diff --git a/swarm-controller/src/main.rs b/swarm-controller/src/main.rs
index 51b2f384..80339b53 100644
--- a/swarm-controller/src/main.rs
+++ b/swarm-controller/src/main.rs
@@ -4091,6 +4091,16 @@ mod tests {
     /// variable, and creates the agent anyway.
     #[tokio::test]
     async fn mint_agent_identity_node_runs_end_to_end_and_fails_without_the_agent_pki_named() {
+        let pki = [
+            crate::agent_identity::ENV_AGENT_PKI_MOUNT,
+            crate::agent_identity::ENV_AGENT_PKI_ROLE,
+        ];
+        assert!(
+            pki.iter().all(|var| std::env::var_os(var).is_none()),
+            "{} and {} must be unset: with them set this test would reach a live store",
+            pki[0],
+            pki[1]
+        );
         let mut sched = hive_jobq::scheduler::Scheduler::new(
             hive_jobq::Graph::new(),
             hive_jobq::resources::ResourceTable::new(),