diff --git a/server/src/__tests__/config.routes.test.js b/server/src/__tests__/config.routes.test.js
new file mode 100644
index 0000000..ea92ed9
--- /dev/null
+++ b/server/src/__tests__/config.routes.test.js
@@ -0,0 +1,115 @@
+import { describe, it, expect, vi, beforeEach, afterAll } from 'vitest';
+import request from 'supertest';
+
+const app = require('../app');
+const db = require('../db');
+
+const originalQuery = db.pool.query;
+const originalConnect = db.pool.connect;
+
+db.pool.query = vi.fn();
+
+const mockClient = {
+  query: vi.fn(),
+  release: vi.fn(),
+};
+db.pool.connect = vi.fn().mockResolvedValue(mockClient);
+
+afterAll(() => {
+  db.pool.query = originalQuery;
+  db.pool.connect = originalConnect;
+});
+
+const configRows = [
+  { key: 'paycheck1_day', value: '1' },
+  { key: 'paycheck2_day', value: '15' },
+  { key: 'paycheck1_gross', value: '3000' },
+  { key: 'paycheck1_net', value: '2400' },
+  { key: 'paycheck2_gross', value: '3000' },
+  { key: 'paycheck2_net', value: '2400' },
+];
+
+describe('GET /api/config', () => {
+  beforeEach(() => db.pool.query.mockReset());
+
+  it('returns all config values as numbers', async () => {
+    db.pool.query.mockResolvedValue({ rows: configRows });
+
+    const res = await request(app).get('/api/config');
+
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({
+      paycheck1_day: 1,
+      paycheck2_day: 15,
+      paycheck1_gross: 3000,
+      paycheck1_net: 2400,
+      paycheck2_gross: 3000,
+      paycheck2_net: 2400,
+    });
+  });
+
+  it('uses defaults for missing keys', async () => {
+    // Only partial config stored — paycheck1_day and paycheck2_day default to 1 and 15
+    db.pool.query.mockResolvedValue({ rows: [] });
+
+    const res = await request(app).get('/api/config');
+
+    expect(res.status).toBe(200);
+    expect(res.body.paycheck1_day).toBe(1);
+    expect(res.body.paycheck2_day).toBe(15);
+    expect(res.body.paycheck1_gross).toBeNull();
+  });
+
+  it('returns 500 on db error', async () => {
+    db.pool.query.mockRejectedValueOnce(new Error('DB error'));
+
+    const res = await request(app).get('/api/config');
+
+    expect(res.status).toBe(500);
+  });
+});
+
+describe('PUT /api/config', () => {
+  beforeEach(() => {
+    db.pool.query.mockReset();
+    db.pool.connect.mockClear();
+    mockClient.query.mockReset();
+    mockClient.release.mockReset();
+  });
+
+  it('updates valid config keys and returns updated config', async () => {
+    mockClient.query.mockResolvedValue(undefined);  // BEGIN, INSERT, COMMIT
+    db.pool.query.mockResolvedValue({ rows: configRows });  // getAllConfig after update
+
+    const res = await request(app)
+      .put('/api/config')
+      .send({ paycheck1_gross: 3200, paycheck1_net: 2600 });
+
+    expect(res.status).toBe(200);
+    expect(res.body).toHaveProperty('paycheck1_gross');
+    expect(mockClient.query).toHaveBeenCalledWith('BEGIN');
+    expect(mockClient.query).toHaveBeenCalledWith('COMMIT');
+  });
+
+  it('ignores unknown keys', async () => {
+    db.pool.query.mockResolvedValue({ rows: configRows });  // getAllConfig
+
+    const res = await request(app)
+      .put('/api/config')
+      .send({ unknown_key: 'value' });
+
+    expect(res.status).toBe(200);
+    // No client.connect should be called since no valid keys
+    expect(db.pool.connect).not.toHaveBeenCalled();
+  });
+
+  it('returns 500 on db error', async () => {
+    mockClient.query.mockRejectedValue(new Error('DB error'));
