diff --git a/backend/config/ssl_export_test.go b/backend/config/ssl_export_test.go
index f9cddc0d..f7023014 100644
--- a/backend/config/ssl_export_test.go
+++ b/backend/config/ssl_export_test.go
@@ -26,7 +26,7 @@ func TestPublishExternalTLSValidatesBeforeReplacingBundle(t *testing.T) {
 	candidate := validRuntimeConfig()
 	candidate.Root.Domains = DomainConfig{Primary: "example.com", Web: "web.example.com", Accepted: []string{"example.com"}}
 	candidate.Root.HTTP = HTTPConfig{Port: 15184, TLSMode: HTTPSTLSModeProxy, TrustedProxyCIDRs: []string{"127.0.0.1/32"}}
-	candidate.SSL.TLS = SSLConfig{Management: SSLManagementWebServer, Mode: ManagedSSLModeUpload, CustomDirectory: "ssl"}
+	candidate.SSL.TLS = SSLConfig{Management: SSLManagementWebServer, Mode: ManagedSSLModeUpload, DefaultDirectory: "config/ssl", CustomDirectory: "ssl"}
 	writeRuntimeFixture(t, root, candidate)
 	key, certificate := testManagedCertificate(t, "example.com", time.Now().Add(-time.Hour), time.Now().Add(time.Hour), 2048, "*.example.com")
 	write := func(name string, data []byte) {
diff --git a/backend/hooks/plugin_isolation_linux_test.go b/backend/hooks/plugin_isolation_linux_test.go
index b47ca871..3d0a1654 100644
--- a/backend/hooks/plugin_isolation_linux_test.go
+++ b/backend/hooks/plugin_isolation_linux_test.go
@@ -101,9 +101,22 @@ func TestInheritedAbstractSocketRemainsReachableAcrossListenerCopy(t *testing.T)
 	}
 }
 
+func testPluginEgressSocketDir(t *testing.T) string {
+	t.Helper()
+	dir := t.TempDir()
+	if len(dir)+len("/egress.socket") >= 90 {
+		shortDir, err := os.MkdirTemp("/tmp", "smail-egress-*")
+		if err == nil {
+			t.Cleanup(func() { _ = os.RemoveAll(shortDir) })
+			return shortDir
+		}
+	}
+	return dir
+}
+
 func TestPluginEgressSocketLifecycle(t *testing.T) {
 	spec := &pluginLaunchSpec{
-		runtimeDir: t.TempDir(),
+		runtimeDir: testPluginEgressSocketDir(t),
 		procAttr: &os.ProcAttr{Env: []string{
 			"SMAIL_PLUGIN_ID=wechat_push",
 			"SMAIL_PLUGIN_RPC_TOKEN=" + strings.Repeat("b", 64),