diff --git a/tests/test_app.py b/tests/test_app.py
index df4c85f..ba473b0 100644
--- a/tests/test_app.py
+++ b/tests/test_app.py
@@ -42,7 +42,32 @@ def test_health_exposes_current_version():
     with TestClient(app.app) as client:
         response = client.get("/health")
     assert response.status_code == 200
-    assert response.json()["version"] == app.VERSION == "2.3.2"
+    assert response.json()["version"] == app.VERSION == "2.3.3"
+
+
+def test_sysctl_audit_reads_fixed_keys_from_inventory_host(monkeypatch):
+    payload = {
+        "live": {"net.ipv4.tcp_congestion_control": "bbr"},
+        "persistent": {"net.ipv4.tcp_congestion_control": [{"file": "/etc/sysctl.d/99-net-tuning.conf", "value": "bbr"}]},
+        "errors": {},
+    }
+    calls = []
+    monkeypatch.setattr(app, "_find_inventory_host", lambda name: {"name": name, "user": "root", "ip": "10.5.85.16"})
+    monkeypatch.setattr(app, "_ssh", lambda host, command, timeout=600: (calls.append((host, command, timeout)) or (0, __import__("json").dumps(payload), "")))
+    with TestClient(app.app) as client:
+        response = client.get("/system/sysctl/node6", headers={"Authorization": "Bearer test-token"})
+    assert response.status_code == 200
+    assert response.json()["live"]["net.ipv4.tcp_congestion_control"] == "bbr"
+    assert calls[0][0] == "root@10.5.85.16"
+    assert "base64.b64decode" in calls[0][1]
+
+
+def test_sysctl_audit_rejects_unknown_host_without_ssh(monkeypatch):
+    monkeypatch.setattr(app, "_find_inventory_host", lambda _name: None)
+    monkeypatch.setattr(app, "_ssh", lambda *_args, **_kwargs: (_ for _ in ()).throw(AssertionError("must not SSH")))
+    with TestClient(app.app) as client:
+        response = client.get("/system/sysctl/not-there", headers={"Authorization": "Bearer test-token"})
+    assert response.status_code == 404
 
 
 def test_invalid_log_target_is_rejected_before_ssh():