@@ -20,6 +20,7 @@ const {
     deletePolicy,
     listUsers,
     invokeBreakGlass,
+    createAccessReviewCampaign,
     decideAccessReviewItem,
     setBreakGlassPolicy,
     proposePolicyVersion,
@@ -81,6 +82,20 @@ describe("api/client", () => {
         expect((init?.headers as Record<string, string>).Authorization).toBe("Bearer token-123");
     });
 
+    it("never sends Content-Type: application/json on a bodyless POST — a real Fastify server 400s an empty body declared as JSON", async () => {
+        // Regression test: caught by an actual browser session against a
+        // real server, not by any test that existed before this one — every
+        // mock in this file resolves regardless of what headers were sent,
+        // so this specific bug (activateComputePolicy, and every other
+        // bodyless POST helper in this file, all silently 400ing in
+        // production) had no test coverage at all until now.
+        vi.mocked(fetch).mockResolvedValueOnce(jsonResponse(200, { id: "campaign-1" }));
+        await createAccessReviewCampaign("org-1");
+        const [, init] = vi.mocked(fetch).mock.calls[0];
+        expect(init?.body).toBeUndefined();
+        expect((init?.headers as Record<string, string>)["Content-Type"]).toBeUndefined();
+    });
+
     it("sends the correct method, path, and JSON body for a POST endpoint", async () => {
         vi.mocked(fetch).mockResolvedValueOnce(jsonResponse(201, { id: "u1", organizationId: "org-1" }));
         await createUser("org-1", { externalSubject: "idp|new", displayName: "New User" });
 
@@ -41,10 +41,20 @@ async function authorizedRequest(path: string, init?: RequestInit): Promise<Resp
     }
     let response: Response;
     try {
-        response = await fetch(`${API_BASE_URL}${path}`, {
-            ...init,
-            headers: { ...(init?.headers ?? {}), Authorization: `Bearer ${user.access_token}`, "Content-Type": "application/json" },
-        });
+        // Content-Type: application/json only when there actually is a body
+        // — sending it on a bodyless call (activateComputePolicy,
+        // createAccessReviewCampaign, verifyAiInferenceDeployment, ...)
+        // declares a JSON body that never arrives, and Fastify's body
+        // parser correctly rejects that as a 400 ("Body cannot be empty
+        // when content-type is set to 'application/json'"). Caught by an
+        // actual browser session against a real server — every call site
+        // using this helper for a bodyless POST was silently broken, and no
+        // existing test could have caught it (admin-console unit tests mock
+        // fetch directly, so they never exercise a real Content-Type/body
+        // mismatch the way an actual HTTP client does).
+        const headers: Record<string, string> = { ...(init?.headers as Record<string, string> ?? {}), Authorization: `Bearer ${user.access_token}` };
+        if (init?.body !== undefined) headers["Content-Type"] = "application/json";
+        response = await fetch(`${API_BASE_URL}${path}`, { ...init, headers });
     } catch (err) {
         throw new ApiError(0, undefined, `Could not reach the admin API: ${err instanceof Error ? err.message : String(err)}`);
     }
 
@@ -3470,6 +3470,27 @@ describe("CORS (@fastify/cors, gated on adminConsoleOrigin — see config.ts)",
         expect(response.headers["access-control-allow-origin"]).toBe("https://admin.example-hospital.test");
     });
 
+    it("allows PUT, PATCH, and DELETE preflights — every mutating admin-console call (quota, break-glass policy, user/group/policy updates, deletes) needs these, not just GET/POST", async () => {
+        // Caught by an actual browser session against a real server, not by
+        // any prior test: @fastify/cors's own default `methods` is
+        // 'GET,HEAD,POST' only (verified directly against the installed
+        // @fastify/cors@11 package) — the one preflight test that existed
+        // before this only ever asserted a GET preflight, so a real
+        // browser's PUT-method quota save silently failed CORS while every
+        // .inject()-based integration test (which bypasses CORS entirely)
+        // stayed green.
+        const app = buildTestApp("https://admin.example-hospital.test");
+        for (const method of ["PUT", "PATCH", "DELETE"]) {
+            const response = await app.inject({
+                method: "OPTIONS",
+                url: "/me",
+                headers: { origin: "https://admin.example-hospital.test", "access-control-request-method": method, "access-control-request-headers": "authorization" },
+            });
+            expect(response.statusCode, `${method} preflight`).toBe(204);
+            expect(response.headers["access-control-allow-methods"], `${method} preflight`).toContain(method);
+        }
+    });
+
     it("never sets Access-Control-Allow-Credentials (auth here is a header, never an ambient cookie)", async () => {
         const app = buildTestApp("https://admin.example-hospital.test");
         const response = await app.inject({ method: "GET", url: "/health", headers: { origin: "https://admin.example-hospital.test" } });
 
@@ -295,7 +295,18 @@ export function buildApp(options: BuildAppOptions): FastifyInstance {
         // do. See config.ts's adminConsoleOrigin doc comment for why this
         // is opt-in (unset = no CORS plugin at all) rather than a default
         // wildcard/allow-list.
-        fastify.register(cors, { origin: options.adminConsoleOrigin, credentials: false });
+        //
+        // methods must be explicit: @fastify/cors's own default is
+        // 'GET,HEAD,POST' only (verified directly against the installed
+        // @fastify/cors@11 package, not assumed) — every PUT/PATCH/DELETE
+        // route the admin console calls (quota, break-glass policy, user/
+        // group/policy/service-principal updates, policy/invitation
+        // deletes) would otherwise fail preflight from a real browser. This
+        // was caught by an actual browser session against a real server,
+        // not by any existing test — app.inject()-based integration tests
+        // bypass CORS entirely, and admin-console unit tests mock fetch
+        // directly, so neither exercises a real preflight.
+        fastify.register(cors, { origin: options.adminConsoleOrigin, credentials: false, methods: ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"] });
     }
 
     // Routes are registered inside a nested plugin, not directly on