diff --git a/src/cli/daemon-cli/install.test.ts b/src/cli/daemon-cli/install.test.ts
index 2c6c16dc2..054beebd0 100644
--- a/src/cli/daemon-cli/install.test.ts
+++ b/src/cli/daemon-cli/install.test.ts
@@ -118,6 +118,13 @@ vi.mock("../../runtime.js", () => ({
   },
 }));
 
+function expectFirstInstallPlanCallOmitsToken() {
+  const [firstArg] =
+    (buildGatewayInstallPlanMock.mock.calls.at(0) as [Record<string, unknown>] | undefined) ?? [];
+  expect(firstArg).toBeDefined();
+  expect(firstArg && "token" in firstArg).toBe(false);
+}
+
 const { runDaemonInstall } = await import("./install.js");
 const envSnapshot = captureFullEnv();
 
@@ -198,7 +205,7 @@ describe("runDaemonInstall", () => {
 
     expect(actionState.failed).toEqual([]);
     expect(buildGatewayInstallPlanMock).toHaveBeenCalledTimes(1);
-    expect("token" in buildGatewayInstallPlanMock.mock.calls[0][0]).toBe(false);
+    expectFirstInstallPlanCallOmitsToken();
     expect(writeConfigFileMock).not.toHaveBeenCalled();
     expect(
       actionState.warnings.some((warning) =>
@@ -223,7 +230,7 @@ describe("runDaemonInstall", () => {
     expect(actionState.failed).toEqual([]);
     expect(resolveSecretRefValuesMock).toHaveBeenCalledTimes(1);
     expect(buildGatewayInstallPlanMock).toHaveBeenCalledTimes(1);
-    expect("token" in buildGatewayInstallPlanMock.mock.calls[0][0]).toBe(false);
+    expectFirstInstallPlanCallOmitsToken();
   });
 
   it("auto-mints and persists token when no source exists", async () => {
@@ -245,7 +252,7 @@ describe("runDaemonInstall", () => {
     expect(buildGatewayInstallPlanMock).toHaveBeenCalledWith(
       expect.objectContaining({ port: 18789 }),
     );
-    expect("token" in buildGatewayInstallPlanMock.mock.calls[0][0]).toBe(false);
+    expectFirstInstallPlanCallOmitsToken();
     expect(installDaemonServiceAndEmitMock).toHaveBeenCalledTimes(1);
     expect(actionState.warnings.some((warning) => warning.includes("Auto-generated"))).toBe(true);
   });