diff --git a/src/config/plugin-auto-enable.ts b/src/config/plugin-auto-enable.ts
index d68832e236b..1ad048a355e 100644
--- a/src/config/plugin-auto-enable.ts
+++ b/src/config/plugin-auto-enable.ts
@@ -1,3 +1,4 @@
+import type { OpenClawConfig } from "./config.js";
 import { normalizeProviderId } from "../agents/model-selection.js";
 import {
   getChannelPluginCatalogEntry,
@@ -10,7 +11,7 @@ import {
 } from "../channels/registry.js";
 import { isRecord } from "../utils.js";
 import { hasAnyWhatsAppAuth } from "../web/accounts.js";
-import type { OpenClawConfig } from "./config.js";
+import { ensurePluginAllowlisted } from "./plugins-allowlist.js";
 
 type PluginEnableChange = {
   pluginId: string;
@@ -388,20 +389,6 @@ function shouldSkipPreferredPluginAutoEnable(
   return false;
 }
 
-function ensureAllowlisted(cfg: OpenClawConfig, pluginId: string): OpenClawConfig {
-  const allow = cfg.plugins?.allow;
-  if (!Array.isArray(allow) || allow.includes(pluginId)) {
-    return cfg;
-  }
-  return {
-    ...cfg,
-    plugins: {
-      ...cfg.plugins,
-      allow: [...allow, pluginId],
-    },
-  };
-}
-
 function registerPluginEntry(cfg: OpenClawConfig, pluginId: string): OpenClawConfig {
   const entries = {
     ...cfg.plugins?.entries,
@@ -463,7 +450,7 @@ export function applyPluginAutoEnable(params: {
       continue;
     }
     next = registerPluginEntry(next, entry.pluginId);
-    next = ensureAllowlisted(next, entry.pluginId);
+    next = ensurePluginAllowlisted(next, entry.pluginId);
     changes.push(formatAutoEnableChange(entry));
   }
 
diff --git a/src/config/plugins-allowlist.ts b/src/config/plugins-allowlist.ts
new file mode 100644
index 00000000000..a0893f131da
--- /dev/null
+++ b/src/config/plugins-allowlist.ts
@@ -0,0 +1,15 @@
+import type { OpenClawConfig } from "./config.js";
+
+export function ensurePluginAllowlisted(cfg: OpenClawConfig, pluginId: string): OpenClawConfig {
+  const allow = cfg.plugins?.allow;
+  if (!Array.isArray(allow) || allow.includes(pluginId)) {
+    return cfg;
+  }
+  return {
+    ...cfg,
+    plugins: {
+      ...cfg.plugins,
+      allow: [...allow, pluginId],
+    },
+  };
+}
diff --git a/src/plugins/enable.ts b/src/plugins/enable.ts
index 9f5cc479291..1602af22cca 100644
--- a/src/plugins/enable.ts
+++ b/src/plugins/enable.ts
@@ -1,4 +1,5 @@
 import type { OpenClawConfig } from "../config/config.js";
+import { ensurePluginAllowlisted } from "../config/plugins-allowlist.js";
 
 export type PluginEnableResult = {
   config: OpenClawConfig;
@@ -6,20 +7,6 @@ export type PluginEnableResult = {
   reason?: string;
 };
 
-function ensureAllowlisted(cfg: OpenClawConfig, pluginId: string): OpenClawConfig {
-  const allow = cfg.plugins?.allow;
-  if (!Array.isArray(allow) || allow.includes(pluginId)) {
-    return cfg;
-  }
-  return {
-    ...cfg,
-    plugins: {
-      ...cfg.plugins,
-      allow: [...allow, pluginId],
-    },
-  };
-}
-
 export function enablePluginInConfig(cfg: OpenClawConfig, pluginId: string): PluginEnableResult {
   if (cfg.plugins?.enabled === false) {
     return { config: cfg, enabled: false, reason: "plugins disabled" };
@@ -42,6 +29,6 @@ export function enablePluginInConfig(cfg: OpenClawConfig, pluginId: string): Plu
       entries,
     },
   };
-  next = ensureAllowlisted(next, pluginId);
+  next = ensurePluginAllowlisted(next, pluginId);
   return { config: next, enabled: true };
 }