diff --git a/tests/Auth/RefreshTokenRotationTest.php b/tests/Auth/RefreshTokenRotationTest.php
deleted file mode 100644
index d6e428fd..00000000
--- a/tests/Auth/RefreshTokenRotationTest.php
+++ /dev/null
@@ -1,65 +0,0 @@
-<?php
-
-namespace App\Tests\Auth;
-
-use App\Auth\Entity\User;
-use App\Auth\Service\TokenService;
-use App\Tests\ApiTestCase;
-
-/**
- * Refresh tokens are single-use (rotated on every refresh) and a suspended user
- * cannot refresh. Guards against replaying a stolen refresh token.
- */
-class RefreshTokenRotationTest extends ApiTestCase
-{
-    private function issueRefresh(User $user): string
-    {
-        return static::getContainer()->get(TokenService::class)->issueTokens($user)['refresh_token'];
-    }
-
-    private function refresh(string $token): array
-    {
-        $this->client->request(
-            'POST',
-            '/oauth/token/refresh',
-            server: ['CONTENT_TYPE' => 'application/json'],
-            content: json_encode(['refresh_token' => $token]),
-        );
-
-        return json_decode($this->client->getResponse()->getContent(), true) ?? [];
-    }
-
-    public function testTokenIsRotatedAndOldOneRevoked(): void
-    {
-        $this->client->disableReboot();
-        $user = $this->createUser();
-
-        $old  = $this->issueRefresh($user);
-        $body = $this->refresh($old);
-        $this->assertSame(200, $this->responseCode());
-
-        $new = $body['refresh_token'];
-        $this->assertNotSame($old, $new, 'refresh token was not rotated');
-
-        // the old token is now single-use-spent → rejected
-        $this->refresh($old);
-        $this->assertSame(401, $this->responseCode());
-
-        // the new token still works
-        $this->refresh($new);
-        $this->assertSame(200, $this->responseCode());
-    }
-
-    public function testSuspendedUserCannotRefresh(): void
-    {
-        $this->client->disableReboot();
-        $user = $this->createUser();
-        $token = $this->issueRefresh($user);
-
-        $user->setStatus(0);
-        $this->em->flush();
-
-        $this->refresh($token);
-        $this->assertSame(401, $this->responseCode());
-    }
-}