diff --git a/tests/security-boundaries.test.ts b/tests/security-boundaries.test.ts
index 08ae6d3..37db80e 100644
--- a/tests/security-boundaries.test.ts
+++ b/tests/security-boundaries.test.ts
@@ -44,13 +44,21 @@ describe("administrative security boundaries", () => {
     expect(source).toContain('endpoints: ["/sign-in/email"]');
   });
 
-  it("requires a Turnstile token before submitting administrator login", async () => {
+  it("requires a Turnstile token before submitting administrator login outside development", async () => {
     const source = await readFile(
       new URL("../components/admin/login-card.tsx", import.meta.url),
       "utf8",
     );
-    expect(source).toContain('headers: { "x-captcha-response": turnstileToken }');
-    expect(source).toContain("disabled={loading || !turnstileToken}");
+    expect(source).toContain('const turnstileEnabled = process.env.NODE_ENV !== "development";');
+    const tokenGuard = "if (turnstileEnabled && !turnstileToken) return;";
+    expect(source).toContain(tokenGuard);
+    expect(source.indexOf(tokenGuard)).toBeLessThan(
+      source.indexOf("await authClient.signIn.email("),
+    );
+    expect(source).toMatch(
+      /headers:\s*turnstileEnabled && turnstileToken\s*\?\s*\{ "x-captcha-response": turnstileToken \}\s*:\s*undefined/u,
+    );
+    expect(source).toContain("disabled={loading || (turnstileEnabled && !turnstileToken)}");
     expect(source).toContain('"expired-callback": () => setTurnstileToken(null)');
     expect(source).toContain("resetTurnstile();");
   });