diff --git a/internal/api/handler_auth_test.go b/internal/api/handler_auth_test.go
index 26041abe3..eccaf9b60 100644
--- a/internal/api/handler_auth_test.go
+++ b/internal/api/handler_auth_test.go
@@ -707,8 +707,11 @@ func TestHandler_resetPasswordStatus_NoAuthService(t *testing.T) {
 func TestHandler_resetPassword_Error(t *testing.T) {
 	ctx := context.Background()
 	mockAuth := new(MockAuthService)
+	t.Cleanup(func() { mockAuth.AssertExpectations(t) })
 
-	mockAuth.On("ConfirmPasswordReset", ctx, mock.Anything).Return(errors.New("invalid or expired token"))
+	// Use the exact string the real service emits so isResetPasswordClientError
+	// classifies it as a 400 client error, not a 500 internal error.
+	mockAuth.On("ConfirmPasswordReset", ctx, mock.Anything).Return(errors.New("invalid or expired reset token"))
 
 	handler := &Handler{auth: mockAuth}
 
@@ -718,9 +721,12 @@ func TestHandler_resetPassword_Error(t *testing.T) {
 	encoded := base64.StdEncoding.EncodeToString([]byte("newpassword123"))
 	req := &events.LambdaFunctionURLRequest{Body: `{"token": "bad-token", "new_password": "` + encoded + `"}`}
 	result, err := handler.resetPassword(ctx, req)
-	assert.Error(t, err)
+	require.Error(t, err)
 	assert.Nil(t, result)
-	assert.Contains(t, err.Error(), "invalid or expired token")
+	ce, ok := IsClientError(err)
+	require.True(t, ok, "expired-token error must be wrapped as a client error (400)")
+	assert.Equal(t, 400, ce.code)
+	assert.Contains(t, ce.Error(), "invalid or expired reset token")
 }
 
 // Issue #459: ConfirmPasswordReset errors must surface as a 4xx client
@@ -732,6 +738,7 @@ func TestHandler_resetPassword_Error(t *testing.T) {
 func TestHandler_resetPassword_ErrorIsClientError(t *testing.T) {
 	ctx := context.Background()
 	mockAuth := new(MockAuthService)
+	t.Cleanup(func() { mockAuth.AssertExpectations(t) })
 
 	mockAuth.On("ConfirmPasswordReset", ctx, mock.Anything).
 		Return(errors.New("this is your current password, choose a different one"))