diff --git a/frontend/src/lib/ocr/useOcrJob.svelte.test.ts b/frontend/src/lib/ocr/useOcrJob.svelte.test.ts
index 50c9b84f..ecbeb5fe 100644
--- a/frontend/src/lib/ocr/useOcrJob.svelte.test.ts
+++ b/frontend/src/lib/ocr/useOcrJob.svelte.test.ts
@@ -139,29 +139,26 @@ describe('createOcrJob.triggerOcr', () => {
 	});
 });
 
-describe('createOcrJob — CSRF on the default fetch path', () => {
+describe('createOcrJob — CSRF on mutating requests', () => {
 	afterEach(() => {
-		vi.unstubAllGlobals();
 		document.cookie = 'XSRF-TOKEN=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/';
 	});
 
-	it('injects X-XSRF-TOKEN on the trigger POST when no fetchImpl is provided', async () => {
+	it('injects X-XSRF-TOKEN on the trigger POST', async () => {
 		document.cookie = 'XSRF-TOKEN=tok-123; path=/';
-		const globalFetch = vi.fn(
-			async () =>
+		const fetchImpl = makeFetch({
+			'/ocr': () =>
 				new Response(JSON.stringify({ jobId: 'job-1' }), {
 					status: 200,
 					headers: { 'Content-Type': 'application/json' }
 				})
-		);
-		vi.stubGlobal('fetch', globalFetch);
+		});
 
-		// No fetchImpl — exercises the production default path used by the document page.
-		const job = createOcrJob({ documentId: () => 'doc-1' });
+		const job = createOcrJob({ documentId: () => 'doc-1', fetchImpl });
 		await job.triggerOcr('KURRENT', false);
 		job.destroy();
 
-		const postCall = globalFetch.mock.calls.find(
+		const postCall = fetchImpl.mock.calls.find(
 			([url, init]) =>
 				url.toString().includes('/ocr') && (init as RequestInit | undefined)?.method === 'POST'
 		);
diff --git a/frontend/src/lib/ocr/useOcrJob.svelte.ts b/frontend/src/lib/ocr/useOcrJob.svelte.ts
index e3c4382c..af6e5adf 100644
--- a/frontend/src/lib/ocr/useOcrJob.svelte.ts
+++ b/frontend/src/lib/ocr/useOcrJob.svelte.ts
@@ -1,7 +1,7 @@
 import { m } from '$lib/paraglide/messages.js';
 import { getErrorMessage } from '$lib/shared/errors';
 import { translateOcrProgress } from '$lib/ocr/translateOcrProgress';
-import { csrfFetch } from '$lib/shared/cookies';
+import { makeCsrfFetch } from '$lib/shared/cookies';
 
 export interface OcrJobOptions {
 	documentId: () => string;
@@ -28,7 +28,7 @@ const DEFAULT_RESET_DELAY_MS = 1000;
 
 export function createOcrJob(options: OcrJobOptions): OcrJobController {
 	const { documentId, onJobFinished } = options;
-	const fetchImpl = options.fetchImpl ?? csrfFetch;
+	const fetchImpl = makeCsrfFetch(options.fetchImpl ?? fetch);
 	const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
 	const resetDelayMs = options.resetDelayMs ?? DEFAULT_RESET_DELAY_MS;