diff --git a/tests/test_mcp_endpoint.py b/tests/test_mcp_endpoint.py
index 8999620..db8afeb 100644
--- a/tests/test_mcp_endpoint.py
+++ b/tests/test_mcp_endpoint.py
@@ -113,6 +113,10 @@ async def test_mcp_endpoint_valid_token_passes_auth():
             status, _ = await _send_request(
                 app, "POST", "/mcp",
                 headers={
+                    # FastMCP's transport_security module enforces a Host
+                    # header (DNS-rebinding protection); without it the
+                    # request gets a 421 Misdirected Request.
+                    "Host": "testserver",
                     "Authorization": "Bearer fmcp_valid",
                     "Content-Type": "application/json",
                     "Accept": "application/json, text/event-stream",