diff --git a/packages/snjs/mocha/lib/fake_web_crypto.js b/packages/snjs/mocha/lib/fake_web_crypto.js
index d910fdaaa..60ccf1e7f 100644
--- a/packages/snjs/mocha/lib/fake_web_crypto.js
+++ b/packages/snjs/mocha/lib/fake_web_crypto.js
@@ -1,5 +1,18 @@
+function createTotpCrypto() {
+  const g = globalThis
+  const SNWebCryptoClass = g.SNWebCrypto || (g.SNCrypto && g.SNCrypto.SNWebCrypto)
+  if (!SNWebCryptoClass) {
+    throw new Error(
+      'SNWebCrypto is not available. Mocha test.html must load sncrypto-web (see script before snjs.js).',
+    )
+  }
+  return new SNWebCryptoClass()
+}
+
 export default class FakeWebCrypto {
-  constructor() {}
+  constructor() {
+    this._totpCrypto = createTotpCrypto()
+  }
 
   deinit() {}
 
@@ -198,6 +211,6 @@ export default class FakeWebCrypto {
   }
 
   totpToken(secret, timestamp, tokenLength, step) {
-    return '123456'
+    return this._totpCrypto.totpToken(secret, timestamp, tokenLength, step)
   }
 }
diff --git a/packages/snjs/mocha/settings.test.js b/packages/snjs/mocha/settings.test.js
index 466cd8829..faeb2745f 100644
--- a/packages/snjs/mocha/settings.test.js
+++ b/packages/snjs/mocha/settings.test.js
@@ -5,6 +5,10 @@ import * as Events from './lib/Events.js'
 chai.use(chaiAsPromised)
 const expect = chai.expect
 
+const getOtpTokenForSecret = async (application, secret) => {
+  return application.options.crypto.totpToken(secret, Date.now(), 6, 30)
+}
+
 describe('settings service', function () {
   this.timeout(Factory.ThirtySecondTimeout)
 
@@ -105,23 +109,19 @@ describe('settings service', function () {
   })
 
   it('creates and reads a sensitive setting', async () => {
-    await application.settings.updateSetting(
-      SettingName.create(SettingName.NAMES.MfaSecret).getValue(),
-      'fake_secret',
-      true,
-    )
-    const setting = await application.settings.getDoesSensitiveSettingExist(
-      SettingName.create(SettingName.NAMES.MfaSecret).getValue(),
-    )
+    const mfaSettingName = SettingName.create(SettingName.NAMES.MfaSecret).getValue()
+    const secret = await application.mfa.generateMfaSecret()
+    const totp = await getOtpTokenForSecret(application, secret)
+    await application.settings.updateSetting(mfaSettingName, secret, true, totp)
+    const setting = await application.settings.getDoesSensitiveSettingExist(mfaSettingName)
     expect(setting).to.equal(true)
   })
 
   it('creates and lists a sensitive setting', async () => {
-    await application.settings.updateSetting(
-      SettingName.create(SettingName.NAMES.MfaSecret).getValue(),
-      'fake_secret',
-      true,
-    )
+    const mfaSettingName = SettingName.create(SettingName.NAMES.MfaSecret).getValue()
+    const secret = await application.mfa.generateMfaSecret()
+    const totp = await getOtpTokenForSecret(application, secret)
+    await application.settings.updateSetting(mfaSettingName, secret, true, totp)
     await application.settings.updateSetting(
       SettingName.create(SettingName.NAMES.LogSessionUserAgent).getValue(),
       LogSessionUserAgentOption.Enabled,