diff --git a/internal/cloud/backend_plan_test.go b/internal/cloud/backend_plan_test.go
index ddf8aae099..4c23f7ae28 100644
--- a/internal/cloud/backend_plan_test.go
+++ b/internal/cloud/backend_plan_test.go
@@ -399,7 +399,7 @@ func TestCloud_planWithPath(t *testing.T) {
 	if err != nil {
 		t.Fatalf("error loading cloud plan file: %v", err)
 	}
-	if !strings.Contains(plan.RunID, "run-") || plan.Hostname != "app.terraform.io" {
+	if !strings.Contains(plan.RunID, "run-") || plan.Hostname != tfeHost {
 		t.Fatalf("unexpected contents in saved cloud plan: %v", plan)
 	}
 
diff --git a/internal/cloud/backend_show_test.go b/internal/cloud/backend_show_test.go
index 7240d3ecc1..07102c3481 100644
--- a/internal/cloud/backend_show_test.go
+++ b/internal/cloud/backend_show_test.go
@@ -38,7 +38,7 @@ func TestCloud_showMissingRun(t *testing.T) {
 	mockSROWorkspace(t, b, testBackendSingleWorkspaceName)
 
 	absentRunID := "run-WwwwXxxxYyyyZzzz"
-	_, err := b.ShowPlanForRun(context.Background(), absentRunID, "app.terraform.io", true)
+	_, err := b.ShowPlanForRun(context.Background(), absentRunID, tfeHost, true)
 	if !strings.Contains(err.Error(), "tofu login") {
 		t.Fatalf("expected error message to suggest checking your login status, instead got: %s", err)
 	}
@@ -57,7 +57,7 @@ func TestCloud_showMissingUnredactedJson(t *testing.T) {
 		t.Fatalf("failed to init test data: %s", err)
 	}
 	// Showing the human-formatted plan should still work as expected!
-	redacted, err := b.ShowPlanForRun(ctx, runID, "app.terraform.io", true)
+	redacted, err := b.ShowPlanForRun(ctx, runID, tfeHost, true)
 	if err != nil {
 		t.Fatalf("failed to show plan for human, even though redacted json should be present: %s", err)
 	}
@@ -80,7 +80,7 @@ func TestCloud_showMissingUnredactedJson(t *testing.T) {
 	}
 
 	// But show -json should result in a special error.
-	_, err = b.ShowPlanForRun(ctx, runID, "app.terraform.io", false)
+	_, err = b.ShowPlanForRun(ctx, runID, tfeHost, false)
 	if err == nil {
 		t.Fatalf("unexpected success: reading unredacted json without admin permissions should have errored")
 	}
@@ -102,7 +102,7 @@ func TestCloud_showIncludesUnredactedJson(t *testing.T) {
 		t.Fatalf("failed to init test data: %s", err)
 	}
 	// Showing the human-formatted plan should work as expected:
-	redacted, err := b.ShowPlanForRun(ctx, runID, "app.terraform.io", true)
+	redacted, err := b.ShowPlanForRun(ctx, runID, tfeHost, true)
 	if err != nil {
 		t.Fatalf("failed to show plan for human, even though redacted json should be present: %s", err)
 	}
@@ -110,7 +110,7 @@ func TestCloud_showIncludesUnredactedJson(t *testing.T) {
 		t.Fatalf("show for human doesn't include expected redacted json content")
 	}
 	// Showing the external json plan format should work as expected:
-	unredacted, err := b.ShowPlanForRun(ctx, runID, "app.terraform.io", false)
+	unredacted, err := b.ShowPlanForRun(ctx, runID, tfeHost, false)
 	if err != nil {
 		t.Fatalf("failed to show plan for robot, even though unredacted json should be present: %s", err)
 	}
@@ -131,7 +131,7 @@ func TestCloud_showNoChanges(t *testing.T) {
 		t.Fatalf("failed to init test data: %s", err)
 	}
 	// Showing the human-formatted plan should work as expected:
-	redacted, err := b.ShowPlanForRun(ctx, runID, "app.terraform.io", true)
+	redacted, err := b.ShowPlanForRun(ctx, runID, tfeHost, true)
 	if err != nil {
 		t.Fatalf("failed to show plan for human, even though redacted json should be present: %s", err)
 	}
@@ -163,7 +163,7 @@ func TestCloud_showFooterNotConfirmable(t *testing.T) {
 	mc.Runs.Runs[runID].Actions.IsConfirmable = false
 
