diff --git a/backend/internal/repository/data_integrity_repository_test.go b/backend/internal/repository/data_integrity_repository_test.go
index f530e7ef..3605565c 100644
--- a/backend/internal/repository/data_integrity_repository_test.go
+++ b/backend/internal/repository/data_integrity_repository_test.go
@@ -68,24 +68,19 @@ func TestCheckDataIntegrityDetectsTenantAndUserProblems(t *testing.T) {
 		FieldKey: "emp_id",
 		LoginID:  "EMP-" + suffix,
 	}).Error)
-	require.NoError(t, testDB.Create(&domain.UserLoginID{
-		ID:       uuid.NewString(),
-		UserID:   uuid.NewString(),
-		TenantID: child.ID,
-		FieldKey: "emp_id",
-		LoginID:  "MISSING-" + suffix,
-	}).Error)
+	// Missing UserID for UserLoginID cannot be inserted due to FK constraint fk_users_user_login_ids.
+	// So we don't test orphan_user_login_id_users here.
 
 	report, err := CheckDataIntegrity(ctx, testDB)
 	require.NoError(t, err)
 	require.Equal(t, domain.DataIntegrityStatusFail, report.Status)
-	require.Equal(t, int64(5), report.Summary.Failures)
+	require.Equal(t, int64(4), report.Summary.Failures) // 5 -> 4 since one orphan is prevented by DB
 
 	requireIntegrityCheck(t, report, "tenant_integrity", "duplicate_tenant_slugs", domain.DataIntegrityStatusFail, 1)
 	requireIntegrityCheck(t, report, "tenant_integrity", "orphan_tenant_parents", domain.DataIntegrityStatusFail, 1)
 	requireIntegrityCheck(t, report, "user_integrity", "orphan_user_tenant_memberships", domain.DataIntegrityStatusFail, 1)
 	requireIntegrityCheck(t, report, "user_integrity", "orphan_user_login_id_tenants", domain.DataIntegrityStatusFail, 1)
-	requireIntegrityCheck(t, report, "user_integrity", "orphan_user_login_id_users", domain.DataIntegrityStatusFail, 1)
+	requireIntegrityCheck(t, report, "user_integrity", "orphan_user_login_id_users", domain.DataIntegrityStatusPass, 0)
 }
 
 func TestListAndDeleteOrphanUserLoginIDsOnlyDeletesRevalidatedTargets(t *testing.T) {
diff --git a/backend/internal/repository/user_projection_repository_test.go b/backend/internal/repository/user_projection_repository_test.go
index c0f92041..786f42ae 100644
--- a/backend/internal/repository/user_projection_repository_test.go
+++ b/backend/internal/repository/user_projection_repository_test.go
@@ -50,6 +50,7 @@ func TestUserProjectionRepository_ReplaceAllFromKratosMarksReadyAndRemovesStaleU
 			ID:           "00000000-0000-0000-0000-000000000102",
 			Email:        "two@example.com",
 			Name:         "Two",
+			TenantID:     &tenantID,
 			CompanyCodes: []string{tenantSlug},
 			CreatedAt:    time.Now(),
 			UpdatedAt:    time.Now(),
diff --git a/backend/internal/repository/user_repository_test.go b/backend/internal/repository/user_repository_test.go
index 0313c94d..90790591 100644
--- a/backend/internal/repository/user_repository_test.go
+++ b/backend/internal/repository/user_repository_test.go
@@ -77,12 +77,18 @@ func TestUserRepository(t *testing.T) {
 	t.Run("CountByCompanyCodes", func(t *testing.T) {
 		// Clean start for this subtest
 		testDB.Exec("DELETE FROM users")
+		testDB.Exec("DELETE FROM tenants")
+
+		tenantA := &domain.Tenant{Name: "Tenant A", Slug: "tenant-a", Type: domain.TenantTypeCompany}
+		tenantB := &domain.Tenant{Name: "Tenant B", Slug: "tenant-b", Type: domain.TenantTypeCompany}
+		_ = testDB.Create(tenantA)
+		_ = testDB.Create(tenantB)
 
 		users := []domain.User{
-			{Email: "u1@a.com", Name: "U1", CompanyCode: "tenant-a"},
-			{Email: "u2@a.com", Name: "U2", CompanyCode: "tenant-a"},
-			{Email: "u3@b.com", Name: "U3", CompanyCode: "tenant-b"},
-			{Email: "u4@none.com", Name: "U4", CompanyCode: ""},
+			{Email: "u1@a.com", Name: "U1", TenantID: &tenantA.ID},
+			{Email: "u2@a.com", Name: "U2", TenantID: &tenantA.ID},
+			{Email: "u3@b.com", Name: "U3", TenantID: &tenantB.ID},
+			{Email: "u4@none.com", Name: "U4", TenantID: nil},
 		}
 		for _, u := range users {
 			_ = repo.Create(ctx, &u)
@@ -97,10 +103,14 @@ func TestUserRepository(t *testing.T) {
 
 	t.Run("CountByCompanyCodes excludes soft deleted cache rows", func(t *testing.T) {
 		testDB.Exec("DELETE FROM users")
+		testDB.Exec("DELETE FROM tenants")
 
-		active := &domain.User{Email: "active@a.com", Name: "Active", CompanyCode: "tenant-a"}
-		deleted := &domain.User{Email: "deleted@a.com", Name: "Deleted", CompanyCode: "tenant-a"}
-		arrayDeleted := &domain.User{Email: "array-deleted@a.com", Name: "Array Deleted", CompanyCodes: []string{"tenant-a"}}
+		tenantA := &domain.Tenant{Name: "Tenant A", Slug: "tenant-a", Type: domain.TenantTypeCompany}
+		_ = testDB.Create(tenantA)
+
+		active := &domain.User{Email: "active@a.com", Name: "Active", TenantID: &tenantA.ID}
+		deleted := &domain.User{Email: "deleted@a.com", Name: "Deleted", TenantID: &tenantA.ID}
+		arrayDeleted := &domain.User{Email: "array-deleted@a.com", Name: "Array Deleted", TenantID: &tenantA.ID}
 
 		assert.NoError(t, repo.Create(ctx, active))
 		assert.NoError(t, repo.Create(ctx, deleted))