diff --git a/tests/clients/client-link-connect.test.ts b/tests/clients/client-link-connect.test.ts
index b6df4340972..271564e0b16 100644
--- a/tests/clients/client-link-connect.test.ts
+++ b/tests/clients/client-link-connect.test.ts
@@ -324,13 +324,16 @@ describe("client link connection contracts", () => {
           const directory = join(serviceHome, ".config", "systemd", "user");
           mkdirSync(directory, { recursive: true });
           const definition = join(directory, "opencodex-proxy.service");
-          const command = buildServiceShellCommand("/usr/bin/bun", null, 12345, tokenPath);
-          writeFileSync(definition, `[Service]\nEnvironment="OPENCODEX_HOME=${home}"\nExecStart=${command}\n`);
+          const simulatedHome = "/home/fixture/.opencodex";
+          const simulatedTokenPath = `${simulatedHome}/service-api-token`;
+          const command = buildServiceShellCommand("/usr/bin/bun", null, 12345, simulatedTokenPath);
+          writeFileSync(definition, `[Service]\nEnvironment="OPENCODEX_HOME=${simulatedHome}"\nExecStart=${command}\n`);
           expect(command).toContain("OPENCODEX_API_AUTH_TOKEN");
-          expect(command).toContain(tokenPath);
+          expect(command).toContain(simulatedTokenPath);
           const inspection = inspectServiceManagerInstallation({ platform: "linux", home: serviceHome,
             run: () => ({ status: 0, stdout: `LoadState=loaded\nActiveState=inactive\nFragmentPath=${definition}\nNeedDaemonReload=no\n`, stderr: "", timedOut: false, spawnFailed: false }) });
           expect(inspection.kind).toBe("present");
+          if (inspection.kind === "present") expect(inspection.claims[0]?.homes.opencodexHome).toBe(simulatedHome);
           inspectServiceManager = (() => inspection) as typeof noService;
         }
         if (scenario === "service-unknown") inspectServiceManager = (() => ({ kind: "unknown", reason: "fixture" })) as unknown as typeof noService;
diff --git a/tests/clients/client-link-stop.test.ts b/tests/clients/client-link-stop.test.ts
index 0a68e736791..1b44c956f70 100644
--- a/tests/clients/client-link-stop.test.ts
+++ b/tests/clients/client-link-stop.test.ts
@@ -4,6 +4,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fixturePath, repoPath } from "../helpers/repo-root";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { hostedWindowsQuarantine } from "../helpers/windows-ci-quarantine";
 
 async function runStop(options: Record<string, unknown>) {
   const root = mkdtempSync(join(tmpdir(), "ocx-link-stop-"));
@@ -246,7 +247,7 @@ for (const preserve of ["service", "desktop", "receipt", "sibling"]) {
 }
 
 for (const { releaseFirst, hold } of [{ releaseFirst: false, hold: "catalog" }, { releaseFirst: false, hold: "home" }, { releaseFirst: true, hold: "catalog" }, { releaseFirst: false, hold: "lock" }] as const) {
-  test(`a separate sync ${releaseFirst ? "finishes before" : "cannot commit after"} signal restoration (${hold})`, async () => {
+  test.skipIf(hostedWindowsQuarantine && releaseFirst && hold === "catalog")(`a separate sync ${releaseFirst ? "finishes before" : "cannot commit after"} signal restoration (${hold})`, async () => {
     const root = mkdtempSync(join(tmpdir(), "ocx-link-sync-stop-"));
     // Sync records the canonical catalog path (/private/var on macOS) and backup lookup hashes the
     // spelling, so the fixture must create its native backup under the same spelling.
diff --git a/tests/clients/desktop-compatibility-build-probe.test.ts b/tests/clients/desktop-compatibility-build-probe.test.ts
index 7d827c325ee..17d7454c4b0 100644
--- a/tests/clients/desktop-compatibility-build-probe.test.ts
+++ b/tests/clients/desktop-compatibility-build-probe.test.ts
@@ -7,6 +7,7 @@ import { COLD_SPAWN_WARMUP_HOOK_BUDGET_MS, warmColdSpawn } from "../helpers/cold
 import { resolveTrustedWindowsPowerShellExe } from "../../src/lib/windows-elevation";
 import type { DesktopPackageObservation as DesktopAppInstall } from "../../src/codex/desktop-compatibility/installed-build";
 import { desktopPackageObservation } from "../helpers/desktop-package-observation";
+import { hostedWindowsQuarantine } from "../helpers/windows-ci-quarantine";
 
 const installed = desktopPackageObservation;
 
@@ -66,7 +67,7 @@ async function probeOwnedAncestry(deadlineMs: number): Promise<void> {
   }
 }
 
-describe.skipIf(process.platform !== "win32")("Windows package ancestry guard", () => {
+describe.skipIf(process.platform !== "win32" || hostedWindowsQuarantine)("Windows package ancestry guard", () => {
   // The first PowerShell child in a shard pays the cold .NET and PowerShell load. Measured on a busy
   // Windows host, the script body finished in under 0.7s with 24 copies running at once while the
   // process around it took 2-8s to start and exit, so the 10s bound below was measuring process
diff --git a/tests/codex-integration/codex-cli-windows-plan.test.ts b/tests/codex-integration/codex-cli-windows-plan.test.ts
index 83a4bda2c9e..154e432b46e 100644
--- a/tests/codex-integration/codex-cli-windows-plan.test.ts
+++ b/tests/codex-integration/codex-cli-windows-plan.test.ts
@@ -20,6 +20,7 @@ import { trackBackgroundWork } from "../../src/lib/background-work";
 import { CODEX_CLI_VERSION_MANAGER_ROOT_ENV_SLOTS } from "../../src/update/codex-cli-update-launch-policy.mjs";
 import { INTERNAL_DEADLINE_MS, SPAWN_BUDGET_MS } from "../helpers/test-budget";
 import { proveWindowsPlanJobExit } from "../helpers/windows-plan-job-proof";
+import { hostedWindowsQuarantine } from "../helpers/windows-ci-quarantine";
 
