diff --git a/Project-Tests/security/2fa-validation.sh b/Project-Tests/security/2fa-validation.sh
index ade228a..9c500e0 100755
--- a/Project-Tests/security/2fa-validation.sh
+++ b/Project-Tests/security/2fa-validation.sh
@@ -14,7 +14,7 @@ function test_2fa_packages() {
     local failed=0
     
     for package in "${packages[@]}"; do
-        if dpkg -l | grep -q "^ii.*$package"; then
+        if dpkg -s "$package" 2>/dev/null | grep -q "^Status:.*installed"; then
             echo "✅ Package installed: $package"
         else
             echo "❌ Package missing: $package"
diff --git a/Project-Tests/security/https-enforcement.sh b/Project-Tests/security/https-enforcement.sh
index e2a2d12..976d4f0 100755
--- a/Project-Tests/security/https-enforcement.sh
+++ b/Project-Tests/security/https-enforcement.sh
@@ -76,8 +76,10 @@ function test_ssl_certificate_validation() {
     local ssl_failures=0
     
     for url in "${test_urls[@]}"; do
-        # Test with strict SSL verification
-        if curl -s --fail --ssl-reqd --cert-status "$url" >/dev/null 2>&1; then
+        # Verify TLS is required and the certificate chain is valid. Do NOT use
+        # --cert-status: that requires OCSP stapling, which many valid CDNs do
+        # not provide, producing false negatives for otherwise-valid certs.
+        if curl -s --fail --ssl-reqd "$url" >/dev/null 2>&1; then
             echo "✅ SSL certificate valid: $url"
         else
             echo "❌ SSL certificate validation failed: $url"
diff --git a/Project-Tests/unit/safe-download.sh b/Project-Tests/unit/safe-download.sh
index f441227..bde6d11 100755
--- a/Project-Tests/unit/safe-download.sh
+++ b/Project-Tests/unit/safe-download.sh
@@ -218,8 +218,12 @@ function test_download_error_handling() {
         echo "✅ Download with empty destination failed as expected"
     fi
     
-    # Test download to read-only location (should fail)
-    if safe_download "https://github.com" "/test-readonly-$$" 2>/dev/null; then
+    # Test download to read-only location (should fail). Only meaningful for
+    # non-root users: root bypasses filesystem permissions, so the expected
+    # write failure never happens and the assertion is invalid.
+    if [[ $EUID -eq 0 ]]; then
+        echo "⏭️  Skipping read-only-location test (running as root; root bypasses FS perms)"
+    elif safe_download "https://github.com" "/test-readonly-$$" 2>/dev/null; then
         echo "❌ Download to read-only location should have failed"
         ((++failed))
     else