diff --git a/internal/api/security_regression_test.go b/internal/api/security_regression_test.go
index fc52f85868..15a5d4c5f4 100644
--- a/internal/api/security_regression_test.go
+++ b/internal/api/security_regression_test.go
@@ -5272,6 +5272,7 @@ func TestSSHConfigRejectsSetupTokenQueryParam(t *testing.T) {
 // session cookie is present, CSRF must be valid regardless of any other
 // auth-style header.
 func TestCheckCSRF_HeaderDoesNotBypassWhenSessionCookiePresent(t *testing.T) {
+	initCSRFStoreForSecurityTest(t)
 	cases := []struct {
 		name        string
 		setHeader   func(*http.Request)
diff --git a/internal/api/security_test.go b/internal/api/security_test.go
index d69203a143..5f8d5850dc 100644
--- a/internal/api/security_test.go
+++ b/internal/api/security_test.go
@@ -5,6 +5,7 @@ import (
 	"crypto/tls"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"strings"
 	"sync"
 	"testing"
@@ -1346,6 +1347,17 @@ func TestAdminBypassEnabled_DeclinedOutsideDevMode(t *testing.T) {
 	}
 }
 
+func initCSRFStoreForSecurityTest(t *testing.T) {
+	t.Helper()
+	defaultDataPath := os.Getenv("PULSE_DATA_DIR")
+	resetCSRFStoreForTests()
+	InitCSRFStore(t.TempDir())
+	t.Cleanup(func() {
+		resetCSRFStoreForTests()
+		InitCSRFStore(defaultDataPath)
+	})
+}
+
 func TestCheckCSRF_SafeMethods(t *testing.T) {
 	tests := []struct {
 		method string
@@ -1408,6 +1420,7 @@ func TestCheckCSRF_BearerAuth_NoSessionCookie(t *testing.T) {
 }
 
 func TestCheckCSRF_UnknownAuthorizationSchemeDoesNotBypass(t *testing.T) {
+	initCSRFStoreForSecurityTest(t)
 	w := httptest.NewRecorder()
 	req := httptest.NewRequest("POST", "/api/test", nil)
 	req.Header.Set("Authorization", "Digest abc123")
@@ -1435,6 +1448,7 @@ func TestCheckCSRF_NoSessionCookie(t *testing.T) {
 }
 
 func TestCheckCSRF_MissingCSRFToken(t *testing.T) {
+	initCSRFStoreForSecurityTest(t)
 	w := httptest.NewRecorder()
 	req := httptest.NewRequest("POST", "/api/test", nil)
 	req.AddCookie(&http.Cookie{
@@ -1457,6 +1471,7 @@ func TestCheckCSRF_MissingCSRFToken(t *testing.T) {
 }
 
 func TestCheckCSRF_InvalidCSRFToken(t *testing.T) {
+	initCSRFStoreForSecurityTest(t)
 	w := httptest.NewRecorder()
 	req := httptest.NewRequest("POST", "/api/test", nil)
 	req.AddCookie(&http.Cookie{
@@ -1479,9 +1494,7 @@ func TestCheckCSRF_InvalidCSRFToken(t *testing.T) {
 }
 
 func TestCheckCSRF_ValidCSRFToken(t *testing.T) {
-	// Initialize stores with temp directory
-	dir := t.TempDir()
-	InitCSRFStore(dir)
+	initCSRFStoreForSecurityTest(t)
 
 	// Create a session ID
 	sessionID := "valid-session-id-12345678"
@@ -1505,6 +1518,7 @@ func TestCheckCSRF_ValidCSRFToken(t *testing.T) {
 }
 
 func TestCheckCSRF_CSRFTokenFromFormValue(t *testing.T) {
+	initCSRFStoreForSecurityTest(t)
 	w := httptest.NewRecorder()
 	req := httptest.NewRequest("POST", "/api/test?csrf_token=form-token-value", nil)
 	req.AddCookie(&http.Cookie{
@@ -1522,6 +1536,7 @@ func TestCheckCSRF_CSRFTokenFromFormValue(t *testing.T) {
 }
 
 func TestCheckCSRF_UnsafeMethods(t *testing.T) {
+	initCSRFStoreForSecurityTest(t)
 	methods := []string{"POST", "PUT", "DELETE", "PATCH"}
 
 	for _, method := range methods {