diff --git a/.github/workflows/pr-tests.yml b/.github/workflows/pr-tests.yml
index 3ee322d..2255662 100644
--- a/.github/workflows/pr-tests.yml
+++ b/.github/workflows/pr-tests.yml
@@ -136,6 +136,10 @@ jobs:
           # directory layout (dc=example,dc=com) -- only the admin password
           # (normally supplied via a gitignored secrets.js) needs setting.
           app_ldap__bindPassword: your-ldap-password
+          # routes/oauth.js now refuses to start without a real jwtSecret.
+          # This is a non-secret test value; the container under test uses
+          # secrets.js.example's jwtSecret independently.
+          app_oauth__jwtSecret: ci-test-jwt-secret-do-not-use-in-production
         run: npm test
 
   test-summary:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7930c76..f851c26 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,7 @@ correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.
 
 ### Changed
 - Public-release packaging: removed `"private": true` from `nodejs/package.json` and bumped version to `1.1.16`.
+- CI workflow (`.github/workflows/pr-tests.yml`) now sets `app_oauth__jwtSecret` so the test suite can run against the new startup-time JWT validation.
 
 ### Fixed
 - `models/email.js`: fixed a template bug where the rendered `from` address used `template.message` instead of `template.from`.