diff --git a/crates/socket-patch-cli/tests/e2e_vex_vendor.rs b/crates/socket-patch-cli/tests/e2e_vex_vendor.rs
index 423e0d8f6..3aa918b14 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_vendor.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_vendor.rs
@@ -41,19 +41,11 @@ const UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f";
 
 #[path = "common/mod.rs"]
 mod common;
-use common::binary;
 
-/// CLI invocation with the ambient `SOCKET_*` environment scrubbed (same
-/// rationale as `e2e_vex.rs`: explicit flags must be the sole source of
-/// truth).
+/// CLI invocation through the shared hermetic builder (same rationale as
+/// `e2e_vex.rs`: explicit flags must be the sole source of truth).
 fn cli() -> Command {
-    let mut cmd = Command::new(binary());
-    for (key, _) in std::env::vars() {
-        if key.starts_with("SOCKET_") && key != "SOCKET_NO_CONFIG" {
-            cmd.env_remove(key);
-        }
-    }
-    cmd
+    common::hermetic::binary_command()
 }
 
 /// Write `manifest` to `<cwd>/.socket/manifest.json`.
@@ -2310,8 +2302,6 @@ fn vex_json(cwd: &Path, extra: &[&str]) -> (Option<i32>, Value) {
     ];
     args.extend(extra.iter().map(|s| s.to_string()));
     let out = cli()
-        .env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("SOCKET_NO_CONFIG", "1")
         .env("SOCKET_NO_API_TOKEN", "1")
         .args(&args)
         .output()
diff --git a/crates/socket-patch-cli/tests/rollback/rollback_multicopy_blob_gate.rs b/crates/socket-patch-cli/tests/rollback/rollback_multicopy_blob_gate.rs
index 68e3662e5..49bde6f60 100644
--- a/crates/socket-patch-cli/tests/rollback/rollback_multicopy_blob_gate.rs
+++ b/crates/socket-patch-cli/tests/rollback/rollback_multicopy_blob_gate.rs
@@ -21,7 +21,7 @@ use std::path::{Path, PathBuf};
 use std::process::Command;
 use std::sync::{Arc, Mutex};
 
-use crate::common::{binary, git_sha256};
+use crate::common::{binary, git_sha256, hermetic_command};
 
 /// Minimal HTTP stub playing the authenticated API: serves `blob` bytes at
 /// any path ending in `/patches/blob/<hash>`, 404 otherwise, and records
@@ -161,19 +161,11 @@ fn build_diverged_two_copy_tree(root: &Path) -> (PathBuf, PathBuf, String, Vec<u
     (index_a, index_b, before_hash, original, patched)
 }
 
-/// A `rollback` command with the full `SOCKET_*` environment scrubbed and
-/// hermeticity vars pinned, so behavior is driven only by the flags under
-/// test (prefix scrub — an explicit list rots as flags are added).
+/// A `rollback` command through the shared hermetic builder, so behavior is
+/// driven only by the flags under test.
 fn rollback_cmd(cwd: &Path) -> Command {
-    let mut cmd = Command::new(binary());
+    let mut cmd = hermetic_command(&binary());
     cmd.arg("rollback").current_dir(cwd);
-    for (key, _) in std::env::vars_os() {
-        if key.to_string_lossy().starts_with("SOCKET_") {
-            cmd.env_remove(&key);
-        }
-    }
-    cmd.env("SOCKET_NO_CONFIG", "1");
-    cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
     cmd
 }
 
diff --git a/crates/socket-patch-cli/tests/spawn_env_hygiene.rs b/crates/socket-patch-cli/tests/spawn_env_hygiene.rs
index 23ac28316..2ed19837d 100644
--- a/crates/socket-patch-cli/tests/spawn_env_hygiene.rs
+++ b/crates/socket-patch-cli/tests/spawn_env_hygiene.rs
@@ -36,8 +36,6 @@ const PENDING_RAW_SPAWNS: &[&str] = &[
     "e2e_scan.rs",
     "e2e_socket_yml_policy.rs",
     "e2e_vendored_production.rs",
-    "e2e_vex_vendor.rs",
-    "rollback/rollback_multicopy_blob_gate.rs",
 ];
 
 /// The environment `cmd`'s child would see: the parent environment with