diff --git a/pkg/configtest/env.go b/pkg/configtest/env.go
new file mode 100644
index 000000000..f615930ba
--- /dev/null
+++ b/pkg/configtest/env.go
@@ -0,0 +1,32 @@
+package configtest
+
+import (
+	"testing"
+)
+
+// snykAPIKey is the AutomaticEnv name for configuration.API_URL (viper key "snyk_api").
+// Keep aligned with pkg/configuration/constants.go.
+const snykAPIKey = "SNYK_API"
+
+// KnownLeakEnvironmentKeys is cleared when [IsolateEnvironmentForTest] is called with no arguments.
+var KnownLeakEnvironmentKeys = []string{
+	snykAPIKey,
+}
+
+// IsolateEnvironmentForTest clears environment variables for a test using t.Setenv(k, "").
+// If no keys are provided, it clears the variables listed in [KnownLeakEnvironmentKeys].
+// If explicit keys are provided, they OVERRIDE the default behavior: only the specified keys are cleared,
+// and they are NOT merged with [KnownLeakEnvironmentKeys]. Empty keys are skipped.
+func IsolateEnvironmentForTest(t *testing.T, keys ...string) {
+	t.Helper()
+	toClear := keys
+	if len(toClear) == 0 {
+		toClear = KnownLeakEnvironmentKeys
+	}
+	for _, k := range toClear {
+		if k == "" {
+			continue
+		}
+		t.Setenv(k, "")
+	}
+}
diff --git a/pkg/configuration/configuration_test.go b/pkg/configuration/configuration_test.go
index 6a3b8639e..4ecf90d32 100644
--- a/pkg/configuration/configuration_test.go
+++ b/pkg/configuration/configuration_test.go
@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"github.com/patrickmn/go-cache"
+	"github.com/snyk/go-application-framework/pkg/configtest"
 	"github.com/spf13/pflag"
 	"github.com/stretchr/testify/assert"
 )
@@ -269,6 +270,8 @@ func Test_ConfigurationGet_Url(t *testing.T) {
 }
 
 func Test_ConfigurationGet_StringSlice(t *testing.T) {
+	configtest.IsolateEnvironmentForTest(t)
+
 	config := New()
 
 	expectedDefault := []string{}
diff --git a/pkg/local_workflows/report_analytics_workflow_test.go b/pkg/local_workflows/report_analytics_workflow_test.go
index ac94778a1..1d5d10a8e 100644
--- a/pkg/local_workflows/report_analytics_workflow_test.go
+++ b/pkg/local_workflows/report_analytics_workflow_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/snyk/go-application-framework/pkg/analytics"
+	"github.com/snyk/go-application-framework/pkg/configtest"
 	"github.com/snyk/go-application-framework/pkg/configuration"
 	testutils "github.com/snyk/go-application-framework/pkg/local_workflows/test_utils"
 	"github.com/snyk/go-application-framework/pkg/mocks"
@@ -320,6 +321,7 @@ func testInitReportAnalyticsWorkflow(ctrl *gomock.Controller) error {
 
 func testGetMockHTTPClient(t *testing.T, orgId string, requestPayload string) *http.Client {
 	t.Helper()
+	configtest.IsolateEnvironmentForTest(t)
 	mockClient := testutils.NewTestClient(func(req *http.Request) *http.Response {
 		// Test request parameters
 		require.Equal(t, "/hidden/orgs/"+orgId+"/analytics?version=2024-03-07~experimental", req.URL.String())
diff --git a/pkg/local_workflows/whoami_workflow_test.go b/pkg/local_workflows/whoami_workflow_test.go
index 7aea778ff..dd02ce103 100644
--- a/pkg/local_workflows/whoami_workflow_test.go
+++ b/pkg/local_workflows/whoami_workflow_test.go
@@ -13,6 +13,7 @@ import (
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/assert"
 
+	"github.com/snyk/go-application-framework/pkg/configtest"
 	"github.com/snyk/go-application-framework/pkg/configuration"
 	testutils "github.com/snyk/go-application-framework/pkg/local_workflows/test_utils"
 	"github.com/snyk/go-application-framework/pkg/mocks"
@@ -78,6 +79,8 @@ func setupMockContext(t *testing.T, payload string, json bool, statusCode int) *
 	// This method is a helper
 	t.Helper()
 
+	configtest.IsolateEnvironmentForTest(t)
+
 	// setup
 	logger := zerolog.Logger{}
 	config := configuration.New()
diff --git a/pkg/networking/networking_test.go b/pkg/networking/networking_test.go
index 1970f3e7c..6c9bbc850 100644
--- a/pkg/networking/networking_test.go
+++ b/pkg/networking/networking_test.go
@@ -18,6 +18,7 @@ import (
 	"github.com/snyk/error-catalog-golang-public/cli"
 	"github.com/snyk/error-catalog-golang-public/snyk"
 	"github.com/snyk/error-catalog-golang-public/snyk_errors"
+	"github.com/snyk/go-application-framework/pkg/configtest"
 	"github.com/snyk/go-httpauth/pkg/httpauth"
 	"github.com/stretchr/testify/assert"
 	"golang.org/x/oauth2"
@@ -449,6 +450,8 @@ func Test_UserAgentInfo_Complete(t *testing.T) {
 }
 
 func TestNetworkImpl_Clone(t *testing.T) {
+	configtest.IsolateEnvironmentForTest(t)
+
 	config := configuration.NewWithOpts(configuration.WithAutomaticEnv())
 	network := NewNetworkAccess(config)