diff --git a/CHANGELOG.md b/CHANGELOG.md
index ac49649..9874212 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -200,6 +200,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   responder now binds `::` (dual-stack) instead of `127.0.0.1` so
   systemd-resolved's interface-scoped routing via fips0 reaches
   it. DNS queries are accepted only from the localhost.
+- Make the tree ancestry acceptance unit test deterministic.
+  `test_tree_announce_validate_semantics_accepts_valid_non_root`
+  generated a random signing identity while pinning the fixed root
+  to `node_addr[0] = 0x01`; about 2 in 256 random identities were
+  numerically smaller than the claimed root, triggering
+  `AncestryRootNotMinimum`. The test now regenerates the identity
+  until its `node_addr` is strictly larger than both the fixed
+  parent and root.
 
 ## [0.2.0] - 2026-03-22
 
diff --git a/src/protocol/tree.rs b/src/protocol/tree.rs
index 1f0d54e..4255c81 100644
--- a/src/protocol/tree.rs
+++ b/src/protocol/tree.rs
@@ -439,7 +439,15 @@ mod tests {
     fn test_tree_announce_validate_semantics_accepts_valid_non_root() {
         use crate::identity::Identity;
 
-        let identity = Identity::generate();
+        // Regenerate until the random identity's node_addr is numerically
+        // larger than both fixed parent (02:..) and root (01:..), so the
+        // root-minimum invariant holds deterministically.
+        let identity = loop {
+            let id = Identity::generate();
+            if id.node_addr().as_bytes()[0] > 1 {
+                break id;
+            }
+        };
         let node_addr = *identity.node_addr();
         let parent = make_node_addr(2);
         let root = make_node_addr(1);