diff --git a/ApiCore-Backend/src/runtime/root-module.spec.ts b/ApiCore-Backend/src/runtime/root-module.spec.ts
index 4cb1176..b2b93cd 100644
--- a/ApiCore-Backend/src/runtime/root-module.spec.ts
+++ b/ApiCore-Backend/src/runtime/root-module.spec.ts
@@ -100,11 +100,24 @@ describe('rootModuleFor', () => {
   // Only the worker dispatches events. A handler in a module the worker
   // does not import would be registered by the API and never run.
   it('the worker discovers exactly the domain event handlers of the API', async () => {
-    const api = await discoveredHandlerIds(AppModule);
-    const worker = await discoveredHandlerIds(WorkerModule);
+    // Compiling the API constructs JwtStrategy, which needs a secret. CI
+    // builds have no .env file, so the test supplies one itself instead of
+    // relying on another suite of the same worker having set it.
+    const previousSecret = process.env.JWT_ACCESS_SECRET;
+    process.env.JWT_ACCESS_SECRET ||= 'root-module-spec-'.padEnd(40, 'x');
+    try {
+      const api = await discoveredHandlerIds(AppModule);
+      const worker = await discoveredHandlerIds(WorkerModule);
 
-    expect(api).toContain('webhooks.forward');
-    expect(worker).toEqual(api);
+      expect(api).toContain('webhooks.forward');
+      expect(worker).toEqual(api);
+    } finally {
+      if (previousSecret === undefined) {
+        delete process.env.JWT_ACCESS_SECRET;
+      } else {
+        process.env.JWT_ACCESS_SECRET = previousSecret;
+      }
+    }
   }, 30_000);
 });