diff --git a/ci/env-var-doc-allowlist.json b/ci/env-var-doc-allowlist.json
index 53729dedb47..21712b89d06 100644
--- a/ci/env-var-doc-allowlist.json
+++ b/ci/env-var-doc-allowlist.json
@@ -15,10 +15,6 @@
     "name": "NEMOCLAW_DISABLE_GATEWAY_DRIFT_PREFLIGHT",
     "reason": "Internal Vitest-only sentinel that prevents hermetic CLI tests with fake OpenShell binaries from reading the host's real Docker gateway image. Production users should not set it."
   },
-  {
-    "name": "NEMOCLAW_BEDROCK_RUNTIME_ADAPTER_PORT",
-    "reason": "Internal child-process setting used only when launching the hidden Bedrock Runtime adapter. Users should configure Bedrock through the existing custom Anthropic endpoint flow instead."
-  },
   {
     "name": "NEMOCLAW_BEDROCK_RUNTIME_ENDPOINT_URL",
     "reason": "Internal child-process setting used only to pass the auto-detected Bedrock Runtime endpoint to the hidden local adapter. Not a public user-facing configuration knob."
@@ -27,10 +23,6 @@
     "name": "NEMOCLAW_BEDROCK_RUNTIME_REGION",
     "reason": "Internal child-process setting used only to pass the resolved Bedrock Runtime region to the hidden local adapter. Users should rely on the endpoint URL or standard AWS region environment variables."
   },
-  {
-    "name": "NEMOCLAW_HTTPS_PIN_RUNTIME_ADAPTER_PORT",
-    "reason": "Internal child-process setting used only when launching the hidden HTTPS Pin Runtime adapter. The port is a fixed internal constant, not a public user-facing configuration knob."
-  },
   {
     "name": "NEMOCLAW_HTTPS_PIN_RUNTIME_ADAPTER_CONTROL_TOKEN",
     "reason": "Internal host-only child-process secret used to authenticate HTTPS Pin Runtime adapter control-plane calls. It is generated by NemoClaw, stored in a private local state file, and never registered with OpenShell or supplied by users."