diff --git a/internal/auth/session_test.go b/internal/auth/session_test.go
index dc640f46..e805e650 100644
--- a/internal/auth/session_test.go
+++ b/internal/auth/session_test.go
@@ -54,7 +54,7 @@ func TestVerifyPassword(t *testing.T) {
 }
 
 func TestRequireUser_RejectsWhenNoCookieOrBearer(t *testing.T) {
-	next := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+	next := http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
 		t.Fatal("handler must not be called")
 	})
 	h := RequireUser(nil)(next)