diff --git a/apps/api/vitest.config.ts b/apps/api/vitest.config.ts
index f6c17e1..20f9efa 100644
--- a/apps/api/vitest.config.ts
+++ b/apps/api/vitest.config.ts
@@ -18,11 +18,27 @@ export default defineConfig({
     // list tables; running test files in parallel causes FK violations when one
     // file's afterEach deletes rows that another file's test is still using.
     fileParallelism: false,
-    env: isCI
-      ? {}
-      : {
-          DB_NAME: 'familysync_test',
-          DB_HOST: process.env.DB_HOST ?? '127.0.0.1',
-        },
+    env: {
+      // OIDC discovery config — supplied so oidcConfigFallbackMiddleware
+      // (src/auth/middleware.ts) always takes its env path and never reads
+      // app_config on every /api/* request. Without these, the middleware hits
+      // the DB, which 500s any test file that mocks `db` with a partial query
+      // chain (e.g. events/login). CI's api job provides no OIDC env, so this
+      // also makes the suite hermetic rather than depending on a local .env.
+      // Dummy values are safe: tests exercising the real OIDC flow mock
+      // @hono/oidc-auth directly.
+      OIDC_ISSUER: 'https://auth.test.local',
+      OIDC_CLIENT_ID: 'familysync-test',
+      OIDC_AUTH_EXTERNAL_URL: 'https://familysync.test.local',
+      // Local: force the isolated test DB so the dev `familysync` DB is never
+      // mutated. Under CI the job-level env already sets DB_NAME=familysync and
+      // DB_HOST=mariadb — do not override those.
+      ...(isCI
+        ? {}
+        : {
+            DB_NAME: 'familysync_test',
+            DB_HOST: process.env.DB_HOST ?? '127.0.0.1',
+          }),
+    },
   },
 });