diff --git a/backend/tests/share_tests.rs b/backend/tests/share_tests.rs
index b8b2eb7..05d84a1 100644
--- a/backend/tests/share_tests.rs
+++ b/backend/tests/share_tests.rs
@@ -28,6 +28,11 @@ fn unique_email() -> String {
     format!("test_{}@example.com", uuid::Uuid::new_v4())
 }
 
+/// URL-encode a value for a query string (emails contain '@').
+fn q(email: &str) -> String {
+    email.replace('@', "%40")
+}
+
 /// Register a fully-set-up user (identity public key + a default self profile)
 /// and return the access token. The owner profile is `profile_<user_id>`.
 async fn register_full(app: &axum::Router, email: &str) -> String {
@@ -83,8 +88,8 @@ async fn public_key_lookup_returns_recipient_identity_key() {
     let (status, body) = common::send_json(
         &app,
         "GET",
-        "/api/users/public-key",
-        Some(json!({ "email": owner_email })),
+        &format!("/api/users/public-key?email={}", q(&owner_email)),
+        None,
         None,
     )
     .await;
@@ -105,8 +110,8 @@ async fn public_key_lookup_404s_for_unknown_or_keyless_user() {
     let (status, _) = common::send_json(
         &app,
         "GET",
-        "/api/users/public-key",
-        Some(json!({ "email": "does-not-exist@example.com" })),
+        "/api/users/public-key?email=does-not-exist%40example.com",
+        None,
         None,
     )
     .await;
@@ -116,8 +121,8 @@ async fn public_key_lookup_404s_for_unknown_or_keyless_user() {
     let (status, _) = common::send_json(
         &app,
         "GET",
-        "/api/users/public-key",
-        Some(json!({ "email": keyless_email })),
+        &format!("/api/users/public-key?email={}", q(&keyless_email)),
+        None,
         None,
     )
     .await;
@@ -210,11 +215,14 @@ async fn owner_shares_recipient_reads_owner_revokes() {
     assert_eq!(status, 200, "recipient meds read, body: {body}");
     assert_eq!(body.as_array().unwrap().len(), 0);
 
-    // Recipient CANNOT write to the shared profile (POST medication → 403).
-    // The create handler isn't share-aware (write stays owner-only); it sets
-    // user_id = claims.sub (the recipient), so the med would be created under
-    // the recipient rather than the owner. We assert the owner doesn't see it.
-    let (status, _body) = common::send_json(
+    // Recipient attempts a write to the shared profile. The medication create
+    // handler (a) doesn't enforce ownership on writes yet (issue #12) and
+    // (b) returns 200 OK (not 201) on success. So the write currently succeeds
+    // but is attributed to the RECIPIENT's user_id, not the owner — meaning it
+    // does NOT pollute the owner's view of that profile. Accept 200 (current,
+    // #12 not fixed) or 403 (once #12 lands). Either way the owner's records
+    // must be untouched.
+    let (write_status, _body) = common::send_json(
         &app,
         "POST",
         "/api/medications",
@@ -226,9 +234,10 @@ async fn owner_shares_recipient_reads_owner_revokes() {
         Some(&recipient_token),
     )
     .await;
-    // Write is admitted (201) but lands under the recipient's user_id, NOT the
-    // owner. Confirm the owner's view of that profile is unchanged.
-    assert!(status == 201 || status == 403, "write outcome: {status}");
+    assert!(
+        write_status == 200 || write_status == 403,
+        "write outcome: {write_status}"
+    );
     let (status, owner_meds) = common::send_json(
         &app,
         "GET",