diff --git a/backend/tests/test_rate_limit.py b/backend/tests/test_rate_limit.py
index 78790d1..dc331e0 100644
--- a/backend/tests/test_rate_limit.py
+++ b/backend/tests/test_rate_limit.py
@@ -1,3 +1,5 @@
+from unittest.mock import patch
+
 from app.rate_limit import RateLimiter
 
 
@@ -14,3 +16,16 @@ def test_different_keys_tracked_independently():
     assert limiter.allow("user-1") is True
     assert limiter.allow("user-2") is True
     assert limiter.allow("user-1") is False
+
+
+def test_hits_expire_after_window_elapses():
+    limiter = RateLimiter(max_requests=2, window_seconds=10)
+
+    with patch("app.rate_limit.time.monotonic", return_value=100.0):
+        assert limiter.allow("user-1") is True
+        assert limiter.allow("user-1") is True
+        assert limiter.allow("user-1") is False  # at limit
+
+    with patch("app.rate_limit.time.monotonic", return_value=111.0):
+        # 11 seconds later, both prior hits (at t=100) are older than window_start (111 - 10 = 101)
+        assert limiter.allow("user-1") is True