diff --git a/tests/integration/multi-instance/multi_instance_test.go b/tests/integration/multi-instance/multi_instance_test.go
index 1a4ede06..95370efc 100644
--- a/tests/integration/multi-instance/multi_instance_test.go
+++ b/tests/integration/multi-instance/multi_instance_test.go
@@ -345,7 +345,10 @@ func (e *env) startInstance(t *testing.T, name, addr string) *instance {
 	cmd.Stdout, cmd.Stderr = log, log
 	// 演练环境可能带有空的对象存储变量。子进程必须按「未配置」启动，
 	// 否则测不到带类型空 *S3 回落本地目录的路径。
-	cmd.Env = withoutBlobstoreS3(os.Environ())
+	cmd.Env = append(withoutBlobstoreS3(os.Environ()),
+		"SUPER_ADMIN_OWNER=mi-root",
+		"SUPER_ADMIN_PASSWORD=MiRootPass12345!",
+	)
 	// 独立 cwd：serve 会向 ./data 写 skills/SQLite 等，不能落在测试目录。
 	dataDir := t.TempDir()
 	cmd.Dir = dataDir
@@ -455,10 +458,8 @@ func (e *env) killNine(t *testing.T, inst *instance) {
 // 独占落 JSON），redeem 会话进入 grant-setup 改密设 alicePass，完成后再发 Key。
 func (e *env) loginAlice(t *testing.T) *userClient {
 	t.Helper()
-	// 空库先引导首个管理员（本地 pending 创建要求库内已有用户），再建 alice。
-	// 两步都签发一次性凭据，独占落临时 JSON；mi-root 的凭据随后用于初始化其账号。
-	rootCred := filepath.Join(t.TempDir(), "root-cred.json")
-	e.cliIn(t, e.a.dataDir, "user", "bootstrap-admin", "--dsn", e.dbDSN, "--owner", "mi-root", "--out-file", rootCred)
+	// 超级管理员 mi-root 已由 serve 启动时的 SUPER_ADMIN_* 建立；这里只建 alice，
+	// 一次性激活凭据独占落临时 JSON。
 	activation := filepath.Join(t.TempDir(), "activation.json")
 	e.cliIn(t, e.a.dataDir, "user", "create", "--dsn", e.dbDSN, "--owner", aliceOwner, "--name", "Alice", "--out", activation)
 	activateKey := activationSecret(t, activation)
@@ -477,7 +478,7 @@ func (e *env) loginAlice(t *testing.T) *userClient {
 
 	apiKey := e.cliOut(t, "apikey", "create", "--dsn", e.dbDSN, "--owner", aliceOwner, "--name", "mi-acceptance")
 	// IAM U4 把建项目改为系统动作 project.create：由引导管理员经真实 API 授予 alice。
-	e.grantAliceProjectCreate(t, rootCred)
+	e.grantAliceProjectCreate(t)
 	uc := &userClient{
 		api:     &http.Client{Timeout: httpWait, Transport: bearerRT{key: apiKey}},
 		apiB:    &http.Client{Timeout: httpWait, Transport: bearerRT{key: apiKey}},
@@ -491,30 +492,9 @@ func (e *env) loginAlice(t *testing.T) *userClient {
 
 // grantAliceProjectCreate 以 mi-root 身份经 admin API 为 alice 追加系统授权
 // project.create（保留其已有授权；PUT 为整体替换，按 authorityEpoch 乐观并发）。
-// bootstrap-admin 只签发一次性凭据，mi-root 未初始化前不能发 API key，故先照
-// alice 的方式 redeem 并设 rootPass。
-func (e *env) grantAliceProjectCreate(t *testing.T, rootCred string) {
+// mi-root 由 serve 启动时的 SUPER_ADMIN_* 建立，可直接为其发 API key。
+func (e *env) grantAliceProjectCreate(t *testing.T) {
 	t.Helper()
-	raw, err := os.ReadFile(rootCred)
-	if err != nil {
-		t.Fatal(err)
-	}
-	rootSecret := strings.TrimSpace(string(raw))
-	if rootSecret == "" {
-		t.Fatal("bootstrap-admin credential file is empty")
-	}
-	jar, err := cookiejar.New(nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	sess := &http.Client{Timeout: httpWait, Jar: jar}
-	e.do(t, sess, "POST", "/api/auth/login-key/redeem", map[string]any{
-		"key": rootSecret,
-	}, nil)
-	e.do(t, sess, "POST", "/api/auth/password", map[string]any{
-		"next": rootPass,
-	}, nil)
-
 	rootKey := e.cliOut(t, "apikey", "create", "--dsn", e.dbDSN, "--owner", "mi-root", "--name", "mi-acceptance-root")
 	root := &http.Client{Timeout: httpWait, Transport: bearerRT{key: rootKey}}
 	var users []struct {
diff --git a/tests/load/collaboration/run_load.sh b/tests/load/collaboration/run_load.sh
index a62c0834..93c561a6 100755
--- a/tests/load/collaboration/run_load.sh
+++ b/tests/load/collaboration/run_load.sh
@@ -117,7 +117,9 @@ u = urlsplit(sys.argv[1])
 print(urlunsplit((u.scheme, u.netloc, "/u7load_app", u.query, "")))
 PY
 )"
-"$BIN" user create --dsn "$APP_DSN" --admin --owner load_admin --password load-admin-pass-Aa1 >/dev/null
+# load_admin 由 serve 启动时按 SUPER_ADMIN_* 建立为超级管理员。
+export SUPER_ADMIN_OWNER=load_admin
+export SUPER_ADMIN_PASSWORD=load-admin-pass-Aa1
 "$BIN" user create --dsn "$APP_DSN" --owner probe_user --password probe-user-pass-Aa9 >/dev/null
 
 # ---- 3b) B5 seed（可选）：先建 seed_u* 再 COPY 灌量 ----
diff --git a/tests/test_svc.py b/tests/test_svc.py
index 60ebf1cb..b1a64636 100644
--- a/tests/test_svc.py
+++ b/tests/test_svc.py
@@ -893,7 +893,7 @@ class SvcDbRecoveryTests(unittest.TestCase):
     def test_rdm_source_deploy_end_to_end(self):
         remote, work = self.make_rdm_repo()
         env = self.rdm_env(remote)
-        result = self.svc("rdm1", "deploy", "--from", "rdm", "--port", "18841", env=env)
+        result = self.svc("rdm1", "deploy", "--from", "rdm", "--port", "18843", env=env)
         d = self.runtime("rdm1")
         # U2：组合产物入不可变 release，经 current 指针解析；插件空集、工作台随 release。
         active = d / "current"