diff --git a/.wolfssl_known_macro_extras b/.wolfssl_known_macro_extras
index 72a779e844d..57829b9ca12 100644
--- a/.wolfssl_known_macro_extras
+++ b/.wolfssl_known_macro_extras
@@ -184,11 +184,9 @@ CONFIG_USE_WOLFSSL_ESP_SDK_TIME
 CONFIG_USE_WOLFSSL_ESP_SDK_WIFI
 CONFIG_WOLFCRYPT_ARM_SYMMETRIC_ASM
 CONFIG_WOLFCRYPT_ASM
-CONFIG_WOLFCRYPT_FIPS
 CONFIG_WOLFCRYPT_FIPS_PRE_V7_ASM
 CONFIG_WOLFCRYPT_FIPS_READY
 CONFIG_WOLFCRYPT_FIPS_V2
-CONFIG_WOLFCRYPT_FIPS_V5
 CONFIG_WOLFCRYPT_FIPS_V5_2_3
 CONFIG_WOLFCRYPT_FIPS_V6
 CONFIG_WOLFCRYPT_FIPS_V7
@@ -211,7 +209,6 @@ CONFIG_WOLFSSL_CERT_NAME_ALL
 CONFIG_WOLFSSL_CERT_REQ
 CONFIG_WOLFSSL_CHACHA_POLY
 CONFIG_WOLFSSL_CRYPTO_CB
-CONFIG_WOLFSSL_CRYPTO_ONLY
 CONFIG_WOLFSSL_CURVE25519
 CONFIG_WOLFSSL_CURVE448
 CONFIG_WOLFSSL_DTLS
diff --git a/tests/api/test_certman.c b/tests/api/test_certman.c
index 81c8b3573f7..2b8f2064c34 100644
--- a/tests/api/test_certman.c
+++ b/tests/api/test_certman.c
@@ -5416,7 +5416,8 @@ int test_certman_decision_coverage(void)
     XMEMSET(hash, 0, sizeof(hash));
     XMEMSET(&signer, 0, sizeof(signer));
     ExpectNotNull(ctx = wolfSSL_CTX_new(wolfSSLv23_client_method()));
-    cm = ctx->cm;
+    if (EXPECT_SUCCESS())
+        cm = ctx->cm;
     ExpectNotNull(cm);
 
     /* --- 2700:0/1 AlreadySigner: cm==NULL || hash==NULL ------------------ */
@@ -5435,7 +5436,8 @@ int test_certman_decision_coverage(void)
     /* The all-valid case inserts the Signer into the cm's CA table, which the
      * cm then owns and frees on ctx-free; use a heap Signer and remove it
      * before freeing so ownership stays clean. */
-    hs = (Signer*)XMALLOC(sizeof(Signer), cm->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    if (EXPECT_SUCCESS())
+        hs = (Signer*)XMALLOC(sizeof(Signer), cm->heap, DYNAMIC_TYPE_TMP_BUFFER);
     if (hs != NULL) {
         XMEMSET(hs, 0, sizeof(Signer));
         hs->type = WOLFSSL_USER_CA;
diff --git a/tests/api/test_tls.c b/tests/api/test_tls.c
index b8b8b29b46c..1dc587d3ec5 100644
--- a/tests/api/test_tls.c
+++ b/tests/api/test_tls.c
@@ -8532,7 +8532,8 @@ int test_internal_SetSSL_CTX_DecisionCoverage(void)
     /* The guard (7870) tests only server_hint[0]; a single store keeps the
      * state minimal and stays clear of strncpy range analysis on the
      * macro-sized member. */
-    ctxHint->server_hint[0] = 'h';
+    if (EXPECT_SUCCESS())
+        ctxHint->server_hint[0] = 'h';
     {
         WOLFSSL *raw = (WOLFSSL *)XMALLOC(sizeof(WOLFSSL), NULL,
                 DYNAMIC_TYPE_SSL);
@@ -8593,7 +8594,8 @@ int test_internal_SetSSL_CTX_DecisionCoverage(void)
         ExpectIntEQ(SetSSL_CTX(ssl, ctx, 0), WOLFSSL_SUCCESS);
         ExpectIntEQ(ssl->options.side, WOLFSSL_CLIENT_END);
         /* cond1 F: existing SSL, ctx side poked to NEITHER */
-        ctxNoSide->method->side = WOLFSSL_NEITHER_END;
+        if (EXPECT_SUCCESS())
+            ctxNoSide->method->side = WOLFSSL_NEITHER_END;
         ssl->options.side = WOLFSSL_CLIENT_END;
         ExpectIntEQ(SetSSL_CTX(ssl, ctxNoSide, 0), WOLFSSL_SUCCESS);
         ExpectIntEQ(ssl->options.side, WOLFSSL_CLIENT_END);