BCRYPT_ROUNDS was a module-level const evaluated at import time, so env overrides in tests or CI had no effect. Changed to function that reads process.env on each call. Also lowered hardcoded bcryptHash(..., 10) in test to use env var with fallback 4. CI: BCRYPT_ROUNDS=2. Password test suite: 1860ms → 29ms.