diff --git a/frontend/src/components/dashboard/SettingsContent.svelte b/frontend/src/components/dashboard/SettingsContent.svelte
index a4793c9..954c520 100644
--- a/frontend/src/components/dashboard/SettingsContent.svelte
+++ b/frontend/src/components/dashboard/SettingsContent.svelte
@@ -321,7 +321,7 @@
           {/if}
         </div>
         <button type="submit" disabled={emailLoading || !newEmail.trim()}>
-          {emailLoading ? $_('settings.requesting') : currentEmail ? $_('settings.changeEmailButton') : $_('settings.addEmailButton')}
+          {emailLoading ? $_('settings.requesting') : getSessionEmail(session) ? $_('settings.changeEmailButton') : $_('settings.addEmailButton')}
         </button>
       </form>
     {/if}
diff --git a/frontend/src/tests/Dashboard.test.ts b/frontend/src/tests/Dashboard.test.ts
index 4fdc54a..72721dc 100644
--- a/frontend/src/tests/Dashboard.test.ts
+++ b/frontend/src/tests/Dashboard.test.ts
@@ -68,6 +68,14 @@ describe("Dashboard", () => {
         }
       });
     });
+    it("renders settings without crashing", async () => {
+      history.pushState({}, "", "/settings");
+      render(Dashboard);
+      await waitFor(() => {
+        expect(screen.getByRole("button", { name: /change email/i }))
+          .toBeInTheDocument();
+      });
+    });
     it("displays invite codes nav when invites are required and user is admin", async () => {
       setupAuthenticatedUser({ isAdmin: true });
       mockEndpoint(
diff --git a/frontend/src/tests/security-policy.test.ts b/frontend/src/tests/security-policy.test.ts
index 78425fe..f874624 100644
--- a/frontend/src/tests/security-policy.test.ts
+++ b/frontend/src/tests/security-policy.test.ts
@@ -1,16 +1,14 @@
-import { readFileSync } from "node:fs";
-import { resolve } from "node:path";
 import { describe, expect, it } from "vitest";
+import applicationHtml from "../../index.html?raw";
+import homepageHtml from "../../public/homepage.html?raw";
 
 const CSP = "script-src 'self'";
 
 describe("frontend security policy", () => {
   it.each([
-    ["application", "index.html"],
-    ["homepage", "public/homepage.html"],
-  ])("protects the %s document from inline script execution", (_, path) => {
-    const html = readFileSync(resolve(process.cwd(), path), "utf8");
-
+    ["application", applicationHtml],
+    ["homepage", homepageHtml],
+  ])("protects the %s document from inline script execution", (_, html) => {
     expect(html).toContain("http-equiv=\"Content-Security-Policy\"");
     expect(html).toContain(CSP);
     expect(html).not.toMatch(/<script(?![^>]*\bsrc=)[^>]*>/i);