diff --git a/server/src/auth.rs b/server/src/auth.rs
index 7719bce..b8dc6ac 100644
--- a/server/src/auth.rs
+++ b/server/src/auth.rs
@@ -207,6 +207,20 @@ mod tests {
     /// like any other.
     #[tokio::test]
     async fn a_spooled_enrollment_is_adopted_on_first_use() {
+        // Under a subscriber, like every other exercise of this middleware.
+        // `tracing` caches a callsite's interest process-wide the first time it
+        // is reached, so the refusal at the end of this test -- reached with no
+        // subscriber on this thread -- could cache the rejection warning as
+        // never-enabled and make the tripwire above see an empty log. That
+        // failed about one full-suite run in ten, in the test that exists to
+        // notice a credential leak, which is the worst place for a flake.
+        let _guard = tracing::subscriber::set_default(
+            tracing_subscriber::fmt()
+                .with_max_level(tracing::Level::TRACE)
+                .with_writer(std::io::sink)
+                .finish(),
+        );
+
         let dir = tempfile::tempdir().expect("tempdir");
         let manager = manager_with_token(dir.path(), "first");
         let spooled = generate_token();