diff --git a/src/__tests__/email-change.test.ts b/src/__tests__/email-change.test.ts
index 48b0377..e87b23c 100644
--- a/src/__tests__/email-change.test.ts
+++ b/src/__tests__/email-change.test.ts
@@ -105,6 +105,20 @@ describe("POST /v1/email-change/verify", () => {
     expect(res.status).toBe(400);
   });
 
+  it("returns 410 for expired code", async () => {
+    const { verifyCode } = await import("../services/verification.js");
+    vi.mocked(verifyCode).mockResolvedValue({ status: "expired" });
+    const res = await request(app).post("/v1/email-change/verify").send({ apiKey: "df_pro_xxx", newEmail: "new@example.com", code: "999999" });
+    expect(res.status).toBe(410);
+  });
+
+  it("returns 429 for max attempts", async () => {
+    const { verifyCode } = await import("../services/verification.js");
+    vi.mocked(verifyCode).mockResolvedValue({ status: "max_attempts" });
+    const res = await request(app).post("/v1/email-change/verify").send({ apiKey: "df_pro_xxx", newEmail: "new@example.com", code: "999999" });
+    expect(res.status).toBe(429);
+  });
+
   it("returns 200 and updates email on success", async () => {
     const { queryWithRetry } = await import("../services/db.js");
     const res = await request(app).post("/v1/email-change/verify").send({ apiKey: "df_pro_xxx", newEmail: "new@example.com", code: "123456" });