diff --git a/tests/plugins/test_kanban_dashboard_plugin.py b/tests/plugins/test_kanban_dashboard_plugin.py
index 4bbc621f..08452265 100644
--- a/tests/plugins/test_kanban_dashboard_plugin.py
+++ b/tests/plugins/test_kanban_dashboard_plugin.py
@@ -478,9 +478,19 @@ def test_ws_events_rejects_when_token_required(tmp_path, monkeypatch):
     kb.init_db()
 
     # Stub web_server so _check_ws_token has a token to compare against.
+    # NOTE: monkeypatch.setitem(sys.modules, ...) alone is not enough.
+    # If another test in the same xdist worker has already imported
+    # hermes_cli.web_server, the parent package `hermes_cli` has the real
+    # module bound as an attribute. `from hermes_cli import web_server`
+    # then resolves via the attribute, NOT sys.modules — so the stub is
+    # bypassed and _check_ws_token compares against the real (random)
+    # _SESSION_TOKEN, rejecting our "secret-xyz" branch with 1008.
+    # Patching the parent package attribute keeps both lookup paths in sync.
     import types
+    import hermes_cli
     stub = types.SimpleNamespace(_SESSION_TOKEN="secret-xyz")
     monkeypatch.setitem(sys.modules, "hermes_cli.web_server", stub)
+    monkeypatch.setattr(hermes_cli, "web_server", stub, raising=False)
 
     app = FastAPI()
     app.include_router(_load_plugin_router(), prefix="/api/plugins/kanban")