diff --git a/packages/server/lib/privileged-commands/privileged-channel.js b/packages/server/lib/privileged-commands/privileged-channel.js
index 0c16b4b1813b..7f4eec37e2e2 100644
--- a/packages/server/lib/privileged-commands/privileged-channel.js
+++ b/packages/server/lib/privileged-commands/privileged-channel.js
@@ -203,7 +203,7 @@
     // needs to use the fully-qualified url or else when the baseUrl includes
     // basic auth, the fetch fails with a security error
     // see https://github.com/cypress-io/cypress/issues/28336
-    const promise = fetch(`${window.location.origin}/${namespace}/add-verified-command`, {
+    const promise = fetch(`${win.location.origin}/${namespace}/add-verified-command`, {
       body: stringify({
         args,
         name: command.name,
diff --git a/packages/server/test/unit/browsers/privileged-channel_spec.js b/packages/server/test/unit/browsers/privileged-channel_spec.js
index b945ab629831..b8777c3a5c63 100644
--- a/packages/server/test/unit/browsers/privileged-channel_spec.js
+++ b/packages/server/test/unit/browsers/privileged-channel_spec.js
@@ -36,6 +36,9 @@ describe('privileged channel', () => {
       Function: { prototype: {
         toString: Function.prototype.toString,
       } },
+      location: {
+        origin: 'http://localhost:1234',
+      },
       Math: {
         imul: Math.imul,
       },