diff --git a/src/rs/server/websocket_server/mod.rs b/src/rs/server/websocket_server/mod.rs
index b9f0fc21..3a1601fa 100644
--- a/src/rs/server/websocket_server/mod.rs
+++ b/src/rs/server/websocket_server/mod.rs
@@ -519,6 +519,19 @@ mod tests {
     let (spectrum_tx, mut spectrum_rx) = broadcast::channel(8);
     let stream_manager =
       StreamingSourceModeManager::new(Duration::from_millis(250));
+    let _subscription = stream_manager
+      .subscribe(
+        StreamKey::new("hackrf_one-test", StreamMode::Tx),
+        StreamOptions::Tx(TxStreamOptions {
+          center_frequency_hz: 2_400_000,
+          sample_rate_hz: 2_000_000,
+          bandwidth_hz: 2_000_000,
+          signal: "wifi".to_string(),
+          power_dbm: -18.0,
+          ifft_size: 1024,
+        }),
+      )
+      .expect("managed HackRF Tx subscription should open");
     stream_manager.set_tx_payload(
       StreamKey::new("hackrf_one-test", StreamMode::Tx),
       2_400_000,
diff --git a/test/integration/EncryptionLifecycle.test.tsx b/test/integration/EncryptionLifecycle.test.tsx
index c279e6e1..442ebd9c 100644
--- a/test/integration/EncryptionLifecycle.test.tsx
+++ b/test/integration/EncryptionLifecycle.test.tsx
@@ -28,10 +28,14 @@ describe("Encryption Lifecycle Integration (Rust-Generated Test Vectors)", () =>
     // 2. Extract header and payload
     // The header is the first 4096 bytes (JSON)
     const headerBytes = fileArray.slice(0, 4096);
-    const payloadBytes = fileArray.slice(4096);
 
     const headerStr = new TextDecoder().decode(headerBytes).trim();
     const headerJson = JSON.parse(headerStr);
+    const binaryLength = headerJson.metadata.sections?.binary?.length_bytes;
+    const payloadEnd =
+      typeof binaryLength === "number" ? 4096 + binaryLength : fileArray.length;
+    expect(payloadEnd).toBeLessThanOrEqual(fileArray.length);
+    const payloadBytes = fileArray.slice(4096, payloadEnd);
 
     expect(headerJson.metadata.encrypted).toBe(true);
 
diff --git a/test/rust/encryption_e2e_tests.rs b/test/rust/encryption_e2e_tests.rs
index 182b40c7..ae3b9d36 100644
--- a/test/rust/encryption_e2e_tests.rs
+++ b/test/rust/encryption_e2e_tests.rs
@@ -73,12 +73,20 @@ fn test_encryption_save_load_cycle() {
   // 5. Extract header and payload
   // Header is first 4096 bytes
   let header_bytes = &file_bytes[..4096];
-  let payload_bytes = &file_bytes[4096..];
 
   // 6. Parse Header
   let header_str = String::from_utf8_lossy(header_bytes);
   let header_json: serde_json::Value =
     serde_json::from_str(header_str.trim()).expect("Header parse failed");
+  let binary_length = header_json["metadata"]["sections"]["binary"]
+    ["length_bytes"]
+    .as_u64()
+    .expect("binary section length missing") as usize;
+  let payload_end = 4096 + binary_length;
+  assert!(
+    payload_end <= file_bytes.len(),
+    "binary section must fit inside the saved file"
+  );
   let wrapped_dek_b64 = header_json["metadata"]["wrapped_dek"]
     .as_str()
     .expect("wrapped_dek missing");
@@ -93,8 +101,10 @@ fn test_encryption_save_load_cycle() {
   dek.copy_from_slice(&dek_bytes);
 
   // 8. Decrypt Payload using DEK
-  let decrypted_payload = crypto::decrypt_payload_binary(&dek, payload_bytes)
-    .expect("Payload decryption failed");
+  let encrypted_payload = &file_bytes[4096..payload_end];
+  let decrypted_payload =
+    crypto::decrypt_payload_binary(&dek, encrypted_payload)
+      .expect("Payload decryption failed");
 
   // 9. Compare with original
   assert_eq!(decrypted_payload, original_iq, "Decrypted IQ data mismatch");
diff --git a/test/rust/endpoint_auth_tests.rs b/test/rust/endpoint_auth_tests.rs
index 5f8884e1..2f0b062f 100644
--- a/test/rust/endpoint_auth_tests.rs
+++ b/test/rust/endpoint_auth_tests.rs
@@ -147,6 +147,17 @@ async fn test_protected_endpoints_deny_unauthorized() {
   for (path, method) in endpoints {
     let response = if method == "POST" {
       server.post(path).await
+    } else if path.starts_with("/ws/") {
+      server
+        .get(path)
+        .add_header(axum::http::header::CONNECTION, "upgrade")
+        .add_header(axum::http::header::UPGRADE, "websocket")
+        .add_header("sec-websocket-version", "13")
+        .add_header(
+          "sec-websocket-key",
+          "dGhlIHNhbXBsZSBub25jZQ==",
+        )
+        .await
     } else {
       server.get(path).await
     };