diff --git a/extensions/matrix/src/exec-approvals.test.ts b/extensions/matrix/src/exec-approvals.test.ts
index cbd814266d7..6e56af329dd 100644
--- a/extensions/matrix/src/exec-approvals.test.ts
+++ b/extensions/matrix/src/exec-approvals.test.ts
@@ -118,13 +118,13 @@ function makeForeignChannelApprovalRequest(params: {
 }
 
 describe("matrix exec approvals", () => {
-  it("auto-enables when approvers resolve and disables only when forced off", () => {
+  it("requires enablement and approvers before enabling the client", () => {
     expect(isMatrixExecApprovalClientEnabled({ cfg: buildConfig() })).toBe(false);
     expect(
       isMatrixExecApprovalClientEnabled({
         cfg: buildConfig(undefined, { dm: { allowFrom: ["@owner:example.org"] } }),
       }),
-    ).toBe(true);
+    ).toBe(false);
     expect(isMatrixExecApprovalClientEnabled({ cfg: buildConfig({ enabled: true }) })).toBe(false);
     expect(
       isMatrixExecApprovalClientEnabled({
diff --git a/src/cli/qr-cli.test.ts b/src/cli/qr-cli.test.ts
index cafdfabf3ba..ac89cb8857f 100644
--- a/src/cli/qr-cli.test.ts
+++ b/src/cli/qr-cli.test.ts
@@ -235,18 +235,18 @@ describe("registerQrCli", () => {
     expect(output).toContain("gateway.tailscale.mode=serve");
   });
 
-  it("allows lan mdns cleartext setup urls", async () => {
+  it("allows private LAN IP cleartext setup urls", async () => {
     loadConfig.mockReturnValue({
       gateway: {
         bind: "custom",
-        customBindHost: "gateway.local",
+        customBindHost: "192.168.1.8",
         auth: { mode: "token", token: "tok" },
       },
     });
 
     await runQr(["--setup-code-only"]);
 
-    expectLoggedSetupCode("ws://gateway.local:18789");
+    expectLoggedSetupCode("ws://192.168.1.8:18789");
   });
 
   it("allows android emulator cleartext override urls", async () => {