diff --git a/src/services/api-proxy-env-config.ts b/src/services/api-proxy-env-config.ts
index 2d2c59bb9..35033305b 100644
--- a/src/services/api-proxy-env-config.ts
+++ b/src/services/api-proxy-env-config.ts
@@ -8,8 +8,9 @@ import { NetworkConfig } from './squid-service';
 /**
  * Builds provider API target/basePath environment variables for the api-proxy container.
  * Centralizes the repetitive per-provider target/basePath conditional env generation.
+ * @internal Exported for testing
  */
-function buildProviderTargetEnv(config: WrapperConfig): Record<string, string> {
+export function buildProviderTargetEnv(config: WrapperConfig): Record<string, string> {
   const copilotProviderType = config.copilotProviderType || getConfigEnvValue(config, COPILOT_ENV.PROVIDER_TYPE);
   const copilotProviderBaseUrl = config.copilotProviderBaseUrl || getConfigEnvValue(config, COPILOT_ENV.PROVIDER_BASE_URL);
   const copilotProviderApiKey = config.copilotProviderApiKey;
diff --git a/src/services/api-proxy-service-split.test.ts b/src/services/api-proxy-service-split.test.ts
index 0648b1188..e518d561e 100644
--- a/src/services/api-proxy-service-split.test.ts
+++ b/src/services/api-proxy-service-split.test.ts
@@ -3,7 +3,7 @@ import { parseImageTag } from '../image-tag';
 import { COPILOT_PLACEHOLDER_TOKEN } from '../constants/placeholders';
 import { baseConfig } from '../test-helpers/docker-test-fixtures.test-utils';
 import { buildApiProxyServiceConfig } from './api-proxy-service-config';
-import { buildApiProxyBaseEnv } from './api-proxy-env-config';
+import { buildApiProxyBaseEnv, buildProviderTargetEnv } from './api-proxy-env-config';
 import { buildApiProxyLifecycleConfig } from './api-proxy-lifecycle-config';
 import { buildAgentCredentialEnv } from './api-proxy-credential-env';
 
diff --git a/src/ssl-key-storage.ts b/src/ssl-key-storage.ts
index 85d159777..10b5d27ce 100644
--- a/src/ssl-key-storage.ts
+++ b/src/ssl-key-storage.ts
@@ -77,8 +77,9 @@ export async function unmountSslTmpfs(sslDir: string): Promise<void> {
  * cannot be guaranteed on all filesystems (for example, journaling/COW).
  *
  * @param filePath - Path to the file to securely wipe
+ * @internal Exported for testing
  */
-function secureWipeFile(filePath: string): void {
+export function secureWipeFile(filePath: string): void {
   let fd: number | undefined;
 
   try {