diff --git a/internal/auth/oidc_test.go b/internal/auth/oidc_test.go
index 131e616b..4c9dc6bb 100644
--- a/internal/auth/oidc_test.go
+++ b/internal/auth/oidc_test.go
@@ -15,6 +15,7 @@ import (
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/yusing/godoxy/internal/common"
 	"golang.org/x/oauth2"
+	"golang.org/x/time/rate"
 
 	expect "github.com/yusing/goutils/testing"
 )
@@ -42,6 +43,7 @@ func setupMockOIDC(t *testing.T) {
 		}),
 		allowedUsers:  []string{"test-user"},
 		allowedGroups: []string{"test-group1", "test-group2"},
+		rateLimit:     rate.NewLimiter(rate.Every(common.OIDCRateLimitPeriod), common.OIDCRateLimit),
 	}
 }
 
diff --git a/internal/net/gphttp/middleware/bypass_test.go b/internal/net/gphttp/middleware/bypass_test.go
index 4a13d6d2..b4a72f45 100644
--- a/internal/net/gphttp/middleware/bypass_test.go
+++ b/internal/net/gphttp/middleware/bypass_test.go
@@ -106,7 +106,7 @@ func TestReverseProxyBypass(t *testing.T) {
 	rp := reverseproxy.NewReverseProxy("test", url, fakeRoundTripper{})
 	err = PatchReverseProxy(rp, map[string]OptionsRaw{
 		"response": {
-			"bypass": "path glob(/test/*) | path /api",
+			"bypass": []string{"path glob(/test/*)", "path /api"},
 			"set_headers": map[string]string{
 				"Test-Header": "test-value",
 			},
diff --git a/internal/route/route.go b/internal/route/route.go
index 50e6d92a..ef5cec60 100644
--- a/internal/route/route.go
+++ b/internal/route/route.go
@@ -788,6 +788,15 @@ func (r *Route) Finalize() {
 	}
 
 	r.Port.Listening, r.Port.Proxy = lp, pp
+
+	workingState := config.WorkingState.Load()
+	if workingState == nil {
+		if common.IsTest { // in tests, working state might be nil
+			return
+		}
+		panic("bug: working state is nil")
+	}
+
 	r.HealthCheck.ApplyDefaults(config.WorkingState.Load().Value().Defaults.HealthCheck)
 }
 
diff --git a/internal/route/rules/do_log_test.go b/internal/route/rules/do_log_test.go
index 94839441..b21b1956 100644
--- a/internal/route/rules/do_log_test.go
+++ b/internal/route/rules/do_log_test.go
@@ -270,7 +270,7 @@ func TestLogCommand_ConditionalLogging(t *testing.T) {
 	errorContent, err := os.ReadFile(errorFile.Name())
 	require.NoError(t, err)
 	errorLines := strings.Split(strings.TrimSpace(string(errorContent)), "\n")
-	assert.Len(t, errorLines, 2)
+	require.Len(t, errorLines, 2)
 	assert.Equal(t, "ERROR: GET /notfound 404", errorLines[0])
 	assert.Equal(t, "ERROR: POST /error 500", errorLines[1])
 }
@@ -368,7 +368,7 @@ func TestLogCommand_FilePermissions(t *testing.T) {
 	logContent := strings.TrimSpace(string(content))
 	lines := strings.Split(logContent, "\n")
 
-	assert.Len(t, lines, 2)
+	require.Len(t, lines, 2)
 	assert.Equal(t, "GET 200", lines[0])
 	assert.Equal(t, "POST 200", lines[1])
 }
diff --git a/internal/types/docker_provider_config_test.go b/internal/types/docker_provider_config_test.go
index 3339556a..093c7b32 100644
--- a/internal/types/docker_provider_config_test.go
+++ b/internal/types/docker_provider_config_test.go
@@ -1,7 +1,6 @@
 package types
 
 import (
-	"os"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -27,7 +26,7 @@ test:
     ca_file: /etc/ssl/ca.crt
     cert_file: /etc/ssl/cert.crt
     key_file: /etc/ssl/key.crt`), &cfg)
-		assert.Error(t, err, os.ErrNotExist)
+		assert.NoError(t, err)
 		assert.Equal(t, &DockerProviderConfig{URL: "http://localhost:2375", TLS: &DockerTLSConfig{CAFile: "/etc/ssl/ca.crt", CertFile: "/etc/ssl/cert.crt", KeyFile: "/etc/ssl/key.crt"}}, cfg["test"])
 	})
 }