diff --git a/packages/void/test/unit/cf-oauth.test.ts b/packages/void/test/unit/cf-oauth.test.ts
index 7bd921974..a18e0e2ac 100644
--- a/packages/void/test/unit/cf-oauth.test.ts
+++ b/packages/void/test/unit/cf-oauth.test.ts
@@ -24,6 +24,14 @@ import {
 const mockExecFile = vi.fn();
 const originalFetch = globalThis.fetch.bind(globalThis);
 
+function fetchLoopback(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {
+  // Each grant binds the same port. Do not reuse a keep-alive connection to
+  // an earlier grant's server, which still holds that grant's state.
+  const request = new Request(input, init);
+  request.headers.set('Connection', 'close');
+  return originalFetch(request);
+}
+
 const AUTH_CODE = 'cf-auth-code-placeholder';
 const REFRESH_SENTINEL = 'cf-refresh-token-placeholder';
 
@@ -58,7 +66,7 @@ beforeEach(() => {
     const url =
       input instanceof Request ? input.url : input instanceof URL ? input.href : input.toString();
     if (url.startsWith('http://localhost:') || url.startsWith('http://127.0.0.1:')) {
-      return originalFetch(input, init);
+      return fetchLoopback(input, init);
     }
     if (url === CF_OAUTH_TOKEN_URL) {
       tokenExchangeBodies.push(new URLSearchParams(init?.body?.toString() ?? ''));
@@ -258,7 +266,7 @@ describe('runCfOauthGrant', () => {
       const url =
         input instanceof Request ? input.url : input instanceof URL ? input.href : input.toString();
       if (url.startsWith('http://localhost:') || url.startsWith('http://127.0.0.1:')) {
-        return originalFetch(input, init);
+        return fetchLoopback(input, init);
       }
       if (url === CF_OAUTH_TOKEN_URL) {
         tokenExchangeBodies.push(new URLSearchParams(init?.body?.toString() ?? ''));
diff --git a/platform/packages/api/test/integration/api-email-domains.test.ts b/platform/packages/api/test/integration/api-email-domains.test.ts
index b22301614..da363d3e8 100644
--- a/platform/packages/api/test/integration/api-email-domains.test.ts
+++ b/platform/packages/api/test/integration/api-email-domains.test.ts
@@ -1967,15 +1967,25 @@ describe('GET /projects/:id/email/domains', () => {
     const user = await createTestUser(env.db);
     const project = await createTestProject(env.db, user.id);
     await addActiveDomain(project.id, user.jwt);
+    // A public ID may contain `_iv`; only secret field names must be excluded.
+    const id = 'edom_ivm16k7p54l5';
+    await env.db.update(emailDomains).set({ id }).where(eq(emailDomains.project_id, project.id));
 
     const res = await listDomains(project.id, user.jwt);
     expect(res.status).toBe(200);
     const rows = (await res.json()) as Array<Record<string, unknown>>;
     expect(rows).toHaveLength(1);
-    expect(rows[0]).toMatchObject({ domain: 'acme.com', status: 'active' });
-    const raw = JSON.stringify(rows);
-    for (const leaked of [API_TOKEN, 'ciphertext', '_iv', 'key_version']) {
-      expect(raw).not.toContain(leaked);
+    expect(rows[0]).toMatchObject({ id, domain: 'acme.com', status: 'active' });
+    expect(JSON.stringify(rows)).not.toContain(API_TOKEN);
+    for (const field of [
+      'token_ciphertext',
+      'token_iv',
+      'token_key_version',
+      'relay_ciphertext',
+      'relay_iv',
+      'relay_key_version',
+    ]) {
+      expect(rows[0]).not.toHaveProperty(field);
     }
   });
 });