diff --git a/phpunit.xml b/phpunit.xml
index 1df375b..dc686d3 100644
--- a/phpunit.xml
+++ b/phpunit.xml
@@ -21,6 +21,12 @@
         <!-- force=true so these override the dev .env that docker-compose injects
              as real container env vars (otherwise tests use redis/mariadb). -->
         <env name="APP_ENV" value="testing" force="true"/>
+        <!-- Pinned so the suite never depends on the operator's real hostnames:
+             route() builds URLs from APP_URL, and a deployment-specific
+             ADMIN_HOSTS would then 404 every admin route. Tests that exercise
+             the restriction set admin_access.hosts themselves. -->
+        <env name="APP_URL" value="http://localhost" force="true"/>
+        <env name="ADMIN_HOSTS" value="" force="true"/>
         <env name="APP_MAINTENANCE_DRIVER" value="file"/>
         <env name="BCRYPT_ROUNDS" value="4" force="true"/>
         <env name="BROADCAST_CONNECTION" value="null" force="true"/>