diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index cddd5e9..d987811 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -83,6 +83,12 @@ jobs:
           export MEDIA_SERVER_VISUALIZER_ENABLED=false
           export MEDIA_SERVER_UPDATE_CHECK_ENABLED=false
           dbus-run-session -- bash -c '
+            # First run writes a default config (random token) and exits 0
+            # instead of serving, so the server is never left running in
+            # insecure no-auth mode. Run once to seed the config; the real
+            # launch below then finds it and actually boots. /api/health needs
+            # no auth, so the generated token is irrelevant here.
+            python -m media_server.main --no-tray --port 18765 || true
             python -m media_server.main --no-tray --port 18765 &
             SERVER_PID=$!
             for i in $(seq 1 30); do