diff --git a/backend/cmd/app_test.go b/backend/cmd/app_test.go
index f5e42042..23ab2278 100644
--- a/backend/cmd/app_test.go
+++ b/backend/cmd/app_test.go
@@ -70,3 +70,64 @@ func TestNewOpenFlareAppRegistersServerAndWaveletUser(t *testing.T) {
 		}
 	}
 }
+
+func TestFreshInstallSeedsOpenFlareDefaults(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "fresh.db")
+	app := cordisPrepare(t, cordisSQLiteSource(t, dbPath))
+	t.Cleanup(func() { _ = app.Context().Dispose() })
+
+	db := openInspectDB(t, dbPath, "")
+	defer func() { _ = db.Close() }()
+
+	var tables int
+	if err := db.QueryRow(`SELECT COUNT(*) FROM sqlite_master WHERE type = 'table' AND name LIKE 'of_%'`).Scan(&tables); err != nil {
+		t.Fatal(err)
+	}
+	if tables == 0 {
+		t.Fatal("fresh install created no of_* tables")
+	}
+
+	rows, err := db.Query(`SELECT task_type FROM w_schedules WHERE task_type LIKE 'of_%' ORDER BY 1`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = rows.Close() }()
+	var got []string
+	for rows.Next() {
+		var taskType string
+		if err := rows.Scan(&taskType); err != nil {
+			t.Fatal(err)
+		}
+		got = append(got, taskType)
+	}
+	want := []string{
+		"of_pages_source_scan",
+		"of_ssl_renew",
+		"of_uptime_kuma_sync",
+		"of_waf_ip_group_sync",
+	}
+	if len(got) != len(want) {
+		t.Fatalf("of_* schedules = %v, want %v", got, want)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("of_* schedules = %v, want %v", got, want)
+		}
+	}
+
+	var cleanup int
+	if err := db.QueryRow(`SELECT COUNT(*) FROM w_schedules WHERE task_type = 'of_database_auto_cleanup'`).Scan(&cleanup); err != nil {
+		t.Fatal(err)
+	}
+	if cleanup != 0 {
+		t.Fatal("must not seed of_database_auto_cleanup")
+	}
+
+	var geoip string
+	if err := db.QueryRow(`SELECT value FROM w_system_configs WHERE key = 'geoip_provider'`).Scan(&geoip); err != nil {
+		t.Fatalf("geoip_provider: %v", err)
+	}
+	if geoip != "ipinfo" {
+		t.Fatalf("geoip_provider = %q, want ipinfo", geoip)
+	}
+}