diff --git a/cypress.config.ts b/cypress.config.ts
index f25a73273f..ea3f263df9 100644
--- a/cypress.config.ts
+++ b/cypress.config.ts
@@ -12,11 +12,14 @@ export default defineConfig({
         setupNodeEvents(on, config) {
             return require("./t/cypress/plugins/index.js")(on, config);
         },
+        allowCypressEnv: false,
         baseUrl: process.env.KOHA_INTRANET_URL || "http://localhost:8081",
         specPattern: "t/cypress/integration/**/*.*",
         supportFile: "t/cypress/support/e2e.js",
         env: {
             opacBaseUrl: process.env.KOHA_OPAC_URL || "http://localhost:8080",
+            kohaUsername: process.env.KOHA_USER || "koha",
+            kohaPassword: process.env.KOHA_PASS || "koha",
             apiUsername: process.env.KOHA_USER || "koha",
             apiPassword: process.env.KOHA_PASS || "koha",
         },
diff --git a/t/cypress/integration/Islands/SelfRenewal.ts b/t/cypress/integration/Islands/SelfRenewal.ts
index b05562f20e..faf41ee5e2 100644
--- a/t/cypress/integration/Islands/SelfRenewal.ts
+++ b/t/cypress/integration/Islands/SelfRenewal.ts
@@ -55,18 +55,20 @@ describe("Patron self-renewal", () => {
     });
     it("should verify that the patron wants to renew their account", function () {
         cy.visitOpac("/cgi-bin/koha/opac-user.pl");
-        cy.intercept(
-            "GET",
-            Cypress.env("opacBaseUrl") +
-                "/api/v1/public/patrons/*/self_renewal?_per_page=-1",
-            {
-                self_renewal_settings: {
-                    opac_patron_details: "0",
-                    self_renewal_failure_message:
-                        "Your self-renewal can't be processed at this time. Please visit your local branch to complete your renewal.",
-                },
-            }
-        ).as("renewalConfig");
+        cy.env(["opacBaseUrl"]).then(({ opacBaseUrl }) => {
+            cy.intercept(
+                "GET",
+                opacBaseUrl +
+                    "/api/v1/public/patrons/*/self_renewal?_per_page=-1",
+                {
+                    self_renewal_settings: {
+                        opac_patron_details: "0",
+                        self_renewal_failure_message:
+                            "Your self-renewal can't be processed at this time. Please visit your local branch to complete your renewal.",
+                    },
+                }
+            ).as("renewalConfig");
+        });
         cy.get("#patronSelfRenewal", { timeout: 10000 });
         cy.get("#self_renewal_available a").click();
         cy.wait("@renewalConfig");
@@ -76,33 +78,36 @@ describe("Patron self-renewal", () => {
     });
     it("should renew a patron's account", function () {
         cy.visitOpac("/cgi-bin/koha/opac-user.pl");
-        cy.intercept(
-            "GET",
-            Cypress.env("opacBaseUrl") +
-                "/api/v1/public/patrons/*/self_renewal?_per_page=-1",
-            {
-                self_renewal_settings: {
-                    opac_patron_details: "0",
-                    self_renewal_failure_message:
-                        "Your self-renewal can't be processed at this time. Please visit your local branch to complete your renewal.",
-                },
-            }
-        ).as("renewalConfig");
+        cy.env(["opacBaseUrl"]).then(({ opacBaseUrl }) => {
+            cy.intercept(
+                "GET",
+                opacBaseUrl +
+                    "/api/v1/public/patrons/*/self_renewal?_per_page=-1",
+                {
+                    self_renewal_settings: {
+                        opac_patron_details: "0",
+                        self_renewal_failure_message:
+                            "Your self-renewal can't be processed at this time. Please visit your local branch to complete your renewal.",
+                    },
+                }
+            ).as("renewalConfig");
+        });
         cy.get("#patronSelfRenewal", { timeout: 10000 });
         cy.get("#self_renewal_available a").click();
         cy.wait("@renewalConfig");
-        cy.intercept(
-            "POST",
-            Cypress.env("opacBaseUrl") +
-                "/api/v1/public/patrons/*/self_renewal",
-            {
-                statusCode: 201,
-                body: {
-                    expiry_date: "2099-01-01",
-                    confirmation_sent: true,
-                },
-            }
-        ).as("submitRenewal");
+        cy.env(["opacBaseUrl"]).then(({ opacBaseUrl }) => {
+            cy.intercept(
+                "POST",
+                opacBaseUrl + "/api/v1/public/patrons/*/self_renewal",
+                {
+                    statusCode: 201,
+                    body: {
+                        expiry_date: "2099-01-01",
+                        confirmation_sent: true,
+                    },
+                }
+            ).as("submitRenewal");
+        });
         cy.get("#patronSelfRenewal .verification_actions")
             .contains("Yes")
             .click();
@@ -113,34 +118,39 @@ describe("Patron self-renewal", () => {
     });
     it("should display an information message step", function () {
         cy.visitOpac("/cgi-bin/koha/opac-user.pl");
-        cy.intercept(
-            "GET",
-            Cypress.env("opacBaseUrl") +
-                "/api/v1/public/patrons/*/self_renewal?_per_page=-1",
-            {
-                self_renewal_settings: {
-                    opac_patron_details: "0",
-                    self_renewal_failure_message:
-                        "Your self-renewal can't be processed at this time. Please visit your local branch to complete your renewal.",
-                    self_renewal_information_messages: ["This should be shown"],
-                },
-            }
-        ).as("renewalConfig");
+        cy.env(["opacBaseUrl"]).then(({ opacBaseUrl }) => {
+            cy.intercept(
