diff --git a/test/towerops_web/live/user_settings_live_test.exs b/test/towerops_web/live/user_settings_live_test.exs
index c4cabde0..bcb098e5 100644
--- a/test/towerops_web/live/user_settings_live_test.exs
+++ b/test/towerops_web/live/user_settings_live_test.exs
@@ -295,6 +295,33 @@ defmodule ToweropsWeb.UserSettingsLiveTest do
     end
   end
 
+  describe "UserSettingsLive TOTP add device flow with sudo mode" do
+    setup :register_and_log_in_user_with_sudo
+
+    test "create_device success path opens the device QR modal", %{conn: conn} do
+      {:ok, view, _html} = live(conn, ~p"/users/settings?tab=security")
+
+      html = render_click(view, "create_device", %{"name" => "MyPhone"})
+      assert is_binary(html)
+    end
+
+    test "verify_new_device with an invalid code stays on the page", %{conn: conn} do
+      {:ok, view, _html} = live(conn, ~p"/users/settings?tab=security")
+
+      _ = render_click(view, "create_device", %{"name" => "Phone"})
+      html = render_click(view, "verify_new_device", %{"code" => "000000"})
+      assert is_binary(html)
+    end
+
+    test "close_device_qr_modal cleans up the unverified device", %{conn: conn} do
+      {:ok, view, _html} = live(conn, ~p"/users/settings?tab=security")
+
+      _ = render_click(view, "create_device", %{"name" => "Cleanup Phone"})
+      html = render_click(view, "close_device_qr_modal", %{})
+      assert is_binary(html)
+    end
+  end
+
   describe "UserSettingsLive update_email error path" do
     setup :register_and_log_in_user_with_sudo