diff --git a/testing/docker/Dockerfile b/testing/docker/Dockerfile
index bacd89a..7247133 100644
--- a/testing/docker/Dockerfile
+++ b/testing/docker/Dockerfile
@@ -39,6 +39,11 @@ RUN printf '%s\n' \
 COPY fips fipsctl fipstop fips-gateway /usr/local/bin/
 RUN chmod +x /usr/local/bin/fips /usr/local/bin/fipsctl /usr/local/bin/fipstop /usr/local/bin/fips-gateway
 
+# Mirror systemd's RuntimeDirectory=fips so the daemon's resolver picks
+# /run/fips/control.sock — matches production layout and the chaos sim
+# harness probe path (testing/chaos/sim/control.py).
+RUN mkdir -p /run/fips
+
 # Static web page for HTTP server (chaos/static modes)
 RUN printf 'Fuck IPs!\n' > /root/index.html
 
diff --git a/testing/firewall/test.sh b/testing/firewall/test.sh
index 75c758f..e21432f 100755
--- a/testing/firewall/test.sh
+++ b/testing/firewall/test.sh
@@ -238,7 +238,7 @@ fi
 # ── Drop-counter sanity ────────────────────────────────────────────────
 log "Drop counter incremented (case a should have ticked it)"
 DROP_PKTS="$(docker exec "$CONTAINER_B" nft list table inet fips \
-    | awk '/counter packets/ {print $3; exit}')"
+    | awk '/counter packets/ && !seen { print $3; seen=1 }')"
 if [ -z "${DROP_PKTS:-}" ] || [ "$DROP_PKTS" -lt 1 ]; then
     fail "drop counter is $DROP_PKTS — case (a) should have produced drops"
 fi