diff --git a/tests/common/test_server.rs b/tests/common/test_server.rs
index c923fece..0d90865b 100644
--- a/tests/common/test_server.rs
+++ b/tests/common/test_server.rs
@@ -189,7 +189,9 @@ pub async fn start_test_server() -> (u16, TestServerHandle) {
             )
             .route(
                 "/echo-referer",
-                post(async move |headers: HeaderMap| {
+                post(async move |headers: HeaderMap, _body: Bytes| {
+                    // This endpoint tests request-header policy, not early responses. Consume the
+                    // request body before replying so response delivery cannot race body completion.
                     let referer = headers
                         .get("referer")
                         .and_then(|h| h.to_str().ok())
@@ -202,7 +204,9 @@ pub async fn start_test_server() -> (u16, TestServerHandle) {
             )
             .route(
                 "/echo-credentials",
-                post(async move |headers: HeaderMap| {
+                post(async move |headers: HeaderMap, _body: Bytes| {
+                    // Like /echo-referer, keep the fixture focused on header semantics by
+                    // consuming the request body before constructing the response.
                     let authorization = headers
                         .get("authorization")
                         .and_then(|h| h.to_str().ok())