diff --git a/packages/server/src/server/agent/providers/claude/agent.test.ts b/packages/server/src/server/agent/providers/claude/agent.test.ts
index 4705cfdcec..c3e828f457 100644
--- a/packages/server/src/server/agent/providers/claude/agent.test.ts
+++ b/packages/server/src/server/agent/providers/claude/agent.test.ts
@@ -1530,6 +1530,33 @@ describe("ClaudeAgentSession features", () => {
     await session.close();
   });
 
+  test("a patch before the first prompt keeps the restrictions the session opened with", async () => {
+    const { queryFactory } = createQueryMock();
+    const client = new ClaudeAgentClient({
+      logger,
+      queryFactory,
+      resolveBinary: async () => "/test/claude/bin",
+    });
+    const session = await client.createSession({
+      provider: "claude",
+      cwd: process.cwd(),
+      model: "claude-opus-4-8",
+      providerOptions: {
+        disallowedTools: ["Bash"],
+        sandbox: { enabled: true, failIfUnavailable: true },
+      },
+    });
+
+    await session.applyOptions?.({ fast_mode: true });
+    await (session as unknown as { ensureQuery(): Promise<unknown> }).ensureQuery();
+
+    expect(queryFactory.mock.calls[0]?.[0].options).toMatchObject({
+      disallowedTools: ["Bash"],
+      sandbox: { enabled: true, failIfUnavailable: true },
+    });
+    await session.close();
+  });
+
   test("switching to a model without Fast turns it off, reports that, and later patches still apply", async () => {
     const { queryFactory, queryMock } = createQueryMock();
     const client = new ClaudeAgentClient({
diff --git a/packages/server/src/server/agent/providers/cursor-acp-agent.test.ts b/packages/server/src/server/agent/providers/cursor-acp-agent.test.ts
index 11c98d9db1..300cc463cf 100644
--- a/packages/server/src/server/agent/providers/cursor-acp-agent.test.ts
+++ b/packages/server/src/server/agent/providers/cursor-acp-agent.test.ts
@@ -327,7 +327,7 @@ describe("CursorACPAgentClient session start", () => {
     );
   });
 
-  test("removing auto_accept sends nothing, so the session keeps answering permission requests", async () => {
+  test("removing auto_accept returns the session to asking for permission", async () => {
     const session = createCursorSession({ model: "composer-2.5" });
     await session.initializeNewSession();
     const request = {
@@ -337,12 +337,13 @@ describe("CursorACPAgentClient session start", () => {
     } as const;
 
     await session.applyOptions({ auto_accept: true });
-    // The patch for a removal carries no key; the session stays as it was until next open.
-    await session.applyOptions({});
-
     await expect(session.requestPermission({ ...request })).resolves.toEqual({
       outcome: { outcome: "selected", optionId: "allow-always" },
     });
+    await expect(session.applyOptions({ auto_accept: null })).resolves.toEqual({});
+
+    void session.requestPermission({ ...request });
+    await vi.waitFor(() => expect(session.getPendingPermissions()).toHaveLength(1));
   });
 
   test("a rejected patch leaves auto_accept as it was", async () => {