diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7c13b3b..f7e4137 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- Dev: strengthened DependencyInjection tests based on mutation testing
+  findings — the extension's container wiring (cache pool reference,
+  provider options mapping, CLI login route arguments) is now asserted
+  explicitly, and the documented invariant that provider keys are not
+  normalized (`my-provider` ≠ `my_provider`) is covered by a test. No
+  effect on the published package.
+
 - CI: bumped `codecov/codecov-action` from `v5` to `v7` (restores Codecov's
   GPG signing key after the `codecovsecurity` account was removed, and moves
   the bundled `github-script` to Node 24) and set `fail_ci_if_error: false`
diff --git a/tests/DependencyInjection/ConfigurationTest.php b/tests/DependencyInjection/ConfigurationTest.php
index 92fc03d..170f116 100644
--- a/tests/DependencyInjection/ConfigurationTest.php
+++ b/tests/DependencyInjection/ConfigurationTest.php
@@ -163,6 +163,24 @@ public function testHttpClientOptionsRejectsUnknownKey(): void
         );
     }
 
+    public function testProviderKeysAreNotNormalized(): void
+    {
+        $input = $this->getMinimalConfig();
+        $input['openid_providers']['my-provider'] = $input['openid_providers']['provider1'];
+        unset($input['openid_providers']['provider1']);
+
+        $config = $this->processor->processConfiguration(
+            $this->configuration,
+            [$input]
+        );
+
+        // Provider keys are part of the public contract ('my-provider' and
+        // 'my_provider' are distinct providers), so dashes must survive
+        // config processing instead of being normalized to underscores.
+        $this->assertArrayHasKey('my-provider', $config['openid_providers']);
+        $this->assertArrayNotHasKey('my_provider', $config['openid_providers']);
+    }
+
     public function testMultipleProviders(): void
     {
         $input = $this->getMinimalConfig();
diff --git a/tests/DependencyInjection/ItkDevOpenIdConnectExtensionTest.php b/tests/DependencyInjection/ItkDevOpenIdConnectExtensionTest.php
index 3e2b14a..a6b765b 100644
--- a/tests/DependencyInjection/ItkDevOpenIdConnectExtensionTest.php
+++ b/tests/DependencyInjection/ItkDevOpenIdConnectExtensionTest.php
@@ -48,6 +48,48 @@ public function testLoad(): void
         $this->assertTrue($container->hasDefinition(CliLoginTokenAuthenticator::class));
     }
 
+    public function testLoadWiresProviderManagerConfig(): void
+    {
+        $extension = new ItkDevOpenIdConnectExtension();
+        $container = new ContainerBuilder();
+
+        $extension->load([$this->getBaseConfig()], $container);
+
+        $config = $container->getDefinition(OpenIdConfigurationProviderManager::class)->getArgument('$config');
+        $this->assertIsArray($config);
+
+        $defaultOptions = $config['default_providers_options'] ?? null;
+        $this->assertIsArray($defaultOptions);
+        $cacheItemPool = $defaultOptions['cacheItemPool'] ?? null;
+        $this->assertInstanceOf(Reference::class, $cacheItemPool);
+        $this->assertSame('cache.app', (string) $cacheItemPool);
+
+        // Provider options must be keyed by provider name with the
+        // intermediate 'options' level stripped.
+        $providers = $config['providers'] ?? null;
+        $this->assertIsArray($providers);
+        $this->assertSame(['test_provider'], array_keys($providers));
+        $provider = $providers['test_provider'];
+        $this->assertIsArray($provider);
+        $this->assertArrayNotHasKey('options', $provider);
+        $this->assertSame('test_id', $provider['client_id']);
+    }
+
+    public function testLoadWiresCacheAndCliLoginRoute(): void
+    {
+        $extension = new ItkDevOpenIdConnectExtension();
+        $container = new ContainerBuilder();
+
+        $extension->load([$this->getBaseConfig()], $container);
+
+        $cache = $container->getDefinition(CliLoginHelper::class)->getArgument('$cache');
+        $this->assertInstanceOf(Reference::class, $cache);
+        $this->assertSame('cache.app', (string) $cache);
+
+        $this->assertSame('test_route', $container->getDefinition(UserLoginCommand::class)->getArgument('$cliLoginRoute'));
+        $this->assertSame('test_route', $container->getDefinition(CliLoginTokenAuthenticator::class)->getArgument('$cliLoginRoute'));
+    }
+
     public function testLoadWithUserProvider(): void
     {
         $extension = new ItkDevOpenIdConnectExtension();