diff --git a/tests/abac/application.conf b/tests/abac/application.conf
index 6285a00..3e011a9 100644
--- a/tests/abac/application.conf
+++ b/tests/abac/application.conf
@@ -10,13 +10,15 @@ http {
 oauth {
   jwt {
     secret = ${?OAUTH_JWT_SECRET}
-    # RFC 9068 §4 — required by auth.policy-verifier whenever validate = true.
+    # RFC 9068 §4 — required by auth.policy-verifier whenever mode is "verify".
     # This file is mounted OVER the template's application.conf, so the
     # substitutions have to be repeated here or the keys are simply absent.
     issuer = ${?OAUTH_JWT_ISSUER}
     audience = ${?OAUTH_JWT_AUDIENCE}
-    validate = true
-    validate = ${?OAUTH_JWT_VALIDATE}
+    # auth.policy-verifier#134 replaced the validate / allowInsecureDecode pair
+    # with one enum; the verifier now refuses to boot on the removed keys.
+    mode = "verify"
+    mode = ${?OAUTH_JWT_MODE}
   }
 }