diff --git a/haproxy-ddos-protection-configurator/pyproject.toml b/haproxy-ddos-protection-configurator/pyproject.toml
index 3fc674a20..5c1f513da 100644
--- a/haproxy-ddos-protection-configurator/pyproject.toml
+++ b/haproxy-ddos-protection-configurator/pyproject.toml
@@ -102,6 +102,10 @@ skip = "build,lib,venv,icon.svg,.tox,.git,.mypy_cache,.ruff_cache,.coverage,html
 [tool.pytest.ini_options]
 minversion = "6.0"
 log_cli_level = "INFO"
+# promote warnings to test failures
+filterwarnings = [
+  "error",
+]
 
 [tool.coverage.run]
 branch = true
diff --git a/haproxy-ddos-protection-configurator/tox.toml b/haproxy-ddos-protection-configurator/tox.toml
index ff5ea7786..c81661d9a 100644
--- a/haproxy-ddos-protection-configurator/tox.toml
+++ b/haproxy-ddos-protection-configurator/tox.toml
@@ -129,6 +129,8 @@ commands = [
     "--ignore={toxinidir}/haproxy-operator",
     "--log-cli-level=INFO",
     "-s",
+    # Don't promote warnings for integration tests
+    "--override-ini=filterwarnings=",
     { replace = "posargs", extend = "true" },
   ],
 ]
diff --git a/haproxy-operator/pyproject.toml b/haproxy-operator/pyproject.toml
index 80dc23d31..a2f35ead5 100644
--- a/haproxy-operator/pyproject.toml
+++ b/haproxy-operator/pyproject.toml
@@ -117,6 +117,10 @@ ignore-words-list = "iif"
 [tool.pytest.ini_options]
 minversion = "6.0"
 log_cli_level = "INFO"
+# promote warnings to test failures
+filterwarnings = [
+  "error",
+]
 
 [tool.coverage.run]
 branch = true
diff --git a/haproxy-operator/tests/unit/conftest.py b/haproxy-operator/tests/unit/conftest.py
index c6a4f7811..edd44036c 100644
--- a/haproxy-operator/tests/unit/conftest.py
+++ b/haproxy-operator/tests/unit/conftest.py
@@ -16,10 +16,6 @@
     CertificateRequestAttributes,
     CertificateSigningRequest,
     PrivateKey,
-    generate_ca,
-    generate_certificate,
-    generate_csr,
-    generate_private_key,
 )
 from charms.haproxy.v0.spoe_auth import SpoeAuthProviderAppData, SpoeAuthProviderUnitData
 from charms.haproxy.v1.haproxy_route_tcp import (
@@ -80,8 +76,12 @@ def mocks_tls_ca_write_fixture(monkeypatch: pytest.MonkeyPatch):
 @pytest.fixture(scope="function", name="ca_certificate_and_key")
 def ca_certificate_and_key_fixture() -> typing.Tuple[Certificate, PrivateKey]:
     """Ca Certificate and private key."""
-    private_key_ca = generate_private_key()
-    ca = generate_ca(generate_private_key(), timedelta(days=10), "caname")
+    private_key_ca = PrivateKey.generate()
+    ca = Certificate.generate_self_signed_ca(
+        CertificateRequestAttributes(common_name="caname", is_ca=True),
+        private_key_ca,
+        timedelta(days=10),
+    )
     return ca, private_key_ca
 
 
@@ -91,9 +91,12 @@ def csr_certificate_and_key_fixture(
 ) -> typing.Tuple[CertificateSigningRequest, Certificate, PrivateKey]:
     """Ca Certificate and private key."""
     ca, private_key_ca = ca_certificate_and_key
-    private_key = generate_private_key()
-    csr = generate_csr(private_key, TEST_EXTERNAL_HOSTNAME_CONFIG)
-    certificate = generate_certificate(csr, ca, private_key_ca, timedelta(days=5))
+    private_key = PrivateKey.generate()
+    csr_attributes = CertificateRequestAttributes(common_name=TEST_EXTERNAL_HOSTNAME_CONFIG)
+    csr = csr_attributes.generate_csr(private_key)
+    certificate = Certificate.generate(
+        csr=csr, ca=ca, ca_private_key=private_key_ca, validity=timedelta(days=5)
+    )
     return csr, certificate, private_key
 
 
diff --git a/haproxy-operator/tests/unit/legacy/test_ha.py b/haproxy-operator/tests/unit/legacy/test_ha.py
index 27489c80f..825627b19 100644
--- a/haproxy-operator/tests/unit/legacy/test_ha.py
+++ b/haproxy-operator/tests/unit/legacy/test_ha.py
@@ -8,6 +8,12 @@
 
 from state.ha import HACLUSTER_INTEGRATION, HAInformation, HAInformationValidationError
 