+                "GET",
+                opacBaseUrl +
+                    "/api/v1/public/patrons/*/self_renewal?_per_page=-1",
+                {
+                    self_renewal_settings: {
+                        opac_patron_details: "0",
+                        self_renewal_failure_message:
+                            "Your self-renewal can't be processed at this time. Please visit your local branch to complete your renewal.",
+                        self_renewal_information_messages: [
+                            "This should be shown",
+                        ],
+                    },
+                }
+            ).as("renewalConfig");
+        });
         cy.get("#patronSelfRenewal", { timeout: 10000 });
         cy.get("#self_renewal_available a").click();
         cy.wait("@renewalConfig");
-        cy.intercept(
-            "POST",
-            Cypress.env("opacBaseUrl") +
-                "/api/v1/public/patrons/*/self_renewal",
-            {
-                statusCode: 201,
-                body: {
-                    expiry_date: "2099-01-01",
-                    confirmation_sent: true,
-                },
-            }
-        ).as("submitRenewal");
+        cy.env(["opacBaseUrl"]).then(({ opacBaseUrl }) => {
+            cy.intercept(
+                "POST",
+                opacBaseUrl + "/api/v1/public/patrons/*/self_renewal",
+                {
+                    statusCode: 201,
+                    body: {
+                        expiry_date: "2099-01-01",
+                        confirmation_sent: true,
+                    },
+                }
+            ).as("submitRenewal");
+        });
         cy.get("#patronSelfRenewal .verification_question").contains(
             "This should be shown"
         );
@@ -158,18 +168,20 @@ describe("Patron self-renewal", () => {
     });
     it("should confirm patron details if required", function () {
         cy.visitOpac("/cgi-bin/koha/opac-user.pl");
-        cy.intercept(
-            "GET",
-            Cypress.env("opacBaseUrl") +
-                "/api/v1/public/patrons/*/self_renewal?_per_page=-1",
-            {
-                self_renewal_settings: {
-                    opac_patron_details: "1",
-                    self_renewal_failure_message:
-                        "Your self-renewal can't be processed at this time. Please visit your local branch to complete your renewal.",
-                },
-            }
-        ).as("renewalConfig");
+        cy.env(["opacBaseUrl"]).then(({ opacBaseUrl }) => {
+            cy.intercept(
+                "GET",
+                opacBaseUrl +
+                    "/api/v1/public/patrons/*/self_renewal?_per_page=-1",
+                {
+                    self_renewal_settings: {
+                        opac_patron_details: "1",
+                        self_renewal_failure_message:
+                            "Your self-renewal can't be processed at this time. Please visit your local branch to complete your renewal.",
+                    },
+                }
+            ).as("renewalConfig");
+        });
         cy.get("#patronSelfRenewal", { timeout: 10000 });
         cy.get("#self_renewal_available a").click();
         cy.wait("@renewalConfig");
@@ -183,18 +195,19 @@ describe("Patron self-renewal", () => {
         cy.get("#update-account div.alert.alert-info").contains(
             "Please verify your details to proceed with your self-renewal"
         );
-        cy.intercept(
-            "POST",
-            Cypress.env("opacBaseUrl") +
-                "/api/v1/public/patrons/*/self_renewal",
-            {
-                statusCode: 201,
-                body: {
-                    expiry_date: "2099-01-01",
-                    confirmation_sent: true,
-                },
-            }
-        ).as("submitRenewal");
+        cy.env(["opacBaseUrl"]).then(({ opacBaseUrl }) => {
+            cy.intercept(
+                "POST",
+                opacBaseUrl + "/api/v1/public/patrons/*/self_renewal",
+                {
+                    statusCode: 201,
+                    body: {
+                        expiry_date: "2099-01-01",
+                        confirmation_sent: true,
+                    },
+                }
+            ).as("submitRenewal");
+        });
         cy.get("#update-account fieldset.action input[type='submit']")
             .contains("Submit renewal request")
             .click();
diff --git a/t/cypress/integration/OPAC/SCO_spec.ts b/t/cypress/integration/OPAC/SCO_spec.ts
index 03240be29b..6142bd0128 100644
--- a/t/cypress/integration/OPAC/SCO_spec.ts
+++ b/t/cypress/integration/OPAC/SCO_spec.ts
@@ -3,46 +3,58 @@ describe("SCO", () => {
     // cy.request() — no browser navigation, so no cross-origin issues.
     function setSyspref(variable: string, value: string) {
         // Step 1: GET the login page to get an anonymous session + its CSRF token
-        cy.request("/cgi-bin/koha/mainpage.pl?logout.x=1").then(loginPage => {
-            const csrfForLogin = (loginPage.body as string).match(
-                /<meta name="csrf-token" content="([^"]+)"/
-            )?.[1];
-            if (!csrfForLogin)
-                throw new Error("CSRF token not found on login page");
+        cy.env(["apiUsername", "apiPassword"]).then(
+            ({ apiUsername, apiPassword }) => {
+                cy.request("/cgi-bin/koha/mainpage.pl?logout.x=1").then(
+                    loginPage => {
+                        const csrfForLogin = (loginPage.body as string).match(
+                            /<meta name="csrf-token" content="([^"]+)"/
+                        )?.[1];
+                        if (!csrfForLogin)
+                            throw new Error(
+                                "CSRF token not found on login page"
+                            );
 
