diff --git a/.bazelrc b/.bazelrc
index 14b941c263..b62d2d0fcc 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -109,6 +109,8 @@ common:remote --jobs=800
 common:ci --remote_download_minimal
 common:ci --keep_going
 common:ci --verbose_failures
+# A failed snapshot assertion should print its diff without leaving a .snap.new after a passing retry.
+test:ci --test_env=INSTA_UPDATE=no
 common:ci --build_metadata=REPO_URL=https://github.com/openai/codex.git
 common:ci --build_metadata=ROLE=CI
 common:ci --build_metadata=VISIBILITY=PUBLIC
diff --git a/.github/scripts/run-bazel-ci.sh b/.github/scripts/run-bazel-ci.sh
index 89f937a998..07fa1ffe7b 100755
--- a/.github/scripts/run-bazel-ci.sh
+++ b/.github/scripts/run-bazel-ci.sh
@@ -388,6 +388,9 @@ if [[ -n "${BUILDBUDDY_API_KEY:-}" ]]; then
   bazel_run_args+=("--config=${ci_config}")
 else
   echo "BuildBuddy API key is not available; using local Bazel configuration."
+  if [[ "${bazel_args[0]}" == "test" ]]; then
+    bazel_run_args+=("--test_env=INSTA_UPDATE=no")
+  fi
 fi
 if (( ${#post_config_bazel_args[@]} > 0 )); then
   bazel_run_args+=("${post_config_bazel_args[@]}")
diff --git a/codex-rs/otel/tests/suite/otlp_http_loopback.rs b/codex-rs/otel/tests/suite/otlp_http_loopback.rs
index 1548b88c87..44b73bd898 100644
--- a/codex-rs/otel/tests/suite/otlp_http_loopback.rs
+++ b/codex-rs/otel/tests/suite/otlp_http_loopback.rs
@@ -640,12 +640,37 @@ async fn otlp_http_exporter_sends_traces_to_collector_with_bounded_shutdown_in_t
     let addr = listener.local_addr().expect("local_addr");
     listener.set_nonblocking(true).expect("set_nonblocking");
 
+    let otel = OtelProvider::try_new(&OtelSettings {
+        http_client_factory: HttpClientFactory::new(OutboundProxyPolicy::ReqwestDefault),
+        environment: "test".to_string(),
+        service_name: "codex-cli".to_string(),
+        service_version: env!("CARGO_PKG_VERSION").to_string(),
+        codex_home: PathBuf::from("."),
+        exporter: OtelExporter::None,
+        trace_exporter: OtelExporter::OtlpHttp {
+            endpoint: format!("http://{addr}/v1/traces"),
+            headers: HashMap::new(),
+            protocol: OtelHttpProtocol::Json,
+            tls: None,
+        },
+        metrics_exporter: OtelExporter::None,
+        runtime_metrics: false,
+        span_attributes: HashMap::new(),
+        tracestate: BTreeMap::new(),
+    })?
+    .expect("otel provider");
     let (tx, rx) = mpsc::channel::<Vec<CapturedRequest>>();
+    let (stop_tx, stop_rx) = mpsc::channel();
     let server = thread::spawn(move || {
         let mut captured = Vec::new();
         let deadline = Instant::now() + Duration::from_secs(3);
 
         while Instant::now() < deadline {
+            match stop_rx.try_recv() {
+                Ok(()) | Err(mpsc::TryRecvError::Disconnected) => break,
+                Err(mpsc::TryRecvError::Empty) => {}
+            }
+
             match listener.accept() {
                 Ok((mut stream, _)) => {
                     let result = read_http_request(&mut stream);
@@ -667,26 +692,6 @@ async fn otlp_http_exporter_sends_traces_to_collector_with_bounded_shutdown_in_t
 
         let _ = tx.send(captured);
     });
-
-    let otel = OtelProvider::try_new(&OtelSettings {
-        http_client_factory: HttpClientFactory::new(OutboundProxyPolicy::ReqwestDefault),
-        environment: "test".to_string(),
-        service_name: "codex-cli".to_string(),
-        service_version: env!("CARGO_PKG_VERSION").to_string(),
-        codex_home: PathBuf::from("."),
-        exporter: OtelExporter::None,
-        trace_exporter: OtelExporter::OtlpHttp {
-            endpoint: format!("http://{addr}/v1/traces"),
-            headers: HashMap::new(),
-            protocol: OtelHttpProtocol::Json,
-            tls: None,
-        },
-        metrics_exporter: OtelExporter::None,
-        runtime_metrics: false,
-        span_attributes: HashMap::new(),
-        tracestate: BTreeMap::new(),
-    })?
-    .expect("otel provider");
     let tracing_layer = otel.tracing_layer().expect("tracing layer");
     let subscriber = tracing_subscriber::registry().with(tracing_layer);
 
@@ -701,12 +706,14 @@ async fn otlp_http_exporter_sends_traces_to_collector_with_bounded_shutdown_in_t
         let _guard = span.enter();
         tracing::info!("trace loopback event from tokio runtime");
     });
-    tokio::task::block_in_place(|| {
+    let shutdown_result = tokio::task::block_in_place(|| {
         tokio::runtime::Handle::current()
             .block_on(otel.shutdown_with_timeout(Duration::from_secs(/*secs*/ 2)))
-    })?;
+    });
 
+    let _ = stop_tx.send(());
     server.join().expect("server join");
+    shutdown_result?;
     let captured = rx.recv_timeout(Duration::from_secs(1)).expect("captured");
 
     let request = captured