diff --git a/src/db/tests/helpers.ts b/src/db/tests/helpers.ts
index 7d80678..03ffd97 100644
--- a/src/db/tests/helpers.ts
+++ b/src/db/tests/helpers.ts
@@ -61,6 +61,7 @@ export async function clearAllTables(client: PrismaClient): Promise<void> {
   await client.prompt.deleteMany();
   await client.projectServer.deleteMany();
   await client.secret.deleteMany();
+  await client.secretBackend.deleteMany();
   await client.session.deleteMany();
   await client.project.deleteMany();
   await client.mcpServer.deleteMany();
diff --git a/src/db/tests/models.test.ts b/src/db/tests/models.test.ts
index dbedd36..37ea825 100644
--- a/src/db/tests/models.test.ts
+++ b/src/db/tests/models.test.ts
@@ -184,9 +184,22 @@ describe('McpServer', () => {
 // ── Secret model ──
 
 describe('Secret', () => {
+  // New Secret rows always carry a valid backend FK (SecretService guarantees
+  // this; the schema-level `backendId @default("")` only exists so `db push`
+  // can add the column to pre-existing rows). Seed the plaintext backend each
+  // test the same way bootstrapSecretBackends does.
+  let backendId: string;
+
+  beforeEach(async () => {
+    const backend = await prisma.secretBackend.create({
+      data: { name: 'default', type: 'plaintext', isDefault: true },
+    });
+    backendId = backend.id;
+  });
+
   it('creates a secret with defaults', async () => {
     const secret = await prisma.secret.create({
-      data: { name: 'my-secret' },
+      data: { name: 'my-secret', backendId },
     });
     expect(secret.name).toBe('my-secret');
     expect(secret.data).toEqual({});
@@ -197,6 +210,7 @@ describe('Secret', () => {
     const secret = await prisma.secret.create({
       data: {
         name: 'api-keys',
+        backendId,
         data: { API_KEY: 'test-key', API_SECRET: 'test-secret' },
       },
     });
@@ -206,13 +220,15 @@ describe('Secret', () => {
   });
 
   it('enforces unique name', async () => {
-    await prisma.secret.create({ data: { name: 'dup-secret' } });
-    await expect(prisma.secret.create({ data: { name: 'dup-secret' } })).rejects.toThrow();
+    await prisma.secret.create({ data: { name: 'dup-secret', backendId } });
+    await expect(
+      prisma.secret.create({ data: { name: 'dup-secret', backendId } }),
+    ).rejects.toThrow();
   });
 
   it('updates data', async () => {
     const secret = await prisma.secret.create({
-      data: { name: 'updatable', data: { KEY: 'old' } },
+      data: { name: 'updatable', backendId, data: { KEY: 'old' } },
     });
     const updated = await prisma.secret.update({
       where: { id: secret.id },