-            // Step 2: POST credentials — Koha authenticates and redirects to the
-            // logged-in mainpage whose body contains the new session's CSRF token
-            cy.request({
-                method: "POST",
-                url: "/cgi-bin/koha/mainpage.pl",
-                headers: {
-                    "Content-Type": "application/x-www-form-urlencoded",
-                },
-                body: [
-                    `login_userid=${encodeURIComponent(Cypress.env("apiUsername"))}`,
-                    `login_password=${encodeURIComponent(Cypress.env("apiPassword"))}`,
-                    `csrf_token=${encodeURIComponent(csrfForLogin)}`,
-                    `login_op=cud-login`,
-                ].join("&"),
-            }).then(mainPage => {
-                const csrfForSvc = (mainPage.body as string).match(
-                    /<meta name="csrf-token" content="([^"]+)"/
-                )?.[1];
-                if (!csrfForSvc)
-                    throw new Error("CSRF token not found on main page");
+                        // Step 2: POST credentials — Koha authenticates and redirects to the
+                        // logged-in mainpage whose body contains the new session's CSRF token
+                        cy.request({
+                            method: "POST",
+                            url: "/cgi-bin/koha/mainpage.pl",
+                            headers: {
+                                "Content-Type":
+                                    "application/x-www-form-urlencoded",
+                            },
+                            body: [
+                                `login_userid=${encodeURIComponent(apiUsername)}`,
+                                `login_password=${encodeURIComponent(apiPassword)}`,
+                                `csrf_token=${encodeURIComponent(csrfForLogin)}`,
+                                `login_op=cud-login`,
+                            ].join("&"),
+                        }).then(mainPage => {
+                            const csrfForSvc = (mainPage.body as string).match(
+                                /<meta name="csrf-token" content="([^"]+)"/
+                            )?.[1];
+                            if (!csrfForSvc)
+                                throw new Error(
+                                    "CSRF token not found on main page"
+                                );
 
