diff --git a/app/adapters/network/browser.py b/app/adapters/network/browser.py
index 06149c556..458424407 100644
--- a/app/adapters/network/browser.py
+++ b/app/adapters/network/browser.py
@@ -7,8 +7,8 @@ from dataclasses import dataclass, field
 from typing import Any, Callable, Optional, Protocol
 from urllib.parse import urlparse
 
-from app.runtime.config import settings
 from app.runtime.log import logger
+from app.runtime.settings import RuntimeSettingsCompat
 from app.runtime.managed_resources import (
     acquire_managed_resource,
     acquire_managed_resource_async,
@@ -16,6 +16,10 @@ from app.runtime.managed_resources import (
 from app.adapters.network.http import RequestUtils, cookie_parse
 
 
+# 保留旧插件可覆盖的模块级入口，默认通过 runtime 代理动态读取浏览器配置。
+settings = RuntimeSettingsCompat()
+
+
 class BrowserElement(Protocol):
     """
     页面元素的最小接口，避免为了类型标注直接导入 Playwright。
diff --git a/app/adapters/web/security/access.py b/app/adapters/web/security/access.py
index 77fb54498..81c81fcb6 100644
--- a/app/adapters/web/security/access.py
+++ b/app/adapters/web/security/access.py
@@ -15,8 +15,8 @@ from fastapi.security import (
 )
 
 from app.runtime.cache import cached
-from app.runtime.config import settings
 from app.runtime.log import logger
+from app.runtime.settings import RuntimeSettingsCompat
 from app.schemas.token import TokenPayload
 
 SuperuserTokenPayloadProvider = Callable[[], TokenPayload]
@@ -27,6 +27,10 @@ _token_encoder: Optional[TokenEncoder] = None
 _token_decoder: Optional[TokenDecoder] = None
 JWT_ALGORITHM = "HS256"
 
+
+# 兼容旧鉴权插件覆盖模块级设置；令牌实际策略仍由已注入 codec 和 runtime 配置提供。
+settings = RuntimeSettingsCompat()
+
 oauth2_scheme_manual_error = OAuth2PasswordBearer(
     auto_error=False,
     tokenUrl=f"{settings.API_V1_STR}/login/access-token",
diff --git a/tests/fixtures/architecture/configuration-debt-baseline.json b/tests/fixtures/architecture/configuration-debt-baseline.json
index 3c2580878..dc1e86d8c 100644
--- a/tests/fixtures/architecture/configuration-debt-baseline.json
+++ b/tests/fixtures/architecture/configuration-debt-baseline.json
@@ -9,11 +9,9 @@
     "root": "app"
   },
   "settings_imports": {
-    "count": 105,
+    "count": 103,
     "files": [
-      "app/adapters/network/browser.py",
       "app/adapters/system/fsproxy.py",
-      "app/adapters/web/security/access.py",
       "app/agent/capabilities/adapter.py",
       "app/agent/llm/capability.py",
       "app/agent/llm/helper.py",
diff --git a/tests/fixtures/architecture/dependency-baseline.json b/tests/fixtures/architecture/dependency-baseline.json
index 2e8941cea..27928e3be 100644
--- a/tests/fixtures/architecture/dependency-baseline.json
+++ b/tests/fixtures/architecture/dependency-baseline.json
@@ -14,7 +14,7 @@
     "workflow_to_db": []
   },
   "edge_count": 6421,
-  "edge_sha256": "0bbd08d44dc572b174f49e5a08ad2191e8b256ecceb0f7a765e82d3cddf10853",
+  "edge_sha256": "889385bbfbe3634711d921dc76afe38bbfc3ea7c672663e67ae6453aad19af4c",
   "edges": [
     "app -> app.runtime",
     "app -> app.runtime.compat",
@@ -97,9 +97,9 @@
     "app.adapters.network.browser -> app.adapters.network",
     "app.adapters.network.browser -> app.adapters.network.http",
     "app.adapters.network.browser -> app.runtime",
-    "app.adapters.network.browser -> app.runtime.config",
     "app.adapters.network.browser -> app.runtime.log",
     "app.adapters.network.browser -> app.runtime.managed_resources",
+    "app.adapters.network.browser -> app.runtime.settings",
     "app.adapters.network.cloudflare -> app.runtime",
     "app.adapters.network.cloudflare -> app.runtime.log",
     "app.adapters.network.doh -> app.foundation",
@@ -168,8 +168,8 @@
     "app.adapters.web.metrics -> app.runtime.observability",
     "app.adapters.web.security.access -> app.runtime",
     "app.adapters.web.security.access -> app.runtime.cache",
-    "app.adapters.web.security.access -> app.runtime.config",
     "app.adapters.web.security.access -> app.runtime.log",
+    "app.adapters.web.security.access -> app.runtime.settings",
     "app.adapters.web.security.access -> app.schemas",
     "app.adapters.web.security.access -> app.schemas.token",
     "app.agent.callback -> app.agent",