambient_vlt_tool_var(name), "{name} must survive");
+        }
+        for name in ["VLT_REGISTRY", "npm_config_registry", "VIRTUAL_ENV"] {
+            assert!(is_ambient_vlt_tool_var(name), "{name} must be scrubbed");
+        }
+    }
+
     #[test]
     fn ambient_vlt_scrub_removes_only_matching_parent_vars() {
         let parent = parent_var_names();
diff --git a/crates/socket-patch-cli/tests/spawn_env_hygiene.rs b/crates/socket-patch-cli/tests/spawn_env_hygiene.rs
index 70169605b..31fc8d684 100644
--- a/crates/socket-patch-cli/tests/spawn_env_hygiene.rs
+++ b/crates/socket-patch-cli/tests/spawn_env_hygiene.rs
@@ -68,9 +68,6 @@ const PENDING_RAW_SPAWNS: &[&str] = &[
     "vex_e2e_common/uv.rs",
     "vex_pdm_hatch_common/mod.rs",
     "vex_pipenv_pip_common/mod.rs",
-    "vlt_e2e_common/mod.rs",
-    "vlt_hosted_common/mod.rs",
-    "vlt_vendor_common/mod.rs",
 ];
 
 /// The environment `cmd`'s child would see: the parent environment with
diff --git a/crates/socket-patch-cli/tests/vlt_e2e_common/mod.rs b/crates/socket-patch-cli/tests/vlt_e2e_common/mod.rs
index b746664d5..d6970c665 100644
--- a/crates/socket-patch-cli/tests/vlt_e2e_common/mod.rs
+++ b/crates/socket-patch-cli/tests/vlt_e2e_common/mod.rs
@@ -1758,25 +1758,22 @@ pub fn urlencode(s: &str) -> String {
 
 // ── socket-patch ──────────────────────────────────────────────────────────
 
-/// The socket-patch binary with the ambient `SOCKET_*`, `VLT_*`, npm and
-/// proxy environment scrubbed.
+/// The socket-patch binary with the hermetic `SOCKET_*` environment (see
+/// `common::hermetic::command`) and the ambient `VLT_*`, npm and proxy
+/// environment scrubbed.
 pub fn socket_cmd() -> Command {
-    let mut cmd = Command::new(socket_bin());
-    cache_env::scrub_ambient_vlt_env(&mut cmd);
+    let mut cmd = common::hermetic::command(&socket_bin());
+    cache_env::scrub_ambient_vlt_tool_env(&mut cmd);
     for (key, _) in std::env::vars_os() {
         let name = key.to_string_lossy();
         if ["http_proxy", "https_proxy", "all_proxy", "no_proxy"]
             .iter()
             .any(|p| name.eq_ignore_ascii_case(p))
-            || name.starts_with("SOCKET_PATCH_VLT_E2E_")
         {
             cmd.env_remove(&key);
         }
     }
-    cmd.env("SOCKET_NO_CONFIG", "1")
-        .env("SOCKET_NO_UPDATE_CHECK", "1")
-        .env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("VLT_TELEMETRY", "0")
+    cmd.env("VLT_TELEMETRY", "0")
         .env("LANG", "C")
         .env("LC_ALL", "C");
     cmd
diff --git a/crates/socket-patch-cli/tests/vlt_hosted_common/mod.rs b/crates/socket-patch-cli/tests/vlt_hosted_common/mod.rs
index 3693bb401..458839ce6 100644
--- a/crates/socket-patch-cli/tests/vlt_hosted_common/mod.rs
+++ b/crates/socket-patch-cli/tests/vlt_hosted_common/mod.rs
@@ -91,6 +91,8 @@ pub fn with_flags(line: &str, flags: u8) -> String {
     line.replacen("[0,", &format!("[{flags},"), 1)
 }
 
+#[path = "../common/hermetic.rs"]
+mod hermetic;
 #[path = "../common/oracle.rs"]
 mod oracle;
 
@@ -418,32 +420,19 @@ pub fn ledger_path(root: &Path) -> PathBuf {
     root.join(".socket/vendor/redirect-state.json")
 }
 
