diff --git a/tests/e2e/dashboard.spec.ts b/tests/e2e/dashboard.spec.ts
index f9c6052a..cd4fa473 100644
--- a/tests/e2e/dashboard.spec.ts
+++ b/tests/e2e/dashboard.spec.ts
@@ -15,10 +15,10 @@ test.describe('Dashboard home page', () => {
   });
 
   test('shows stat cards for Proxy Hosts, Certificates, and Access Lists', async ({ page }) => {
-    // Stat card labels are inside <p> tags — use exact text to avoid matching nav items
-    await expect(page.locator('p', { hasText: 'Proxy Hosts' })).toBeVisible();
-    await expect(page.locator('p', { hasText: 'Certificates' })).toBeVisible();
-    await expect(page.locator('p', { hasText: 'Access Lists' })).toBeVisible();
+    // Stat card labels are <p> inside link cards — match via the parent link
+    await expect(page.getByRole('link', { name: /\d+\s*Proxy Hosts/ })).toBeVisible();
+    await expect(page.getByRole('link', { name: /\d+\s*Certificates/ })).toBeVisible();
+    await expect(page.getByRole('link', { name: /\d+\s*Access Lists/ })).toBeVisible();
   });
 
   test('shows Traffic (24h) card', async ({ page }) => {
diff --git a/tests/e2e/role-access.spec.ts b/tests/e2e/role-access.spec.ts
index c6e141b6..51d6a51b 100644
--- a/tests/e2e/role-access.spec.ts
+++ b/tests/e2e/role-access.spec.ts
@@ -47,16 +47,14 @@ const ALL_DASHBOARD_PAGES = [...USER_ACCESSIBLE_PAGES, ...ADMIN_ONLY_PAGES];
 
 /**
  * Create a test user inside the running web container using bun.
- * Uses bcrypt to hash the password (same as the app does).
+ * Uses Bun's built-in Bun.password.hash (bcrypt) — no npm deps needed.
  */
 function ensureTestUser(username: string, password: string, role: string) {
-  // Bun uses ESM by default — use import() for bcryptjs
   const script = `
     import { Database } from "bun:sqlite";
-    import bcrypt from "bcryptjs";
     const db = new Database("./data/caddy-proxy-manager.db");
     const email = "${username}@localhost";
-    const hash = bcrypt.hashSync("${password}", 12);
+    const hash = await Bun.password.hash("${password}", { algorithm: "bcrypt", cost: 12 });
     const now = new Date().toISOString();
     const existing = db.query("SELECT id FROM users WHERE email = ?").get(email);
     if (existing) {