diff --git a/CHANGELOG.md b/CHANGELOG.md
index e9715a8..8868f10 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file.
 
+## 2.5.12 - 2026-08-05
+
+### Fixed
+
+- The auth route test now loads the alias bootstrap before the login flow, so isolated test runs do not depend on prior module initialization.
+- The slide editor now blocks pasted data images in TinyMCE so image content must come through the upload flow.
+
 ## 2.5.11 - 2026-08-05
 
 ### Fixed
diff --git a/package.json b/package.json
index 3f81bf3..b1be75f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "pulse-signage",
-  "version": "2.5.11",
+  "version": "2.5.12",
   "private": false,
   "description": "Pulse Signage application with MySQL and media storage",
   "repository": {
diff --git a/src/web/public/js/slides/slide-form-editor.js b/src/web/public/js/slides/slide-form-editor.js
index f509499..3c97a34 100644
--- a/src/web/public/js/slides/slide-form-editor.js
+++ b/src/web/public/js/slides/slide-form-editor.js
@@ -288,6 +288,7 @@ export function createSlideFormEditorController(options) {
       menubar: false,
       branding: false,
       promotion: false,
+      paste_data_images: false,
       plugins: 'lists code advlist fullscreen table',
       toolbar: 'undo redo | fontfamily fontsizeinput | forecolor backcolor bold italic underlineformats removeformat | align lineheight indent outdent bullist numlist table chip | fullscreen',
       toolbar_mode: 'sliding',
diff --git a/test/auth-routes.test.js b/test/auth-routes.test.js
index 24a1690..48ddbd0 100644
--- a/test/auth-routes.test.js
+++ b/test/auth-routes.test.js
@@ -1,6 +1,8 @@
 const test = require('node:test');
 const assert = require('node:assert/strict');
 
+require('../src/common');
+
 const registerAuthRoutes = require('../src/web/routes/auth');
 const renderLoginPage = require('../src/web/routes/auth/login');
 const { createSessionService, normalizeReturnToPath } = require('../src/web/lib/auth/session');
diff --git a/test/slide-form-editor.test.js b/test/slide-form-editor.test.js
new file mode 100644
index 0000000..06ea893
--- /dev/null
+++ b/test/slide-form-editor.test.js
@@ -0,0 +1,9 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+
+const slideFormEditorSource = fs.readFileSync(require.resolve('../src/web/public/js/slides/slide-form-editor.js'), 'utf8');
+
+test('slide editor disables pasted data images in TinyMCE', () => {
+  assert.ok(slideFormEditorSource.includes('paste_data_images: false'));
+});
\ No newline at end of file