diff --git a/tests/unit/test_events.py b/tests/unit/test_events.py
index ffc8234..b527535 100644
--- a/tests/unit/test_events.py
+++ b/tests/unit/test_events.py
@@ -480,3 +480,25 @@ class TestArmRequestDispatch:
         )
 
         assert calls == []
+
+    def test_arm_request_default_triggered_by(self, test_db):
+        """Omitting triggered_by must default to 'unknown' (audit-log value)."""
+        from vigilar.events.processor import EventProcessor
+
+        processor = EventProcessor.__new__(EventProcessor)
+        calls = []
+
+        class FakeFSM:
+            state = ArmState.DISARMED
+
+            def transition(self, new_state, pin="", triggered_by="system"):
+                calls.append((new_state, pin, triggered_by))
+                return True
+
+        processor._handle_arm_request(
+            payload={"mode": "DISARMED", "pin": ""},
+            fsm=FakeFSM(),
+        )
+
+        assert len(calls) == 1
+        assert calls[0][2] == "unknown"
diff --git a/vigilar/events/processor.py b/vigilar/events/processor.py
index 1457937..7800e82 100644
--- a/vigilar/events/processor.py
+++ b/vigilar/events/processor.py
@@ -155,7 +155,7 @@ class EventProcessor:
     def _handle_arm_request(
         self,
         payload: dict[str, Any],
-        fsm: "ArmStateFSM",
+        fsm: ArmStateFSM,
     ) -> None:
         """Handle an arm/disarm request received over MQTT.