diff --git a/vitest.config.ts b/vitest.config.ts
index 2449a98..4a5ad90 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -5,6 +5,20 @@ export default defineConfig({
     globals: true,
     environment: 'node',
     include: ['__tests__/**/*.test.ts'],
+    /**
+     * Several MCP integration tests (mcp-daemon, mcp-initialize, mcp-ppid-watchdog,
+     * mcp-roots) spawn `dist/bin/codegraph.js serve --mcp` with `process.execPath`
+     * and rely on the child inheriting `process.env`. On a Node >= 25 dev machine
+     * the CLI's hard-block (src/bin/codegraph.ts) would otherwise exit the child
+     * before it ever responds, so every spawn-based test times out — see #478.
+     *
+     * Setting the override here keeps the CLI's runtime guard intact for end
+     * users (it's still enforced when `codegraph` is invoked directly) while
+     * letting the test suite run on whatever Node the contributor happens to
+     * have installed. CI on Node 22/23 is unaffected — the guard doesn't fire
+     * there, so the variable is a no-op.
+     */
+    env: { CODEGRAPH_ALLOW_UNSAFE_NODE: '1' },
     coverage: {
       provider: 'v8',
       reporter: ['text', 'json', 'html'],