diff --git a/backend/tests/test_kiosk_security.py b/backend/tests/test_kiosk_security.py
index e7ad101..e72a170 100644
--- a/backend/tests/test_kiosk_security.py
+++ b/backend/tests/test_kiosk_security.py
@@ -256,12 +256,15 @@ async def test_kiosk_device_lifecycle(client: AsyncClient, kiosk_admin_headers,
 
 
 async def test_heartbeat_missing_headers(client: AsyncClient):
-    """Heartbeat ohne Kiosk-Header → 422 (FastAPI Validierungsfehler)."""
+    """Heartbeat ohne Kiosk-Header und ohne Bearer-Token → 401.
+    (Header sind seit Einführung des Bearer-Auth-Modus optional, damit beide
+    Auth-Wege über dieselbe Dependency laufen können; verify_kiosk_request
+    prüft das Fehlen beider Modi selbst und wirft 401 statt 422.)"""
     resp = await client.post(
         HEARTBEAT_URL,
         json={"queued_offline_entries": 0},
     )
-    assert resp.status_code == 422, resp.text
+    assert resp.status_code == 401, resp.text
 
 
 async def test_kiosk_devices_list(
@@ -406,9 +409,10 @@ async def approved_bearer_device(db_session, registered_user):
         key_algorithm="bearer_vpn",
         device_token_hash=hash_token(token),
     )
+    from sqlalchemy import text
+    await db_session.execute(text("SET LOCAL app.bypass_rls = 'on'"))
     db_session.add(device)
     await db_session.commit()
-    await db_session.refresh(device)
     return device, token
 
 
@@ -448,6 +452,8 @@ async def test_bearer_heartbeat_ip_whitelist_violation(client: AsyncClient, db_s
         device_token_hash=hash_token(token),
         ip_whitelist="10.99.99.0/24",
     )
+    from sqlalchemy import text
+    await db_session.execute(text("SET LOCAL app.bypass_rls = 'on'"))
     db_session.add(device)
     await db_session.commit()
 
@@ -472,6 +478,8 @@ async def test_bearer_heartbeat_revoked_device(client: AsyncClient, db_session,
         key_algorithm="bearer_vpn",
         device_token_hash=hash_token(token),
     )
+    from sqlalchemy import text
+    await db_session.execute(text("SET LOCAL app.bypass_rls = 'on'"))
     db_session.add(device)
     await db_session.commit()