diff --git a/tests/conf.bats b/tests/conf.bats
index 60487c9..5511127 100644
--- a/tests/conf.bats
+++ b/tests/conf.bats
@@ -250,8 +250,8 @@ exit 0'
     # The fragment is content, not code, so it is asserted here: this is the
     # one line the PostgreSQL appliance got wrong (docs/traps.md).
     grep -qx 'bind ::1 127.0.0.1' "$REDIS_CONF_D/10-keel-bind.conf"
-    ! grep -qE '^bind .*localhost' "$REDIS_CONF_D/10-keel-bind.conf"
-    ! grep -qE '^bind .*-::1' "$REDIS_CONF_D/10-keel-bind.conf"
+    run ! grep -qE '^bind .*localhost' "$REDIS_CONF_D/10-keel-bind.conf"
+    run ! grep -qE '^bind .*-::1' "$REDIS_CONF_D/10-keel-bind.conf"
 }
 
 @test "the acl fragment declares one user, and it is not the administrative one" {
@@ -260,9 +260,9 @@ exit 0'
     # it is declared once, at the first boot, or not at all.
     grep -qx 'user default on nopass +info' "$REDIS_CONF_D/20-keel-acl.conf"
     [ "$(grep -c '^user ' "$REDIS_CONF_D/20-keel-acl.conf")" -eq 1 ]
-    ! grep -qE '^user admin' "$REDIS_CONF_D/20-keel-acl.conf"
-    ! grep -qE '^requirepass' "$REDIS_CONF_D/20-keel-acl.conf"
-    ! grep -qE '^user default .*\+@all' "$REDIS_CONF_D/20-keel-acl.conf"
+    run ! grep -qE '^user admin' "$REDIS_CONF_D/20-keel-acl.conf"
+    run ! grep -qE '^requirepass' "$REDIS_CONF_D/20-keel-acl.conf"
+    run ! grep -qE '^user default .*\+@all' "$REDIS_CONF_D/20-keel-acl.conf"
 }
 
 @test "no account is declared twice, which Redis refuses outright" {
diff --git a/tests/hook.bats b/tests/hook.bats
index 899e7cb..fdbc322 100644
--- a/tests/hook.bats
+++ b/tests/hook.bats
@@ -99,7 +99,7 @@ write_conf() {
     write_conf
     run "$HOOK"
     [ "$status" -eq 0 ]
-    ! grep -rq "$DECLARED_PASS" "$REDIS_CONF_D"
+    run ! grep -rq "$DECLARED_PASS" "$REDIS_CONF_D"
 }
 
 @test "the password never reaches a command line either" {
@@ -108,7 +108,7 @@ write_conf() {
     [ "$status" -eq 0 ]
     # It is in the environment of the recorded call and in no argument.
     grep -q "REDISCLI_AUTH=$DECLARED_PASS" "$CALLS"
-    ! grep -E "^redis-cli .*$DECLARED_PASS.* REDISCLI_AUTH" "$CALLS"
+    run ! grep -E "^redis-cli .*$DECLARED_PASS.* REDISCLI_AUTH" "$CALLS"
 }
 
 @test "the fragment is not readable by everybody" {
diff --git a/tests/unit.bats b/tests/unit.bats
index 4442341..ec416c1 100644
--- a/tests/unit.bats
+++ b/tests/unit.bats
@@ -9,6 +9,8 @@
 # one variable per line and fab refuses anything that is not a variable
 # name; the version is a single token the layer manifest can carry.
 
+bats_require_minimum_version 1.5.0
+
 setup() {
     unit="$(cd "$BATS_TEST_DIRNAME/.." && pwd)"
 }
@@ -28,7 +30,7 @@ setup() {
     # reads none, and a dead interface is not carried (the same reasoning
     # unit-mariadb records for MYSQL_PASS).
     [ ! -e "$unit/conf-vars" ]
-    ! grep -qE '\$\{?(REDIS_PASS|APP_PASS|DB_PASS)' "$unit/conf"
+    run ! grep -qE '\$\{?(REDIS_PASS|APP_PASS|DB_PASS)' "$unit/conf"
 }
 
 @test "the version is one line a layer manifest can carry" {
@@ -74,6 +76,6 @@ setup() {
 @test "the component writes no password anywhere in the tree it ships" {
     # The one property the whole design rests on: what lands on the machine
     # is a digest. A requirepass line anywhere here would undo it.
-    ! grep -rqE '^[[:space:]]*requirepass' "$unit/overlay"
-    ! grep -rq 'masterauth' "$unit/overlay"
+    run ! grep -rqE '^[[:space:]]*requirepass' "$unit/overlay"
+    run ! grep -rq 'masterauth' "$unit/overlay"
 }