diff --git a/tests/bin/patch-coverage.php b/tests/bin/patch-coverage.php
index e2f342b..0a548e3 100644
--- a/tests/bin/patch-coverage.php
+++ b/tests/bin/patch-coverage.php
@@ -164,6 +164,10 @@ function changed_lines($base_ref) {
 	// plugin_npc_install() at install time, not exercisable in the isolated
 	// unit process.
 	'includes/database.php',
+	// Legacy web header: executes at the top level against the session and
+	// auth tables, so it cannot be loaded into the isolated unit process. Changed
+	// here only to replace a deprecated request-variable alias.
+	'top_graph_header.php',
 ];
 $unmeasured            = array_values(array_diff(array_keys($changed), array_keys($measured)));
 $unexpected_unmeasured = array_values(array_diff($unmeasured, $unmeasured_allowlist));
diff --git a/top_graph_header.php b/top_graph_header.php
index 012b7ce..600f418 100644
--- a/top_graph_header.php
+++ b/top_graph_header.php
@@ -31,7 +31,7 @@
 }
 
 /* ================= input validation ================= */
-input_validate_input_number(get_request_var_request("local_graph_id"));
+input_validate_input_number(get_request_var("local_graph_id"));
 /* ==================================================== */
 
 if (read_config_option("auth_method") != 0) {