diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2040ae8..67b9059 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 All notable changes to Epicure are documented here. This file is mirrored in-app at `/changelog` (and in the admin dashboard) via `apps/web/lib/changelog.ts` — update both together.
 
+## 0.30.1 — 2026-07-14 16:20
+
+Internal: fixed test mocks left stale by the earlier API-key auth-widening pass (recipes/meal-plans/shopping-lists route tests) — no user-facing change.
+
 ## 0.30.0 — 2026-07-14 16:05
 
 ### Added
diff --git a/apps/web/app/api/v1/meal-plans/[weekStart]/members/__tests__/route.test.ts b/apps/web/app/api/v1/meal-plans/[weekStart]/members/__tests__/route.test.ts
index 7d8bf80..9d416b0 100644
--- a/apps/web/app/api/v1/meal-plans/[weekStart]/members/__tests__/route.test.ts
+++ b/apps/web/app/api/v1/meal-plans/[weekStart]/members/__tests__/route.test.ts
@@ -4,7 +4,7 @@ import { NextRequest } from "next/server";
 const mockSession = { user: { id: "user-1" } };
 
 vi.mock("@/lib/api-auth", () => ({
-  requireSession: vi.fn(),
+  requireSessionOrApiKey: vi.fn(),
 }));
 
 const { mockPlanFindFirst, mockMemberFindFirst, mockMemberFindMany, mockUserFindFirst, mockInsertValues, mockInsertPlanValues, mockDeleteWhere } = vi.hoisted(() => ({
@@ -34,7 +34,7 @@ vi.mock("@epicure/db", () => ({
   and: vi.fn((...args) => ({ args, op: "and" })),
 }));
 
-const { requireSession } = await import("@/lib/api-auth");
+const { requireSessionOrApiKey } = await import("@/lib/api-auth");
 import { GET, POST, DELETE } from "../route";
 
 const ctx = { params: Promise.resolve({ weekStart: "2026-06-01" }) };
@@ -49,7 +49,7 @@ function makeRequest(method: string, body?: unknown, search = "") {
 
 beforeEach(() => {
   vi.clearAllMocks();
-  vi.mocked(requireSession).mockResolvedValue({ session: mockSession as never, response: null });
+  vi.mocked(requireSessionOrApiKey).mockResolvedValue({ session: mockSession as never, response: null });
 });
 
 describe("GET /api/v1/meal-plans/[weekStart]/members", () => {
@@ -123,7 +123,7 @@ describe("DELETE /api/v1/meal-plans/[weekStart]/members", () => {
   it("returns 403 when caller is neither owner nor the member themselves", async () => {
     mockPlanFindFirst.mockResolvedValue({ id: "plan-1", userId: "user-1" });
     mockMemberFindFirst.mockResolvedValue({ id: "m1", userId: "user-2" });
-    vi.mocked(requireSession).mockResolvedValue({ session: { user: { id: "user-3" } } as never, response: null });
+    vi.mocked(requireSessionOrApiKey).mockResolvedValue({ session: { user: { id: "user-3" } } as never, response: null });
     const res = await DELETE(makeRequest("DELETE", undefined, "?memberId=m1"), ctx);
     expect(res.status).toBe(403);
   });
diff --git a/apps/web/app/api/v1/meal-plans/shared/[mealPlanId]/entries/__tests__/route.test.ts b/apps/web/app/api/v1/meal-plans/shared/[mealPlanId]/entries/__tests__/route.test.ts
index a084bb4..6ff7556 100644
--- a/apps/web/app/api/v1/meal-plans/shared/[mealPlanId]/entries/__tests__/route.test.ts
+++ b/apps/web/app/api/v1/meal-plans/shared/[mealPlanId]/entries/__tests__/route.test.ts
@@ -4,7 +4,7 @@ import { NextRequest } from "next/server";
 const mockSession = { user: { id: "user-2" } };
 
 vi.mock("@/lib/api-auth", () => ({
-  requireSession: vi.fn(),
+  requireSessionOrApiKey: vi.fn(),
 }));
 
 vi.mock("@/lib/webhooks", () => ({
@@ -37,9 +37,10 @@ vi.mock("@epicure/db", () => ({
   and: vi.fn((...args) => ({ args, op: "and" })),
   or: vi.fn((...args) => ({ args, op: "or" })),
   ne: vi.fn((a, b) => ({ a, b, op: "ne" })),
+  inArray: vi.fn((a, b) => ({ a, b, op: "inArray" })),
 }));
 
