diff --git a/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs b/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs
index d21512967..fc5a3966f 100644
--- a/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs
+++ b/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs
@@ -17,9 +17,7 @@ const PENDING_PRIVATE_HELPERS: &[&str] = &[
     "apply/apply_network.rs",
     "cli/api_client_errors_e2e.rs",
     "diff_created_file_e2e.rs",
-    "e2e_vex_redirect.rs",
     "e2e_vex_vendor.rs",
-    "get/global_packages_e2e.rs",
     "in_process_agent_reapply.rs",
     "in_process_alternate_installers.rs",
     "in_process_cargo_apply.rs",
@@ -31,16 +29,13 @@ const PENDING_PRIVATE_HELPERS: &[&str] = &[
     "in_process_pypi_multi_release.rs",
     "in_process_remote_ecosystems_apply.rs",
     "in_process_remove_repair_lifecycle.rs",
-    "mode_migration_npm.rs",
     "remove_rollback_api_overrides.rs",
     "repair/covgap_commands_repair.rs",
     "repair/covgap_commands_repair_vendor.rs",
     "repair/repair_invariants.rs",
     "rollback/rollback_multicopy_blob_gate.rs",
     "scan/covgap_commands_fetch_stage.rs",
-    "scan_rollout_e2e.rs",
     "scan_vendor_e2e.rs",
-    "vendor_ecosystem_fixtures/mod.rs",
     "vex_e2e_common/mod.rs",
     "vlt_e2e_common/mod.rs",
     "vlt_hosted_common/mod.rs",
diff --git a/crates/socket-patch-cli/tests/e2e_vex_redirect.rs b/crates/socket-patch-cli/tests/e2e_vex_redirect.rs
index c22287262..c9c64e3da 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_redirect.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_redirect.rs
@@ -30,6 +30,10 @@
 //! lockfile still resolves the dependency from its hosted patch (a reverted
 //! lockfile with the ledger left behind must not keep attesting).
 
+#[path = "common/mod.rs"]
+mod common;
+use common::binary;
+
 #[path = "vex_e2e_common/mod.rs"]
 mod vex_e2e_common;
 
@@ -93,10 +97,6 @@ fn write_hosted_package_lock(cwd: &Path, deps: &[(&str, &str, &str)], pinned: bo
     .unwrap();
 }
 
-fn binary() -> &'static str {
-    env!("CARGO_BIN_EXE_socket-patch")
-}
-
 /// CLI invocation with the ambient `SOCKET_*` environment scrubbed (explicit
 /// flags must be the sole source of truth).
 fn cli() -> Command {
diff --git a/crates/socket-patch-cli/tests/get/global_packages_e2e.rs b/crates/socket-patch-cli/tests/get/global_packages_e2e.rs
index c3bc89231..a2d1b723d 100644
--- a/crates/socket-patch-cli/tests/get/global_packages_e2e.rs
+++ b/crates/socket-patch-cli/tests/get/global_packages_e2e.rs
@@ -21,14 +21,11 @@
 //! that crashes, swallows the PURL, or silently reports success no
 //! longer slips through.
 
-use std::path::{Path, PathBuf};
+use std::path::Path;
 use std::process::Command;
 
 use crate::cache_env;
-
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
+use crate::common::binary;
 
 /// Build a `socket-patch` `Command` with the ambient `SOCKET_*` env
 /// surface scrubbed (mirrors `common::run_with_env`). The binary binds
diff --git a/crates/socket-patch-cli/tests/mode_migration_npm.rs b/crates/socket-patch-cli/tests/mode_migration_npm.rs
index f89e3a788..83cf9d7e0 100644
--- a/crates/socket-patch-cli/tests/mode_migration_npm.rs
+++ b/crates/socket-patch-cli/tests/mode_migration_npm.rs
@@ -22,6 +22,10 @@
 //! the registry is unreachable for the fixture install; all assertions after
 //! that are hard.
 
+#[path = "common/mod.rs"]
+mod common;
+use common::{binary, cache_env, git_sha256, hermetic};
+
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
 
@@ -32,10 +36,6 @@ use socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes;
 use wiremock::matchers::{method, path, path_regex};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/cache_env.rs"]
-mod cache_env;
-#[path = "common/hermetic.rs"]
-mod hermetic;
 // yarn legs: release selection (classic) + the manifest-less VEX matrices.
 #[path = "vex_e2e_common/mod.rs"]
 mod vex_e2e_common;
@@ -60,10 +60,6 @@ const YARN_BERRY: &str = "yarn@4.12.0";
 // ── self-contained helpers (harness patterns shared with the redirect /
 //    vendor yarn capstones) ──────────────────────────────────────────────────
 
-fn binary() -> PathBuf {
-    PathBuf::from(env!("CARGO_BIN_EXE_socket-patch"))
-}
-
 /// Probe corepack from a NEUTRAL temp dir: a `packageManager` field in an
 /// ancestor `package.json` makes corepack refuse to run a different package
 /// manager, which would spuriously fail the gate.
@@ -134,10 +130,6 @@ fn copy_dir_recursive(src: &Path, dst: &Path) {
     }
 }
 
