diff --git a/src/app/api/auth/login/__tests__/route.test.ts b/src/app/api/auth/login/__tests__/route.test.ts
index 785b30601..8d926404e 100644
--- a/src/app/api/auth/login/__tests__/route.test.ts
+++ b/src/app/api/auth/login/__tests__/route.test.ts
@@ -33,6 +33,12 @@ vi.mock("@/lib/rate-limit", () => ({
   checkRateLimit: vi
     .fn()
     .mockResolvedValue({ allowed: true, remaining: 5, reset: 0 }),
+  checkAuthSurfaceRateLimit: vi.fn().mockResolvedValue({
+    allowed: true,
+    remaining: 5,
+    reset: 0,
+    ip: "1.2.3.4",
+  }),
   rateLimitHeaders: vi.fn(() => ({})),
 }));
 
@@ -61,7 +67,11 @@ import { POST } from "../route";
 import { prisma } from "@/lib/db";
 import { verifyPassword } from "@/lib/auth/password";
 import { auditLog } from "@/lib/auth/audit";
-import { checkRateLimit, rateLimitHeaders } from "@/lib/rate-limit";
+import {
+  checkRateLimit,
+  checkAuthSurfaceRateLimit,
+  rateLimitHeaders,
+} from "@/lib/rate-limit";
 import { ensureDbCompatibility } from "@/lib/db-compat";
 
 const TYPED_EMAIL = "leaked-identifier@example.com";
@@ -84,6 +94,12 @@ beforeEach(() => {
     remaining: 5,
     reset: 0,
   } as never);
+  vi.mocked(checkAuthSurfaceRateLimit).mockResolvedValue({
+    allowed: true,
+    remaining: 5,
+    reset: 0,
+    ip: "1.2.3.4",
+  } as never);
   vi.mocked(rateLimitHeaders).mockReturnValue({} as never);
   vi.mocked(ensureDbCompatibility).mockResolvedValue(undefined);
 });
diff --git a/src/app/api/auth/register/__tests__/route.test.ts b/src/app/api/auth/register/__tests__/route.test.ts
index 47c2aac30..5e1f3bfcd 100644
--- a/src/app/api/auth/register/__tests__/route.test.ts
+++ b/src/app/api/auth/register/__tests__/route.test.ts
@@ -32,6 +32,7 @@ vi.mock("@/lib/auth/audit", () => ({
 
 vi.mock("@/lib/rate-limit", () => ({
   checkRateLimit: vi.fn(),
+  checkAuthSurfaceRateLimit: vi.fn(),
   rateLimitHeaders: () => ({}),
 }));
 
@@ -58,7 +59,7 @@ vi.mock("next/headers", () => ({
 }));
 
 import { POST } from "../route";
-import { checkRateLimit } from "@/lib/rate-limit";
+import { checkRateLimit, checkAuthSurfaceRateLimit } from "@/lib/rate-limit";
 
 function postReq(body: unknown): NextRequest {
   return new NextRequest("http://localhost/api/auth/register", {
@@ -71,6 +72,10 @@ function postReq(body: unknown): NextRequest {
 beforeEach(() => {
   vi.resetAllMocks();
   vi.mocked(checkRateLimit).mockResolvedValue({ allowed: true } as never);
+  vi.mocked(checkAuthSurfaceRateLimit).mockResolvedValue({
+    allowed: true,
+    ip: "1.2.3.4",
+  } as never);
 });
 
 describe("POST /api/auth/register — 422 multi-issue (v1.4.43 W6)", () => {