diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..825f0bb
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,2 @@
+# Test vectors are compared byte for byte; never convert line endings.
+tests/vectors/** -text
diff --git a/src/util.rs b/src/util.rs
index ea18057..05b3ffd 100644
--- a/src/util.rs
+++ b/src/util.rs
@@ -526,12 +526,13 @@ mod tests {
         );
         assert_eq!(Instant::parse_rfc3339("2023-02-29T00:00:00Z"), None);
         assert!(Instant::parse_rfc3339("2024-02-29T00:00:00Z").is_some());
-        let neg = Instant::from_system(std::time::UNIX_EPOCH - Duration::new(0, 1));
+        // 100 ns: Windows' SystemTime resolution.
+        let neg = Instant::from_system(std::time::UNIX_EPOCH - Duration::new(0, 100));
         assert_eq!(
             neg,
             Instant {
                 secs: -1,
-                nanos: 999_999_999
+                nanos: 999_999_900
             }
         );
         assert_eq!(Instant::from_system(neg.to_system()), neg);
diff --git a/tests/cli.rs b/tests/cli.rs
index b7c0d03..93b47a9 100644
--- a/tests/cli.rs
+++ b/tests/cli.rs
@@ -24,7 +24,13 @@ struct Env {
 
 impl Env {
     fn new(tag: &str) -> Env {
-        let dir = std::env::temp_dir().join(format!(
+        // Not temp_dir(): macOS's long $TMPDIR pushes the agent socket path
+        // past SUN_LEN.
+        #[cfg(unix)]
+        let base = PathBuf::from("/tmp");
+        #[cfg(not(unix))]
+        let base = std::env::temp_dir();
+        let dir = base.join(format!(
             "vault-cli-{tag}-{}-{}",
             std::process::id(),
             std::time::SystemTime::now()