diff --git a/tests/int/security-api.int.spec.ts b/tests/int/security-api.int.spec.ts
index 46e47c1..2a75dea 100644
--- a/tests/int/security-api.int.spec.ts
+++ b/tests/int/security-api.int.spec.ts
@@ -9,7 +9,8 @@ import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
 import { NextRequest, NextResponse } from 'next/server'
 
 // Enable CSRF validation in CI by setting BYPASS_CSRF=false
-vi.stubEnv('BYPASS_CSRF', 'false')
+// This must be set before any module imports that read this variable
+process.env.BYPASS_CSRF = 'false'
 import {
   generateTestCsrfToken,
   generateExpiredCsrfToken,