+# These legacy tests still use Harness, which ops marks as deprecated with a
+# PendingDeprecationWarning. The unit suite runs with warnings promoted to
+# errors (see pyproject.toml), so ignore that one warning here until the tests
+# are ported to ops.testing.Context like the rest of tests/unit.
+pytestmark = pytest.mark.filterwarnings("ignore:Harness is deprecated:PendingDeprecationWarning")
+
 
 def test_ha_information(harness: Harness):
     """
diff --git a/haproxy-operator/tests/unit/legacy/test_haproxy_route_lib.py b/haproxy-operator/tests/unit/legacy/test_haproxy_route_lib.py
index de9f445d0..378b9e2f5 100644
--- a/haproxy-operator/tests/unit/legacy/test_haproxy_route_lib.py
+++ b/haproxy-operator/tests/unit/legacy/test_haproxy_route_lib.py
@@ -26,6 +26,12 @@
 from ops.testing import Harness
 from pydantic import ValidationError
 
+# These legacy tests still use Harness, which ops marks as deprecated with a
+# PendingDeprecationWarning. The unit suite runs with warnings promoted to
+# errors (see pyproject.toml), so ignore that one warning here until the tests
+# are ported to ops.testing.Context like the rest of tests/unit.
+pytestmark = pytest.mark.filterwarnings("ignore:Harness is deprecated:PendingDeprecationWarning")
+
 logger = logging.getLogger()
 MOCK_RELATION_NAME = "haproxy-route"
 MOCK_ADDRESS = "10.0.0.1"
@@ -67,8 +73,10 @@ def mock_provider_app_data_fixture():
 
 @pytest.fixture(name="mock_requirer_charm")
 def mock_requirer_charm_fixture():
-    """Create mock unit data."""
-    return Harness(ops.CharmBase, meta=MOCK_REQUIRER_CHARM_META)
+    """Create a harness for a mock requirer charm and clean up its files afterwards."""
+    harness = Harness(ops.CharmBase, meta=MOCK_REQUIRER_CHARM_META)
+    yield harness
+    harness.cleanup()
 
 
 def test_requirer_application_data_validation():
diff --git a/haproxy-operator/tests/unit/legacy/test_tls_relation.py b/haproxy-operator/tests/unit/legacy/test_tls_relation.py
index d71358f15..9fbeb6f54 100644
--- a/haproxy-operator/tests/unit/legacy/test_tls_relation.py
+++ b/haproxy-operator/tests/unit/legacy/test_tls_relation.py
@@ -17,6 +17,12 @@
 from state.tls import HaproxyPeerRelationAppData, TLSInformation, TLSNotReadyError
 from tls_relation import TLSRelationService
 
+# These legacy tests still use Harness, which ops marks as deprecated with a
+# PendingDeprecationWarning. The unit suite runs with warnings promoted to
+# errors (see pyproject.toml), so ignore that one warning here until the tests
+# are ported to ops.testing.Context like the rest of tests/unit.
+pytestmark = pytest.mark.filterwarnings("ignore:Harness is deprecated:PendingDeprecationWarning")
+
 TEST_EXTERNAL_HOSTNAME_CONFIG = "haproxy.internal"
 
 
diff --git a/haproxy-operator/tox.toml b/haproxy-operator/tox.toml
index d58ca0a89..8b125fc4e 100644
--- a/haproxy-operator/tox.toml
+++ b/haproxy-operator/tox.toml
@@ -125,6 +125,8 @@ commands = [
     "--ignore={toxinidir}/haproxy_spoe_auth_operator",
     "--log-cli-level=INFO",
     "-s",
+    # Don't promote warnings for integration tests
+    "--override-ini=filterwarnings=",
     { replace = "posargs", extend = "true" },
   ],
 ]
diff --git a/haproxy-route-policy-operator/pyproject.toml b/haproxy-route-policy-operator/pyproject.toml
index 1ce0631ba..88c71f774 100644
--- a/haproxy-route-policy-operator/pyproject.toml
+++ b/haproxy-route-policy-operator/pyproject.toml
@@ -85,6 +85,13 @@ skip = "build,lib,venv,icon.svg,.tox,.git,.mypy_cache,.ruff_cache,.coverage,html
 [tool.pytest.ini_options]
 minversion = "6.0"
 log_cli_level = "INFO"
+# promote warnings to test failures
+filterwarnings = [
+  "error",
+  # Raised by the vendored data_platform_libs charm lib; the fix belongs
+  # upstream in canonical/data-platform-libs.
+  "ignore:JujuVersion.from_environ\\(\\) is deprecated:DeprecationWarning",
+]
 
