diff --git a/crates/picloud/tests/api.rs b/crates/picloud/tests/api.rs
index cdf8aba..3e1841d 100644
--- a/crates/picloud/tests/api.rs
+++ b/crates/picloud/tests/api.rs
@@ -890,8 +890,14 @@ async fn version_includes_public_base_url(pool: PgPool) {
     let v: Value = r.json();
     assert!(v["public_base_url"].is_string());
     assert_eq!(v["api"], 1);
-    assert_eq!(v["schema"], 6);
-    assert_eq!(v["sdk"], "1.1");
+    // `schema` is migrations::latest_version() — the highest embedded
+    // migration number. Bumped to 42 by audit 2026-06-11's
+    // 0042_secrets_envelope_version.sql (H-D1). Both this and `sdk` had
+    // rotted (pinned at 6 / "1.1" while the codebase moved to 41 / "1.10")
+    // because the test is #[ignore]-gated; pinned to current reality so
+    // unintended changes are still caught.
+    assert_eq!(v["schema"], 42);
+    assert_eq!(v["sdk"], "1.10");
 }
 
 // ============================================================================
diff --git a/crates/picloud/tests/email_inbound.rs b/crates/picloud/tests/email_inbound.rs
index 8e85a18..16e6f93 100644
--- a/crates/picloud/tests/email_inbound.rs
+++ b/crates/picloud/tests/email_inbound.rs
@@ -229,19 +229,19 @@ async fn create_without_inbound_secret_is_rejected() {
         .post(&format!("/api/v1/admin/apps/{app_id}/triggers/email"))
         .json(&json!({ "script_id": handler, "inbound_secret": null }))
         .await;
-    resp.assert_status(axum::http::StatusCode::BAD_REQUEST);
+    resp.assert_status(axum::http::StatusCode::UNPROCESSABLE_ENTITY);
 
     let resp = server
         .post(&format!("/api/v1/admin/apps/{app_id}/triggers/email"))
         .json(&json!({ "script_id": handler, "inbound_secret": "" }))
         .await;
-    resp.assert_status(axum::http::StatusCode::BAD_REQUEST);
+    resp.assert_status(axum::http::StatusCode::UNPROCESSABLE_ENTITY);
 
     let resp = server
         .post(&format!("/api/v1/admin/apps/{app_id}/triggers/email"))
         .json(&json!({ "script_id": handler, "inbound_secret": "   " }))
         .await;
-    resp.assert_status(axum::http::StatusCode::BAD_REQUEST);
+    resp.assert_status(axum::http::StatusCode::UNPROCESSABLE_ENTITY);
 }
 
 #[tokio::test]