+
+    const res = await request(app)
+      .put('/api/config')
+      .send({ paycheck1_gross: 3200 });
+
+    expect(res.status).toBe(500);
+  });
+});
diff --git a/server/src/__tests__/one-time-expenses.routes.test.js b/server/src/__tests__/one-time-expenses.routes.test.js
new file mode 100644
index 0000000..39ee1fd
--- /dev/null
+++ b/server/src/__tests__/one-time-expenses.routes.test.js
@@ -0,0 +1,157 @@
+import { describe, it, expect, vi, beforeEach, afterAll } from 'vitest';
+import request from 'supertest';
+
+const app = require('../app');
+const db = require('../db');
+
+const originalQuery = db.pool.query;
+db.pool.query = vi.fn();
+
+afterAll(() => {
+  db.pool.query = originalQuery;
+});
+
+describe('POST /api/one-time-expenses', () => {
+  beforeEach(() => db.pool.query.mockReset());
+
+  it('creates a one-time expense', async () => {
+    const expense = { id: 1, paycheck_id: 5, name: 'Dinner out', amount: 45.00, paid: false, paid_at: null };
+    db.pool.query.mockResolvedValue({ rows: [expense] });
+
+    const res = await request(app)
+      .post('/api/one-time-expenses')
+      .send({ paycheck_id: 5, name: 'Dinner out', amount: 45.00 });
+
+    expect(res.status).toBe(201);
+    expect(res.body).toEqual(expense);
+  });
+
+  it('returns 400 when paycheck_id is missing', async () => {
+    const res = await request(app)
+      .post('/api/one-time-expenses')
+      .send({ name: 'Dinner out', amount: 45 });
+
+    expect(res.status).toBe(400);
+    expect(res.body.message).toBe('paycheck_id is required');
+  });
+
+  it('returns 400 when name is missing', async () => {
+    const res = await request(app)
+      .post('/api/one-time-expenses')
+      .send({ paycheck_id: 5, amount: 45 });
+
+    expect(res.status).toBe(400);
+    expect(res.body.message).toBe('name is required');
+  });
+
+  it('returns 400 when name is blank', async () => {
+    const res = await request(app)
+      .post('/api/one-time-expenses')
+      .send({ paycheck_id: 5, name: '   ', amount: 45 });
+
+    expect(res.status).toBe(400);
+  });
+
+  it('returns 400 when amount is missing', async () => {
+    const res = await request(app)
+      .post('/api/one-time-expenses')
+      .send({ paycheck_id: 5, name: 'Dinner' });
+
+    expect(res.status).toBe(400);
+    expect(res.body.message).toBe('amount is required');
+  });
+
+  it('returns 400 when amount is non-numeric', async () => {
+    const res = await request(app)
+      .post('/api/one-time-expenses')
+      .send({ paycheck_id: 5, name: 'Dinner', amount: 'abc' });
+
+    expect(res.status).toBe(400);
+  });
+
+  it('returns 500 on db error', async () => {
+    db.pool.query.mockRejectedValueOnce(new Error('DB error'));
+
+    const res = await request(app)
+      .post('/api/one-time-expenses')
+      .send({ paycheck_id: 5, name: 'Dinner', amount: 45 });
+
+    expect(res.status).toBe(500);
+  });
+});
+
+describe('DELETE /api/one-time-expenses/:id', () => {
+  beforeEach(() => db.pool.query.mockReset());
+
+  it('deletes an expense', async () => {
+    db.pool.query.mockResolvedValue({ rows: [{ id: 1 }] });
+
+    const res = await request(app).delete('/api/one-time-expenses/1');
+
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ id: 1 });
+  });
+
+  it('returns 404 when not found', async () => {
+    db.pool.query.mockResolvedValue({ rows: [] });
+
+    const res = await request(app).delete('/api/one-time-expenses/999');