 [tool.coverage.run]
 branch = true
diff --git a/haproxy-route-policy-operator/tox.toml b/haproxy-route-policy-operator/tox.toml
index d23cbc68a..14dc4b2d4 100644
--- a/haproxy-route-policy-operator/tox.toml
+++ b/haproxy-route-policy-operator/tox.toml
@@ -129,6 +129,8 @@ commands = [
     "--ignore={[vars]tst_path}unit",
     "--log-cli-level=INFO",
     "-s",
+    # Don't promote warnings for integration tests
+    "--override-ini=filterwarnings=",
     { replace = "posargs", extend = "true" },
   ],
 ]
diff --git a/haproxy-route-policy/haproxy_route_policy/test_settings.py b/haproxy-route-policy/haproxy_route_policy/test_settings.py
index 91c46a6cc..51aa80bd5 100644
--- a/haproxy-route-policy/haproxy_route_policy/test_settings.py
+++ b/haproxy-route-policy/haproxy_route_policy/test_settings.py
@@ -21,3 +21,9 @@
         "rest_framework.permissions.AllowAny",
     ],
 }
+
+# The tests run without `collectstatic`, so STATIC_ROOT does not exist and
+# WhiteNoise would warn "No directory at ..." when its middleware starts. The
+# unit tox envs promote warnings to errors, so serve static files on demand
+# instead of from a pre-collected directory.
+WHITENOISE_AUTOREFRESH = True
diff --git a/haproxy-route-policy/haproxy_route_policy/test_settings_authenticated.py b/haproxy-route-policy/haproxy_route_policy/test_settings_authenticated.py
index c3090bfc0..caad4415b 100644
--- a/haproxy-route-policy/haproxy_route_policy/test_settings_authenticated.py
+++ b/haproxy-route-policy/haproxy_route_policy/test_settings_authenticated.py
@@ -14,3 +14,9 @@
         "NAME": ":memory:",
     }
 }
+
+# The tests run without `collectstatic`, so STATIC_ROOT does not exist and
+# WhiteNoise would warn "No directory at ..." when its middleware starts. The
+# unit tox envs promote warnings to errors, so serve static files on demand
+# instead of from a pre-collected directory.
+WHITENOISE_AUTOREFRESH = True
diff --git a/haproxy-route-policy/tox.toml b/haproxy-route-policy/tox.toml
index 3923feee0..cb3ca75a3 100644
--- a/haproxy-route-policy/tox.toml
+++ b/haproxy-route-policy/tox.toml
@@ -18,8 +18,15 @@ PY_COLORS = "1"
 
 [env.unit]
 description = "Run unit tests"
+# -W error promotes every Python warning to a test failure, mirroring the
+# filterwarnings = ["error"] setting the charms in this repository use with
+# pytest; Django's test runner has no equivalent setting of its own.
 commands = [
   [
+    "python",
+    "-W",
+    "error",
+    "-m",
     "coverage",
     "run",
     "manage.py",
@@ -37,6 +44,10 @@ dependency_groups = ["unit"]
 description = "Run auth unit tests"
 commands = [
   [
+    "python",
+    "-W",
+    "error",
+    "-m",
     "coverage",
     "run",
     "manage.py",
diff --git a/haproxy-spoe-auth-operator/pyproject.toml b/haproxy-spoe-auth-operator/pyproject.toml
index 01e371756..03a914bad 100644
--- a/haproxy-spoe-auth-operator/pyproject.toml
+++ b/haproxy-spoe-auth-operator/pyproject.toml
@@ -114,6 +114,10 @@ skip = "build,lib,venv,icon.svg,.tox,.git,.mypy_cache,.ruff_cache,.coverage,html
 [tool.pytest.ini_options]
 minversion = "6.0"
 log_cli_level = "INFO"
+# promote warnings to test failures
+filterwarnings = [
+  "error",
+]
 
 [tool.coverage.run]
 branch = true
diff --git a/haproxy-spoe-auth-operator/tox.toml b/haproxy-spoe-auth-operator/tox.toml
index 7529f9110..e82ed1672 100644
--- a/haproxy-spoe-auth-operator/tox.toml
+++ b/haproxy-spoe-auth-operator/tox.toml
@@ -120,6 +120,8 @@ commands = [
     "--ignore={[vars]tst_path}unit",
     "--log-cli-level=INFO",
     "-s",
+    # Don't promote warnings for integration tests
+    "--override-ini=filterwarnings=",
     { replace = "posargs", extend = "true" },
   ],
 ]