diff --git a/src/entry.respawn.test.ts b/src/entry.respawn.test.ts
index c56381f8c9c7..86efc11146a4 100644
--- a/src/entry.respawn.test.ts
+++ b/src/entry.respawn.test.ts
@@ -103,7 +103,7 @@ describe("buildCliRespawnPlan", () => {
     expect(respawnPlan.detachForProcessTree).toBe(false);
   });
 
-  it("uses the file-backed CA store for one-shot macOS commands", () => {
+  it("uses bundled public roots for one-shot macOS commands", () => {
     const plan = buildCliRespawnPlan({
       argv: ["node", "openclaw", "cron", "list", "--json"],
       env: { NODE_USE_SYSTEM_CA: "1" },
@@ -115,7 +115,7 @@ describe("buildCliRespawnPlan", () => {
     const respawnPlan = expectCliRespawnPlan(plan);
     expect(respawnPlan.argv).toEqual([
       EXPERIMENTAL_WARNING_FLAG,
-      OPENSSL_CA_FLAG,
+      BUNDLED_CA_FLAG,
       "openclaw",
       "cron",
       "list",
@@ -182,15 +182,15 @@ describe("buildCliRespawnPlan", () => {
     },
   );
 
-  it("does not respawn again after selecting the macOS file-backed CA store", () => {
+  it("does not respawn again after selecting bundled public roots", () => {
     expect(
       buildCliRespawnPlan({
         argv: ["node", "openclaw", "cron", "list", "--json"],
         env: {
-          NODE_USE_SYSTEM_CA: "1",
+          NODE_USE_SYSTEM_CA: "0",
           [OPENCLAW_NODE_OPTIONS_READY]: "1",
         },
-        execArgv: [OPENSSL_CA_FLAG, EXPERIMENTAL_WARNING_FLAG],
+        execArgv: [BUNDLED_CA_FLAG, EXPERIMENTAL_WARNING_FLAG],
         autoNodeExtraCaCerts: undefined,
         platform: "darwin",
       }),
diff --git a/src/entry.respawn.ts b/src/entry.respawn.ts
index 465ba1313c67..3a90d9651d34 100644
--- a/src/entry.respawn.ts
+++ b/src/entry.respawn.ts
@@ -152,11 +152,11 @@ export function buildCliRespawnPlan(
     !hasNodeRuntimeOption({ env, execArgv, option: OPENSSL_CA_FLAG })
   ) {
     // Node loads the macOS Keychain off-thread on the first TLS import, then joins
-    // that worker during shutdown. One-shot CLIs use the file-backed CA store instead;
+    // that worker during shutdown. One-shot CLIs use Node's bundled public roots;
     // an explicit --use-system-ca remains the opt-in for Keychain-only trust.
     childEnv.NODE_USE_SYSTEM_CA = "0";
     if (!hasNodeRuntimeOption({ env, execArgv, option: BUNDLED_CA_FLAG })) {
-      childExecArgv.unshift(OPENSSL_CA_FLAG);
+      childExecArgv.unshift(BUNDLED_CA_FLAG);
     }
     needsRespawn = true;
   }