diff --git a/backend/internal/repository/plugin_kv_store_test.go b/backend/internal/repository/plugin_kv_store_test.go
index b7a0bbb947..04a15e8398 100644
--- a/backend/internal/repository/plugin_kv_store_test.go
+++ b/backend/internal/repository/plugin_kv_store_test.go
@@ -15,7 +15,8 @@ func newTestPluginKVStore(t *testing.T) (*pluginKVStore, *miniredis.Miniredis) {
 	t.Helper()
 	mr := miniredis.RunT(t)
 	rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
-	store := NewPluginKVStore(rdb).(*pluginKVStore)
+	store, ok := NewPluginKVStore(rdb).(*pluginKVStore)
+	require.True(t, ok)
 	return store, mr
 }
 
diff --git a/backend/internal/service/plugin_host_services_test.go b/backend/internal/service/plugin_host_services_test.go
index 900b9c3318..52c474c93e 100644
--- a/backend/internal/service/plugin_host_services_test.go
+++ b/backend/internal/service/plugin_host_services_test.go
@@ -317,13 +317,15 @@ func TestBuildHostServicesGatesDirectoryByCapability(t *testing.T) {
 	authorized := &PluginInstallation{PluginKey: "p.authorized", Manifest: PluginManifest{
 		Capabilities: []PluginCapability{{ID: PluginCapabilityOpenAIOAuthOutbound, Platform: PlatformOpenAI, AccountType: AccountTypeOAuth}},
 	}}
-	srv := m.buildHostServices(authorized).(*pluginHostServiceServer)
+	srv, ok := m.buildHostServices(authorized).(*pluginHostServiceServer)
+	require.True(t, ok)
 	require.NotNil(t, srv.directory)
 
 	unauthorized := &PluginInstallation{PluginKey: "p.other", Manifest: PluginManifest{
 		Capabilities: []PluginCapability{{ID: "some.other.capability", Platform: "x", AccountType: "y"}},
 	}}
-	srv2 := m.buildHostServices(unauthorized).(*pluginHostServiceServer)
+	srv2, ok := m.buildHostServices(unauthorized).(*pluginHostServiceServer)
+	require.True(t, ok)
 	require.Nil(t, srv2.directory, "unauthorized plugin must not receive the account directory")
 	require.NotNil(t, srv2.store, "but KV remains available")
 }