diff --git a/test/scripts/dependency-vulnerability-gate.test.ts b/test/scripts/dependency-vulnerability-gate.test.ts
index e49181d23389..aa272667c854 100644
--- a/test/scripts/dependency-vulnerability-gate.test.ts
+++ b/test/scripts/dependency-vulnerability-gate.test.ts
@@ -1,4 +1,4 @@
-import { mkdtemp, writeFile } from "node:fs/promises";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { describe, expect, it } from "vitest";
@@ -97,47 +97,51 @@ describe("dependency-vulnerability-gate", () => {
 
   it("queries full and production lockfile graphs separately", async () => {
     const rootDir = await mkdtemp(path.join(tmpdir(), "openclaw-vuln-gate-"));
-    await writeLockfile(rootDir);
-    const payloads: Record<string, string[]>[] = [];
+    try {
+      await writeLockfile(rootDir);
+      const payloads: Record<string, string[]>[] = [];
 
-    const report = await runDependencyVulnerabilityGate({
-      rootDir,
-      fetchImpl: async (_url, init) => {
-        const payload = JSON.parse(String(init?.body));
-        payloads.push(payload);
-        const packages = Object.keys(payload);
-        const body: Record<string, unknown[]> = {};
-        if (packages.includes("runtime-high")) {
-          body["runtime-high"] = [
-            advisory({ id: "GHSA-runtime-high", severity: "high", title: "runtime high" }),
-          ];
-        }
-        if (packages.includes("dev-high")) {
-          body["dev-high"] = [
-            advisory({ id: "GHSA-dev-high", severity: "high", title: "dev high" }),
-          ];
-        }
-        return new Response(JSON.stringify(body), {
-          status: 200,
-          headers: { "content-type": "application/json" },
-        });
-      },
-    });
+      const report = await runDependencyVulnerabilityGate({
+        rootDir,
+        fetchImpl: async (_url, init) => {
+          const payload = JSON.parse(String(init?.body));
+          payloads.push(payload);
+          const packages = Object.keys(payload);
+          const body: Record<string, unknown[]> = {};
+          if (packages.includes("runtime-high")) {
+            body["runtime-high"] = [
+              advisory({ id: "GHSA-runtime-high", severity: "high", title: "runtime high" }),
+            ];
+          }
+          if (packages.includes("dev-high")) {
+            body["dev-high"] = [
+              advisory({ id: "GHSA-dev-high", severity: "high", title: "dev high" }),
+            ];
+          }
+          return new Response(JSON.stringify(body), {
+            status: 200,
+            headers: { "content-type": "application/json" },
+          });
+        },
+      });
 
-    expect(payloads).toHaveLength(2);
-    expect(payloads[0]).toEqual({
-      "dev-high": ["1.0.0"],
-      "runtime-high": ["1.0.0"],
-      "transitive-critical": ["1.0.0"],
-    });
-    expect(payloads[1]).toEqual({
-      "runtime-high": ["1.0.0"],
-    });
-    expect(report.blockers.map((finding) => finding.id)).toEqual(["GHSA-runtime-high"]);
-    expect(report.findings.map((finding) => finding.id)).toEqual([
-      "GHSA-dev-high",
-      "GHSA-runtime-high",
-    ]);
+      expect(payloads).toHaveLength(2);
+      expect(payloads[0]).toEqual({
+        "dev-high": ["1.0.0"],
+        "runtime-high": ["1.0.0"],
+        "transitive-critical": ["1.0.0"],
+      });
+      expect(payloads[1]).toEqual({
+        "runtime-high": ["1.0.0"],
+      });
+      expect(report.blockers.map((finding) => finding.id)).toEqual(["GHSA-runtime-high"]);
+      expect(report.findings.map((finding) => finding.id)).toEqual([
+        "GHSA-dev-high",
+        "GHSA-runtime-high",
+      ]);
+    } finally {
+      await rm(rootDir, { force: true, recursive: true });
+    }
   });
 
   it("documents the resolved transitive dependency graph scope in Markdown", () => {
diff --git a/test/scripts/generate-dependency-release-evidence.test.ts b/test/scripts/generate-dependency-release-evidence.test.ts
index 85a4266b6f12..a2785e8c8830 100644
--- a/test/scripts/generate-dependency-release-evidence.test.ts
+++ b/test/scripts/generate-dependency-release-evidence.test.ts
@@ -1,4 +1,4 @@
-import { mkdtemp, readFile, writeFile } from "node:fs/promises";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { describe, expect, it } from "vitest";
@@ -105,68 +105,72 @@ describe("generate-dependency-release-evidence", () => {
 
