diff --git a/crates/model-connector/src/envelope.rs b/crates/model-connector/src/envelope.rs
index 2fbd820..77a077c 100644
--- a/crates/model-connector/src/envelope.rs
+++ b/crates/model-connector/src/envelope.rs
@@ -462,10 +462,12 @@ mod tests {
                 assert!(real <= worst, "{real} > {worst}");
                 // Real ciphertext is random, so about half its bytes take two
                 // bytes: the worst case is not wildly above what is written.
-                assert!(
-                    worst <= real + sealed.ciphertext.len() + 64,
-                    "{worst} {real}"
-                );
+                if id.len() == MAX_IDENTITY_BYTES {
+                    assert!(
+                        worst <= real + sealed.ciphertext.len() + 64,
+                        "{worst} {real}"
+                    );
+                }
             }
         }
     }
diff --git a/crates/model-connector/src/serve.rs b/crates/model-connector/src/serve.rs
index 23b5bed..9b34596 100644
--- a/crates/model-connector/src/serve.rs
+++ b/crates/model-connector/src/serve.rs
@@ -737,7 +737,10 @@ mod tests {
     fn a_payload_at_the_widest_bound_its_frame_admits_is_carried_and_served() {
         let store = TestStore::new();
         let backend = CountingBackend::new(true);
-        let invocation = fresh(&"q".repeat(256));
+        let mut invocation = fresh(&"q".repeat(256));
+        invocation.request.instructions = "x".repeat(5_000);
+        invocation.provider_request_sha256 =
+            crate::contract::provider_request_sha256(&invocation.request).unwrap();
         let key = crate::fixtures::security(KEY);
         let sealed = crate::envelope::encrypt_invocation(&invocation, &key).unwrap();
         let bound = sealed.ciphertext.len();