-/// The `socket-patch` binary with the ambient `SOCKET_*` and proxy
-/// environment scrubbed (telemetry opt-outs kept).
+/// The `socket-patch` binary with the hermetic `SOCKET_*` environment (see
+/// `hermetic::command`) and the ambient proxy environment scrubbed.
 pub fn scrubbed_cli() -> std::process::Command {
-    let mut cmd = std::process::Command::new(env!("CARGO_BIN_EXE_socket-patch"));
-    cmd.env("SOCKET_DRY_RUN", "true")
-        .env("SOCKET_OFFLINE", "true")
-        .env("SOCKET_NO_VLT_INSTALL_CLEANUP", "true")
-        .env_remove("SOCKET_DRY_RUN")
-        .env_remove("SOCKET_OFFLINE")
-        .env_remove("SOCKET_NO_VLT_INSTALL_CLEANUP");
+    let mut cmd = hermetic::binary_command();
     for (key, _) in std::env::vars_os() {
         let name = key.to_string_lossy();
-        let proxy = name.eq_ignore_ascii_case("http_proxy")
-            || name.eq_ignore_ascii_case("https_proxy")
-            || name.eq_ignore_ascii_case("all_proxy")
-            || name.eq_ignore_ascii_case("no_proxy");
-        if proxy
-            || (name.starts_with("SOCKET_")
-                && !name.contains("TELEMETRY")
-                && name != "SOCKET_NO_CONFIG")
+        if ["http_proxy", "https_proxy", "all_proxy", "no_proxy"]
+            .iter()
+            .any(|p| name.eq_ignore_ascii_case(p))
         {
             cmd.env_remove(&key);
         }
     }
-    cmd.env("SOCKET_NO_CONFIG", "1")
-        .env("SOCKET_NO_UPDATE_CHECK", "1");
     cmd
 }
 
diff --git a/crates/socket-patch-cli/tests/vlt_vendor_common/mod.rs b/crates/socket-patch-cli/tests/vlt_vendor_common/mod.rs
index 4de6e0add..a178f1db4 100644
--- a/crates/socket-patch-cli/tests/vlt_vendor_common/mod.rs
+++ b/crates/socket-patch-cli/tests/vlt_vendor_common/mod.rs
@@ -18,6 +18,8 @@
 
 #![allow(dead_code)]
 
+#[path = "../common/hermetic.rs"]
+mod hermetic;
 #[path = "../prebuilt_common/mod.rs"]
 mod prebuilt_common;
 
@@ -347,34 +349,20 @@ pub fn capture_project(root: &Path, case: &Case) {
 
 // ── CLI ──────────────────────────────────────────────────────────────────
 
-/// The `socket-patch` binary with the ambient `SOCKET_*`, `VLT_*` and proxy
-/// environment scrubbed (telemetry disabled).
+/// The `socket-patch` binary with the hermetic `SOCKET_*` environment (see
+/// `hermetic::command`) and the ambient `VLT_*` and proxy environment
+/// scrubbed.
 pub fn cli() -> Command {
-    let mut cmd = Command::new(env!("CARGO_BIN_EXE_socket-patch"));
+    let mut cmd = hermetic::binary_command();
     for (key, _) in std::env::vars_os() {
-        let name = key.to_string_lossy().to_string();
+        let name = key.to_string_lossy();
         let proxy = ["http_proxy", "https_proxy", "all_proxy", "no_proxy"]
             .iter()
             .any(|p| name.eq_ignore_ascii_case(p));
-        if proxy
-            || name.starts_with("VLT_")
-            || (name.starts_with("SOCKET_") && name != "SOCKET_NO_CONFIG")
-        {
+        if proxy || name.starts_with("VLT_") {
             cmd.env_remove(&key);
         }
     }
-    for key in [
-        "SOCKET_OFFLINE",
-        "SOCKET_DRY_RUN",
-        "SOCKET_API_URL",
-        "SOCKET_PROXY_URL",
-        "SOCKET_NO_VLT_INSTALL_CLEANUP",
-    ] {
-        cmd.env_remove(key);
-    }
-    cmd.env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("SOCKET_NO_CONFIG", "1")
-        .env("SOCKET_NO_UPDATE_CHECK", "1");
     cmd
 }