-                // Step 3: POST to svc endpoint — session cookie sent automatically
-                cy.request({
-                    method: "POST",
-                    url: "/cgi-bin/koha/svc/config/systempreferences",
-                    headers: {
-                        "Content-Type": "application/x-www-form-urlencoded",
-                        "CSRF-TOKEN": csrfForSvc,
-                    },
-                    body: `pref_${encodeURIComponent(variable)}=${encodeURIComponent(value)}`,
-                });
-            });
-        });
+                            // Step 3: POST to svc endpoint — session cookie sent automatically
+                            cy.request({
+                                method: "POST",
+                                url: "/cgi-bin/koha/svc/config/systempreferences",
+                                headers: {
+                                    "Content-Type":
+                                        "application/x-www-form-urlencoded",
+                                    "CSRF-TOKEN": csrfForSvc,
+                                },
+                                body: `pref_${encodeURIComponent(variable)}=${encodeURIComponent(value)}`,
+                            });
+                        });
+                    }
+                );
+            }
+        );
     }
 
     beforeEach(() => {
diff --git a/t/cypress/support/e2e.js b/t/cypress/support/e2e.js
index 2e36505ab2..b87ae98c09 100644
--- a/t/cypress/support/e2e.js
+++ b/t/cypress/support/e2e.js
@@ -75,46 +75,40 @@ Cypress.on("uncaught:exception", err => {
     }
 });
 
-function get_fallback_login_value(param) {
-    var env_var = param == "username" ? "KOHA_USER" : "KOHA_PASS";
-
-    return typeof Cypress.env(env_var) === "undefined"
-        ? "koha"
-        : Cypress.env(env_var);
-}
-
 Cypress.Commands.add("visitOpac", path => {
-    cy.visit(Cypress.env("opacBaseUrl") + path);
+    cy.env(["opacBaseUrl"]).then(({ opacBaseUrl }) =>
+        cy.visit(opacBaseUrl + path)
+    );
 });
 
 Cypress.Commands.add("login", (username, password) => {
-    var user =
-        typeof username === "undefined"
-            ? get_fallback_login_value("username")
-            : username;
-    var pass =
-        typeof password === "undefined"
-            ? get_fallback_login_value("password")
-            : password;
-    cy.visit("/cgi-bin/koha/mainpage.pl?logout.x=1");
-    cy.get("#userid").type(user);
-    cy.get("#password").type(pass);
-    cy.get("#submit-button").click();
+    cy.env(["kohaUsername", "kohaPassword"]).then(
+        ({ kohaUsername, kohaPassword }) => {
+            var user =
+                typeof username === "undefined" ? kohaUsername : username;
+            var pass =
+                typeof password === "undefined" ? kohaPassword : password;
+            cy.visit("/cgi-bin/koha/mainpage.pl?logout.x=1");
+            cy.get("#userid").type(user);
+            cy.get("#password").type(pass);
+            cy.get("#submit-button").click();
+        }
+    );
 });
 
 Cypress.Commands.add("loginOpac", (username, password) => {
-    var user =
-        typeof username === "undefined"
-            ? get_fallback_login_value("username")
-            : username;
-    var pass =
-        typeof password === "undefined"
-            ? get_fallback_login_value("password")
-            : password;
-    cy.visitOpac("/cgi-bin/koha/opac-main.pl?logout.x=1");
-    cy.get("#userid").type(user);
-    cy.get("#password").type(pass);
-    cy.get("#auth .action").contains("Log in").click();
+    cy.env(["kohaUsername", "kohaPassword"]).then(
+        ({ kohaUsername, kohaPassword }) => {
+            var user =
+                typeof username === "undefined" ? kohaUsername : username;
+            var pass =
+                typeof password === "undefined" ? kohaPassword : password;
+            cy.visitOpac("/cgi-bin/koha/opac-main.pl?logout.x=1");
+            cy.get("#userid").type(user);
+            cy.get("#password").type(pass);
+            cy.get("#auth .action").contains("Log in").click();
+        }
+    );
 });
 
 Cypress.Commands.add("left_menu_active_item_is", label => {