diff --git a/tests/unit/core/test_security.py b/tests/unit/core/test_security.py
index 658d797..9259993 100644
--- a/tests/unit/core/test_security.py
+++ b/tests/unit/core/test_security.py
@@ -45,7 +45,7 @@ def test_authenticate_valid_token() -> None:
 
 def test_authenticate_visitor_token_returns_limited_anonymous_context() -> None:
     now = datetime.now(UTC)
-    private_key = Path("config/jwt/jwt-private.pem").read_text(encoding="utf-8")
+    private_key = (DEV_KEY_DIR / "jwt-private.pem").read_text(encoding="utf-8")
     token = jwt.encode(
         {"sub": "2", "iss": "jr-auth", "aud": "jr-agent-platform", "iat": now,
          "nbf": now, "exp": now + timedelta(minutes=5), "jti": "visitor-jti-1",
@@ -105,7 +105,7 @@ async def test_visitor_token_skips_identity_database_resolution(monkeypatch):
     from app.api.dependencies.auth import _authenticator, build_request_context
 
     now = datetime.now(UTC)
-    private_key = Path("config/jwt/jwt-private.pem").read_text(encoding="utf-8")
+    private_key = (DEV_KEY_DIR / "jwt-private.pem").read_text(encoding="utf-8")
     token = jwt.encode(
         {"sub": "2", "iss": "jr-local", "aud": "jr-agent-platform", "iat": now,
          "nbf": now, "exp": now + timedelta(minutes=5), "jti": "visitor-jti-2",