diff --git a/tests/TestCase/Authentication/AuthenticationServiceTest.php b/tests/TestCase/Authentication/AuthenticationServiceTest.php
index 004aa50..e36dc07 100644
--- a/tests/TestCase/Authentication/AuthenticationServiceTest.php
+++ b/tests/TestCase/Authentication/AuthenticationServiceTest.php
@@ -104,9 +104,9 @@ public function testAuthenticateFail()
         );
         $formFailure = new Failure(
             $service->authenticators()->get('Form'),
-            new Result(null, Result::FAILURE_IDENTITY_NOT_FOUND, [
-                'Password' => [],
-            ])
+            // Newer cakephp/authentication no longer records an empty per-identifier
+            // error entry on identity-not-found.
+            new Result(null, Result::FAILURE_IDENTITY_NOT_FOUND)
         );
         $expected = [$sessionFailure, $formFailure];
         $actual = $service->getFailures();
diff --git a/tests/TestCase/Authenticator/CookieAuthenticatorTest.php b/tests/TestCase/Authenticator/CookieAuthenticatorTest.php
index e2c1b34..01aa1e0 100644
--- a/tests/TestCase/Authenticator/CookieAuthenticatorTest.php
+++ b/tests/TestCase/Authenticator/CookieAuthenticatorTest.php
@@ -81,7 +81,12 @@ public function testPersistIdentity($setCookie, $field, array $post, array $sess
         $this->assertInstanceOf(RequestInterface::class, $result['request']);
         $this->assertInstanceOf(ResponseInterface::class, $result['response']);
         if ($setCookie) {
-            $this->assertStringContainsString('CookieAuth=%5B%22johndoe%22%2C%22%242y%24', $result['response']->getHeaderLine('Set-Cookie'));
+            // The token is now [username, expires, hmac]; the password hash must not
+            // be stored in the cookie (timing-safe remember-me hardening).
+            $cookie = $result['response']->getHeaderLine('Set-Cookie');
+            $this->assertStringContainsString('CookieAuth=%5B%22johndoe%22%2C', $cookie);
+            $this->assertStringNotContainsString('%242y%24', $cookie);
+            $this->assertStringNotContainsString('%242a%24', $cookie);
         } else {
             $this->assertStringNotContainsString('CookieAuth', $result['response']->getHeaderLine('Set-Cookie'));
         }