diff --git a/pkg/workflow/blocked_domains_integration_test.go b/pkg/workflow/blocked_domains_integration_test.go
index befd726f49..aa6fdd1c21 100644
--- a/pkg/workflow/blocked_domains_integration_test.go
+++ b/pkg/workflow/blocked_domains_integration_test.go
@@ -65,9 +65,9 @@ Test workflow with blocked domains.
 
 		lockYAML := string(lockContent)
 
-		// Verify --block-domains flag is present
-		if !strings.Contains(lockYAML, "--block-domains") {
-			t.Error("Compiled workflow should contain '--block-domains' flag")
+		// Verify blockDomains key is present in the config JSON
+		if !strings.Contains(lockYAML, `"blockDomains"`) {
+			t.Error("Compiled workflow should contain 'blockDomains' key in config JSON")
 		}
 
 		// Verify blocked domains are in the command
@@ -79,9 +79,9 @@ Test workflow with blocked domains.
 			t.Error("Compiled workflow should contain blocked domain 'tracker.example.com'")
 		}
 
-		// Verify standard AWF flags are still present
-		if !strings.Contains(lockYAML, "--allow-domains") {
-			t.Error("Compiled workflow should still contain '--allow-domains' flag")
+		// Verify allowDomains key is present in the config JSON
+		if !strings.Contains(lockYAML, `"allowDomains"`) {
+			t.Error("Compiled workflow should still contain 'allowDomains' key in config JSON")
 		}
 
 		if !strings.Contains(lockYAML, "--log-level") {
@@ -140,9 +140,9 @@ Test workflow with blocked ecosystem.
 
 		lockYAML := string(lockContent)
 
-		// Verify --block-domains flag is present
-		if !strings.Contains(lockYAML, "--block-domains") {
-			t.Error("Compiled workflow should contain '--block-domains' flag")
+		// Verify blockDomains key is present in the config JSON
+		if !strings.Contains(lockYAML, `"blockDomains"`) {
+			t.Error("Compiled workflow should contain 'blockDomains' key in config JSON")
 		}
 
 		// Verify at least one Python ecosystem domain is blocked
@@ -208,14 +208,14 @@ Test workflow without blocked domains.
 
 		lockYAML := string(lockContent)
 
-		// Verify --block-domains flag is NOT present
-		if strings.Contains(lockYAML, "--block-domains") {
-			t.Error("Compiled workflow should NOT contain '--block-domains' flag when no domains are blocked")
+		// Verify blockDomains key is NOT present in the config JSON
+		if strings.Contains(lockYAML, `"blockDomains"`) {
+			t.Error("Compiled workflow should NOT contain 'blockDomains' key in config JSON when no domains are blocked")
 		}
 
-		// Verify --allow-domains is still present
-		if !strings.Contains(lockYAML, "--allow-domains") {
-			t.Error("Compiled workflow should still contain '--allow-domains' flag")
+		// Verify allowDomains key is still present
+		if !strings.Contains(lockYAML, `"allowDomains"`) {
+			t.Error("Compiled workflow should still contain 'allowDomains' key in config JSON")
 		}
 	})
 
@@ -269,9 +269,9 @@ Test Claude workflow with blocked domains.
 
 		lockYAML := string(lockContent)
 
-		// Verify --block-domains flag is present
-		if !strings.Contains(lockYAML, "--block-domains") {
-			t.Error("Compiled Claude workflow should contain '--block-domains' flag")
+		// Verify blockDomains key is present in the config JSON
+		if !strings.Contains(lockYAML, `"blockDomains"`) {
+			t.Error("Compiled Claude workflow should contain 'blockDomains' key in config JSON")
 		}
 
 		// Verify blocked domain is in the command
@@ -330,9 +330,9 @@ Test Codex workflow with blocked domains.
 
 		lockYAML := string(lockContent)
 
-		// Verify --block-domains flag is present
-		if !strings.Contains(lockYAML, "--block-domains") {
-			t.Error("Compiled Codex workflow should contain '--block-domains' flag")
+		// Verify blockDomains key is present in the config JSON
+		if !strings.Contains(lockYAML, `"blockDomains"`) {
+			t.Error("Compiled Codex workflow should contain 'blockDomains' key in config JSON")
 		}
 
 		// Verify blocked domain is in the command
diff --git a/pkg/workflow/domains_protocol_integration_test.go b/pkg/workflow/domains_protocol_integration_test.go
index 80777500b9..101b83a4d1 100644
--- a/pkg/workflow/domains_protocol_integration_test.go
+++ b/pkg/workflow/domains_protocol_integration_test.go
@@ -136,10 +136,10 @@ Test protocol-specific domains in safe-outputs.
 				}
 			}
 
-			// If checking AWF args, verify --allow-domains flag is present
+			// If checking AWF args, verify allowDomains key is present in the config JSON
 			if tt.checkAWFArgs {
-				if !strings.Contains(lockYAML, "--allow-domains") {
-					t.Error("Expected --allow-domains flag in compiled workflow")
+				if !strings.Contains(lockYAML, `"allowDomains"`) {
+					t.Error("Expected 'allowDomains' key in config JSON of compiled workflow")
 				}
 			}
 
@@ -301,8 +301,8 @@ Test backward compatibility with domains without protocols.
 		}
 	}
 
-	// Verify --allow-domains flag is present
-	if !strings.Contains(lockYAML, "--allow-domains") {
-		t.Error("Expected --allow-domains flag in compiled workflow")
+	// Verify allowDomains key is present in the config JSON
+	if !strings.Contains(lockYAML, `"allowDomains"`) {
+		t.Error("Expected 'allowDomains' key in config JSON of compiled workflow")
 	}
 }