diff --git a/tests/test_app.py b/tests/test_app.py
index c1bb9c8..4552a81 100644
--- a/tests/test_app.py
+++ b/tests/test_app.py
@@ -43,7 +43,7 @@ def test_health_exposes_current_version():
     with TestClient(app.app) as client:
         response = client.get("/health")
     assert response.status_code == 200
-    assert response.json()["version"] == app.VERSION == "2.3.8"
+    assert response.json()["version"] == app.VERSION == "2.3.9"
 
 
 def test_media_handoff_proxies_strict_category_contract(monkeypatch):
@@ -1344,3 +1344,14 @@ def test_sascha_media_tunnel_apply_returns_redacted_result(monkeypatch):
     assert response.status_code == 200
     assert response.json()["handshake"] is True
     assert "private" not in response.text.lower()
+
+
+def test_sascha_media_tunnel_candidate_uses_valid_wireguard_interface_name():
+    import base64
+    import re
+
+    command = app._media_tunnel_install_command("vps", "A" * 43 + "=")
+    encoded = re.search(r"b64decode\('([^']+)'\)", command).group(1)
+    script = base64.b64decode(encoded).decode()
+    assert 'root / "wgmtest.conf"' in script
+    assert len("wgmtest") <= 15