diff --git a/tests/test_app.py b/tests/test_app.py
index 1b0f3bf..e9960d4 100644
--- a/tests/test_app.py
+++ b/tests/test_app.py
@@ -42,7 +42,7 @@ def test_health_exposes_current_version():
     with TestClient(app.app) as client:
         response = client.get("/health")
     assert response.status_code == 200
-    assert response.json()["version"] == app.VERSION == "2.3.4"
+    assert response.json()["version"] == app.VERSION == "2.3.5"
 
 
 def test_sysctl_audit_reads_fixed_keys_from_inventory_host(monkeypatch):
@@ -108,7 +108,7 @@ def test_inventory_upsert_uses_base64_script(monkeypatch):
     assert "\\nname =" not in calls[0][1]
 
 
-def test_ansible_run_supports_safe_tune_action_and_syncs_git(monkeypatch):
+def test_ansible_run_supports_safe_tune_action_and_syncs_approved_files(monkeypatch):
     calls = []
 
     def fake_ssh(host, command, timeout=600):
@@ -124,7 +124,9 @@ def test_ansible_run_supports_safe_tune_action_and_syncs_git(monkeypatch):
         )
     assert response.status_code == 200
     assert response.json()["action"] == "tune"
-    assert "git pull --ff-only origin master" in calls[0][1]
+    assert "git fetch origin master" in calls[0][1]
+    assert "git show origin/master:roles/sysctl/tasks/main.yml" in calls[0][1]
+    assert "git pull --ff-only" not in calls[0][1]
     assert "bash pfannkuchen.sh tune emby-sascha" in calls[0][1]
     assert len(calls) == 1