-const { requireSession } = await import("@/lib/api-auth");
+const { requireSessionOrApiKey } = await import("@/lib/api-auth");
 import { POST, DELETE } from "../route";
 
 const ctx = { params: Promise.resolve({ mealPlanId: "plan-1" }) };
@@ -54,7 +55,7 @@ function makeRequest(method: string, body?: unknown, search = "") {
 
 beforeEach(() => {
   vi.clearAllMocks();
-  vi.mocked(requireSession).mockResolvedValue({ session: mockSession as never, response: null });
+  vi.mocked(requireSessionOrApiKey).mockResolvedValue({ session: mockSession as never, response: null });
   mockPlanFindFirst.mockResolvedValue({ id: "plan-1", userId: "user-1" });
 });
 
diff --git a/apps/web/app/api/v1/recipes/bulk/__tests__/route.test.ts b/apps/web/app/api/v1/recipes/bulk/__tests__/route.test.ts
index 203362e..027fd53 100644
--- a/apps/web/app/api/v1/recipes/bulk/__tests__/route.test.ts
+++ b/apps/web/app/api/v1/recipes/bulk/__tests__/route.test.ts
@@ -10,7 +10,7 @@ const { mockRequireSession } = vi.hoisted(() => ({
 }));
 
 vi.mock("@/lib/api-auth", () => ({
-  requireSession: mockRequireSession,
+  requireSessionOrApiKey: mockRequireSession,
 }));
 
 vi.mock("@epicure/db", () => ({
diff --git a/apps/web/app/api/v1/shopping-lists/[id]/members/__tests__/route.test.ts b/apps/web/app/api/v1/shopping-lists/[id]/members/__tests__/route.test.ts
index c79b789..d5a0af2 100644
--- a/apps/web/app/api/v1/shopping-lists/[id]/members/__tests__/route.test.ts
+++ b/apps/web/app/api/v1/shopping-lists/[id]/members/__tests__/route.test.ts
@@ -4,7 +4,7 @@ import { NextRequest } from "next/server";
 const mockSession = { user: { id: "user-1" } };
 
 vi.mock("@/lib/api-auth", () => ({
-  requireSession: vi.fn(),
+  requireSessionOrApiKey: vi.fn(),
 }));
 
 const { mockListFindFirst, mockMemberFindFirst, mockMemberFindMany, mockUserFindFirst, mockInsertValues, mockDeleteWhere } = vi.hoisted(() => ({
@@ -33,7 +33,7 @@ vi.mock("@epicure/db", () => ({
   and: vi.fn((...args) => ({ args, op: "and" })),
 }));
 
-const { requireSession } = await import("@/lib/api-auth");
+const { requireSessionOrApiKey } = await import("@/lib/api-auth");
 import { GET, POST, DELETE } from "../route";
 
 const ctx = { params: Promise.resolve({ id: "list-1" }) };
@@ -48,7 +48,7 @@ function makeRequest(method: string, body?: unknown, search = "") {
 
 beforeEach(() => {
   vi.clearAllMocks();
-  vi.mocked(requireSession).mockResolvedValue({ session: mockSession as never, response: null });
+  vi.mocked(requireSessionOrApiKey).mockResolvedValue({ session: mockSession as never, response: null });
 });
 
 describe("GET /api/v1/shopping-lists/[id]/members", () => {
diff --git a/apps/web/lib/changelog.ts b/apps/web/lib/changelog.ts
index fe83aba..db31273 100644
--- a/apps/web/lib/changelog.ts
+++ b/apps/web/lib/changelog.ts
@@ -1,5 +1,5 @@
 // Mirrors CHANGELOG.md at the repo root — update both together.
-export const APP_VERSION = "0.30.0";
+export const APP_VERSION = "0.30.1";
 
 export type ChangelogEntry = {
   version: string;
@@ -11,6 +11,11 @@ export type ChangelogEntry = {
 };
 
 export const CHANGELOG: ChangelogEntry[] = [
+  {
+    version: "0.30.1",
+    date: "2026-07-14 16:20",
+    notes: "Internal: fixed test mocks left stale by the earlier API-key auth-widening pass (recipes/meal-plans/shopping-lists route tests) — no user-facing change.",
+  },
   {
     version: "0.30.0",
     date: "2026-07-14 16:05",
diff --git a/apps/web/package.json b/apps/web/package.json
index 4711a8d..122afe1 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@epicure/web",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "private": true,
   "scripts": {
     "dev": "next dev",
diff --git a/package.json b/package.json
index 663f2b7..7c9fbe5 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "epicure",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "private": true,
   "scripts": {
     "dev": "pnpm --filter web dev",