diff --git a/tests/test_exam_templates.py b/tests/test_exam_templates.py
index cb4d497..ea4fa95 100644
--- a/tests/test_exam_templates.py
+++ b/tests/test_exam_templates.py
@@ -138,7 +138,7 @@ def test_requires_auth_when_not_overridden():
     app.include_router(router, prefix="/api/exam")
     # No dependency override → real SupabaseBearer runs and rejects the missing token.
     resp = TestClient(app).get("/api/exam/templates")
-    assert resp.status_code == 403
+    assert resp.status_code in (401, 403)  # unauthenticated, not processed
 
 
 def test_create_template_sets_owner_and_institute():