diff --git a/t/cypress/integration/OPAC/SCO_spec.ts b/t/cypress/integration/OPAC/SCO_spec.ts
index e67cb8bd6d..03240be29b 100644
--- a/t/cypress/integration/OPAC/SCO_spec.ts
+++ b/t/cypress/integration/OPAC/SCO_spec.ts
@@ -1,4 +1,50 @@
 describe("SCO", () => {
+    // Sets a system preference via the intranet svc endpoint using only
+    // cy.request() — no browser navigation, so no cross-origin issues.
+    function setSyspref(variable: string, value: string) {
+        // Step 1: GET the login page to get an anonymous session + its CSRF token
+        cy.request("/cgi-bin/koha/mainpage.pl?logout.x=1").then(loginPage => {
+            const csrfForLogin = (loginPage.body as string).match(
+                /<meta name="csrf-token" content="([^"]+)"/
+            )?.[1];
+            if (!csrfForLogin)
+                throw new Error("CSRF token not found on login page");
+
+            // Step 2: POST credentials — Koha authenticates and redirects to the
+            // logged-in mainpage whose body contains the new session's CSRF token
+            cy.request({
+                method: "POST",
+                url: "/cgi-bin/koha/mainpage.pl",
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                },
+                body: [
+                    `login_userid=${encodeURIComponent(Cypress.env("apiUsername"))}`,
+                    `login_password=${encodeURIComponent(Cypress.env("apiPassword"))}`,
+                    `csrf_token=${encodeURIComponent(csrfForLogin)}`,
+                    `login_op=cud-login`,
+                ].join("&"),
+            }).then(mainPage => {
+                const csrfForSvc = (mainPage.body as string).match(
+                    /<meta name="csrf-token" content="([^"]+)"/
+                )?.[1];
+                if (!csrfForSvc)
+                    throw new Error("CSRF token not found on main page");
+
+                // Step 3: POST to svc endpoint — session cookie sent automatically
+                cy.request({
+                    method: "POST",
+                    url: "/cgi-bin/koha/svc/config/systempreferences",
+                    headers: {
+                        "Content-Type": "application/x-www-form-urlencoded",
+                        "CSRF-TOKEN": csrfForSvc,
+                    },
+                    body: `pref_${encodeURIComponent(variable)}=${encodeURIComponent(value)}`,
+                });
+            });
+        });
+    }
+
     beforeEach(() => {
         cy.task("insertSampleBiblio", { item_count: 1 }).then(objects => {
             cy.wrap(objects).as("objects");
@@ -9,15 +55,15 @@ describe("SCO", () => {
         });
         cy.task("query", {
             sql: "SELECT value FROM systempreferences WHERE variable='WebBasedSelfCheck'",
-        }).then(value => {
-            cy.wrap(value).as("syspref_WebBasedSelfCheck");
+        }).then(rows => {
+            cy.wrap(rows[0].value).as("syspref_WebBasedSelfCheck");
         });
+        setSyspref("WebBasedSelfCheck", "1");
     });
 
     afterEach(function () {
         cy.task("deleteSampleObjects", this.objects);
-        cy.login();
-        cy.set_syspref("WebBasedSelfCheck", this.syspref_WebBasedSelfCheck);
+        setSyspref("WebBasedSelfCheck", this.syspref_WebBasedSelfCheck);
     });
 
     it("Should not crash if barcode contains '+'", function () {