diff --git a/src/db.rs b/src/db.rs
index 5238c04..8ace052 100644
--- a/src/db.rs
+++ b/src/db.rs
@@ -441,7 +441,10 @@ mod tests {
         let r = db.rotate_key_sealed("g1", b"spki-2", |_id| Err("seal boom".to_string()));
         assert!(r.is_err());
 
-        let after = db.active_key("g1").unwrap().expect("original key still active");
+        let after = db
+            .active_key("g1")
+            .unwrap()
+            .expect("original key still active");
         assert_eq!(after.key_id, before.key_id, "the original key stays active");
         let opened = kek.open("g1", after.key_id, &after.sealed_pkcs8).unwrap();
         assert_eq!(opened, b"secret-1");
diff --git a/tests/at_rest.rs b/tests/at_rest.rs
index a85cb2c..589864f 100644
--- a/tests/at_rest.rs
+++ b/tests/at_rest.rs
@@ -37,9 +37,11 @@ async fn private_key_is_ciphertext_at_rest() {
             res.status() == 202 || res.status() == 200,
             "POST /key should enqueue (202) or be already-ready (200)"
         );
-        // Poll until ready (generous ceiling for slow release keygen).
+        // Poll until ready. Ceiling 3600 x 100ms ~ 360s: 2048-bit safe-prime
+        // keygen is high-variance and a single key has taken ~50s on a slow
+        // shared CI runner; the poll exits as soon as the key is ready.
         let mut ready = false;
-        for _ in 0..1200 {
+        for _ in 0..3600 {
             let res = client
                 .get(format!("{base}/key?group_id={g}"))
                 .send()
diff --git a/tests/issuance.rs b/tests/issuance.rs
index 5533573..3f1ce0c 100644
--- a/tests/issuance.rs
+++ b/tests/issuance.rs
@@ -26,8 +26,14 @@ fn info(version: &str) -> Vec<u8> {
 
 /// Fetch the active public key, polling `GET /key` until the async keygen
 /// reports the key ready. The first call typically returns 202 pending.
+///
+/// Ceiling 3600 x 100ms ~ 360s: all five tests here run in parallel, each with
+/// its own 2048-bit safe-prime keygen (the scheme rejects smaller moduli), so
+/// on a slow shared CI runner a single key can take minutes to come ready. The
+/// poll exits as soon as the key is ready; the ceiling only spends wall clock
+/// on degraded runners instead of failing.
 async fn fetch_pubkey(client: &reqwest::Client, base: &str, group: &str) -> PubKey {
-    for _ in 0..1200 {
+    for _ in 0..3600 {
         let res = client
             .get(format!("{base}/key?group_id={group}"))
             .send()
diff --git a/tests/keygen_dos.rs b/tests/keygen_dos.rs
index fee44d6..bdb0c28 100644
--- a/tests/keygen_dos.rs
+++ b/tests/keygen_dos.rs
@@ -25,8 +25,16 @@ use std::time::Duration;
 const FAST_BITS: usize = 1024;
 
 /// Poll `GET /key` until ready (200) or timeout. Returns the final status code.
+///
+/// The ceiling (3600 x 100ms ~ 360s) matches the other integration suites
+/// (at_rest, issuance): safe-prime keygen is high-variance, the binary runs its
+/// tests in parallel, and shared CI runners are slow, so many concurrent
+/// keygens contending for a few vCPUs can legitimately take minutes. The poll
+/// exits as soon as the key is ready, so the ceiling costs nothing on a healthy
+/// run. The DoS bound is asserted by the immediate 200/202 responses, not by
+/// this eventual-readiness poll, so a generous ceiling weakens nothing.
 async fn poll_until_ready(client: &reqwest::Client, base: &str, group: &str) -> bool {
-    for _ in 0..600 {
+    for _ in 0..3600 {
         let res = client
             .get(format!("{base}/key?group_id={group}"))
             .send()
@@ -37,7 +45,7 @@ async fn poll_until_ready(client: &reqwest::Client, base: &str, group: &str) ->
             assert_eq!(body["status"], "ready");
             return true;
         }
-        tokio::time::sleep(Duration::from_millis(25)).await;
+        tokio::time::sleep(Duration::from_millis(100)).await;
     }
     false
 }