diff --git a/tests/applications/sharepoint_renamer/test_handler.py b/tests/applications/sharepoint_renamer/test_handler.py
index 06ea241e6..cd0ce98ca 100644
--- a/tests/applications/sharepoint_renamer/test_handler.py
+++ b/tests/applications/sharepoint_renamer/test_handler.py
@@ -197,3 +197,38 @@ def test_completed_subtask_carries_the_run_summary(
             "failed": [],
         }
     }
+
+
+# ---------------------------------------------------------------------------
+# A queue-delivered dry run is actually a dry run
+# ---------------------------------------------------------------------------
+
+
+def test_dry_run_in_an_sqs_record_body_renames_nothing(
+    harness: Harness, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """The request must come from the SQS *record body*, not the raw Lambda
+    event. Validating the raw event leaves every unknown key ignored, so
+    ``dry_run`` fell back to False and every queue-triggered run renamed live
+    files — the flag only ever worked on a direct invoke."""
+    # Arrange
+    sharepoint = FakeSharepoint(_one_property_site(_file("Survey.pdf", "id-1")))
+    _install(monkeypatch, tmp_path, sharepoint)
+
+    # Act
+    result = _handler(harness)(
+        _sqs_event({"sharepoint_site": SITE, "dry_run": True}), None
+    )
+
+    # Assert
+    assert sharepoint.renamed == []
+    assert harness.subtasks.get(_subtask_id(result)).outputs == {
+        "result": {
+            "renamed": 0,
+            "would_rename": 1,
+            "skipped_already_canonical": 0,
+            "skipped_images": 0,
+            "missing_folders": [],
+            "failed": [],
+        }
+    }