diff --git a/src/__tests__/keycloak.apppassword.test.js b/src/__tests__/keycloak.apppassword.test.js
index 64c621f..787c2f9 100644
--- a/src/__tests__/keycloak.apppassword.test.js
+++ b/src/__tests__/keycloak.apppassword.test.js
@@ -1,7 +1,10 @@
 import { jest } from '@jest/globals';
 
+const userQueryMock = {
+  lean: jest.fn(),
+};
 const userModelMock = {
-  findOne: jest.fn(),
+  findOne: jest.fn(() => userQueryMock),
 };
 const appPasswordQueryMock = {
   select: jest.fn(),
@@ -90,7 +93,7 @@ describe('app-password authentication', () => {
 
   it('accepts a valid username and app password', async () => {
     const user = { _id: 'user-1', username: 'slicer-user' };
-    userModelMock.findOne.mockResolvedValue(user);
+    userQueryMock.lean.mockResolvedValue(user);
     appPasswordQueryMock.lean.mockResolvedValue([{ secret: 'stored-hash' }]);
     bcryptCompareMock.mockResolvedValue(true);
 
@@ -105,7 +108,7 @@ describe('app-password authentication', () => {
     const user = { _id: 'user-1', username: 'slicer-user' };
     req.headers = {};
     req.params.password = 'app-secret';
-    userModelMock.findOne.mockResolvedValue(user);
+    userQueryMock.lean.mockResolvedValue(user);
     appPasswordQueryMock.lean.mockResolvedValue([{ secret: 'stored-hash' }]);
     bcryptCompareMock.mockResolvedValue(true);
 
@@ -117,7 +120,7 @@ describe('app-password authentication', () => {
   });
 
   it('rejects an invalid app password', async () => {
-    userModelMock.findOne.mockResolvedValue({ _id: 'user-1', username: 'slicer-user' });
+    userQueryMock.lean.mockResolvedValue({ _id: 'user-1', username: 'slicer-user' });
     appPasswordQueryMock.lean.mockResolvedValue([{ secret: 'stored-hash' }]);
     bcryptCompareMock.mockResolvedValue(false);