-fn git_sha256(content: &[u8]) -> String {
-    compute_git_sha256_from_bytes(content)
-}
-
 /// Write `.socket/manifest.json` + the after-hash blob so `vendor --offline`
 /// runs fully offline (npm-family file keys carry the `package/` prefix).
 fn stage_patch(proj: &Path, before: &[u8], after: &[u8]) {
diff --git a/crates/socket-patch-cli/tests/scan_rollout_e2e.rs b/crates/socket-patch-cli/tests/scan_rollout_e2e.rs
index 335dd3229..63adbe95b 100644
--- a/crates/socket-patch-cli/tests/scan_rollout_e2e.rs
+++ b/crates/socket-patch-cli/tests/scan_rollout_e2e.rs
@@ -3,14 +3,17 @@
 //! three packages per run, most severe first, in hosted, agent and vendored
 //! mode; a fourth run changes nothing. Mock API, the built binary.
 
+#[path = "common/mod.rs"]
+mod common;
+use common::{binary, git_sha256};
+
 #[path = "prebuilt_common/mod.rs"]
 mod prebuilt_common;
 
-use std::path::{Path, PathBuf};
+use std::path::Path;
 use std::process::Command;
 
 use serde_json::{json, Value};
-use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path, path_regex};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
@@ -36,10 +39,6 @@ const ORDER: [&str; 9] = [
     "roll-e", "roll-b", "roll-g", "roll-c", "roll-d", "roll-h", "roll-a", "roll-i", "roll-f",
 ];
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 fn uuid(name: &str) -> String {
     let n = PACKAGES.iter().position(|(p, _)| *p == name).unwrap() + 1;
     format!("{n:08x}-1111-4111-8111-{n:012x}")
@@ -64,13 +63,6 @@ fn after(name: &str) -> Vec<u8> {
     format!("module.exports = '{name} after';\n").into_bytes()
 }
 
-fn git_sha256(content: &[u8]) -> String {
-    let mut hasher = Sha256::new();
-    hasher.update(format!("blob {}\0", content.len()).as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 fn b64(bytes: &[u8]) -> String {
     use base64::Engine;
     base64::engine::general_purpose::STANDARD.encode(bytes)
diff --git a/crates/socket-patch-cli/tests/vendor_ecosystem_fixtures/mod.rs b/crates/socket-patch-cli/tests/vendor_ecosystem_fixtures/mod.rs
index df1178e1a..0e4819770 100644
--- a/crates/socket-patch-cli/tests/vendor_ecosystem_fixtures/mod.rs
+++ b/crates/socket-patch-cli/tests/vendor_ecosystem_fixtures/mod.rs
@@ -15,14 +15,9 @@ mod prebuilt_common;
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
-use sha2::{Digest, Sha256};
+use sha2::Digest as _;
 
-pub fn git_sha256(content: &[u8]) -> String {
-    let mut hasher = Sha256::new();
-    hasher.update(format!("blob {}\0", content.len()).as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
+use crate::common::git_sha256;
 
 /// Every ecosystem fixture, by name.
 pub const ALL: &[&str] = &[
diff --git a/crates/socket-patch-cli/tests/vendor_group_commit_e2e.rs b/crates/socket-patch-cli/tests/vendor_group_commit_e2e.rs
index 374e3a9b0..cdbe93aae 100644
--- a/crates/socket-patch-cli/tests/vendor_group_commit_e2e.rs
+++ b/crates/socket-patch-cli/tests/vendor_group_commit_e2e.rs
@@ -17,13 +17,13 @@
 //!   files (a hand edit after the crash) is set aside whole, never
 //!   half-applied.
 
+#[path = "common/mod.rs"]
+mod common;
+
 #[path = "vendor_ecosystem_fixtures/mod.rs"]
 mod fx;
 
-#[path = "common/envelope.rs"]
-mod envelope;
-
-use envelope::{event_triples, parse_json_envelope};
+use common::envelope::{event_triples, parse_json_envelope};
 use fx::{masked_tree, Fixture};
 
 const OFF: (&str, &str) = ("SOCKET_PATCH_SWITCH_OFF", "group_commit");
diff --git a/crates/socket-patch-cli/tests/vendor_ledger_schema_e2e.rs b/crates/socket-patch-cli/tests/vendor_ledger_schema_e2e.rs
index 7db6f500d..f2014ee28 100644
--- a/crates/socket-patch-cli/tests/vendor_ledger_schema_e2e.rs
+++ b/crates/socket-patch-cli/tests/vendor_ledger_schema_e2e.rs
@@ -15,6 +15,9 @@
 //!   far smaller than the inline text, the others stay version 1, and the
 //!   revert is exact.
 
+#[path = "common/mod.rs"]
+mod common;
+
 #[path = "vendor_ecosystem_fixtures/mod.rs"]
 mod fx;