diff --git a/workspace-server/internal/handlers/terminal.go b/workspace-server/internal/handlers/terminal.go
index 18b1b4cc..94e81cd6 100644
--- a/workspace-server/internal/handlers/terminal.go
+++ b/workspace-server/internal/handlers/terminal.go
@@ -9,6 +9,7 @@ import (
 	"net/http"
 	"os"
 	"os/exec"
+	"strconv"
 	"strings"
 	"time"
 
@@ -439,7 +440,9 @@ func pickFreePort() (int, error) {
 // its local port before we dial ssh at it.
 func waitForPort(ctx context.Context, host string, port int, timeout time.Duration) error {
 	deadline := time.Now().Add(timeout)
-	addr := fmt.Sprintf("%s:%d", host, port)
+	// JoinHostPort handles IPv6 bracketing; `%s:%d` does not. Caught by
+	// `go vet` on ubuntu-latest (newer Go toolchain than the Mac mini).
+	addr := net.JoinHostPort(host, strconv.Itoa(port))
 	for time.Now().Before(deadline) {
 		if ctx.Err() != nil {
 			return ctx.Err()
diff --git a/workspace/tests/test_a2a_executor.py b/workspace/tests/test_a2a_executor.py
index 9194cd96..f393dfad 100644
--- a/workspace/tests/test_a2a_executor.py
+++ b/workspace/tests/test_a2a_executor.py
@@ -408,7 +408,13 @@ def test_extract_history_non_list():
 @pytest.mark.asyncio
 async def test_set_current_task_updates_heartbeat():
     """set_current_task updates heartbeat fields."""
+    # Seed active_tasks as an int — without this, MagicMock auto-creates
+    # the attribute on first access, getattr() returns a MagicMock, and
+    # `MagicMock + 1` stays a MagicMock instead of becoming 1. The real
+    # HeartbeatLoop class initialises active_tasks=0 so this matches
+    # production behaviour.
     heartbeat = MagicMock()
+    heartbeat.active_tasks = 0
     await set_current_task(heartbeat, "Doing work")
     assert heartbeat.current_task == "Doing work"
     assert heartbeat.active_tasks == 1