diff --git a/tests/test_hermes_leoclean_kb_bridge_source.py b/tests/test_hermes_leoclean_kb_bridge_source.py
index 90105f1..5eaa0ce 100644
--- a/tests/test_hermes_leoclean_kb_bridge_source.py
+++ b/tests/test_hermes_leoclean_kb_bridge_source.py
@@ -308,7 +308,20 @@ def _configure_runtime_environment(monkeypatch: pytest.MonkeyPatch) -> None:
             normalized_key.startswith("PG")
             or normalized_key.startswith("CLOUDSDK_")
             or normalized_key == "GOOGLE_APPLICATION_CREDENTIALS"
-            or normalized_key in {"LD_PRELOAD", "PYTHONHOME", "PYTHONPATH"}
+            or normalized_key.startswith("LD_")
+            or normalized_key.startswith("BASH_FUNC_")
+            or normalized_key.startswith("PYTHON")
+            or normalized_key
+            in {
+                "BASH_ENV",
+                "BASHOPTS",
+                "CDPATH",
+                "ENV",
+                "GLOBIGNORE",
+                "IFS",
+                "PS4",
+                "SHELLOPTS",
+            }
             or normalized_key == "PROXY"
             or normalized_key.endswith("_PROXY")
             or normalized_key in {
@@ -325,6 +338,24 @@ def _configure_runtime_environment(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setenv("TELEO_CLOUDSQL_ENABLE_AUDIT_FALLBACK", "0")
 
 
+def test_runtime_environment_fixture_scrubs_github_runner_inheritance(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    module = _load_module(BRIDGE_DIR / "cloudsql_memory_tool.py")
+    args = _runtime_connection_args(module)
+    monkeypatch.setenv("CI", "true")
+    monkeypatch.setenv("LD_LIBRARY_PATH", "/opt/hostedtoolcache/Python/3.11.15/x64/lib")
+    monkeypatch.setenv("pythonLocation", "/opt/hostedtoolcache/Python/3.11.15/x64")
+    monkeypatch.setenv("HTTP_PROXY", "http://runner-proxy.invalid:8080")
+    monkeypatch.setenv("BASH_FUNC_runner%%", "() { :; }")
+    monkeypatch.setenv("SSL_CERT_FILE", "/tmp/runner-ca.pem")
+
+    _configure_runtime_environment(monkeypatch)
+
+    assert os.environ["CI"] == "true"
+    module.validate_runtime_connection(args)
+
+
 class _FakeHttpResponse:
     def __init__(self, body: bytes, status: int = 200) -> None:
         self.body = body