diff --git a/tests/unit/check-db-rules-classification.test.ts b/tests/unit/check-db-rules-classification.test.ts
index d17c5ae6cc..36e0a836a0 100644
--- a/tests/unit/check-db-rules-classification.test.ts
+++ b/tests/unit/check-db-rules-classification.test.ts
@@ -122,10 +122,12 @@ test("INTENTIONALLY_INTERNAL is exported from check-db-rules.mjs", () => {
   assert.ok(INTENTIONALLY_INTERNAL.size > 0, "INTENTIONALLY_INTERNAL must not be empty");
 });
 
-test("INTENTIONALLY_INTERNAL contains the expected 26 audited modules", () => {
+test("INTENTIONALLY_INTERNAL contains the expected 28 audited modules", () => {
   const expected = [
     "_rowTypes",
     "accessTokens",
+    "apiKeyColumnFallbacks",
+    "apiKeyUsageLimitFields",
     "cleanup",
     "cliToolState",
     "comboForecast",
diff --git a/tests/unit/web-session-credentials.test.ts b/tests/unit/web-session-credentials.test.ts
index f6406ba2fb..48c498e9ba 100644
--- a/tests/unit/web-session-credentials.test.ts
+++ b/tests/unit/web-session-credentials.test.ts
@@ -37,13 +37,15 @@ test("web session credential metadata identifies cookie, token, and no-auth prov
     acceptsFullCookieHeader: false,
     storageKeys: ["token", "userToken"],
   });
-  // lmarena.ai's real auth cookie is `arena-auth-prod-v1`, not `session` (#3810)
+  // lmarena.ai's real auth cookie is `arena-auth-prod-v1`, not `session` (#3810).
+  // The session is now split across `arena-auth-prod-v1.0`, `.1`, … (#4271).
   assert.deepEqual(webSessionCredentials.getWebSessionCredentialRequirement("lmarena"), {
     kind: "cookie",
     credentialName: "arena-auth-prod-v1",
-    placeholder: "arena-auth-prod-v1=... or full Cookie header from lmarena.ai",
+    placeholder:
+      "Paste the full Cookie header from lmarena.ai (the session is now split across arena-auth-prod-v1.0, .1, …)",
     acceptsFullCookieHeader: true,
-    storageKeys: ["cookie", "arena-auth-prod-v1", "session"],
+    storageKeys: ["cookie", "arena-auth-prod-v1", "arena-auth-prod-v1.0", "arena-auth-prod-v1.1", "session"],
   });
   // veoaifree-web is now a NOAUTH provider — not in WEB_SESSION_CREDENTIAL_REQUIREMENTS
   assert.equal(webSessionCredentials.getWebSessionCredentialRequirement("veoaifree-web"), null);