 	// Showing the human-formatted plan should work as expected:
-	redacted, err := b.ShowPlanForRun(ctx, runID, "app.terraform.io", true)
+	redacted, err := b.ShowPlanForRun(ctx, runID, tfeHost, true)
 	if err != nil {
 		t.Fatalf("failed to show plan for human, even though redacted json should be present: %s", err)
 	}
diff --git a/internal/cloud/backend_test.go b/internal/cloud/backend_test.go
index 8d3458a49c..e4d3b77503 100644
--- a/internal/cloud/backend_test.go
+++ b/internal/cloud/backend_test.go
@@ -469,7 +469,7 @@ func TestCloud_config(t *testing.T) {
 
 func TestCloud_configVerifyMinimumTFEVersion(t *testing.T) {
 	config := cty.ObjectVal(map[string]cty.Value{
-		"hostname":     cty.StringVal("app.terraform.io"),
+		"hostname":     cty.StringVal(tfeHost),
 		"organization": cty.StringVal("hashicorp"),
 		"token":        cty.NullVal(cty.String),
 		"workspaces": cty.ObjectVal(map[string]cty.Value{
@@ -506,7 +506,7 @@ func TestCloud_configVerifyMinimumTFEVersion(t *testing.T) {
 
 func TestCloud_configVerifyMinimumTFEVersionInAutomation(t *testing.T) {
 	config := cty.ObjectVal(map[string]cty.Value{
-		"hostname":     cty.StringVal("app.terraform.io"),
+		"hostname":     cty.StringVal(tfeHost),
 		"organization": cty.StringVal("hashicorp"),
 		"token":        cty.NullVal(cty.String),
 		"workspaces": cty.ObjectVal(map[string]cty.Value{
@@ -550,7 +550,7 @@ func TestCloud_setUnavailableTerraformVersion(t *testing.T) {
 	workspaceName := "unavailable-terraform-version"
 
 	config := cty.ObjectVal(map[string]cty.Value{
-		"hostname":     cty.StringVal("app.terraform.io"),
+		"hostname":     cty.StringVal(tfeHost),
 		"organization": cty.StringVal("hashicorp"),
 		"token":        cty.NullVal(cty.String),
 		"workspaces": cty.ObjectVal(map[string]cty.Value{
@@ -1293,7 +1293,7 @@ func TestCloud_ServiceDiscoveryAliases(t *testing.T) {
 	b := New(testDisco(s))
 
 	diag := b.Configure(cty.ObjectVal(map[string]cty.Value{
-		"hostname":     cty.StringVal("app.terraform.io"),
+		"hostname":     cty.StringVal(tfeHost),
 		"organization": cty.StringVal("hashicorp"),
 		"token":        cty.NullVal(cty.String),
 		"workspaces": cty.ObjectVal(map[string]cty.Value{
diff --git a/internal/cloud/testing.go b/internal/cloud/testing.go
index 90cffd00ab..bbe80f7b39 100644
--- a/internal/cloud/testing.go
+++ b/internal/cloud/testing.go
@@ -12,6 +12,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"os"
 	"path"
 	"strconv"
 	"testing"
@@ -44,9 +45,9 @@ const (
 )
 
 var (
-	tfeHost  = svchost.Hostname("app.terraform.io")
+	tfeHost  = "app.terraform.io"
 	credsSrc = auth.StaticCredentialsSource(map[svchost.Hostname]map[string]interface{}{
-		tfeHost: {"token": testCred},
+		svchost.Hostname(tfeHost): {"token": testCred},
 	})
 	testBackendSingleWorkspaceName = "app-prod"
 	defaultTFCPing                 = map[string]func(http.ResponseWriter, *http.Request){
@@ -58,6 +59,12 @@ var (
 	}
 )
 
+func skipIfTFENotEnabled(t *testing.T) {
+	if os.Getenv("TF_TFC_TEST") == "" {
+		t.Skip("this test accesses app.terraform.io; set TF_TFC_TEST=1 to run it")
+	}
+}
+
 // mockInput is a mock implementation of tofu.UIInput.
 type mockInput struct {
 	answers map[string]string
@@ -79,6 +86,7 @@ func (m *mockInput) Input(ctx context.Context, opts *tofu.InputOpts) (string, er
 }
 
 func testInput(t *testing.T, answers map[string]string) *mockInput {
+	skipIfTFENotEnabled(t)
 	return &mockInput{answers: answers}
 }
 
