diff --git a/tests/hermes_cli/test_cli_init.py b/tests/hermes_cli/test_cli_init.py
index a44bd50d05..4f665ce606 100644
--- a/tests/hermes_cli/test_cli_init.py
+++ b/tests/hermes_cli/test_cli_init.py
@@ -780,3 +780,19 @@ class TestPluginToolsetStartupValidation:
 
 
 
+
+
+@pytest.mark.parametrize(
+    "env, expected",
+    [
+        ({"OPENROUTER_API_KEY": "", "OPENAI_API_KEY": "fake-openai-project-key"}, ""),
+        ({"OPENROUTER_API_KEY": "", "OPENAI_API_KEY": "sk-or-v1-fake-in-openai-var"}, "sk-or-v1-fake-in-openai-var"),
+        ({"OPENROUTER_API_KEY": "sk-or-v1-fake-router", "OPENAI_API_KEY": "fake-openai-project-key"}, "sk-or-v1-fake-router"),
+    ],
+    ids=["real-openai-key-not-seeded", "sk-or-in-openai-var", "openrouter-key-wins"],
+)
+def test_openrouter_startup_key_never_holds_a_real_openai_key(env, expected):
+    # The startup key can reach /model before the first turn resolves runtime,
+    # so it must already follow the sk-or- gate for openrouter.ai.
+    cli = _make_cli(env_overrides=env)
+    assert (cli.api_key or "") == expected