diff --git a/tests/unit/test_events.py b/tests/unit/test_events.py
index a3878d7..11cf051 100644
--- a/tests/unit/test_events.py
+++ b/tests/unit/test_events.py
@@ -562,3 +562,25 @@ class TestArmRequestDispatch:
         )
 
         assert calls == []
+
+    def test_arm_request_default_triggered_by(self, test_db):
+        """Omitting triggered_by must default to 'unknown' (audit-log value)."""
+        from vigilar.events.processor import EventProcessor
+
+        processor = EventProcessor.__new__(EventProcessor)
+        calls = []
+
+        class FakeFSM:
+            state = ArmState.DISARMED
+
+            def transition(self, new_state, pin="", triggered_by="system"):
+                calls.append((new_state, pin, triggered_by))
+                return True
+
+        processor._handle_arm_request(
+            payload={"mode": "DISARMED", "pin": ""},
+            fsm=FakeFSM(),
+        )
+
+        assert len(calls) == 1
+        assert calls[0][2] == "unknown"
diff --git a/vigilar/events/processor.py b/vigilar/events/processor.py
index 6f549bf..d26fac3 100644
--- a/vigilar/events/processor.py
+++ b/vigilar/events/processor.py
@@ -171,7 +171,7 @@ class EventProcessor:
     def _handle_arm_request(
         self,
         payload: dict[str, Any],
-        fsm: "ArmStateFSM",
+        fsm: ArmStateFSM,
     ) -> None:
         """Handle an arm/disarm request received over MQTT.