+
+    expect(res.status).toBe(404);
+    expect(res.body.message).toBe('One-time expense not found');
+  });
+
+  it('returns 400 for invalid id', async () => {
+    const res = await request(app).delete('/api/one-time-expenses/abc');
+
+    expect(res.status).toBe(400);
+  });
+});
+
+describe('PATCH /api/one-time-expenses/:id/paid', () => {
+  beforeEach(() => db.pool.query.mockReset());
+
+  it('marks expense as paid', async () => {
+    const expense = { id: 1, paycheck_id: 5, name: 'Dinner', amount: 45, paid: true, paid_at: '2026-03-15T10:00:00Z' };
+    db.pool.query.mockResolvedValue({ rows: [expense] });
+
+    const res = await request(app)
+      .patch('/api/one-time-expenses/1/paid')
+      .send({ paid: true });
+
+    expect(res.status).toBe(200);
+    expect(res.body.paid).toBe(true);
+  });
+
+  it('unmarks expense as paid', async () => {
+    const expense = { id: 1, paycheck_id: 5, name: 'Dinner', amount: 45, paid: false, paid_at: null };
+    db.pool.query.mockResolvedValue({ rows: [expense] });
+
+    const res = await request(app)
+      .patch('/api/one-time-expenses/1/paid')
+      .send({ paid: false });
+
+    expect(res.status).toBe(200);
+    expect(res.body.paid).toBe(false);
+    expect(res.body.paid_at).toBeNull();
+  });
+
+  it('returns 400 when paid is not boolean', async () => {
+    const res = await request(app)
+      .patch('/api/one-time-expenses/1/paid')
+      .send({ paid: 'yes' });
+
+    expect(res.status).toBe(400);
+    expect(res.body.message).toBe('paid must be a boolean');
+  });
+
+  it('returns 404 when not found', async () => {
+    db.pool.query.mockResolvedValue({ rows: [] });
+
+    const res = await request(app)
+      .patch('/api/one-time-expenses/999/paid')
+      .send({ paid: true });
+
+    expect(res.status).toBe(404);
+  });
+});
diff --git a/server/src/__tests__/summary.routes.test.js b/server/src/__tests__/summary.routes.test.js
new file mode 100644
index 0000000..bbf118f
--- /dev/null
+++ b/server/src/__tests__/summary.routes.test.js
@@ -0,0 +1,133 @@
+import { describe, it, expect, vi, beforeEach, afterAll } from 'vitest';
+import request from 'supertest';
+
+const app = require('../app');
+const db = require('../db');
+
+const originalQuery = db.pool.query;
+db.pool.query = vi.fn();
+
+afterAll(() => {
+  db.pool.query = originalQuery;
+});
+
+describe('GET /api/summary/monthly', () => {
+  beforeEach(() => db.pool.query.mockReset());
+
+  it('returns 400 for missing params', async () => {
+    const res = await request(app).get('/api/summary/monthly');
+    expect(res.status).toBe(400);
+  });
+
+  it('returns 400 for invalid month', async () => {
+    const res = await request(app).get('/api/summary/monthly?year=2026&month=0');
+    expect(res.status).toBe(400);
+  });
+
+  it('returns zeros when no paychecks exist for month', async () => {
+    db.pool.query.mockResolvedValue({ rows: [] });
+
+    const res = await request(app).get('/api/summary/monthly?year=2026&month=3');
+
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({
+      year: 2026,
+      month: 3,
+      month_name: 'March',
+      income: { gross: 0, net: 0 },
+      bills: { planned: 0, paid: 0, unpaid: 0, count: 0, paid_count: 0 },
+      actuals: { total: 0, count: 0 },
+      one_time_expenses: { total: 0, count: 0 },
+      summary: { total_spending: 0, surplus_deficit: 0 },
+    });
+  });
+
+  it('returns computed summary when paychecks exist', async () => {
+    db.pool.query
+      .mockResolvedValueOnce({ rows: [
+        { id: 1, gross: '3000', net: '2400' },
+        { id: 2, gross: '3000', net: '2400' },
+      ]})
+      .mockResolvedValueOnce({ rows: [{ count: 3, planned: '600', paid_amount: '400', paid_count: 2 }] })
+      .mockResolvedValueOnce({ rows: [{ count: 5, total: '250' }] })
+      .mockResolvedValueOnce({ rows: [{ category: 'Food', total: '150' }, { category: 'Gas', total: '100' }] })
+      .mockResolvedValueOnce({ rows: [{ count: 1, total: '50' }] });
+
+    const res = await request(app).get('/api/summary/monthly?year=2026&month=3');
+
+    expect(res.status).toBe(200);
+    expect(res.body.income).toEqual({ gross: 6000, net: 4800 });
+    expect(res.body.bills.planned).toBe(600);
+    expect(res.body.bills.paid).toBe(400);
+    expect(res.body.bills.unpaid).toBe(200);
+    expect(res.body.actuals.total).toBe(250);
+    expect(res.body.actuals.by_category).toHaveLength(2);
+    expect(res.body.one_time_expenses.total).toBe(50);
+    expect(res.body.summary.total_spending).toBe(900);  // 600 + 250 + 50
+    expect(res.body.summary.surplus_deficit).toBe(3900); // 4800 - 900
+    expect(res.body.month_name).toBe('March');
+  });
+
+  it('returns 500 on db error', async () => {
+    db.pool.query.mockRejectedValueOnce(new Error('DB error'));
+
+    const res = await request(app).get('/api/summary/monthly?year=2026&month=3');
+
+    expect(res.status).toBe(500);
+  });
+});
+
+describe('GET /api/summary/annual', () => {
+  beforeEach(() => db.pool.query.mockReset());
+
+  it('returns 400 when year is missing', async () => {
+    const res = await request(app).get('/api/summary/annual');
+    expect(res.status).toBe(400);
+  });
+
+  it('returns empty months when no paychecks for year', async () => {
+    db.pool.query.mockResolvedValue({ rows: [] });
+
+    const res = await request(app).get('/api/summary/annual?year=2026');
+
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ year: 2026, months: [], categories: [] });
+  });
+
+  it('returns per-month breakdown when paychecks exist', async () => {
+    db.pool.query
+      .mockResolvedValueOnce({ rows: [
+        { id: 1, period_month: 1, gross: '3000', net: '2400' },
+        { id: 2, period_month: 1, gross: '3000', net: '2400' },
+        { id: 3, period_month: 2, gross: '3000', net: '2400' },
+        { id: 4, period_month: 2, gross: '3000', net: '2400' },
+      ]})
+      .mockResolvedValueOnce({ rows: [
+        { period_month: 1, planned: '600' },
+        { period_month: 2, planned: '600' },
+      ]})
+      .mockResolvedValueOnce({ rows: [] })   // no one-time expenses
+      .mockResolvedValueOnce({ rows: [
+        { period_month: 1, category: 'Food', total: '200' },
+      ]});
+
+    const res = await request(app).get('/api/summary/annual?year=2026');
+
+    expect(res.status).toBe(200);
+    expect(res.body.year).toBe(2026);
+    expect(res.body.months).toHaveLength(2);
+    expect(res.body.months[0].month).toBe(1);
+    expect(res.body.months[0].month_name).toBe('January');
+    expect(res.body.months[0].income_net).toBe(4800);
+    expect(res.body.months[0].total_bills).toBe(600);
+    expect(res.body.categories).toEqual(['Food']);
+  });
+
+  it('returns 500 on db error', async () => {
+    db.pool.query.mockRejectedValueOnce(new Error('DB error'));
+
+    const res = await request(app).get('/api/summary/annual?year=2026');
+
+    expect(res.status).toBe(500);
+  });
+});