diff --git a/.gitignore b/.gitignore
index bf8131d..6d92b7c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -69,6 +69,7 @@ web_modules/
 .env
 .env.*
 !.env.example
+!.env.test.example
 
 # parcel-bundler cache (https://parceljs.org/)
 .cache
diff --git a/apps/api/.env.test.example b/apps/api/.env.test.example
new file mode 100644
index 0000000..2d467ad
--- /dev/null
+++ b/apps/api/.env.test.example
@@ -0,0 +1,15 @@
+NODE_ENV=test
+PORT=3000
+# Must point at a *different* database than your `.env`'s — `pnpm test`
+# (test-support/reset-db.ts's `resetDatabase()`) TRUNCATEs almost every
+# table before each test. Pointing this at the same database `pnpm dev`
+# uses will wipe real local data on every test run. Easiest setup: same
+# Postgres server/credentials as `.env`, just a different database name —
+# create it once with e.g.:
+#   pnpm exec prisma db execute --url "postgresql://USER:PASSWORD@localhost:PORT/postgres?schema=public" --file - <<< "CREATE DATABASE batchcooking_test;"
+#   DATABASE_URL="postgresql://USER:PASSWORD@localhost:PORT/batchcooking_test?schema=public" pnpm exec prisma migrate deploy
+DATABASE_URL="postgresql://changeme:changeme@localhost:5432/batchcooking_test?schema=public"
+
+# Required, no default on purpose — generate your own, e.g.:
+#   node -e "console.log(require('crypto').randomBytes(48).toString('hex'))"
+JWT_SECRET=changeme-generate-a-real-random-secret-at-least-32-chars
diff --git a/apps/api/src/config/env.ts b/apps/api/src/config/env.ts
index 037ad71..7f52193 100644
--- a/apps/api/src/config/env.ts
+++ b/apps/api/src/config/env.ts
@@ -1,6 +1,18 @@
-import "dotenv/config";
+import dotenv from "dotenv";
 import { z } from "zod";
 
+// Loads `.env.test` instead of `.env` when running the test suite
+// (NODE_ENV=test, set by `cross-env` in package.json's `test` script —
+// already present in `process.env` by the time this module runs, since
+// `cross-env` sets it before invoking node/tsx at all). Keeps
+// `resetDatabase()` (test-support/reset-db.ts, which TRUNCATEs almost
+// every table before each test) pointed at a dedicated test database,
+// never whatever `pnpm dev` actually uses — running the test suite once
+// already wiped a real local dev database this way (`.env`/`.env.test`
+// sharing one `DATABASE_URL`), see `.env.test.example` for how to set the
+// separate test database this now requires.
+dotenv.config({ path: process.env.NODE_ENV === "test" ? ".env.test" : ".env" });
+
 /**
  * Schema for every environment variable the API reads. Parsing (below)
  * fails fast at startup if something required is missing/invalid, instead
diff --git a/apps/api/test-support/reset-db.ts b/apps/api/test-support/reset-db.ts
index 81f235a..cdf8e04 100644
--- a/apps/api/test-support/reset-db.ts
+++ b/apps/api/test-support/reset-db.ts
@@ -1,7 +1,35 @@
+import { env } from "../src/config/env.js";
 import { prisma } from "../src/db/prisma.js";
 import { syncRecipeSources } from "../src/db/recipe-source-sync.js";
 import { seedReferenceData } from "../src/db/reference-seed-data.js";
 
+/**
+ * Refuses to run outside a database that's obviously a test one — belt and
+ * braces alongside `config/env.ts` loading `.env.test` (not `.env`) under
+ * `NODE_ENV=test`: this already wiped a real local dev database once, when
+ * both env files shared one `DATABASE_URL`. `resetDatabase()` below
+ * TRUNCATEs almost the entire schema before every single test, so a
+ * misconfigured/missing `.env.test` must fail loudly here rather than
+ * silently truncate whatever `DATABASE_URL` happens to be set.
+ */
+function assertRunningAgainstTestDatabase() {
+  if (env.NODE_ENV !== "test") {
+    throw new Error(
+      `resetDatabase() TRUNCATEs almost the whole schema — refusing to run outside NODE_ENV=test (currently "${env.NODE_ENV}").`,
+    );
+  }
+  // "test" covers a local `.env.test` (`batchcooking_test`); "ci" covers
+  // CI's own service database (`batchcooking_ci`, set directly via the
+  // workflow's `env:`, not a `.env.test` file — see ci.yml). Neither
+  // matches the real dev database's name (`batchcooking`), which is the
+  // one case this must actually catch.
+  if (!env.DATABASE_URL?.includes("test") && !env.DATABASE_URL?.includes("ci")) {
+    throw new Error(
+      `resetDatabase() refuses to run against a DATABASE_URL that doesn't look like a test database (got "${env.DATABASE_URL}", expected it to contain "test" or "ci") — see .env.test.example.`,
+    );
+  }
+}
+
 // Single TRUNCATE ... CASCADE covers FK ordering and resets identity
 // sequences — used between tests/scenarios to start from a clean slate.
 // Re-seeds the Diet/Category/Allergy/Unit reference data right after
@@ -12,6 +40,7 @@ import { seedReferenceData } from "../src/db/reference-seed-data.js";
 // reflect whatever adapters this test run happens to have registered
 // (usually none — see recipe-source-registry.ts).
 export async function resetDatabase() {
+  assertRunningAgainstTestDatabase();
   await prisma.$executeRawUnsafe(`
     TRUNCATE TABLE
       "user_profile_allergy", "user_preference", "allergy", "category",