diff --git a/tests/conftest.py b/tests/conftest.py
index 0afacb0..da8bb9d 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -8,18 +8,25 @@ migration code paths.
 
 import os
 
-import pytest
-import pytest_asyncio
-from sqlalchemy import create_engine
-from sqlalchemy.ext.asyncio import (
+# Audit 2026-06-02: CredentialCrypto now refuses to auto-generate a
+# Fernet key without explicit opt-in (production safety against silent
+# key regeneration on partial restore). The test environment never has
+# a pre-seeded key file, so set the bootstrap flag here before any
+# create_app() / CredentialCrypto() import path fires.
+os.environ.setdefault("CURATOR_BOOTSTRAP_NEW_KEY", "1")
+
+import pytest  # noqa: E402
+import pytest_asyncio  # noqa: E402
+from sqlalchemy import create_engine  # noqa: E402
+from sqlalchemy.ext.asyncio import (  # noqa: E402
     AsyncSession,
     async_sessionmaker,
     create_async_engine,
 )
-from sqlalchemy.orm import sessionmaker
+from sqlalchemy.orm import sessionmaker  # noqa: E402
 
-from backend.app import create_app
-from backend.app.models import Base
+from backend.app import create_app  # noqa: E402
+from backend.app.models import Base  # noqa: E402
 
 
 def _async_database_url() -> str: