diff --git a/COVERAGE.md b/COVERAGE.md
index da242480..48dbaf36 100644
--- a/COVERAGE.md
+++ b/COVERAGE.md
@@ -53,9 +53,11 @@ not the last command of its test passes whatever happens; as the last
 command it does decide the test, because bats takes the last status as the
 verdict. `run !` asserts wherever it stands, which is why it is the
 convention. shellcheck grades the two cases differently: SC2314 is an error
-for the inert one and a note otherwise. Of the three bare negations in
-`tests/postfix-local.bats`, only line 96 is inert; lines 66 and 97 are last
-in their tests. It is left for the pull request that owns that file.
+for the inert one and a note otherwise. `tests/postfix-local.bats` had three
+bare negations: line 96 was inert and lines 66 and 97 did assert, because
+they were last. All three are `run !` now, so none of them depends on its
+position, and the check runs for every repository in the reusable
+`test-shell` workflow.
 
 ## Baseline before the merge: 0 percent, nothing measured
 
diff --git a/tests/postfix-local.bats b/tests/postfix-local.bats
index 1c2cb065..39dcdb14 100644
--- a/tests/postfix-local.bats
+++ b/tests/postfix-local.bats
@@ -5,6 +5,8 @@
 # tests/stubs that record their arguments in STUB_LOG; the script never
 # reaches the real postfix or systemd.
 
+bats_require_minimum_version 1.5.0
+
 setup() {
     TESTS_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")" && pwd)"
     SCRIPT="$TESTS_DIR/../conf/turnkey.d/postfix-local"
@@ -63,7 +65,7 @@ LISTEN 0      100    [2001:db8::25]:25   [::]:*            users:((\"master\",pi
     run "$SCRIPT"
     [ "$status" -eq 1 ]
     [[ "$output" == *"Port 25 is already in use"* ]]
-    ! logged postconf
+    run ! logged postconf
 }
 
 @test "configures postfix when port 25 is free" {
@@ -93,6 +95,6 @@ EXPECTED
     run "$SCRIPT"
     [ "$status" -eq 1 ]
     logged "postconf -e myhostname=mail.example.com"
-    ! logged smtpd_banner
-    ! logged postmulti
+    run ! logged smtpd_banner
+    run ! logged postmulti
 }