diff --git a/Cargo.toml b/Cargo.toml
index 8266ff5..ad538d1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -36,6 +36,13 @@ rustix = { version = "1.1.5", features = ["fs", "process", "mm", "termios", "eve
 [target.'cfg(windows)'.dependencies]
 windows-sys = { version = "0.61", features = ["Win32_Foundation", "Win32_Storage_FileSystem", "Win32_System_Console", "Win32_System_IO", "Win32_System_Memory", "Win32_Security"] }
 
+# Tests run the real KEMs and Argon2id; unoptimised they are far too slow.
+[profile.dev]
+opt-level = 1
+
+[profile.dev.package."*"]
+opt-level = 3
+
 [profile.release]
 codegen-units = 1
 lto = true
diff --git a/tests/cli.rs b/tests/cli.rs
index 4cd69a6..84fb04d 100644
--- a/tests/cli.rs
+++ b/tests/cli.rs
@@ -478,12 +478,25 @@ fn agent_idle_extends_and_expires() {
     genkey(&e, RUST, false);
     e.ok(RUST, Some(REAL), &["init"]);
     e.ok(RUST, Some(REAL), &["unlock", "--for", "2s", "--idle"]);
-    for _ in 0..4 {
+    // Fetch the key and stop: with no vault there, a command that got the
+    // key from the agent fails at once with "not a vault"; one that did not
+    // fails asking for the passphrase. This keeps slow (debug) builds from
+    // stretching the gaps between uses.
+    let use_key = || {
+        let o = e
+            .cmd(RUST, None)
+            .env("VAULT_DIR", e.dir.join("nowhere"))
+            .arg("list")
+            .output()
+            .unwrap();
+        String::from_utf8_lossy(&o.stderr).contains("is not a vault")
+    };
+    for i in 0..4 {
         std::thread::sleep(Duration::from_millis(900));
-        e.ok(RUST, None, &["list"]); // each use pushes expiry back
+        assert!(use_key(), "idle agent expired while in use (use {i})"); // each use pushes expiry back
     }
     std::thread::sleep(Duration::from_millis(3500));
-    assert!(!e.run(RUST, None, &["list"]).status.success(), "idle agent outlived its idle time");
+    assert!(!use_key(), "idle agent outlived its idle time");
 }
 
 #[cfg(unix)]