diff --git a/src/agent/runner/harness/pi/__tests__/tools.test.ts b/src/agent/runner/harness/pi/__tests__/tools.test.ts
index 0fa075634..08cb94249 100644
--- a/src/agent/runner/harness/pi/__tests__/tools.test.ts
+++ b/src/agent/runner/harness/pi/__tests__/tools.test.ts
@@ -236,11 +236,14 @@ describe('pi check_env_keys — failures arrive as rejections', () => {
     // instead of arriving as a failed tool call. Dropping `async` here — the
     // scan removed the last `await` — is what made that reachable.
     const { checkEnvKeys } = makeTools({});
-    const run = () =>
-      call(checkEnvKeys, { keys: ['ANY'], filePath: '../../etc/passwd' });
-
-    expect(run).not.toThrow();
-    return expect(run()).rejects.toThrow('Path traversal rejected');
+    let result: Promise<unknown> | undefined;
+    expect(() => {
+      result = call(checkEnvKeys, {
+        keys: ['ANY'],
+        filePath: '../../etc/passwd',
+      });
+    }).not.toThrow();
+    return expect(result).rejects.toThrow('Path traversal rejected');
   });
 
   it('answers normally for a path inside the working directory', async () => {
diff --git a/tsconfig.json b/tsconfig.json
index 9947307f6..f2a7c51d7 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -15,6 +15,7 @@
     "bin.ts",
     "tsdown.config.ts",
     "vitest.config.ts",
+    "vitest.setup.ts",
     "spec/**/*",
     "src/**/*",
     "test/**/*",
diff --git a/vitest.config.ts b/vitest.config.ts
index 16492b363..09463d143 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -100,6 +100,7 @@ export default defineConfig({
   test: {
     globals: true,
     environment: 'node',
+    setupFiles: [r('vitest.setup.ts')],
     projects: [
       project('agent', AGENT_TESTS),
       project('programs', PROGRAM_TESTS),
diff --git a/vitest.setup.ts b/vitest.setup.ts
new file mode 100644
index 000000000..00857e2e8
--- /dev/null
+++ b/vitest.setup.ts
@@ -0,0 +1,4 @@
+import { vi } from 'vitest';
+
+// Tests must never send events or exceptions to production PostHog.
+vi.mock('posthog-node');