diff --git a/tests/integration/withings-activity-sync.test.ts b/tests/integration/withings-activity-sync.test.ts
index 5afc464b2..0c0b54a8f 100644
--- a/tests/integration/withings-activity-sync.test.ts
+++ b/tests/integration/withings-activity-sync.test.ts
@@ -11,6 +11,15 @@
  */
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
+// Crypto reads `ENCRYPTION_KEY` lazily on first encrypt(). Under the
+// previous `isolate: false` suite the env from any sibling that seeded
+// the key leaked into this file; per-file isolation (v1.4.37 W-CI)
+// reveals that this spec never seeded its own key. Pin a deterministic
+// 32-byte test key before any `@/lib/crypto` import so the spec stays
+// self-contained.
+process.env.ENCRYPTION_KEY ??=
+  "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
+
 import { encrypt } from "@/lib/crypto";
 
 import { getPrismaClient, truncateAllTables } from "./setup";
diff --git a/tests/integration/withings-sleep-sync.test.ts b/tests/integration/withings-sleep-sync.test.ts
index eb058e790..293dd30b8 100644
--- a/tests/integration/withings-sleep-sync.test.ts
+++ b/tests/integration/withings-sleep-sync.test.ts
@@ -9,6 +9,15 @@
  */
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
+// Crypto reads `ENCRYPTION_KEY` lazily on first encrypt(). Under the
+// previous `isolate: false` suite the env from any sibling that seeded
+// the key leaked into this file; per-file isolation (v1.4.37 W-CI)
+// reveals that this spec never seeded its own key. Pin a deterministic
+// 32-byte test key before any `@/lib/crypto` import so the spec stays
+// self-contained.
+process.env.ENCRYPTION_KEY ??=
+  "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
+
 import { encrypt } from "@/lib/crypto";
 
 import { getPrismaClient, truncateAllTables } from "./setup";
diff --git a/vitest.integration.config.mts b/vitest.integration.config.mts
index ed3f4eb8b..4ae52780a 100644
--- a/vitest.integration.config.mts
+++ b/vitest.integration.config.mts
@@ -23,7 +23,18 @@ export default defineConfig({
     // level (the old `poolOptions.forks.singleFork` was removed).
     pool: "forks",
     fileParallelism: false,
-    isolate: false,
+    // v1.4.37 W-CI — switched from `isolate: false` to `isolate: true`.
+    // The previous setting reused the module graph across files inside
+    // one fork; mock declarations (`vi.mock("@/lib/notifications/...")`,
+    // `vi.mock("@parse/node-apn")`) registered in `apns-dispatch.test.ts`
+    // and `integration-status.test.ts` lost to whichever earlier file
+    // had already pulled the real dispatcher / sender modules into the
+    // shared graph, so the in-suite run showed flaky 0-call mocks while
+    // each file passed in isolation. Re-isolating module state per file
+    // costs ~10 s of import-rebuild on a 56-file run; the Postgres
+    // testcontainer + migrations still live in `globalSetup` so the
+    // expensive boot cost is unaffected.
+    isolate: true,
     // One container for the whole run; tests truncate between them.
     globalSetup: ["./tests/integration/global-setup.ts"],
   },