diff --git a/tests/Server/ZB.MOM.WW.OtOpcUa.ControlPlane.Tests/Communication/MeshPskProviderRefreshTests.cs b/tests/Server/ZB.MOM.WW.OtOpcUa.ControlPlane.Tests/Communication/MeshPskProviderRefreshTests.cs
index 02aafc1b6..36c209b7d 100644
--- a/tests/Server/ZB.MOM.WW.OtOpcUa.ControlPlane.Tests/Communication/MeshPskProviderRefreshTests.cs
+++ b/tests/Server/ZB.MOM.WW.OtOpcUa.ControlPlane.Tests/Communication/MeshPskProviderRefreshTests.cs
@@ -232,7 +232,13 @@ public sealed class MeshPskProviderRefreshTests
         public int Calls => Volatile.Read(ref _calls);
         public ManualResetEventSlim Entered { get; } = new();
 
-        public void Hold() => _gate = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        // Reset Entered too: the priming refresh already set it, so without the reset Wait() returned before the
+        // held call had even reached the store and the call-count snapshot raced its increment (hosted-CI flake).
+        public void Hold()
+        {
+            Entered.Reset();
+            _gate = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        }
         public void Release() => _gate?.TrySetResult();
 
         public async Task<string?> GetAsync(SecretName name, CancellationToken ct)
diff --git a/tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/FailedCredentialLockoutTests.cs b/tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/FailedCredentialLockoutTests.cs
index 0c0d5cfdf..85a4741e4 100644
--- a/tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/FailedCredentialLockoutTests.cs
+++ b/tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/FailedCredentialLockoutTests.cs
@@ -162,7 +162,9 @@ public sealed class FailedCredentialLockoutTests
             lockout.Complete(Client, succeeded: false);
         }, Ct)).ToArray();
 
-        await WaitUntilAsync(() => lockout.WaitingCount(Client) == 15);
+        // Wait for the slot holders' increments too: the 15 waiters can queue before a slot holder's thread has run
+        // the line after BeginAsync, which read authenticated == 0 on the 2-core hosted runner.
+        await WaitUntilAsync(() => lockout.WaitingCount(Client) == 15 && Volatile.Read(ref authenticated) == 5);
         authenticated.ShouldBe(5);
         release.SetResult();
         await Task.WhenAll(attempts);