diff --git a/cmd/configure_gcp_signal_test.go b/cmd/configure_gcp_signal_test.go
index b0b43f0be..98bcb4b52 100644
--- a/cmd/configure_gcp_signal_test.go
+++ b/cmd/configure_gcp_signal_test.go
@@ -146,6 +146,8 @@ func childState(child *exec.Cmd) string {
 
 func startGCPInterruptChild(t *testing.T, phase string) (*exec.Cmd, string, io.ReadCloser, *syncBuffer) {
 	t.Helper()
+	// The child inherits this env; it sets its own secretsmanager endpoint.
+	clearAWSEndpointOverrides(t)
 	dir := t.TempDir()
 	adc := filepath.Join(dir, "adc.json")
 	require.NoError(t, os.WriteFile(adc, []byte(`{"type":"authorized_user","client_id":"fixture","client_secret":"fixture","refresh_token":"fixture"}`), 0600))
diff --git a/cmd/multi_service_extended_support_unavailable_test.go b/cmd/multi_service_extended_support_unavailable_test.go
index 8c3e0dc86..3babe4519 100644
--- a/cmd/multi_service_extended_support_unavailable_test.go
+++ b/cmd/multi_service_extended_support_unavailable_test.go
@@ -161,7 +161,7 @@ func (s *rdsAPIStub) serveEnv(t *testing.T) {
 	t.Setenv("AWS_SHARED_CREDENTIALS_FILE", empty)
 	t.Setenv("AWS_EC2_METADATA_DISABLED", "true")
 	t.Setenv("AWS_PROFILE", "")
-	t.Setenv("AWS_IGNORE_CONFIGURED_ENDPOINT_URLS", "")
+	clearAWSEndpointOverrides(t)
 	t.Setenv("AWS_ACCESS_KEY_ID", "AKIDEXAMPLE")
 	t.Setenv("AWS_SECRET_ACCESS_KEY", "secret")
 	t.Setenv("AWS_SESSION_TOKEN", "")
diff --git a/cmd/multi_service_test.go b/cmd/multi_service_test.go
index 8498296ea..707921986 100644
--- a/cmd/multi_service_test.go
+++ b/cmd/multi_service_test.go
@@ -1648,6 +1648,20 @@ func TestFilterAndAdjustRecommendations(t *testing.T) {
 	}
 }
 
+// clearAWSEndpointOverrides blanks every service-specific AWS_ENDPOINT_URL_*
+// variable and AWS_IGNORE_CONFIGURED_ENDPOINT_URLS for the test, so a
+// developer's global overrides can neither bypass nor disable a test's local
+// endpoint. Set the test's own endpoint variables after calling it.
+func clearAWSEndpointOverrides(t *testing.T) {
+	t.Helper()
+	for _, kv := range os.Environ() {
+		if name, _, _ := strings.Cut(kv, "="); strings.HasPrefix(name, "AWS_ENDPOINT_URL_") {
+			t.Setenv(name, "")
+		}
+	}
+	t.Setenv("AWS_IGNORE_CONFIGURED_ENDPOINT_URLS", "")
+}
+
 // isolateAWSEnv pins the AWS environment to deterministic invalid static
 // credentials and points every SDK client at a local server that answers 403
 // AccessDenied, so the runToolFromCSV tests behave identically on credentialed
@@ -1674,13 +1688,7 @@ func isolateAWSEnv(t *testing.T) *atomic.Int64 {
 	}))
 	t.Cleanup(srv.Close)
 
-	// A developer's global endpoint overrides must not bypass the local server.
-	for _, kv := range os.Environ() {
-		if name, _, _ := strings.Cut(kv, "="); strings.HasPrefix(name, "AWS_ENDPOINT_URL_") {
-			t.Setenv(name, "")
-		}
-	}
-	t.Setenv("AWS_IGNORE_CONFIGURED_ENDPOINT_URLS", "")
+	clearAWSEndpointOverrides(t)
 	t.Setenv("AWS_ENDPOINT_URL", srv.URL)
 	return hits
 }
diff --git a/cmd/purchase_confirmation_test.go b/cmd/purchase_confirmation_test.go
index 079adfed1..e484663b3 100644
--- a/cmd/purchase_confirmation_test.go
+++ b/cmd/purchase_confirmation_test.go
@@ -150,10 +150,10 @@ func TestRunToolFromCSVRequiresTerminal(t *testing.T) {
 	t.Setenv("HTTP_PROXY", server.URL)
 	t.Setenv("HTTPS_PROXY", server.URL)
 	t.Setenv("NO_PROXY", "")
+	clearAWSEndpointOverrides(t)
 	for _, key := range []string{"AWS_ENDPOINT_URL", "AWS_ENDPOINT_URL_RDS", "AWS_ENDPOINT_URL_EC2"} {
 		t.Setenv(key, server.URL)
 	}
-	t.Setenv("AWS_IGNORE_CONFIGURED_ENDPOINT_URLS", "false")
 	cfg := toolCfg
 	cfg.ActualPurchase = actualPurchase
 	cfg.Coverage = 100