diff --git a/apps/community/src/server/passkey-challenge.test.ts b/apps/community/src/server/passkey-challenge.test.ts
index ecd9efc6..2b7cdb2c 100644
--- a/apps/community/src/server/passkey-challenge.test.ts
+++ b/apps/community/src/server/passkey-challenge.test.ts
@@ -55,7 +55,7 @@ describe('the challenge held between the two passkey requests', () => {
     const packed = packChallenge('authenticate', 'abc', {}, NOW)
     const dot = packed.lastIndexOf('.')
     const sig = packed.slice(dot + 1)
-    const tampered = `${packed.slice(0, dot + 1)}${sig.endsWith('A') ? 'B' : 'A'}${sig.slice(1)}`
+    const tampered = `${packed.slice(0, dot + 1)}${sig.startsWith('A') ? 'B' : 'A'}${sig.slice(1)}`
     expect(unpackChallenge(tampered, 'authenticate', NOW)).toBeNull()
   })
 })
diff --git a/docs/contributing/testing.md b/docs/contributing/testing.md
index 4298a529..1d3311d8 100644
--- a/docs/contributing/testing.md
+++ b/docs/contributing/testing.md
@@ -31,6 +31,10 @@ Most tests run without JavaScript. Test enhancements separately. Use the fixture
 
 The suite shares state and runs serially. Restore global settings changed by a test. Use fixed clocks where appropriate and allow for task scheduling and the single-connection pool. Do not hide intermittent failures with retries.
 
+Signature-tampering tests must change the character they inspect when choosing a
+replacement. Comparing the last character and replacing the first can leave a
+randomly generated signature unchanged.
+
 Use the fake mailbox to retrieve mail tokens. Request-level tests should use the signed-header helper where HTTP/Secure-cookie behaviour differs from Chromium. Clear the intended cookie by name. Local passkey tests deliberately omit the board URL setting.
 
 ## Website tests