diff --git a/crates/iam/tests/minio_iam_migration_test.rs b/crates/iam/tests/minio_iam_migration_test.rs
index b83045be3..7c3ca0cdc 100644
--- a/crates/iam/tests/minio_iam_migration_test.rs
+++ b/crates/iam/tests/minio_iam_migration_test.rs
@@ -94,7 +94,6 @@ async fn minio_permanent_identities_survive_migration_and_repeated_iam_loads() {
     let temp_dir = tempfile::TempDir::with_prefix("rustfs_minio_iam_migration_").expect("temp directory must be created");
     let env = rustfs_test_utils::TestECStoreEnv::builder()
         .base_dir(temp_dir.path())
-        .init_bucket_metadata(false)
         .build()
         .await;
     env.make_bucket(LEGACY_META_BUCKET, false).await;
diff --git a/crates/test-utils/src/lib.rs b/crates/test-utils/src/lib.rs
index 38b93f0bc..354716dc0 100644
--- a/crates/test-utils/src/lib.rs
+++ b/crates/test-utils/src/lib.rs
@@ -190,8 +190,7 @@ impl TestECStoreEnvBuilder {
     }
 
     /// Whether to run `init_bucket_metadata_sys` after the store comes up
-    /// (default `true`, as the heal bootstraps did). The IAM bootstrap test
-    /// opts out to preserve its historical semantics.
+    /// (default `true`, as the heal bootstraps did).
     pub fn init_bucket_metadata(mut self, yes: bool) -> Self {
         self.init_bucket_metadata = yes;
         self
diff --git a/rustfs/src/app/capacity_dirty_scope_test.rs b/rustfs/src/app/capacity_dirty_scope_test.rs
index 6bff49992..e00c21b73 100644
--- a/rustfs/src/app/capacity_dirty_scope_test.rs
+++ b/rustfs/src/app/capacity_dirty_scope_test.rs
@@ -193,8 +193,13 @@ async fn heal_object_marks_missing_shard_disk_dirty_for_capacity_manager() {
 
     let _ = manager.get_dirty_disks().await;
 
-    let object_root = disk_paths[0].join(&bucket_name).join("test").join("heal.bin");
-    let missing_part = find_part_file(&object_root, "part.1").expect("part file on first disk");
+    let (missing_disk, missing_part) = disk_paths
+        .iter()
+        .find_map(|disk_path| {
+            let object_root = disk_path.join(&bucket_name).join("test").join("heal.bin");
+            find_part_file(&object_root, "part.1").map(|part| (disk_path, part))
+        })
+        .expect("part file on an erasure disk");
     fs::remove_file(&missing_part).await.expect("remove shard to force heal");
 
     let heal_opts = HealOpts {
@@ -219,7 +224,7 @@ async fn heal_object_marks_missing_shard_disk_dirty_for_capacity_manager() {
         .into_iter()
         .map(|disk| stdfs::canonicalize(&disk.drive_path).unwrap().to_string_lossy().into_owned())
         .collect();
-    let expected_missing_disk = stdfs::canonicalize(&disk_paths[0]).unwrap().to_string_lossy().into_owned();
+    let expected_missing_disk = stdfs::canonicalize(missing_disk).unwrap().to_string_lossy().into_owned();
 
     assert!(
         error.is_none() || actual_paths.contains(&expected_missing_disk),
diff --git a/rustfs/src/connect/registration_bootstrap.rs b/rustfs/src/connect/registration_bootstrap.rs
index c14deeb6b..6231941ac 100644
--- a/rustfs/src/connect/registration_bootstrap.rs
+++ b/rustfs/src/connect/registration_bootstrap.rs
@@ -434,7 +434,8 @@ mod tests {
     };
 
     fn secure_tempdir() -> tempfile::TempDir {
-        let home = std::path::PathBuf::from(std::env::var_os("HOME").expect("test requires a protected home directory"));
+        let home = std::fs::canonicalize(std::env::var_os("HOME").expect("test requires a protected home directory"))
+            .expect("test home directory must resolve without symlink components");
         tempfile::Builder::new()
             .prefix(".connect-registration-bootstrap-")
             .tempdir_in(home)
diff --git a/rustfs/tests/connect_registration_bootstrap.rs b/rustfs/tests/connect_registration_bootstrap.rs
index 7797b95d3..70f15a466 100644
--- a/rustfs/tests/connect_registration_bootstrap.rs
+++ b/rustfs/tests/connect_registration_bootstrap.rs
@@ -278,7 +278,8 @@ fn prepare_inputs(temp: &tempfile::TempDir, root_pem: &str) -> (std::path::PathB
 }
 
 fn secure_tempdir() -> tempfile::TempDir {
-    let home = std::path::PathBuf::from(std::env::var_os("HOME").expect("test requires a protected home directory"));
+    let home = std::fs::canonicalize(std::env::var_os("HOME").expect("test requires a protected home directory"))
+        .expect("test home directory must resolve without symlink components");
     tempfile::Builder::new()
         .prefix(".connect-registration-")
         .tempdir_in(home)