diff --git a/tests/test_recherche.py b/tests/test_recherche.py
index a484bcc..99b2ade 100644
--- a/tests/test_recherche.py
+++ b/tests/test_recherche.py
@@ -45,6 +45,8 @@ def test_sister_origins_dev():
         "https://flowdeck-dev.dracodev.net",
         "https://tiktak-dev.dracodev.net",
         "https://kanbante-dev.dracodev.net",
+        "https://agent.dracodev.net",
+        "https://agent-dev.dracodev.net",
     }
 
 
@@ -107,3 +109,22 @@ def test_sister_origins_hote_requete():
     assert "https://og-dev.dracodev.net" in sister_origins(
         {}, request_host="kanbante.dracodev.net"
     )
+
+
+def test_origines_agent_console():
+    # Fédération console (défaut 2) : la page de recherche de la
+    # console appelle /api/search depuis agent(. -dev) avec le
+    # cookie SSO — ces deux origines passent, prod ET dev, quelle
+    # que soit la résolution ; un tiers reste refusé.
+    assert cors_headers_for(
+        "https://agent.dracodev.net", RESOLVED_DEV) is not None
+    assert cors_headers_for(
+        "https://agent-dev.dracodev.net", {}) is not None
+    assert cors_headers_for(
+        "https://agent.dracodev.net",
+        RESOLVED_DEV)["Access-Control-Allow-Credentials"] == "true"
+    assert preflight_headers(
+        "https://agent-dev.dracodev.net", RESOLVED_DEV) is not None
+    assert "https://agent.dracodev.net" in sister_origins({})
+    assert "https://agent-dev.dracodev.net" in sister_origins({})
+    assert "https://agent-dev.dracodev.net" in sister_origins()