diff --git a/apps/web/src/__tests__/test-env-isolation.test.ts b/apps/web/src/__tests__/test-env-isolation.test.ts
index 7ed06572a..ab108c546 100644
--- a/apps/web/src/__tests__/test-env-isolation.test.ts
+++ b/apps/web/src/__tests__/test-env-isolation.test.ts
@@ -42,4 +42,11 @@ describe('test environment isolation', () => {
     // frontend-only mode, which is what the suite asserts against.
     expect(process.env.BACKEND_URL ?? '').not.toMatch(/^http/);
   });
+
+  it.each(['NEXT_PUBLIC_BACKEND_URL', 'NEXT_PUBLIC_API_URL'] as const)(
+    'pins %s to a blank test default',
+    (key) => {
+      expect(process.env[key]).toBe('');
+    },
+  );
 });
diff --git a/apps/web/vitest.config.ts b/apps/web/vitest.config.ts
index b29facb8e..998b003a1 100644
--- a/apps/web/vitest.config.ts
+++ b/apps/web/vitest.config.ts
@@ -29,6 +29,8 @@ export default defineConfig({
     // a key set it explicitly in their own setup, so a blank default is safe.
     env: {
       BACKEND_URL: '',
+      NEXT_PUBLIC_BACKEND_URL: '',
+      NEXT_PUBLIC_API_URL: '',
       BILLING_COOKIE_SECRET: 'test-billing-cookie-secret',
       AI_GATEWAY_API_KEY: '',
       VERCEL_AI_GATEWAY_API_KEY: '',