diff --git a/apps/api/src/core/tenant-provider-config.ts b/apps/api/src/core/tenant-provider-config.ts
index 0ae4f5f2..b0575091 100644
--- a/apps/api/src/core/tenant-provider-config.ts
+++ b/apps/api/src/core/tenant-provider-config.ts
@@ -51,7 +51,12 @@ function parseSecretRef(value: unknown): { scope: TenantSecretScope; key: string
 
 function defaultSecretScope(provider: string): TenantSecretScope {
   const normalized = provider.toLowerCase().replace(/[_\s]/g, '-');
-  if (normalized.includes('sms') || normalized === 'aliyun' || normalized === 'tencent') return 'sms';
+  if (
+    normalized.includes('sms') ||
+    normalized === 'aliyun' ||
+    normalized === 'aliyun-pnvs' ||
+    normalized === 'tencent'
+  ) return 'sms';
   if (normalized.includes('pay') || normalized.includes('alipay')) return 'payment';
   return 'oauth';
 }
diff --git a/scripts/aliyun-pnvs-provider-contract-test.js b/scripts/aliyun-pnvs-provider-contract-test.js
index 62e7d760..d7ebc76b 100644
--- a/scripts/aliyun-pnvs-provider-contract-test.js
+++ b/scripts/aliyun-pnvs-provider-contract-test.js
@@ -8,6 +8,7 @@ const deployEnvExample = fs.readFileSync(path.join(process.cwd(), 'scripts/deplo
 const providerDoc = fs.readFileSync(path.join(process.cwd(), 'docs/refactor/auth-payment-provider-plan.md'), 'utf8');
 const launchChecklist = fs.readFileSync(path.join(process.cwd(), 'docs/refactor/web-launch-acceptance-checklist.md'), 'utf8');
 const readinessSource = fs.readFileSync(path.join(process.cwd(), 'scripts/production-readiness-check.js'), 'utf8');
+const tenantProviderConfigSource = fs.readFileSync(path.join(process.cwd(), 'apps/api/src/core/tenant-provider-config.ts'), 'utf8');
 
 assert.match(providerSource, /class AliyunPnvsSmsProvider/, 'PNVS provider class should exist');
 assert.match(providerSource, /SendSmsVerifyCode/, 'PNVS provider should call SendSmsVerifyCode');
@@ -17,6 +18,7 @@ assert.match(providerSource, /##code##/, 'PNVS provider should preserve Aliyun-g
 assert.match(routeSource, /aliyun-pnvs/, 'auth routes should recognize aliyun-pnvs aliases');
 assert.match(routeSource, /verification.*provider/s, 'auth routes should store provider verification mode');
 assert.match(routeSource, /provider\.verify/, 'auth routes should delegate PNVS verification to provider');
+assert.match(tenantProviderConfigSource, /normalized === 'aliyun-pnvs'[\s\S]*return 'sms'/, 'PNVS secrets should default to sms scope');
 assert.match(deployEnvExample, /AUTH_SMS_PROVIDER=aliyun-pnvs/, 'deploy env example should prefer aliyun-pnvs');
 assert.match(readinessSource, /aliyunPnvs/, 'production readiness should validate aliyun-pnvs public config');
 assert.match(providerDoc, /SendSmsVerifyCode/, 'provider doc should document PNVS send action');