diff --git a/api/routes.py b/api/routes.py
index 06db3f69..5e7d12cd 100644
--- a/api/routes.py
+++ b/api/routes.py
@@ -548,7 +548,7 @@ def _guard_request_session_visibility(handler, parsed, body=None, method="GET")
     method = str(method).upper()
     if _request_session_visibility_exempt(method, getattr(parsed, "path", "")):
         return True
-    sid = parse_qs(parsed.query).get("session_id", [None])[0]
+    sid = parse_qs(getattr(parsed, "query", "") or "").get("session_id", [None])[0]
     if not _session_id_visible_to_request_profile(handler, sid):
         return False
     if isinstance(body, dict) and not _session_id_visible_to_request_profile(handler, body.get("session_id")):
diff --git a/tests/test_session_ops.py b/tests/test_session_ops.py
index e57d8140..6ec78c4e 100644
--- a/tests/test_session_ops.py
+++ b/tests/test_session_ops.py
@@ -14,9 +14,10 @@ import pytest
 from tests.conftest import TEST_BASE, TEST_STATE_DIR, _post, make_session_tracked
 
 
-def _get(path):
+def _get(path, headers=None):
     """GET helper -- returns parsed JSON, or raises HTTPError on non-2xx."""
-    with urllib.request.urlopen(TEST_BASE + path, timeout=10) as r:
+    req = urllib.request.Request(TEST_BASE + path, headers=headers or {})
+    with urllib.request.urlopen(req, timeout=10) as r:
         return json.loads(r.read())
 
 
@@ -240,7 +241,10 @@ def test_status_returns_profile_specific_hermes_home(cleanup_test_sessions):
     sid = data['session']['session_id']
     cleanup_test_sessions.append(sid)
 
-    r = _get(f'/api/session/status?session_id={sid}')
+    r = _get(
+        f'/api/session/status?session_id={sid}',
+        headers={'Cookie': 'hermes_profile=research'},
+    )
 
     assert r['profile'] == 'research'
     assert r['hermes_home'] == str(TEST_STATE_DIR / 'profiles' / 'research')