diff --git a/tests/data/content/.env b/tests/data/content/.env
new file mode 100644
index 0000000..0c45785
--- /dev/null
+++ b/tests/data/content/.env
@@ -0,0 +1 @@
+SECRET_KEY=not-a-real-secret
diff --git a/tests/data/content/.secret/hidden-file b/tests/data/content/.secret/hidden-file
new file mode 100644
index 0000000..7b0730d
--- /dev/null
+++ b/tests/data/content/.secret/hidden-file
@@ -0,0 +1 @@
+This file should never be served by default.
diff --git a/tests/tests.rs b/tests/tests.rs
index 9cfc7d5..6e9b553 100644
--- a/tests/tests.rs
+++ b/tests/tests.rs
@@ -445,7 +445,7 @@ fn serve_secret_meta_config_subdir() {
 /// - hidden files should stay hidden even when the dot is percent-encoded
 fn secret_percent_encoded_dot() {
     avoid_default_port_conflict();
-    let page = get(&[], "gemini://localhost/%2emeta").expect("could not get page");
+    let page = get(&[], "gemini://localhost/%2eenv").expect("could not get page");
 
     assert_eq!(page.status, Status::Gone.value());
 }
@@ -454,8 +454,7 @@ fn secret_percent_encoded_dot() {
 /// - hidden subdirectory segments should stay hidden even when dot is encoded
 fn secret_subdir_percent_encoded_dot() {
     avoid_default_port_conflict();
-    let page =
-        get(&["-C"], "gemini://localhost/%2Ewell-known/hidden-file").expect("could not get page");
+    let page = get(&[], "gemini://localhost/%2esecret/hidden-file").expect("could not get page");
 
     assert_eq!(page.status, Status::Gone.value());
 }