diff --git a/.github/workflows/call-flags-project-board.yml b/.github/workflows/call-flags-project-board.yml
index 0e74e28c..0ab36546 100644
--- a/.github/workflows/call-flags-project-board.yml
+++ b/.github/workflows/call-flags-project-board.yml
@@ -7,11 +7,17 @@ on:
     pull_request:
         types: [opened, ready_for_review, review_requested, synchronize, converted_to_draft, reopened]
 
+permissions: {}
+
 jobs:
     call-flags-project:
-        uses: PostHog/.github/.github/workflows/flags-project-board.yml@d8b55d05dc5150f05c24542a6397ff3ecfbfb56d
+        uses: PostHog/.github/.github/workflows/flags-project-board.yml@69336b569d22687f8982eea6ff7d450a885cda05
         with:
             pr_number: ${{ github.event.pull_request.number }}
             pr_node_id: ${{ github.event.pull_request.node_id }}
             is_draft: ${{ github.event.pull_request.draft }}
-        secrets: inherit
\ No newline at end of file
+        # The central .github reusable workflow does not declare workflow_call.secrets,
+        # so explicit secret mapping makes GitHub reject this caller at startup.
+        # It gates fork/Dependabot PRs before using secrets; keep this scoped call
+        # as an intentional exception to the broad-inheritance Semgrep rule.
+        secrets: inherit # nosemgrep
diff --git a/extras/tcp_drop_test.go b/extras/tcp_drop_test.go
index 3b14e946..91b67ead 100644
--- a/extras/tcp_drop_test.go
+++ b/extras/tcp_drop_test.go
@@ -52,7 +52,6 @@ func TestTCPDropRecovery(t *testing.T) {
 
 			url, err := server.Start()
 			require.NoError(t, err, "Failed to start server")
-			defer server.Close()
 			t.Logf("TCP server started at %s", url)
 
 			callback := newTestCallback(t)
@@ -91,6 +90,7 @@ func TestTCPDropRecovery(t *testing.T) {
 			}
 
 			client.Close()
+			require.NoError(t, server.Close(), "Failed to close server")
 
 			success, failure := callback.GetCounts()
 			assert.Equal(t, 1, success, "Expected 1 success")
@@ -148,7 +148,6 @@ func TestTCPDropFailure(t *testing.T) {
 
 			url, err := server.Start()
 			require.NoError(t, err, "Failed to start server")
-			defer server.Close()
 			t.Logf("TCP server started at %s", url)
 
 			callback := newTestCallback(t)
@@ -187,6 +186,7 @@ func TestTCPDropFailure(t *testing.T) {
 			}
 
 			client.Close()
+			require.NoError(t, server.Close(), "Failed to close server")
 
 			success, failure := callback.GetCounts()
 			assert.Equal(t, 10, server.ConnCount())