diff --git a/app/phpstan-baseline.neon b/app/phpstan-baseline.neon
index 08ba9bb8..d9069fba 100644
--- a/app/phpstan-baseline.neon
+++ b/app/phpstan-baseline.neon
@@ -1059,7 +1059,7 @@ parameters:
 		-
 			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:getJson\(\)\.$#'
 			identifier: method.notFound
-			count: 3
+			count: 4
 			path: tests/Feature/Import/ImportControllerTest.php
 
 		-
diff --git a/app/tests/Feature/Import/ImportControllerTest.php b/app/tests/Feature/Import/ImportControllerTest.php
index 16e17370..949214e7 100644
--- a/app/tests/Feature/Import/ImportControllerTest.php
+++ b/app/tests/Feature/Import/ImportControllerTest.php
@@ -127,3 +127,16 @@ test('resolve отвергает несуществующий slug', function ()
         'mappings' => [['status_ru' => 'Архив', 'slug' => 'нет-такого']],
     ])->assertStatus(422);
 });
+
+test('GET /api/imports/{id} отвергает import_log чужого тенанта (403)', function (): void {
+    $otherTenant = Tenant::factory()->create();
+    $otherUser = User::factory()->for($otherTenant)->create();
+    $foreignLog = ImportLog::factory()->create([
+        'tenant_id' => $otherTenant->id,
+        'user_id' => $otherUser->id,
+    ]);
+
+    // Авторизован пользователь $this->tenant; запрашиваем чужой import_log.
+    // abort_if(tenant_id mismatch, 403) в ImportController::show — defense-in-depth.
+    $this->getJson("/api/imports/{$foreignLog->id}")->assertStatus(403);
+});