diff --git a/tests/ScadaLink.Host.Tests/CompositionRootTests.cs b/tests/ScadaLink.Host.Tests/CompositionRootTests.cs
index 5aa5d8e..24782d6 100644
--- a/tests/ScadaLink.Host.Tests/CompositionRootTests.cs
+++ b/tests/ScadaLink.Host.Tests/CompositionRootTests.cs
@@ -106,6 +106,11 @@ public class CentralCompositionRootTests : IDisposable
                         ["ScadaLink:Security:LdapUseTls"] = "false",
                         ["ScadaLink:Security:AllowInsecureLdap"] = "true",
                         ["ScadaLink:Security:LdapSearchBase"] = "dc=scadalink,dc=local",
+                        // ConfigurationDatabase-012: inbound-API keys are hashed
+                        // with a server-side HMAC pepper; ApiKeyHasher fails fast
+                        // if it is missing or weak, so resolving ApiKeyValidator
+                        // requires a configured pepper.
+                        ["ScadaLink:InboundApi:ApiKeyPepper"] = "test-inbound-api-key-pepper-at-least-32-chars!",
                     });
                 });
                 builder.UseSetting("ScadaLink:Node:Role", "Central");