diff --git a/docs/waves/backlog.md b/docs/waves/backlog.md
index 07c162e..8aedeb6 100644
--- a/docs/waves/backlog.md
+++ b/docs/waves/backlog.md
@@ -601,8 +601,12 @@ deliberately deferred.
   anyone who has ever used the asset picker — the API is genuinely configured, returns
   real Micron tags, and three checks fail. Nothing is wrong with the app; the test's
   premise is violated by the environment it runs in.
-- **Fix:** pop `MICRON_DB_URL` from the env for that server, exactly as `start_server`
-  now pops `LDAP_REQUIRED_GROUP` for the same reason (`T10.7`).
+- **Fix:** SET `MICRON_DB_URL` empty for that server — do not pop it. `server/db.py`
+  calls `load_dotenv()` at import, and python-dotenv only skips keys already present in
+  `os.environ`, so a *popped* variable is restored from the developer's `.env` inside the
+  subprocess and the test runs against the real catalog anyway. An empty string counts as
+  present and therefore wins. `start_server` does exactly this for `LDAP_REQUIRED_GROUP`
+  (`T10.7`), after the pop-based version was caught doing the wrong thing.
 - **Why not now:** it is not this wave's defect and the fix belongs with whoever owns
   the asset picker's tests. Recorded so the failure is not mistaken for D13 fallout.
 - **Suggested wave or follow-up:** next housekeeping pass.
diff --git a/tests/browser_check.py b/tests/browser_check.py
index 63969cf..0b23f9a 100644
--- a/tests/browser_check.py
+++ b/tests/browser_check.py
@@ -172,9 +172,12 @@ def start_server(port, db_path):
     env["DATABASE_URL"] = "sqlite:///" + db_path.replace("\\", "/")
     env.setdefault("AUTH_SECRET_KEY", "browser-check-secret-not-for-production")
     env["WP_LDAP_FAKE_DIRECTORY"] = FAKE_DIRECTORY
-    # No required group: the fake grants "WP-Suite-Users" to everyone, and a test
-    # asserting the group gate belongs in ldap_auth_check where it can be explicit.
-    env.pop("LDAP_REQUIRED_GROUP", None)
+    # SET empty, never pop: server/db.py calls load_dotenv() at import and
+    # python-dotenv only skips keys already present in os.environ, so a popped
+    # variable comes back from the developer's .env inside the subprocess. An empty
+    # string is "present" and therefore wins. The fake grants "WP-Suite-Users" to
+    # everyone; a test asserting the group gate belongs in ldap_auth_check.
+    env["LDAP_REQUIRED_GROUP"] = ""
     proc = subprocess.Popen(
         [sys.executable, "-m", "uvicorn", "server.app:app", "--host", "127.0.0.1",
          "--port", str(port), "--log-level", "warning"],
diff --git a/tests/ldap_auth_check.py b/tests/ldap_auth_check.py
index 8034e49..679f85d 100644
--- a/tests/ldap_auth_check.py
+++ b/tests/ldap_auth_check.py
@@ -89,10 +89,12 @@ def start(port, db_path, fake, required_group=""):
     env["DATABASE_URL"] = "sqlite:///" + db_path.replace("\\", "/")
     env["AUTH_SECRET_KEY"] = SECRET
     env["WP_LDAP_FAKE_DIRECTORY"] = json.dumps(fake)
-    if required_group:
-        env["LDAP_REQUIRED_GROUP"] = required_group
-    else:
-        env.pop("LDAP_REQUIRED_GROUP", None)
+    # SET it empty, never pop it. server/db.py calls load_dotenv() at import, and
+    # python-dotenv only skips a key that is already present in os.environ — so a
+    # popped variable is helpfully restored from the developer's .env inside the
+    # subprocess, and the test silently runs against the real required group.
+    # An empty string counts as present, so it wins.
+    env["LDAP_REQUIRED_GROUP"] = required_group or ""
     proc = subprocess.Popen(
         [sys.executable, "-m", "uvicorn", "server.app:app", "--host", "127.0.0.1",
          "--port", str(port), "--log-level", "warning"],