diff --git a/modules/mesh-build-node/cmd/mesh-build-node/fetch_test.go b/modules/mesh-build-node/cmd/mesh-build-node/fetch_test.go
index fc8251c1e..9571a76d6 100644
--- a/modules/mesh-build-node/cmd/mesh-build-node/fetch_test.go
+++ b/modules/mesh-build-node/cmd/mesh-build-node/fetch_test.go
@@ -207,9 +207,7 @@ func TestAnotherNovoxPackageIsInstalledFromTheRegistryThroughAUserconfig(t *test
 	files := typeScriptModule(`{"dependencies":{"@novox/other":"^1","lodash":"^4"}}`)
 	files["modules/m/package-lock.json"] = `{}`
 	m, f := fetchMachine(t, files, map[string]string{"@novox/other/index.js": "o", "lodash/index.js": "l"})
-	m.Toolchain.Registry = func() (Registry, error) {
-		return Registry{URL: "https://git.novox.be/api/packages/novox/npm/"}, nil
-	}
+	reg, _ := m.Toolchain.Registry()
 	var npmrc string
 	inner := f.effect
 	f.effect = func(c call) {
@@ -226,7 +224,7 @@ func TestAnotherNovoxPackageIsInstalledFromTheRegistryThroughAUserconfig(t *test
 		t.Fatal(err)
 	}
 	// Reads are anonymous (ADR 0346, CAT-BN3): the config names the scope's registry and no credential.
-	if !strings.Contains(npmrc, "@novox:registry=https://git.novox.be/api/packages/novox/npm/") || strings.Contains(npmrc, "_auth") {
+	if !strings.Contains(npmrc, "@novox:registry="+reg.URL+"\n") || strings.Contains(npmrc, "_auth") {
 		t.Errorf("npm ci was given the config %q", npmrc)
 	}
 	r := out.(FetchResult)
diff --git a/modules/mesh-build-node/cmd/mesh-build-node/harness_test.go b/modules/mesh-build-node/cmd/mesh-build-node/harness_test.go
index abd3a634d..86d4ad4a5 100644
--- a/modules/mesh-build-node/cmd/mesh-build-node/harness_test.go
+++ b/modules/mesh-build-node/cmd/mesh-build-node/harness_test.go
@@ -73,10 +73,11 @@ func newMachine(t *testing.T) (*Module, *fakeMachine, string) {
 	home, cache, work := t.TempDir(), t.TempDir(), t.TempDir()
 	f := &fakeMachine{now: time.Unix(1_000_000, 0), cost: map[string]time.Duration{}, answer: map[string]forgekey.Ran{}}
 	m := &Module{Node: "ace", Recipe: Recipe{Steps: "1", Lock: "lock"},
-		Toolchain: &Toolchain{Paths: Paths{Home: home, Cache: cache}, Registry: func() (Registry, error) {
-			return Registry{URL: "https://git.novox.be/api/packages/novox/npm/"}, nil
-		}},
-		Work: work, Clock: f.clock, Ctx: context.Background()}
+		Toolchain: &Toolchain{Paths: Paths{Home: home, Cache: cache}},
+		Work:      work, Clock: f.clock, Ctx: context.Background()}
+	// A test never reaches the network: the registry is a stand-in of the test's own, holding one release of the SDK
+	// (every TypeScript module of a fetch gets the latest, ADR 0573 §2); a test that needs another calls fakeRegistry.
+	fakeRegistry(t, m, map[string][]byte{"0.1.15": tgzOf(t, sdkPackage, "0.1.15")})
 	// A run step's commands run in bubblewrap (1309); the fake reads each back and runs its command.
 	m.Run = throughBubblewrap(t, f.run, &f.shut)
 	withStore(t, m) // a build pushes its bundle to a store of the test's own (ADR 0498)