diff --git a/src/lib/onboard/gateway-host-runtime.test.ts b/src/lib/onboard/gateway-host-runtime.test.ts
index 94639413704..a7a1edb7adc 100644
--- a/src/lib/onboard/gateway-host-runtime.test.ts
+++ b/src/lib/onboard/gateway-host-runtime.test.ts
@@ -576,11 +576,17 @@ describe("gateway host runtime attachment probe", () => {
 
   it("reads the authoritative gateway port lazily, not at construction (#6576)", () => {
     let port = 8080;
-    const runtime = createGatewayHostRuntime(createDeps({ gatewayPort: () => port }));
+    const getGatewayStartNetworkEnv = vi.fn((gatewayPort: number) => ({
+      OPENSHELL_SERVER_PORT: String(gatewayPort),
+    }));
+    const runtime = createGatewayHostRuntime(
+      createDeps({ gatewayPort: () => port, getGatewayStartNetworkEnv }),
+    );
 
     port = 9443;
 
     expect(runtime.getGatewayStartEnv()).toMatchObject({ OPENSHELL_SERVER_PORT: "9443" });
+    expect(getGatewayStartNetworkEnv).toHaveBeenCalledWith(9443);
   }, 15_000);
 
   it("registers and selects the exact declared endpoint without prior gateway metadata (#6576)", async () => {
diff --git a/src/lib/onboard/gateway-host-runtime.ts b/src/lib/onboard/gateway-host-runtime.ts
index 49cdd794fa7..b3330efb24a 100644
--- a/src/lib/onboard/gateway-host-runtime.ts
+++ b/src/lib/onboard/gateway-host-runtime.ts
@@ -56,6 +56,8 @@ export interface GatewayHostRuntimeDeps {
    */
   gatewayPort(): number;
   gatewayName(): string;
+  /** Optional narrow resolver for callers that already own the gateway network boundary. */
+  getGatewayStartNetworkEnv?(gatewayPort: number): Record<string, string>;
   /**
    * Unfiltered listener enumeration. An externally supervised gateway is an
    * ordinary systemd-run executable with no Docker-driver env markers, so the
@@ -545,9 +547,12 @@ export function createGatewayHostRuntime(deps: GatewayHostRuntimeDeps): GatewayH
     // reads NEMOCLAW_GATEWAY_BIND_ADDRESS at load, and callers that reload
     // onboarding with a different environment drop it from the require cache.
     // A hoisted binding would pin this module to the stale first instance.
-    const { getGatewayStartNetworkEnv } =
-      require("./docker-driver-gateway-env") as typeof import("./docker-driver-gateway-env");
-    const gatewayEnv = getGatewayStartNetworkEnv(deps.gatewayPort());
+    const gatewayPort = deps.gatewayPort();
+    const gatewayEnv = deps.getGatewayStartNetworkEnv
+      ? deps.getGatewayStartNetworkEnv(gatewayPort)
+      : (
+          require("./docker-driver-gateway-env") as typeof import("./docker-driver-gateway-env")
+        ).getGatewayStartNetworkEnv(gatewayPort);
     const openshellVersion = deps.getInstalledOpenshellVersion();
     if (openshellVersion) {
       const stableGatewayImage = `ghcr.io/nvidia/openshell/cluster:${openshellVersion}`;