diff --git a/test/registered/models_e2e/test_qwen35_fp4_mtp.py b/test/registered/models_e2e/test_qwen35_fp4_mtp.py
index 46aaf89d3..3428af1af 100644
--- a/test/registered/models_e2e/test_qwen35_fp4_mtp.py
+++ b/test/registered/models_e2e/test_qwen35_fp4_mtp.py
@@ -14,7 +14,7 @@ from sglang.test.test_utils import (
     popen_launch_server,
 )
 
-register_cuda_ci(est_time=400, stage="base-c", runner_config="4-gpu-b200")
+register_cuda_ci(est_time=800, stage="base-c", runner_config="4-gpu-b200")
 
 QWEN35_FP4_MODEL = "nvidia/Qwen3.5-397B-A17B-NVFP4"
 ACC_THRESHOLDS = {QWEN35_FP4_MODEL: {"gsm8k": 0.95}}
@@ -106,5 +106,46 @@ class TestQwen35FP4MTP(ReasoningTokenUsageMixin, CustomTestCase):
         _run_mtp_gsm8k(self)
 
 
+class TestQwen35FP4MTPReplaySSM(ReasoningTokenUsageMixin, CustomTestCase):
+    """MTP with the ReplaySSM spec-verify fold protocol.
+
+    Pins the FlashInfer GDN (bf16-state) kernel stack explicitly: the
+    --mamba-ssm-dtype bfloat16 in MTP_BASE_ARGS overrides the float32
+    default that --enable-linear-replayssm-spec would set, and the three
+    linear-attn backend flags keep decode/prefill/verify on FlashInfer
+    even if the auto-selection defaults drift.
+    """
+
+    reasoning_parser_name = "qwen3"
+
+    @classmethod
+    def setUpClass(cls):
+        cls.model = QWEN35_FP4_MODEL
+        cls.base_url = DEFAULT_URL_FOR_TEST
+        cls.init_reasoning_token_verifier()
+        cls.process = popen_launch_server(
+            cls.model,
+            cls.base_url,
+            timeout=DEFAULT_TIMEOUT_FOR_SERVER_LAUNCH,
+            other_args=MTP_BASE_ARGS
+            + [
+                "--enable-linear-replayssm-spec",
+                "--linear-attn-decode-backend",
+                "flashinfer",
+                "--linear-attn-prefill-backend",
+                "flashinfer",
+                "--linear-attn-verify-backend",
+                "flashinfer",
+            ],
+        )
+
+    @classmethod
+    def tearDownClass(cls):
+        kill_process_tree(cls.process.pid)
+
+    def test_gsm8k(self):
+        _run_mtp_gsm8k(self)
+
+
 if __name__ == "__main__":
     unittest.main()