diff --git a/crates/socket-patch-cli/tests/e2e_maven.rs b/crates/socket-patch-cli/tests/e2e_maven.rs
index 5878e539b..a455fcc85 100644
--- a/crates/socket-patch-cli/tests/e2e_maven.rs
+++ b/crates/socket-patch-cli/tests/e2e_maven.rs
@@ -15,10 +15,10 @@
 
 #[path = "common/mod.rs"]
 mod common;
-use common::binary;
+use common::hermetic;
 
 use std::path::Path;
-use std::process::{Command, Output};
+use std::process::Output;
 
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
@@ -46,11 +46,14 @@ async fn start_proxy() -> MockServer {
 /// Run the binary as a blocking subprocess (off the async runtime so the
 /// in-test proxy can service its requests concurrently), pinned to `proxy_url`.
 ///
-/// `SOCKET_API_TOKEN` is stripped so the binary deterministically takes the
-/// public-proxy path (an ambient token would flip it onto the authenticated
-/// API, bypassing `--proxy-url`), and every other variable that could
-/// redirect the API elsewhere or disable it is scrubbed so an ambient value
-/// can't quietly change what the scan reports.
+/// The child gets the hermetic `SOCKET_*` environment (no token, so the
+/// binary deterministically takes the public-proxy path `--proxy-url`
+/// pins, and no ambient variable can redirect or disable the API). The
+/// scans are unscoped, so an activated venv is scrubbed and the JVM env is
+/// isolated (`jvm_env::isolate_cli`). The home pins below must stay after
+/// that call (the last write for a name wins): they replace its shared
+/// stand-in home with siblings of this fixture's repo, so no Coursier, Ivy
+/// or Gradle cache exists below them.
 async fn run(args: &[&str], cwd: &Path, m2_repo: &Path, proxy_url: &str) -> Output {
     let mut args: Vec<String> = args.iter().map(|s| s.to_string()).collect();
     args.extend(["--proxy-url".to_string(), proxy_url.to_string()]);
@@ -58,8 +61,10 @@ async fn run(args: &[&str], cwd: &Path, m2_repo: &Path, proxy_url: &str) -> Outp
     let m2_repo = m2_repo.to_path_buf();
     tokio::task::spawn_blocking(move || {
         let arg_refs: Vec<&str> = args.iter().map(String::as_str).collect();
-        Command::new(binary())
-            .args(&arg_refs)
+        let mut cmd = hermetic::binary_command();
+        hermetic::scrub_extra(&mut cmd, &[hermetic::Extra::Venv]);
+        common::jvm_env::isolate_cli(&mut cmd);
+        cmd.args(&arg_refs)
             .current_dir(&cwd)
             // Point the crawler at the fake local repo.
             .env("MAVEN_REPO_LOCAL", &m2_repo)
@@ -70,17 +75,8 @@ async fn run(args: &[&str], cwd: &Path, m2_repo: &Path, proxy_url: &str) -> Outp
             .env("USERPROFILE", m2_repo.with_file_name("no-home"))
             .env("XDG_CACHE_HOME", m2_repo.with_file_name("no-xdg-cache"))
             .env("LOCALAPPDATA", m2_repo.with_file_name("no-localappdata"))
-            .env_remove("COURSIER_CACHE")
-            .env_remove("SBT_OPTS")
-            .env_remove("JAVA_OPTS")
-            // Keep the run hermetic: no ambient token, no inherited repo path.
-            .env_remove("SOCKET_API_TOKEN")
-            .env_remove("SOCKET_CLI_API_TOKEN")
+            .env("GRADLE_USER_HOME", m2_repo.with_file_name("no-gradle"))
             .env_remove("M2_HOME")
-            .env_remove("SOCKET_API_URL")
-            .env_remove("SOCKET_OFFLINE")
-            .env_remove("SOCKET_PROXY_URL")
-            .env_remove("SOCKET_BATCH_SIZE")
             .output()
             .expect("Failed to run socket-patch binary")
     })
diff --git a/crates/socket-patch-cli/tests/spawn_env_hygiene.rs b/crates/socket-patch-cli/tests/spawn_env_hygiene.rs
index 23ac28316..ed37e4281 100644
--- a/crates/socket-patch-cli/tests/spawn_env_hygiene.rs
+++ b/crates/socket-patch-cli/tests/spawn_env_hygiene.rs
@@ -31,7 +31,6 @@ use serial_test::serial;
 const PENDING_RAW_SPAWNS: &[&str] = &[
     "apply/apply_network.rs",
     "e2e_hosted_production.rs",
-    "e2e_maven.rs",
     "e2e_redirect_cargo_shapes.rs",
     "e2e_scan.rs",
     "e2e_socket_yml_policy.rs",