diff --git a/testing/tests/test_hermes_cli_lanes.py b/testing/tests/test_hermes_cli_lanes.py
index 0d899925e..02fe17d78 100644
--- a/testing/tests/test_hermes_cli_lanes.py
+++ b/testing/tests/test_hermes_cli_lanes.py
@@ -809,7 +809,10 @@ def test_agent_network_boundary_allows_only_authenticated_web_and_broker_surface
                     }
                 }
             ],
-            "ports": [{"protocol": "TCP", "port": 9003}],
+            "ports": [
+                {"protocol": "TCP", "port": 9003},
+                {"protocol": "TCP", "port": 9006},
+            ],
         },
     ]
     assert isolation["spec"]["egress"] == [{}]
@@ -847,13 +850,17 @@ def test_switchyard_has_a_dedicated_non_owner_identity_and_read_only_catalog():
         for item in service_accounts
     )
 
-    deployment = yaml.safe_load((HERMES / "switchyard-deployment.yaml").read_text())
-    pod = deployment["spec"]["template"]["spec"]
-    assert pod["serviceAccountName"] == "hermes-switchyard"
-    for container_name in ("claude-oauth-broker", "worker-route-broker"):
-        container = next(
-            item for item in pod["containers"] if item["name"] == container_name
-        )
+    switchyard = yaml.safe_load(
+        (HERMES / "switchyard-deployment.yaml").read_text()
+    )
+    switchyard_pod = switchyard["spec"]["template"]["spec"]
+    assert switchyard_pod["serviceAccountName"] == "hermes-switchyard"
+    agent_pod = _agent_deployment()["spec"]["template"]["spec"]
+    for pod, container_name in (
+        (switchyard_pod, "worker-route-broker"),
+        (agent_pod, "claude-broker"),
+    ):
+        container = next(item for item in pod["containers"] if item["name"] == container_name)
         catalog = next(
             item
             for item in container["volumeMounts"]
@@ -1079,7 +1086,7 @@ def test_codex_runtime_patch_uses_cli_and_forwards_route(tmp_path: Path):
     auxiliary_content = auxiliary_out.read_text()
     assert 'os.environ.get("CODEX_HOME"' in auxiliary_content
     assert 'Path(codex_home).expanduser() / "auth.json"' in auxiliary_content
-    assert "sole owner" in auxiliary_content
+    assert "never creates a metered API-key lane" in auxiliary_content
 
 
 def test_agent_mounts_codex_auxiliary_runtime_patch():