diff --git a/.serena/memories/backend/testing.md b/.serena/memories/backend/testing.md
index 66d6f8a246..23ae25c31c 100644
--- a/.serena/memories/backend/testing.md
+++ b/.serena/memories/backend/testing.md
@@ -8,4 +8,5 @@ JVM `clojure.test` (kaocha runner) under `backend/test/backend_tests/`.
 - Coverage: if code is added or modified in `src/`, corresponding tests in `test/backend_tests/` must be added or updated.
 - Isolated run: `clojure -M:dev:test --focus backend-tests.my-ns-test` for a specific test namespace, or `clojure -M:dev:test --focus backend-tests.my-ns-test/my-test-var` for a specific test var.
 - Regression run: `clojure -M:dev:test` to ensure no regressions in related functional areas.
-- If you need to filter output, tee to a temp file first: `clojure -M:dev:test 2>&1 | tee /tmp/penpot-test-output.txt`.
\ No newline at end of file
+- If you need to filter output, tee to a temp file first: `clojure -M:dev:test 2>&1 | tee /tmp/penpot-test-output.txt`.
+- RPC test helpers `command!`/`management-command!` split the data map: qualified keys become server params, unqualified keys become request body params. To inject request-level context (headers, `:app.http/auth-key-id`, ip), pass a map under `:app.http/request` metadata; non-map `IRequest` stubs fall back to a dummy request.
\ No newline at end of file
diff --git a/backend/test/backend_tests/helpers.clj b/backend/test/backend_tests/helpers.clj
index 8f26f95a5c..b41bde7770 100644
--- a/backend/test/backend_tests/helpers.clj
+++ b/backend/test/backend_tests/helpers.clj
@@ -443,14 +443,23 @@
 
 (defn- prepare-rpc-params
   [data]
-  (let [params  (reduce-kv (fn [params k v]
-                             (if (qualified-keyword? k)
-                               (assoc params k v)
-                               params))
-                           {}
-                           (dissoc data ::type))
-        request (-> (make-dummy-request)
-                    (assoc :params (d/without-qualified data)))]
+  (let [params   (reduce-kv (fn [params k v]
+                              (if (qualified-keyword? k)
+                                (assoc params k v)
+                                params))
+                            {}
+                            (dissoc data ::type))
+        ;; Honor a caller-supplied request map from the data metadata so
+        ;; tests can inject headers, remote address and auth context (e.g.
+        ;; :app.http/auth-key-id). Non-map requests (reify IRequest stubs)
+        ;; fall back to the dummy request, which carries the body params
+        ;; the validation wrapper reads.
+        supplied (-> data meta :app.http/request)
+        request  (if (map? supplied)
+                   (assoc supplied :params (merge (:params supplied)
+                                                  (d/without-qualified data)))
+                   (assoc (make-dummy-request)
+                          :params (d/without-qualified data)))]
 
     (-> params
         (assoc :app.rpc/request-at (ct/now))
diff --git a/backend/test/backend_tests/helpers_test.clj b/backend/test/backend_tests/helpers_test.clj
index 4aef915a91..d8e1bb2dc2 100644
--- a/backend/test/backend_tests/helpers_test.clj
+++ b/backend/test/backend_tests/helpers_test.clj
@@ -90,3 +90,35 @@
 
 (t/deftest make-dummy-request-missing-cookie-returns-nil-value
   (t/is (= {:value nil} (yreq/get-cookie (th/make-dummy-request) "missing"))))
+
+;; --- RPC PARAMS: REQUEST METADATA
+
+(t/deftest prepare-rpc-params-preserves-supplied-request
+  (let [supplied {:headers {"x-frontend-version" "1.2.3"}
+                  :app.http/auth-key-id :admin-console}
+        params   (#'th/prepare-rpc-params
+                  (with-meta {::th/type :dummy
+                              :events [{:name "event"}]}
+                    {:app.http/request supplied}))
+        request  (:app.http/request (meta params))]
+    (t/is (= "1.2.3" (yreq/get-header request "x-frontend-version")))
+    (t/is (= :admin-console (:app.http/auth-key-id request)))
+    (t/is (= {:events [{:name "event"}]} (:params request)))))
+
+(t/deftest prepare-rpc-params-builds-dummy-request-without-metadata
+  (let [params  (#'th/prepare-rpc-params {::th/type :dummy
+                                          :events [{:name "event"}]})
+        request (:app.http/request (meta params))]
+    (t/is (instance? backend_tests.helpers.DummyRequest request))
+    (t/is (= {:events [{:name "event"}]} (:params request)))))
+
+(t/deftest prepare-rpc-params-falls-back-to-dummy-for-non-map-request
+  (let [supplied (reify yreq/IRequest
+                   (get-header [_ _] nil))
+        params   (#'th/prepare-rpc-params
+                  (with-meta {::th/type :dummy
+                              :events [{:name "event"}]}
+                    {:app.http/request supplied}))
+        request  (:app.http/request (meta params))]
+    (t/is (instance? backend_tests.helpers.DummyRequest request))
+    (t/is (= {:events [{:name "event"}]} (:params request)))))