   it("collects report counts and renders human summaries", async () => {
     const dir = await mkdtemp(path.join(tmpdir(), "openclaw-release-dependency-evidence-test-"));
-    await writeJson(dir, "dependency-vulnerability-gate.json", {
-      blockers: [{ id: "GHSA-blocker" }],
-      findings: [{ id: "GHSA-blocker" }, { id: "GHSA-report" }],
-    });
-    await writeJson(dir, "transitive-manifest-risk-report.json", {
-      findingCount: 17,
-      workspaceExcludedFindingCount: 3,
-      metadataFailures: [{ packageName: "missing" }],
-    });
-    await writeJson(dir, "dependency-ownership-surface-report.json", {
-      summary: {
-        lockfilePackageCount: 101,
-        buildRiskPackageCount: 8,
-      },
-    });
-    await writeJson(dir, "dependency-changes-report.json", {
-      summary: {
+    try {
+      await writeJson(dir, "dependency-vulnerability-gate.json", {
+        blockers: [{ id: "GHSA-blocker" }],
+        findings: [{ id: "GHSA-blocker" }, { id: "GHSA-report" }],
+      });
+      await writeJson(dir, "transitive-manifest-risk-report.json", {
+        findingCount: 17,
+        workspaceExcludedFindingCount: 3,
+        metadataFailures: [{ packageName: "missing" }],
+      });
+      await writeJson(dir, "dependency-ownership-surface-report.json", {
+        summary: {
+          lockfilePackageCount: 101,
+          buildRiskPackageCount: 8,
+        },
+      });
+      await writeJson(dir, "dependency-changes-report.json", {
+        summary: {
+          dependencyFileChanges: 4,
+          addedPackages: 5,
+          removedPackages: 6,
+          changedPackages: 7,
+        },
+      });
+
+      const counts = await collectDependencyEvidenceSummaryCounts(dir);
+      expect(counts).toEqual({
+        vulnerabilityBlockers: 1,
+        vulnerabilityFindings: 2,
+        transitiveRiskSignals: 17,
+        workspaceExcludedTransitiveSignals: 3,
+        transitiveMetadataFailures: 1,
+        ownershipLockfilePackages: 101,
+        ownershipBuildRiskPackages: 8,
         dependencyFileChanges: 4,
-        addedPackages: 5,
-        removedPackages: 6,
-        changedPackages: 7,
-      },
-    });
+        dependencyAddedPackages: 5,
+        dependencyRemovedPackages: 6,
+        dependencyChangedPackages: 7,
+      });
 
-    const counts = await collectDependencyEvidenceSummaryCounts(dir);
-    expect(counts).toEqual({
-      vulnerabilityBlockers: 1,
-      vulnerabilityFindings: 2,
-      transitiveRiskSignals: 17,
-      workspaceExcludedTransitiveSignals: 3,
-      transitiveMetadataFailures: 1,
-      ownershipLockfilePackages: 101,
-      ownershipBuildRiskPackages: 8,
-      dependencyFileChanges: 4,
-      dependencyAddedPackages: 5,
-      dependencyRemovedPackages: 6,
-      dependencyChangedPackages: 7,
-    });
+      const summary = renderDependencyEvidenceSummary({
+        releaseTag: "v2026.5.13",
+        releaseSha: "abc123",
+        baseRef: "v2026.5.1",
+        counts,
+      });
+      expect(summary).toContain("- npm advisory vulnerability hard blockers: 1");
+      expect(summary).toContain("- Transitive manifest reported risk signals: 17");
+      expect(summary).toContain("- Dependency change baseline: `v2026.5.1`");
+      expect(summary).toContain("- Resolved package changes: +5 -6 changed 7");
 
-    const summary = renderDependencyEvidenceSummary({
-      releaseTag: "v2026.5.13",
-      releaseSha: "abc123",
-      baseRef: "v2026.5.1",
-      counts,
-    });
-    expect(summary).toContain("- npm advisory vulnerability hard blockers: 1");
-    expect(summary).toContain("- Transitive manifest reported risk signals: 17");
-    expect(summary).toContain("- Dependency change baseline: `v2026.5.1`");
-    expect(summary).toContain("- Resolved package changes: +5 -6 changed 7");
+      const stepSummary = renderDependencyEvidenceStepSummary({
+        evidenceArtifactName: "openclaw-release-dependency-evidence-v2026.5.13",
+        baseRef: "v2026.5.1",
+        counts,
+      });
+      expect(stepSummary).toContain(
+        "- Evidence artifact: `openclaw-release-dependency-evidence-v2026.5.13`",
+      );
+      expect(stepSummary).toContain("- npm advisory vulnerability hard blockers: `1`");
 
-    const stepSummary = renderDependencyEvidenceStepSummary({
-      evidenceArtifactName: "openclaw-release-dependency-evidence-v2026.5.13",
-      baseRef: "v2026.5.1",
-      counts,
-    });
-    expect(stepSummary).toContain(
-      "- Evidence artifact: `openclaw-release-dependency-evidence-v2026.5.13`",
-    );
-    expect(stepSummary).toContain("- npm advisory vulnerability hard blockers: `1`");
-
-    await expect(
-      readFile(path.join(dir, "dependency-vulnerability-gate.json"), "utf8"),
-    ).resolves.toContain("GHSA-blocker");
+      await expect(
+        readFile(path.join(dir, "dependency-vulnerability-gate.json"), "utf8"),
+      ).resolves.toContain("GHSA-blocker");
+    } finally {
+      await rm(dir, { force: true, recursive: true });
+    }
   });
 });