diff --git a/src/pkg/config/config.go b/src/pkg/config/config.go
index ee3198cd8..bd083baa8 100644
--- a/src/pkg/config/config.go
+++ b/src/pkg/config/config.go
@@ -5409,6 +5409,17 @@ var DashboardOverlayFile = "/data/hive.yaml.dashboard"
 // production always uses the fixed in-cluster path.
 var saTokenFile = "/var/run/secrets/kubernetes.io/serviceaccount/token"
 
+// SetSATokenFileForTest points IsKubernetesPod's serviceaccount-token probe
+// at path and returns a restore func. Out-of-package tests that need the
+// non-Kubernetes branch call this with a non-existent path (alongside
+// clearing KUBERNETES_SERVICE_HOST) so they stay hermetic on hosts that
+// really are pods — in-cluster CI runners and dev hives.
+func SetSATokenFileForTest(path string) func() {
+	orig := saTokenFile
+	saTokenFile = path
+	return func() { saTokenFile = orig }
+}
+
 // IsKubernetesPod reports whether the process is running inside a
 // Kubernetes pod (mirrors the entrypoint's IS_KUBERNETES detection).
 func IsKubernetesPod() bool {
diff --git a/src/pkg/dashboard/api_provenance_test.go b/src/pkg/dashboard/api_provenance_test.go
index b9dd19b7b..c90afd874 100644
--- a/src/pkg/dashboard/api_provenance_test.go
+++ b/src/pkg/dashboard/api_provenance_test.go
@@ -145,8 +145,14 @@ func TestProvenanceReportsSeedUnwritable(t *testing.T) {
 // report must say so: writable=true, writer names the spoke, and the path
 // names the real file — never the ConfigMap, which does not exist here.
 func TestProvenanceReportsSeedWritableOutsideKubernetes(t *testing.T) {
-	// No KUBERNETES_SERVICE_HOST set and no serviceaccount token on this host
-	// — IsKubernetesPod() reads false, matching a real Docker/podman hive.
+	// Force the non-Kubernetes branch explicitly: clear the env probe and
+	// point the serviceaccount-token probe at a non-existent path so
+	// IsKubernetesPod() reads false even when the test host really is a pod
+	// (in-cluster CI runners and dev hives have both signals set, which made
+	// this test fail there while silently passing on laptops).
+	t.Setenv("KUBERNETES_SERVICE_HOST", "")
+	restoreSAToken := config.SetSATokenFileForTest(filepath.Join(t.TempDir(), "no-such-sa-token"))
+	t.Cleanup(restoreSAToken)
 	writeProvenanceFixture(t,
 		"project:\n  org: acme\nagents:\n  scanner: {}\nhub:\n  is_public: true\nacmm_level: 4\n",
 		"project:\n  org: acme\nagents:\n  scanner: {}\n")