diff --git a/codex-rs/core/src/thread_manager_tests.rs b/codex-rs/core/src/thread_manager_tests.rs
index 0e3f336f66..4502d4938b 100644
--- a/codex-rs/core/src/thread_manager_tests.rs
+++ b/codex-rs/core/src/thread_manager_tests.rs
@@ -1876,8 +1876,18 @@ async fn cloud_agent_uses_memory_only_models_cache_with_local_runtime_paths() {
         /*external_time_provider*/ None,
     );
 
-    let _ = manager.list_models(RefreshStrategy::OnlineIfUncached).await;
-    let _ = manager.list_models(RefreshStrategy::OnlineIfUncached).await;
+    let http_client_factory = codex_http_client::HttpClientFactory::new(
+        codex_http_client::OutboundProxyPolicy::ReqwestDefault,
+    );
+    let _ = manager
+        .list_models(
+            RefreshStrategy::OnlineIfUncached,
+            http_client_factory.clone(),
+        )
+        .await;
+    let _ = manager
+        .list_models(RefreshStrategy::OnlineIfUncached, http_client_factory)
+        .await;
 
     assert_eq!(models_mock.requests().len(), 1);
     assert!(!config.codex_home.join("models_cache.json").exists());
diff --git a/codex-rs/models-manager/src/manager_tests.rs b/codex-rs/models-manager/src/manager_tests.rs
index 7347b3b139..20ba8ff207 100644
--- a/codex-rs/models-manager/src/manager_tests.rs
+++ b/codex-rs/models-manager/src/manager_tests.rs
@@ -222,10 +222,16 @@ async fn manager_without_disk_cache_fetches_and_retains_models_in_memory() {
     );
 
     let catalog = manager
-        .raw_model_catalog(RefreshStrategy::OnlineIfUncached)
+        .raw_model_catalog(
+            RefreshStrategy::OnlineIfUncached,
+            DEFAULT_HTTP_CLIENT_FACTORY,
+        )
         .await;
     let cached_catalog = manager
-        .raw_model_catalog(RefreshStrategy::OnlineIfUncached)
+        .raw_model_catalog(
+            RefreshStrategy::OnlineIfUncached,
+            DEFAULT_HTTP_CLIENT_FACTORY,
+        )
         .await;
 
     assert_eq!(catalog.models, remote_models);
diff --git a/codex-rs/rmcp-client/src/oauth.rs b/codex-rs/rmcp-client/src/oauth.rs
index 4d66348645..413423d418 100644
--- a/codex-rs/rmcp-client/src/oauth.rs
+++ b/codex-rs/rmcp-client/src/oauth.rs
@@ -1031,7 +1031,8 @@ mod tests {
         let fallback_path = super::fallback_file_path()?;
         let original_file = fs::read(&fallback_path)?;
 
-        let loaded = super::load_oauth_tokens(
+        let loaded = super::resolve_oauth_tokens_from_store_policy(
+            &DefaultKeyringStore,
             &tokens.server_name,
             &tokens.url,
             OAuthCredentialsStoreMode::Disabled,
@@ -1051,7 +1052,7 @@ mod tests {
             AuthKeyringBackendKind::Direct,
         )?;
 
-        assert_eq!(loaded, None);
+        assert!(loaded.is_none());
         assert_eq!(
             save_error.to_string(),
             "MCP OAuth credential persistence is disabled for this runtime"
diff --git a/codex-rs/rmcp-client/src/oauth/resolved_store.rs b/codex-rs/rmcp-client/src/oauth/resolved_store.rs
index 6a688ea539..2cd226072a 100644
--- a/codex-rs/rmcp-client/src/oauth/resolved_store.rs
+++ b/codex-rs/rmcp-client/src/oauth/resolved_store.rs
@@ -111,6 +111,7 @@ pub(crate) fn resolve_oauth_tokens_from_store_policy<K: KeyringStore + Clone + '
     keyring_backend_kind: AuthKeyringBackendKind,
 ) -> Result<Option<ResolvedOAuthTokens>> {
     match store_mode {
+        OAuthCredentialsStoreMode::Disabled => Ok(None),
         OAuthCredentialsStoreMode::Auto => {
             // Auto remains keyring-first at lifecycle startup. The returned source is then pinned
             // by the client transport recipe and OAuth persistor so retries, recovery, and