diff --git a/hscontrol/servertest/apiv1_errors_test.go b/hscontrol/servertest/apiv1_errors_test.go
index e6e20613..7e8542ae 100644
--- a/hscontrol/servertest/apiv1_errors_test.go
+++ b/hscontrol/servertest/apiv1_errors_test.go
@@ -8,8 +8,11 @@ import (
 	apiv1 "github.com/juanfont/headscale/gen/api/v1"
 )
 
-// The not-found cases below exercise the gRPC->HTTP error translation: a state
-// "record not found" must surface as an RFC 7807 404, not a 500 or a success.
+// These cases assert the HTTP error translation for paths that the
+// per-resource happy-path tests do not already cover; they are the ones that
+// caught the RenameNode/ExpireNode 500 and the pre-auth-key silent-success bugs.
+// Not-found cases that the per-resource tests already assert (DeleteNode,
+// DeleteUser, RenameUser, ExpireApiKey, DeleteApiKey) live there, not here.
 
 func TestAPIv1_Nodes_NotFound(t *testing.T) {
 	_, client := apiClient(t)
@@ -17,8 +20,6 @@ func TestAPIv1_Nodes_NotFound(t *testing.T) {
 
 	const missing = uint64(99999)
 
-	requireProblem(t, client.DeleteNode(ctx, apiv1.DeleteNodeParams{NodeID: missing}), http.StatusNotFound)
-
 	_, err := client.RenameNode(ctx, apiv1.RenameNodeParams{NodeID: missing, NewName: "x"})
 	requireProblem(t, err, http.StatusNotFound)
 
@@ -26,31 +27,6 @@ func TestAPIv1_Nodes_NotFound(t *testing.T) {
 	requireProblem(t, err, http.StatusNotFound)
 }
 
-func TestAPIv1_Users_NotFound(t *testing.T) {
-	_, client := apiClient(t)
-	ctx := context.Background()
-
-	const missing = uint64(99999)
-
-	requireProblem(t, client.DeleteUser(ctx, apiv1.DeleteUserParams{ID: missing}), http.StatusNotFound)
-
-	_, err := client.RenameUser(ctx, apiv1.RenameUserParams{OldID: missing, NewName: "x"})
-	requireProblem(t, err, http.StatusNotFound)
-}
-
-func TestAPIv1_ApiKeys_NotFound(t *testing.T) {
-	_, client := apiClient(t)
-	ctx := context.Background()
-
-	requireProblem(t, client.ExpireApiKey(ctx, &apiv1.ExpireApiKeyReq{
-		ID: apiv1.NewOptUint64(99999),
-	}), http.StatusNotFound)
-
-	requireProblem(t, client.DeleteApiKey(ctx, apiv1.DeleteApiKeyParams{
-		Prefix: "nonexistent",
-	}), http.StatusNotFound)
-}
-
 func TestAPIv1_PreAuthKeys_Errors(t *testing.T) {
 	_, client := apiClient(t)
 	ctx := context.Background()
diff --git a/hscontrol/servertest/apiv1_health_test.go b/hscontrol/servertest/apiv1_health_test.go
index 4316f919..959fbbac 100644
--- a/hscontrol/servertest/apiv1_health_test.go
+++ b/hscontrol/servertest/apiv1_health_test.go
@@ -15,8 +15,7 @@ import (
 // talks to the ogen-generated server in-process and gets a healthy response
 // reporting database connectivity.
 func TestAPIv1_Health(t *testing.T) {
-	srv := servertest.NewServer(t)
-	client := srv.APIClient(t, srv.CreateAPIKey(t))
+	_, client := apiClient(t)
 
 	resp, err := client.Health(context.Background())
 	require.NoError(t, err)
@@ -29,7 +28,7 @@ func TestAPIv1_Health(t *testing.T) {
 
 // TestAPIv1_Health_Unauthorized verifies the bearer-auth SecurityHandler:
 // an invalid API key yields a 401 RFC 7807 problem, matching the previous
-// gRPC/gateway behaviour of rejecting bad tokens.
+// behaviour of rejecting bad tokens.
 func TestAPIv1_Health_Unauthorized(t *testing.T) {
 	srv := servertest.NewServer(t)
 	client := srv.APIClient(t, "tskey-invalid")