diff --git a/.github/workflows/openclaw-release-telegram-qa.yml b/.github/workflows/openclaw-release-telegram-qa.yml
index de0948178c5d..0d7ca3cc26ef 100644
--- a/.github/workflows/openclaw-release-telegram-qa.yml
+++ b/.github/workflows/openclaw-release-telegram-qa.yml
@@ -472,6 +472,7 @@ jobs:
             LANG=C.UTF-8 \
             NODE_OPTIONS=--max-old-space-size=8192 \
             NPM_CONFIG_USERCONFIG=/dev/null \
+            OPENCLAW_BUILD_PRIVATE_QA=1 \
             PATH="$PATH" \
             RUNNER_TEMP="$RUNNER_TEMP" \
             pnpm --dir .candidate exec node scripts/build-all.mjs qaRuntime
diff --git a/docs/.generated/plugin-sdk-api-baseline.sha256 b/docs/.generated/plugin-sdk-api-baseline.sha256
index 98ede16d1c31..a6d55ad5be11 100644
--- a/docs/.generated/plugin-sdk-api-baseline.sha256
+++ b/docs/.generated/plugin-sdk-api-baseline.sha256
@@ -4,7 +4,7 @@ cbf4e2c3088f8886a7c9ea91325a66e0f0846cea21f0b2891f36399b4811306c  module/account
 6b674e7aa4006240227c16eb5c74360f1d67639e8f5580ad72499d6ed28283c4  module/account-resolution
 e5e67ddf3cab38fcbf9220bc3160715897e2709d9a9ff6ff36f1ecc9453c2367  module/agent-config-primitives
 74daa746deb548379d3f0d6eac3c4d082df1034c4360cc03bf51fee0f10a2e4d  module/agent-harness
-a007ddc637e402aab94b52ebd950f8bf7b4f72fa5c03644b629766fdf773da12  module/agent-harness-runtime
+295ed1dea9f7ca084593462f2530434ed3ee87d6a7159616b15a42995a0520f1  module/agent-harness-runtime
 5168648cd946abad8a92822889f13ceacc87ed502314a66190d0b1eb8ebe76ea  module/agent-media-payload
 8b406b7a50b0b4f088be869ea6a899c0d33229a5c73d3f82bda76ce0be0941b0  module/agent-runtime
 dd9282f1eeadf44db2887599b52d80db7f5fb99c6d9eac720dbf1b77065f2145  module/allow-from
diff --git a/extensions/copilot/src/attempt.test.ts b/extensions/copilot/src/attempt.test.ts
index 35734febfbef..549c37ce363e 100644
--- a/extensions/copilot/src/attempt.test.ts
+++ b/extensions/copilot/src/attempt.test.ts
@@ -908,6 +908,13 @@ describe("runCopilotAttempt", () => {
         makeParams({
           imageOrder: ["offloaded"],
           images: [],
+          media: [
+            {
+              url: `media://inbound/${mediaId}`,
+              contentType: "image/png",
+              kind: "image",
+            },
+          ],
           model: {
             api: "openai-responses",
             id: "gpt-4o",
diff --git a/extensions/copilot/src/attempt.ts b/extensions/copilot/src/attempt.ts
index 19f8178402d8..a98c5993efb3 100644
--- a/extensions/copilot/src/attempt.ts
+++ b/extensions/copilot/src/attempt.ts
@@ -1749,6 +1749,7 @@ async function resolvePromptImages(
     model: resolveImageCapabilityModel(params),
     existingImages: Array.isArray(params.images) ? params.images : undefined,
     imageOrder: Array.isArray(params.imageOrder) ? params.imageOrder : undefined,
+    media: Array.isArray(params.media) ? params.media : undefined,
     config: params.config,
     workspaceOnly: context.workspaceOnly,
     localRoots,
diff --git a/src/plugin-sdk/agent-harness-runtime.ts b/src/plugin-sdk/agent-harness-runtime.ts
index 64f01e7f0f7f..f11e6859ce90 100644
--- a/src/plugin-sdk/agent-harness-runtime.ts
+++ b/src/plugin-sdk/agent-harness-runtime.ts
@@ -254,6 +254,7 @@ export async function detectAndLoadAgentHarnessPromptImages(params: {
   model: { input?: string[] };
   existingImages?: ImageContent[];
   imageOrder?: PromptImageOrderEntry[];
+  media?: import("../media/media-facts.js").MediaFact[];
   config?: import("../config/types.openclaw.js").OpenClawConfig;
   workspaceOnly?: boolean;
   localRoots?: readonly string[];
@@ -277,6 +278,7 @@ export async function detectAndLoadAgentHarnessPromptImages(params: {
     model: params.model,
     existingImages: params.existingImages,
     imageOrder: params.imageOrder,
+    media: params.media,
     maxBytes: MAX_IMAGE_BYTES,
     maxDimensionPx: resolveImageSanitizationLimits(params.config).maxDimensionPx,
     workspaceOnly: params.workspaceOnly,
diff --git a/test/scripts/openclaw-release-telegram-qa-workflow.test.ts b/test/scripts/openclaw-release-telegram-qa-workflow.test.ts
index 2cce2d8a16dd..4cc00d1cf99a 100644
--- a/test/scripts/openclaw-release-telegram-qa-workflow.test.ts
+++ b/test/scripts/openclaw-release-telegram-qa-workflow.test.ts
@@ -435,8 +435,12 @@ describe("release Telegram QA workflow", () => {
     };
     const buildJob = workflow.jobs?.build_candidate;
     const runJob = workflow.jobs?.run_telegram;
+    const buildRuntimeStep = buildJob?.steps?.find(
+      (step) => step.name === "Build candidate runtime without runner credentials",
+    );
 
     expect(JSON.stringify(buildJob)).not.toContain("secrets.");
+    expect(buildRuntimeStep?.run).toContain("OPENCLAW_BUILD_PRIVATE_QA=1");
     expect(runJob?.environment).toBe("qa-live-shared");
     const secretSteps = runJob?.steps
       ?.filter((step) => JSON.stringify(step).includes("secrets."))