diff --git a/crates/contextforge-data-plane-lib/tests/gateway_plugins.rs b/crates/contextforge-data-plane-lib/tests/gateway_plugins.rs
index 0a1f78e..106ba0e 100644
--- a/crates/contextforge-data-plane-lib/tests/gateway_plugins.rs
+++ b/crates/contextforge-data-plane-lib/tests/gateway_plugins.rs
@@ -11,7 +11,7 @@ use rmcp::{
     model::{
         CallToolRequestParams, CallToolResult, ClientCapabilities, ClientRequest, ContentBlock, ErrorCode,
         GetPromptRequestParams, GetPromptResult, Implementation, InitializeRequestParams, ProgressNotificationParam,
-        ReadResourceRequestParams, Request, ResourceContents, Role as McpRole, ServerResult,
+        ProtocolVersion, ReadResourceRequestParams, Request, ResourceContents, Role as McpRole, ServerResult,
     },
     service::{NotificationContext, PeerRequestOptions, RequestHandle, RoleClient, RunningService},
 };
@@ -667,8 +667,7 @@ async fn secrets_detection_pre_hook_respects_field_allowlist() {
     assert_eq!(Some(&Value::from(ignored_secret)), args.get("ignored"));
 }
 
-#[tokio::test(flavor = "multi_thread", worker_threads = 1)]
-async fn secrets_detection_resource_post_hook_redacts_password_resource() {
+async fn assert_secrets_detection_redacts_password_resource(protocol_version: ProtocolVersion) {
     let runtime = runtime_with_secrets_detection(
         vec![cmf_hook_names::RESOURCE_POST_FETCH],
         json!({
@@ -679,7 +678,14 @@ async fn secrets_detection_resource_post_hook_redacts_password_resource() {
     )
     .await;
     let gateway = start_gateway(TEST_USER_ID, true, runtime).await;
-    let service = gateway.connect(TEST_USER_ID).await;
+    let client = support::create_client(TEST_USER_ID);
+    let service = if protocol_version == ProtocolVersion::V_2026_07_28 {
+        support::connect_modern_client(gateway.gateway_url(), client, support::modern_client_info()).await
+    } else {
+        support::connect_client_with_protocol(gateway.gateway_url().to_owned(), client, protocol_version)
+            .await
+            .expect("supported client connects")
+    };
 
     for downstream_uri in ["file:///password.env".to_owned(), format!("{}__file:///password.env", gateway.backend_name)]
     {
@@ -695,6 +701,16 @@ async fn secrets_detection_resource_post_hook_redacts_password_resource() {
     }
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 1)]
+async fn secrets_detection_redacts_password_resource_for_2026_07_28() {
+    assert_secrets_detection_redacts_password_resource(ProtocolVersion::V_2026_07_28).await;
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 1)]
+async fn secrets_detection_redacts_password_resource_for_2025_11_25() {
+    assert_secrets_detection_redacts_password_resource(ProtocolVersion::V_2025_11_25).await;
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
 async fn pre_hook_rewrites_payload_without_changing_forwarded_parameter_headers() {
     let plugin = Arc::new(TestPlugin::new("pre", vec![cmf_hook_names::TOOL_PRE_INVOKE]).with_pre_rewrite());