diff --git a/tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/AbCipReadSmokeTests.cs b/tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/AbCipReadSmokeTests.cs
index 2d6457f..150cfdb 100644
--- a/tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/AbCipReadSmokeTests.cs
+++ b/tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/AbCipReadSmokeTests.cs
@@ -26,7 +26,11 @@ public sealed class AbCipReadSmokeTests
         await fixture.InitializeAsync();
         try
         {
-            var deviceUri = $"ab://127.0.0.1:{fixture.Port}/1,0";
+            // Use fixture.Host (not hardcoded 127.0.0.1) so the docker-host migration
+            // (10.100.0.35) and AB_SERVER_ENDPOINT overrides reach this test too. The
+            // sibling Emulate tests already use the fixture's resolved endpoint; this
+            // smoke test was missed.
+            var deviceUri = $"ab://{fixture.Host}:{fixture.Port}/1,0";
             var drv = new AbCipDriver(new AbCipDriverOptions
             {
                 Devices = [new AbCipDeviceOptions(deviceUri, profile.Family)],
diff --git a/tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/AddressingGrammarTests.cs b/tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/AddressingGrammarTests.cs
index 8655644..e0cbaff 100644
--- a/tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/AddressingGrammarTests.cs
+++ b/tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/AddressingGrammarTests.cs
@@ -54,7 +54,12 @@ public sealed class AddressingGrammarTests
     {
         if (_sim.SkipReason is not null) Assert.Skip(_sim.SkipReason);
 
-        var tag = new ModbusTagDefinition("Tank", ModbusRegion.HoldingRegisters, 100, ModbusDataType.Float32,
+        // HR 200 lives in pymodbus's scratch range (`write: [200, 209]` per standard.json),
+        // which gives us two consecutive writable HRs for the Float32 round-trip. The earlier
+        // version used HR 100 — but standard.json declares HR 100 as a single-cell auto-
+        // incrementing register (`write: [100, 100]`) so the second register of the Float32
+        // write was rejected with Illegal Data Address.
+        var tag = new ModbusTagDefinition("Tank", ModbusRegion.HoldingRegisters, 200, ModbusDataType.Float32,
             ByteOrder: ModbusByteOrder.WordSwap);
         var drv = await NewDriverAsync(tag);
 
@@ -87,9 +92,13 @@ public sealed class AddressingGrammarTests
         if (_sim.SkipReason is not null) Assert.Skip(_sim.SkipReason);
 
         // Sanity check that the simulator accepts the larger PDU coalescing produces.
-        var t1 = new ModbusTagDefinition("T1", ModbusRegion.HoldingRegisters, 300, ModbusDataType.Int16);
-        var t2 = new ModbusTagDefinition("T2", ModbusRegion.HoldingRegisters, 302, ModbusDataType.Int16);
-        var t3 = new ModbusTagDefinition("T3", ModbusRegion.HoldingRegisters, 304, ModbusDataType.Int16);
+        // Using HR 200/202/204 in the scratch range (standard.json's `uint16: 200..209`),
+        // not 300/302/304 — pymodbus rejects reads outside the seeded uint16 list with
+        // Illegal Data Address (= BadOutOfRange). The coalescing semantic the test
+        // exercises is identical with the scratch addresses.
+        var t1 = new ModbusTagDefinition("T1", ModbusRegion.HoldingRegisters, 200, ModbusDataType.Int16);
+        var t2 = new ModbusTagDefinition("T2", ModbusRegion.HoldingRegisters, 202, ModbusDataType.Int16);
+        var t3 = new ModbusTagDefinition("T3", ModbusRegion.HoldingRegisters, 204, ModbusDataType.Int16);
         var opts = new ModbusDriverOptions
         {
             Host = _sim.Host, Port = _sim.Port, Tags = [t1, t2, t3], MaxReadGap = 5,