diff --git a/testing/backend/unit/test_saved_views.py b/testing/backend/unit/test_saved_views.py
index 1a0b3a2f1..09b72cfb1 100644
--- a/testing/backend/unit/test_saved_views.py
+++ b/testing/backend/unit/test_saved_views.py
@@ -10,7 +10,6 @@
 from fastapi import FastAPI
 from backend.secuscan.saved_views import saved_views_router
 from backend.secuscan.database import Database, get_db
-from backend.secuscan.auth import require_api_key
 import backend.secuscan.database as _db_module
 import backend.secuscan.auth as _auth_module
 from pathlib import Path
@@ -18,11 +17,6 @@
 
 # ─── Fixtures ─────────────────────────────────────────────────────────────────
 
-async def _mock_require_api_key() -> str:
-    """Mock auth dependency that always succeeds."""
-    return "test-owner-id"
-
-
 @pytest_asyncio.fixture
 async def app_client():
     """
@@ -30,18 +24,18 @@ async def app_client():
     and the saved_views_router registered. The client authenticates as
     the "default" owner (no X-User-Id header) using a real API key,
     matching how routes.py's own tests exercise auth (issue #1743).
+
+    require_api_key is exercised for real (not mocked) so the auth
+    negative-path tests below actually verify enforcement instead of
+    always observing whatever the mock returns.
     """
     # In-memory DB — isolated per test function
     test_db = Database(":memory:")
     await test_db.connect()
     _db_module.db = test_db
 
-    # Minimal app with auth override
     _app = FastAPI()
     _app.include_router(saved_views_router)
-    
-    # Override auth dependency to bypass authentication in tests
-    _app.dependency_overrides[require_api_key] = _mock_require_api_key
 
     with tempfile.TemporaryDirectory() as tmp_data_dir:
         api_key = _auth_module.init_api_key(tmp_data_dir)
@@ -354,7 +348,6 @@ async def test_filter_json_with_null_values_rejected(app_client: AsyncClient):
 
 # ─── Auth & owner isolation (issue #1743) ────────────────────────────────────
 
-@pytest.mark.skip(reason="pre-existing upstream issue: app_client overrides auth so 401 cannot be tested here")
 @pytest.mark.asyncio
 async def test_unauthenticated_request_rejected(app_client: AsyncClient):
     """Requests without a valid API key/session are rejected, not served."""
@@ -364,7 +357,6 @@ async def test_unauthenticated_request_rejected(app_client: AsyncClient):
     assert res.status_code == 401
 
 
-@pytest.mark.skip(reason="pre-existing upstream issue: app_client overrides auth so 401 cannot be tested here")
 @pytest.mark.asyncio
 async def test_wrong_api_key_rejected(app_client: AsyncClient):
     """A malformed/incorrect API key is rejected."""