diff --git a/tests/test_auth.py b/tests/test_auth.py
index 6b0338d7..cacb95ff 100644
--- a/tests/test_auth.py
+++ b/tests/test_auth.py
@@ -169,6 +169,35 @@ class TestRequiredScope:
     def test_admin_memory_delete_needs_approve(self):
         assert required_scope("DELETE", "/api/admin/memories/some-id") == "approve"
 
+    # Internal endpoints
+    def test_internal_mcp_reload_needs_approve(self):
+        assert required_scope("POST", "/api/_internal/mcp-reload") == "approve"
+
+    def test_v1_internal_mcp_reload_needs_approve(self):
+        assert required_scope("POST", "/v1/api/_internal/mcp-reload") == "approve"
+
+    def test_internal_config_reload_needs_approve(self):
+        assert required_scope("POST", "/api/_internal/config-reload") == "approve"
+
+    def test_v1_internal_config_reload_needs_approve(self):
+        assert required_scope("POST", "/v1/api/_internal/config-reload") == "approve"
+
+    def test_proxy_internal_config_reload_needs_approve(self):
+        assert required_scope("POST", "/node/n1/v1/api/_internal/config-reload") == "approve"
+
+    def test_proxy_no_v1_internal_config_reload_needs_approve(self):
+        assert required_scope("POST", "/node/n1/api/_internal/config-reload") == "approve"
+
+    def test_proxy_internal_mcp_reload_needs_approve(self):
+        assert required_scope("POST", "/node/n1/v1/api/_internal/mcp-reload") == "approve"
+
+    def test_proxy_no_v1_internal_mcp_reload_needs_approve(self):
+        assert required_scope("POST", "/node/n1/api/_internal/mcp-reload") == "approve"
+
+    def test_get_internal_mcp_reload_needs_read(self):
+        """Only POST is elevated — GET falls through to read."""
+        assert required_scope("GET", "/api/_internal/mcp-reload") == "read"
+
 
 # ---------------------------------------------------------------------------
 # TestAuthConfig