diff --git a/web/src/api/client.error.test.ts b/web/src/api/client.error.test.ts
index 8c4ea98..34326ca 100644
--- a/web/src/api/client.error.test.ts
+++ b/web/src/api/client.error.test.ts
@@ -51,6 +51,10 @@ function mockErrorResponse(status: number, body: { message?: string; error?: str
     status,
     json: () => Promise.resolve(body),
     statusText: 'Error',
+    // Audit 2026-05-10 HIGH-8 closure landed a WWW-Authenticate-header
+    // read in the 401 path (src/api/client.ts L144). The mock needs a
+    // headers.get() so the read doesn't throw against an undefined.
+    headers: { get: () => null } as unknown as Headers,
   } as Response);
 }
 
diff --git a/web/src/api/client.test.ts b/web/src/api/client.test.ts
index 1068043..be89a6b 100644
--- a/web/src/api/client.test.ts
+++ b/web/src/api/client.test.ts
@@ -120,6 +120,10 @@ function mockErrorResponse(status: number, body: { message?: string; error?: str
     status,
     json: () => Promise.resolve(body),
     statusText: 'Error',
+    // Audit 2026-05-10 HIGH-8 closure landed a WWW-Authenticate-header
+    // read in the 401 path (src/api/client.ts L144). The mock needs a
+    // headers.get() so the read doesn't throw against an undefined.
+    headers: { get: () => null } as unknown as Headers,
   } as Response);
 }