diff --git a/internal/app/lifecycle_test.go b/internal/app/lifecycle_test.go
index 777cb57..9a73956 100644
--- a/internal/app/lifecycle_test.go
+++ b/internal/app/lifecycle_test.go
@@ -235,8 +235,11 @@ func TestRunStopsWhenContextEnds(t *testing.T) {
 }
 
 func TestRunReturnsStartError(t *testing.T) {
-	if err := Run(context.Background(), config.Flags{DataDir: t.TempDir()}); err == nil {
-		t.Fatal("expected the --insecure-http refusal")
+	// No TLS flags is no longer an error (install mode serves a self-signed certificate), so use a flag combination
+	// that is always refused.
+	f := config.Flags{DataDir: t.TempDir(), TLSCert: "cert.pem"}
+	if err := Run(context.Background(), f); err == nil {
+		t.Fatal("expected the --tls-cert without --tls-key refusal")
 	}
 }
 
diff --git a/internal/poller/poller_test.go b/internal/poller/poller_test.go
index 2ad3085..5b1b3c4 100644
--- a/internal/poller/poller_test.go
+++ b/internal/poller/poller_test.go
@@ -304,17 +304,19 @@ func TestICMPStateMachine(t *testing.T) {
 	h.startWaiters(2) // ICMP timer and selfmon ticker; no SNMP credential
 
 	var ups []float64
+	// One probe per step: advance only once the ICMP loop has written and re-armed its timer (two waiters: that
+	// timer and the selfmon ticker), so a slow runner can never fire two probes in one step.
+	armed := func() bool { return clk.Waiters() >= 2 }
 	step := func() {
+		eventually(t, armed)
 		before := h.ping.count()
-		for h.ping.count() == before {
-			clk.Advance(15 * time.Second)
-			time.Sleep(2 * time.Millisecond)
-		}
-		time.Sleep(20 * time.Millisecond) // the write follows the ping
+		clk.Advance(15 * time.Second)
+		eventually(t, func() bool { return h.ping.count() > before })
 	}
 	for i := 0; i < 6; i++ {
 		step()
 	}
+	eventually(t, armed) // the last write is done
 	for _, s := range h.w.samples("nmon_icmp_up") {
 		ups = append(ups, s.Value)
 	}