diff --git a/backend/tests/conftest.py b/backend/tests/conftest.py
index 03dee4b0cd..b51358545c 100644
--- a/backend/tests/conftest.py
+++ b/backend/tests/conftest.py
@@ -9,7 +9,7 @@
 import importlib.util
 import sys
 from pathlib import Path
-from types import SimpleNamespace
+from types import ModuleType, SimpleNamespace
 from unittest.mock import MagicMock
 
 import pytest
@@ -41,7 +41,7 @@
 
 
 @pytest.fixture()
-def provisioner_module():
+def provisioner_module() -> ModuleType:
     """Load docker/provisioner/app.py as an importable test module.
 
     Shared by test_provisioner_kubeconfig and test_provisioner_pvc_volumes so
diff --git a/backend/tests/test_auth.py b/backend/tests/test_auth.py
index f19c83c7d3..32968aacd1 100644
--- a/backend/tests/test_auth.py
+++ b/backend/tests/test_auth.py
@@ -129,6 +129,14 @@ def test_decode_token_invalid():
     assert isinstance(decode_token("completely-wrong"), TokenError)
 
 
+def test_decode_token_malformed_jwt():
+    """JWT with wrong number of parts (not 3) returns TokenError."""
+    from app.gateway.auth.errors import TokenError
+
+    assert isinstance(decode_token("header.payload"), TokenError)
+    assert isinstance(decode_token("header.payload.signature.extra"), TokenError)
+
+
 def test_create_token_custom_expiry():
     """Custom expiry is respected."""
     user_id = str(uuid4())