diff --git a/app/Glimpse/Config.php b/app/Glimpse/Config.php
index 338a67e..ac8651e 100644
--- a/app/Glimpse/Config.php
+++ b/app/Glimpse/Config.php
@@ -14,7 +14,7 @@ final class Config
      * process fills it in before tagging, and an empty value keeps the
      * fallback off.
      */
-    private const PUBLIC_TOKEN = '';
+    private const PUBLIC_TOKEN = '4|wbQrxtzJP89PXWn5Mku5fRUjBGLTnbB9javJhN9m5d9cb13f';
 
     private readonly string $publicToken;
 
diff --git a/tests/Feature/Glimpse/PublicTokenTest.php b/tests/Feature/Glimpse/PublicTokenTest.php
index 66db005..bc017fc 100644
--- a/tests/Feature/Glimpse/PublicTokenTest.php
+++ b/tests/Feature/Glimpse/PublicTokenTest.php
@@ -26,10 +26,22 @@
         ->and($config->usingPublicToken())->toBeFalse();
 });
 
-test('without a baked public token the fallback stays off', function () {
-    $config = new Config;
+test('an empty public token keeps the fallback off', function () {
+    $config = new Config(publicTokenOverride: '');
 
     expect($config->token())->toBeNull()
         ->and($config->publicToken())->toBeNull()
         ->and($config->usingPublicToken())->toBeFalse();
 });
+
+test('the baked release token is a plausible Sanctum token when present', function () {
+    $baked = (new Config)->publicToken();
+
+    // Empty in the repository is allowed (the release guard enforces
+    // baking); when present it must look like id|secret.
+    if ($baked !== null) {
+        expect($baked)->toMatch('/^\d+\|\w{40,}$/');
+    }
+
+    expect(true)->toBeTrue();
+});
diff --git a/tests/Pest.php b/tests/Pest.php
index e6b2329..c35b8ab 100644
--- a/tests/Pest.php
+++ b/tests/Pest.php
@@ -1,6 +1,7 @@
 <?php
 
 use Illuminate\Support\Facades\File;
+use MathiasGrimm\GlimpseCli\Glimpse\Config;
 use MathiasGrimm\GlimpseCli\Support\BaselineFile;
 use MathiasGrimm\GlimpseCli\Support\Sleeper;
 use Tests\Fixtures\Images;
@@ -14,6 +15,11 @@
         putenv('XDG_CONFIG_HOME='.$this->configHome);
         putenv('GLIMPSE_TOKEN');
         putenv('GLIMPSE_API_URL');
+
+        // A real public token is baked into Config for releases. Tests
+        // must not silently fall back to it: run with the fallback off,
+        // and let tests that exercise it bind their own override.
+        $this->app->instance(Config::class, new Config(publicTokenOverride: ''));
     })
     ->afterEach(function () {
         if ($this->originalCwd !== '') {
diff --git a/tests/Unit/ConfigTest.php b/tests/Unit/ConfigTest.php
index c09b31b..2906a60 100644
--- a/tests/Unit/ConfigTest.php
+++ b/tests/Unit/ConfigTest.php
@@ -4,18 +4,18 @@
 
 describe('token', function () {
     test('returns null when nothing is configured', function () {
-        expect((new Config)->token())->toBeNull();
+        expect((new Config(publicTokenOverride: ''))->token())->toBeNull();
     });
 
     test('reads the token from the config file', function () {
-        $config = new Config;
+        $config = new Config(publicTokenOverride: '');
         $config->setToken('file-token');
 
         expect($config->token())->toBe('file-token');
     });
 
     test('GLIMPSE_TOKEN env var beats the config file', function () {
-        $config = new Config;
+        $config = new Config(publicTokenOverride: '');
         $config->setToken('file-token');
 
         putenv('GLIMPSE_TOKEN=env-token');
@@ -28,19 +28,19 @@
 
 describe('apiUrl', function () {
     test('defaults to the production API url', function () {
-        expect((new Config)->apiUrl())->toBe('https://glimpseimg.com/api');
+        expect((new Config(publicTokenOverride: ''))->apiUrl())->toBe('https://glimpseimg.com/api');
     });
 
     test('GLIMPSE_API_URL env var overrides the default and trailing slashes are trimmed', function () {
         putenv('GLIMPSE_API_URL=https://glimpseimg.test/api/');
 
-        expect((new Config)->apiUrl())->toBe('https://glimpseimg.test/api');
+        expect((new Config(publicTokenOverride: ''))->apiUrl())->toBe('https://glimpseimg.test/api');
 
         putenv('GLIMPSE_API_URL');
     });
 
     test('reads api_url from the config file', function () {
-        $config = new Config;
+        $config = new Config(publicTokenOverride: '');
 
         mkdir(dirname($config->path()), 0700, true);
         file_put_contents($config->path(), json_encode(['api_url' => 'https://staging.glimpseimg.com/api']));
@@ -51,7 +51,7 @@
 
 describe('setToken', function () {
     test('creates the config file under XDG_CONFIG_HOME with restrictive permissions', function () {
-        $config = new Config;
+        $config = new Config(publicTokenOverride: '');
         $config->setToken('secret');
 
         expect($config->path())->toBe($this->configHome.'/glimpse/config.json')
@@ -60,7 +60,7 @@
     });
 
     test('preserves other config keys when updating the token', function () {
-        $config = new Config;
+        $config = new Config(publicTokenOverride: '');
 
         mkdir(dirname($config->path()), 0700, true);
         file_put_contents($config->path(), json_encode(['api_url' => 'https://staging.glimpseimg.com/api']));
@@ -72,7 +72,7 @@
     });
 
     test('setting a null token removes it from the file', function () {
-        $config = new Config;
+        $config = new Config(publicTokenOverride: '');
         $config->setToken('secret');
         $config->setToken(null);