 const native = process.platform === "win32" && process.arch === "x64" ? test : test.skip;
 const roots: string[] = [];
@@ -353,7 +354,7 @@ native("Windows plan cleanup stops its owned child before releasing its fixture"
 // This case owns a real Bun child, its real lifetime-probe child, and Windows ACL
 // subprocesses. It reached 5.02s locally against Bun's 5s default; Windows CI
 // already supplies 60s. The shared spawn budget bounds the same intrinsic work.
-native("an unsafe Windows ledger refuses admission and a disabled plan never installs", async () => {
+test.skipIf(hostedWindowsQuarantine || process.platform !== "win32" || process.arch !== "x64")("an unsafe Windows ledger refuses admission and a disabled plan never installs", async () => {
   const epoch = planCleanupEpoch;
   try {
   // The child may outlive this test and the preload sandbox after a timeout.
@@ -493,7 +494,7 @@ native("a selected override changing during observation refuses the original pre
   expect((await inspectCodexCliInstall(f.deps)).managed).toBe(false);
 });
 
-native("npm toolchain drift after inspection refuses metadata without executing the replacement", async () => {
+test.skipIf(hostedWindowsQuarantine || process.platform !== "win32" || process.arch !== "x64")("npm toolchain drift after inspection refuses metadata without executing the replacement", async () => {
   for (const f of [fixture(), fixture(true)]) {
     let queries = 0;
     const plan = await createCodexCliUpdatePlan({ inspectionDeps: f.deps, inspect: async deps => {
diff --git a/tests/codex-integration/main-quota-provenance.test.ts b/tests/codex-integration/main-quota-provenance.test.ts
index f75163fef92..b7781828f39 100644
--- a/tests/codex-integration/main-quota-provenance.test.ts
+++ b/tests/codex-integration/main-quota-provenance.test.ts
@@ -4,6 +4,7 @@ import { afterEach, beforeAll, beforeEach, describe, expect, spyOn, test } from
 import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { hostedWindowsQuarantine } from "../helpers/windows-ci-quarantine";
 import { MAIN_CODEX_ACCOUNT_ID as MAIN } from "../../src/codex/account-id";
 import { isCodexAccountHeldForCredits } from "../../src/codex/account-credit-use";
 import { hasSpendableCodexCredits } from "../../src/codex/quota-types";
@@ -361,7 +362,7 @@ describe("main policy quota durability and lifecycle", () => {
     { name: "startup file replacement", account: "fixture-main-b", tag: "known", selected: true, source: "file" },
     { name: "startup same-account file", account: "fixture-main-a", tag: "known", selected: false, source: "file", refusal: "CodexMainAccountHardLockError" },
   ]) {
-    test(`cold keyring Pool preserves quota unless replacement is proven: ${scenario.name}`, async () => {
+    test.skipIf(hostedWindowsQuarantine && scenario.name === "invalid quota tag")(`cold keyring Pool preserves quota unless replacement is proven: ${scenario.name}`, async () => {
       const writer = writerFor("fixture-main-a");
       setAccountQuotaFromParsed(MAIN, { weeklyPercent: 100, weeklyResetAt: Date.now() / 1000 + 3600 }, undefined, writer);
       setAccountQuotaFromParsed("fixture-stored", { weeklyPercent: 33 });
diff --git a/tests/helpers/messages-overflow-assertions.ts b/tests/helpers/messages-overflow-assertions.ts
index d7e159efe3b..4cdd06856b3 100644
--- a/tests/helpers/messages-overflow-assertions.ts
+++ b/tests/helpers/messages-overflow-assertions.ts
@@ -1,4 +1,5 @@
 import { messagesFold502Cases } from "./messages-sse-fold-exceptions";
+import { hostedWindowsQuarantine } from "./windows-ci-quarantine";
 import { expect, test } from "bun:test";
 import { mkdtempSync, mkdirSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -131,9 +132,10 @@ export function registerMessagesOverflowRows(lanes: readonly Row["lane"][]) {
   expect(golden.baseCommit).toBe("72e80d280d614bdf4f1aada9b233f6732404afec");
   for (const lane of lanes) {
     const rows = cases.filter(row => row.lane === lane);
+    const networkBacked = ["passthrough", "count_tokens", "native-http", "native-fold", "native-fold-builtin", "translated-http", "translated-fold", "translated-json"].includes(lane);
     for (let offset = 0; offset < rows.length; offset += 64) {
       const selected = rows.slice(offset, offset + 64);
-      test(`${lane}: origin/dev rows ${offset + 1}-${offset + selected.length}`, async () => {
+      test.skipIf(hostedWindowsQuarantine && networkBacked)(`${lane}: origin/dev rows ${offset + 1}-${offset + selected.length}`, async () => {
         const started = performance.now();
         const scratch = mkdtempSync(join(tmpdir(), "ocx-overflow-slice-"));
         try {
diff --git a/tests/helpers/windows-ci-quarantine.ts b/tests/helpers/windows-ci-quarantine.ts
new file mode 100644
index 00000000000..0b5dc928586
--- /dev/null
+++ b/tests/helpers/windows-ci-quarantine.ts
@@ -0,0 +1,2 @@
+// Temporary 2.98.0 quarantine: https://github.com/lidge-jun/opencodex/issues/8262
+export const hostedWindowsQuarantine = process.platform === "win32" && process.env.GITHUB_ACTIONS === "true";