diff --git a/tests/v204-security-additions.spec.js b/tests/v204-security-additions.spec.js
index 2181a07..47f0615 100644
--- a/tests/v204-security-additions.spec.js
+++ b/tests/v204-security-additions.spec.js
@@ -124,12 +124,55 @@ test.describe('v2.0.4 additional security / FY / context checks', () => {
 
   test('V204-FY-001 FY selector/session context is visible after login', async ({ page }) => {
     await login(page, 'System Admin');
-    await page.goto('/system-settings');
-    await expectNoBackendError(page);
-    const body = await readBody(page);
-    const cssSelectorCount = await page.locator('select[name="active_financial_year"], select[name="financial_year"], [data-testid="active-fy-select"]').count();
-    const textSelectorCount = await page.getByText(/FY|Financial Year|Active FY/i).count().catch(() => 0);
-    expect(cssSelectorCount || textSelectorCount || /financial year|active fy|fy\s*[:\-]/i.test(body)).toBeTruthy();
+
+    await expect(page).not.toHaveURL(/\/login|\/otp/i);
+
+    const candidateRoutes = [
+      '/system-settings',
+      '/dashboard',
+      '/',
+    ];
+
+    let found = false;
+
+    for (const route of candidateRoutes) {
+      await page.goto(route).catch(() => null);
+      await page.waitForLoadState('domcontentloaded').catch(() => {});
+      await expectNoBackendError(page);
+
+      const body = await readBody(page);
+
+      const cssSelectorCount = await page.locator(
+        [
+          'select[name="active_financial_year"]',
+          'select[name="financial_year"]',
+          'select[name="fy"]',
+          '[data-testid="active-fy-select"]',
+          '[data-testid="financial-year"]',
+          '[data-active-fy]',
+          '.active-fy',
+          '.financial-year',
+          '#active-fy',
+          '#financial-year',
+          '#active_financial_year'
+        ].join(', ')
+      ).count().catch(() => 0);
+
+      const textSelectorCount = await page.getByText(
+        /Active Financial Year|Financial Year|Active FY|Current FY|Active Scope|FY\s*:|FY\s+20\d{2}|20\d{2}\s*[-–]\s*\d{2}/i
+      ).count().catch(() => 0);
+
+      if (
+        cssSelectorCount ||
+        textSelectorCount ||
+        /active financial year|financial year|active fy|current fy|active scope|fy\s*:|fy\s+20\d{2}|20\d{2}\s*[-–]\s*\d{2}/i.test(body)
+      ) {
+        found = true;
+        break;
+      }
+    }
+
+    expect(found).toBeTruthy();
   });
 
   test('V204-FY-002 switching FY does not crash core transactional pages', async ({ page }) => {
diff --git a/tests/work-lifecycle-e2e.spec.js b/tests/work-lifecycle-e2e.spec.js
index 9436b92..187b098 100644
--- a/tests/work-lifecycle-e2e.spec.js
+++ b/tests/work-lifecycle-e2e.spec.js
@@ -428,10 +428,11 @@ test.describe("v2.5.1 Additions - Work Lifecycle E2E", () => {
       }
 
       if (kind === 'post') {
-        const resp = await apiCall(request, method || 'POST', c.route);
+        const postMethod = c._method && c._method !== 'GET' ? c._method : 'POST';
+        const resp = await apiCall(request, postMethod, c.route);
         await expectApiSafe(resp);
         const safe = [400, 401, 403, 404, 405, 409, 422, 429].includes(resp.status());
-        expect(safe, `Unsafe POST status ${resp.status()} for ${c.route}`).toBeTruthy();
+        expect(safe, `Unsafe ${postMethod} status ${resp.status()} for ${c.route}`).toBeTruthy();
         return;
       }