diff --git a/src/utils/githubModelsCredentials.refresh.test.ts b/src/utils/githubModelsCredentials.refresh.test.ts
index 12dbff7e7..d8dd14929 100644
--- a/src/utils/githubModelsCredentials.refresh.test.ts
+++ b/src/utils/githubModelsCredentials.refresh.test.ts
@@ -3,8 +3,16 @@ import {
   acquireSharedMutationLock,
   releaseSharedMutationLock,
 } from '../test/sharedMutationLock.js'
-import * as realDeviceFlow from '../services/github/deviceFlow.js'
-import * as realSecureStorage from './secureStorage/index.js'
+
+// Module namespaces have live bindings: keep detached exports so a module mock
+// cannot replace the implementations that cleanup needs to restore.
+const nonce = `${Date.now()}-${Math.random()}`
+const realDeviceFlow = {
+  ...await import(`../services/github/deviceFlow.js?real=${nonce}`),
+}
+const realSecureStorage = {
+  ...await import(`./secureStorage/index.js?real=${nonce}`),
+}
 
 async function importFreshModule() {
   mock.restore()
@@ -174,6 +182,8 @@ describe('refreshCopilotTokenOn401', () => {
   afterEach(() => {
     try {
       mock.restore()
+      mock.module('./secureStorage/index.js', () => realSecureStorage)
+      mock.module('../services/github/deviceFlow.js', () => realDeviceFlow)
       for (const [k, v] of Object.entries(orig)) {
         if (v === undefined) {
           delete process.env[k as keyof typeof orig]