diff --git a/server/src/config.js b/server/src/config.js
index e9b5da0..68da085 100644
--- a/server/src/config.js
+++ b/server/src/config.js
@@ -40,13 +40,13 @@ const config = {
   trustedProxies: getTrustProxies('TRUSTED_PROXIES'),
   surveyUrl: getUrl('SURVEY_URL', ''),
   bugReportUrl: getUrl('BUG_REPORT_URL', ''),
-  testing: {
-    enabled: process.env.TESTING === 'true',
-    username: get('TESTING_USERNAME', ''),
-    password: get('TESTING_PASSWORD', ''),
-  },
 }
 
 config.baseUrl = get('BASE_URL', `http://${config.host}:${config.port}`)
+config.testing = {
+  enabled: !config.isProduction && process.env.TESTING === 'true',
+  username: get('TESTING_USERNAME', ''),
+  password: get('TESTING_PASSWORD', ''),
+}
 
 export default config
diff --git a/server/src/middleware/rateLimiter.js b/server/src/middleware/rateLimiter.js
index 85b1f5d..f8dcc32 100644
--- a/server/src/middleware/rateLimiter.js
+++ b/server/src/middleware/rateLimiter.js
@@ -1,16 +1,24 @@
 import rateLimit from 'express-rate-limit'
+import config from '../config.js'
 
-export const globalRateLimit = rateLimit({
+function createRateLimiter(options) {
+  if (config.testing.enabled) {
+    return (req, res, next) => next()
+  }
+  return rateLimit(options)
+}
+
+export const globalRateLimit = createRateLimiter({
   windowMs: 60 * 1000, // 1 minute
   max: 100,
 })
 
-export const authenticateRateLimit = rateLimit({
+export const authenticateRateLimit = createRateLimiter({
   windowMs: 2 * 60 * 1000,
   max: 5,
 })
 
-export const sessionRateLimit = rateLimit({
+export const sessionRateLimit = createRateLimiter({
   windowMs: 10 * 1000,
   max: 1,
   keyGenerator: (req) => {