diff --git a/src/memory/embeddings-voyage.test.ts b/src/memory/embeddings-voyage.test.ts
index 2f4bedc87c3..28314017a6f 100644
--- a/src/memory/embeddings-voyage.test.ts
+++ b/src/memory/embeddings-voyage.test.ts
@@ -1,8 +1,8 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 import * as authModule from "../agents/model-auth.js";
-import * as ssrf from "../infra/net/ssrf.js";
 import { type FetchMock, withFetchPreconnect } from "../test-utils/fetch-mock.js";
 import { createVoyageEmbeddingProvider, normalizeVoyageModel } from "./embeddings-voyage.js";
+import { mockPublicPinnedHostname } from "./test-helpers/ssrf.js";
 
 vi.mock("../agents/model-auth.js", async () => {
   const { createModelAuthMockModule } = await import("../test-utils/model-auth-mock.js");
@@ -28,18 +28,6 @@ function mockVoyageApiKey() {
   });
 }
 
-function mockPublicPinnedHostname() {
-  return vi.spyOn(ssrf, "resolvePinnedHostnameWithPolicy").mockImplementation(async (hostname) => {
-    const normalized = hostname.trim().toLowerCase().replace(/\.$/, "");
-    const addresses = ["93.184.216.34"];
-    return {
-      hostname: normalized,
-      addresses,
-      lookup: ssrf.createPinnedLookup({ hostname: normalized, addresses }),
-    };
-  });
-}
-
 async function createDefaultVoyageProvider(
   model: string,
   fetchMock: ReturnType<typeof createFetchMock>,
diff --git a/src/memory/embeddings.test.ts b/src/memory/embeddings.test.ts
index 206eb53326f..6f489ecc0c1 100644
--- a/src/memory/embeddings.test.ts
+++ b/src/memory/embeddings.test.ts
@@ -1,8 +1,8 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 import * as authModule from "../agents/model-auth.js";
-import * as ssrf from "../infra/net/ssrf.js";
 import { DEFAULT_GEMINI_EMBEDDING_MODEL } from "./embeddings-gemini.js";
 import { createEmbeddingProvider, DEFAULT_LOCAL_MODEL } from "./embeddings.js";
+import { mockPublicPinnedHostname } from "./test-helpers/ssrf.js";
 
 vi.mock("../agents/model-auth.js", async () => {
   const { createModelAuthMockModule } = await import("../test-utils/model-auth-mock.js");
@@ -33,18 +33,6 @@ function readFirstFetchRequest(fetchMock: { mock: { calls: unknown[][] } }) {
   return { url, init: init as RequestInit | undefined };
 }
 
-function mockPublicPinnedHostname() {
-  return vi.spyOn(ssrf, "resolvePinnedHostnameWithPolicy").mockImplementation(async (hostname) => {
-    const normalized = hostname.trim().toLowerCase().replace(/\.$/, "");
-    const addresses = ["93.184.216.34"];
-    return {
-      hostname: normalized,
-      addresses,
-      lookup: ssrf.createPinnedLookup({ hostname: normalized, addresses }),
-    };
-  });
-}
-
 afterEach(() => {
   vi.resetAllMocks();
   vi.unstubAllGlobals();
diff --git a/src/memory/test-helpers/ssrf.ts b/src/memory/test-helpers/ssrf.ts
new file mode 100644
index 00000000000..c90ef0c4502
--- /dev/null
+++ b/src/memory/test-helpers/ssrf.ts
@@ -0,0 +1,14 @@
+import { vi } from "vitest";
+import * as ssrf from "../../infra/net/ssrf.js";
+
+export function mockPublicPinnedHostname() {
+  return vi.spyOn(ssrf, "resolvePinnedHostnameWithPolicy").mockImplementation(async (hostname) => {
+    const normalized = hostname.trim().toLowerCase().replace(/\.$/, "");
+    const addresses = ["93.184.216.34"];
+    return {
+      hostname: normalized,
+      addresses,
+      lookup: ssrf.createPinnedLookup({ hostname: normalized, addresses }),
+    };
+  });
+}