@@ -89,7 +97,7 @@ func testBackendWithName(t *testing.T) (*Cloud, func()) {
 
 func testBackendAndMocksWithName(t *testing.T) (*Cloud, *MockClient, func()) {
 	obj := cty.ObjectVal(map[string]cty.Value{
-		"hostname":     cty.StringVal("app.terraform.io"),
+		"hostname":     cty.StringVal(tfeHost),
 		"organization": cty.StringVal("hashicorp"),
 		"token":        cty.NullVal(cty.String),
 		"workspaces": cty.ObjectVal(map[string]cty.Value{
@@ -103,7 +111,7 @@ func testBackendAndMocksWithName(t *testing.T) (*Cloud, *MockClient, func()) {
 
 func testBackendWithTags(t *testing.T) (*Cloud, func()) {
 	obj := cty.ObjectVal(map[string]cty.Value{
-		"hostname":     cty.StringVal("app.terraform.io"),
+		"hostname":     cty.StringVal(tfeHost),
 		"organization": cty.StringVal("hashicorp"),
 		"token":        cty.NullVal(cty.String),
 		"workspaces": cty.ObjectVal(map[string]cty.Value{
@@ -122,7 +130,7 @@ func testBackendWithTags(t *testing.T) (*Cloud, func()) {
 
 func testBackendNoOperations(t *testing.T) (*Cloud, func()) {
 	obj := cty.ObjectVal(map[string]cty.Value{
-		"hostname":     cty.StringVal("app.terraform.io"),
+		"hostname":     cty.StringVal(tfeHost),
 		"organization": cty.StringVal("no-operations"),
 		"token":        cty.NullVal(cty.String),
 		"workspaces": cty.ObjectVal(map[string]cty.Value{
@@ -137,7 +145,7 @@ func testBackendNoOperations(t *testing.T) (*Cloud, func()) {
 
 func testBackendWithHandlers(t *testing.T, handlers map[string]func(http.ResponseWriter, *http.Request)) (*Cloud, func()) {
 	obj := cty.ObjectVal(map[string]cty.Value{
-		"hostname":     cty.StringVal("app.terraform.io"),
+		"hostname":     cty.StringVal(tfeHost),
 		"organization": cty.StringVal("hashicorp"),
 		"token":        cty.NullVal(cty.String),
 		"workspaces": cty.ObjectVal(map[string]cty.Value{
@@ -225,6 +233,7 @@ func testBackendWithOutputs(t *testing.T) (*Cloud, func()) {
 }
 
 func testBackend(t *testing.T, obj cty.Value, handlers map[string]func(http.ResponseWriter, *http.Request)) (*Cloud, *MockClient, func()) {
+	skipIfTFENotEnabled(t)
 	var s *httptest.Server
 	if handlers != nil {
 		s = testServerWithHandlers(handlers)
@@ -305,6 +314,8 @@ func testBackend(t *testing.T, obj cty.Value, handlers map[string]func(http.Resp
 // testUnconfiguredBackend is used for testing the configuration of the backend
 // with the mock client
 func testUnconfiguredBackend(t *testing.T) (*Cloud, func()) {
+	skipIfTFENotEnabled(t)
+
 	s := testServer(t)
 	b := New(testDisco(s))
 
@@ -354,6 +365,8 @@ func testUnconfiguredBackend(t *testing.T) (*Cloud, func()) {
 }
 
 func testLocalBackend(t *testing.T, cloud *Cloud) backend.Enhanced {
+	skipIfTFENotEnabled(t)
+
 	b := backendLocal.NewWithBackend(cloud)
 
 	// Add a test provider to the local backend.
@@ -378,6 +391,8 @@ func testLocalBackend(t *testing.T, cloud *Cloud) backend.Enhanced {
 // testServer returns a started *httptest.Server used for local testing with the default set of
 // request handlers.
 func testServer(t *testing.T) *httptest.Server {
+	skipIfTFENotEnabled(t)
+
 	return testServerWithHandlers(testDefaultRequestHandlers)
 }
 
@@ -398,6 +413,8 @@ func testServerWithHandlers(handlers map[string]func(http.ResponseWriter, *http.
 }
 
 func testServerWithSnapshotsEnabled(t *testing.T, enabled bool) *httptest.Server {
+	skipIfTFENotEnabled(t)
+
 	var serverURL string
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		t.Log(r.Method, r.URL.String())
@@ -581,7 +598,7 @@ func testDisco(s *httptest.Server) *disco.Disco {
 	d := disco.NewWithCredentialsSource(credsSrc)
 	d.SetUserAgent(httpclient.OpenTofuUserAgent(version.String()))
 
-	d.ForceHostServices(svchost.Hostname("app.terraform.io"), services)
+	d.ForceHostServices(svchost.Hostname(tfeHost), services)
 	d.ForceHostServices(svchost.Hostname("localhost"), services)
 	d.ForceHostServices(svchost.Hostname("nontfe.local"), nil)
 	return d