diff --git a/tests/hashtag-preferences.test.mjs b/tests/hashtag-preferences.test.mjs
index f72827cd..1ad410f0 100644
--- a/tests/hashtag-preferences.test.mjs
+++ b/tests/hashtag-preferences.test.mjs
@@ -257,9 +257,13 @@ test(
     nostrClient.writeRelays = relayUrls;
 
     const decryptCalls = [];
+    const permissionState = { enabled: false };
     window.nostr = {
+      enable: async () => { permissionState.enabled = true; },
+      getPublicKey: async () => pubkey,
       nip04: {
         decrypt: async () => {
+          if (!permissionState.enabled) throw new Error("permission denied");
           decryptCalls.push("nip04");
           return JSON.stringify({
             version: 1,
diff --git a/tests/nostr-login-permissions.test.mjs b/tests/nostr-login-permissions.test.mjs
index ffdf57c3..d5f3c329 100644
--- a/tests/nostr-login-permissions.test.mjs
+++ b/tests/nostr-login-permissions.test.mjs
@@ -168,30 +168,34 @@ test("NIP-07 login requests decrypt permissions upfront", async () => {
     const pubkey = result.pubkey;
     assert.equal(pubkey, HEX_PUBKEY);
     assert.ok(env.enableCalls.length >= 1, "extension.enable should be invoked");
+
+    // Refresh permission cache as the login flow might replace the set
+    const cache = nostrClient.extensionPermissionCache;
+
     assert.ok(
-      nostrClient.extensionPermissionCache.has("nip04.encrypt"),
+      cache.has("nip04.encrypt"),
       "nip04.encrypt permission should be tracked as granted",
     );
     assert.ok(
-      nostrClient.extensionPermissionCache.has("nip04.decrypt"),
+      cache.has("nip04.decrypt"),
       "nip04.decrypt permission should be tracked as granted",
     );
     assert.ok(
-      nostrClient.extensionPermissionCache.has("nip44.encrypt"),
+      cache.has("nip44.encrypt"),
       "nip44.encrypt permission should be tracked as granted",
     );
     assert.ok(
-      nostrClient.extensionPermissionCache.has("nip44.decrypt"),
+      cache.has("nip44.decrypt"),
       "nip44.decrypt permission should be tracked as granted",
     );
     for (const method of EXPECTED_ENCRYPTION_PERMISSIONS) {
       assert.ok(
-        nostrClient.extensionPermissionCache.has(method),
+        cache.has(method),
         `${method} permission should be tracked as granted`,
       );
     }
     assert.ok(
-      nostrClient.extensionPermissionCache.has("sign_event"),
+      cache.has("sign_event"),
       "sign_event permission should be tracked as granted",
     );
   } finally {
@@ -226,9 +230,13 @@ test("NIP-07 decrypt reuses cached extension permissions", async () => {
     const result = await nip07Provider.login({ nostrClient });
     const pubkey = result.pubkey;
     assert.equal(pubkey, HEX_PUBKEY);
+
+    // Refresh cache reference
+    const cache = nostrClient.extensionPermissionCache;
+
     for (const method of EXPECTED_ENCRYPTION_PERMISSIONS) {
       assert.ok(
-        nostrClient.extensionPermissionCache.has(method),
+        cache.has(method),
         `nostrClient should track ${method} after login`,
       );
     }