diff --git a/README.md b/README.md
index af18aff..4d88cb0 100644
--- a/README.md
+++ b/README.md
@@ -94,8 +94,7 @@ Note that in order to create MariaDB database on Rahti, PHPMyAdmin data dump doe
 
 - Test:
     - Automated testing with Playwright
-        - Admin editing challenges
-    - Giving malicious login token
+        - Admin editing challenges (requires setting up admin username limited to this system & saving that to Playwright env)
 - For 2025:
     - Handling higher taxa (is uses adds rikkavoikukka, don't add voikukat to taxon_count)
     - Accessibility
diff --git a/tests-playwright/test_login.py b/tests-playwright/test_login.py
index ba07c24..a81127a 100644
--- a/tests-playwright/test_login.py
+++ b/tests-playwright/test_login.py
@@ -210,3 +210,11 @@ def test_teardown(browser):
     os.remove(state_file)
     
 
+# Non-real token
+def test_token(browser):
+    context = browser.new_context()
+    page = context.new_page()
+
+    page.goto("http://web:8081/login?token=nonrealtoken")
+    page.wait_for_selector('body')
+    assert "Kirjautuminen epäonnistui" in page.content()