diff --git a/connector/saml/saml_test.go b/connector/saml/saml_test.go
index 03e891fe64..b97f98fcbd 100644
--- a/connector/saml/saml_test.go
+++ b/connector/saml/saml_test.go
@@ -549,6 +549,9 @@ func runVerify(t *testing.T, ca string, resp string, shouldSucceed bool) {
 	s := certStore{[]*x509.Certificate{cert}}
 
 	validator := dsig.NewDefaultValidationContext(s)
+	// Pin the validator's clock so signature checks don't fail once the
+	// fixture certs in testdata/ eventually expire in real time.
+	validator.Clock = dsig.NewFakeClockAt(time.Date(2020, 1, 1, 0, 0, 0, 0, time.UTC))
 
 	data, err := os.ReadFile(resp)
 	if err != nil {
diff --git a/storage/kubernetes/storage.go b/storage/kubernetes/storage.go
index 00771815c3..84231e00fd 100644
--- a/storage/kubernetes/storage.go
+++ b/storage/kubernetes/storage.go
@@ -423,7 +423,7 @@ func (cli *client) DeleteClient(ctx context.Context, id string) error {
 	if err != nil {
 		return err
 	}
-	return cli.delete(resourceClient, c.Name)
+	return cli.delete(resourceClient, c.ObjectMeta.Name)
 }
 
 func (cli *client) DeleteRefresh(ctx context.Context, id string) error {
@@ -493,7 +493,7 @@ func (cli *client) UpdateClient(ctx context.Context, id string, updater func(old
 
 	newClient := cli.fromStorageClient(updated)
 	newClient.ObjectMeta = c.ObjectMeta
-	return cli.put(resourceClient, c.Name, newClient)
+	return cli.put(resourceClient, c.ObjectMeta.Name, newClient)
 }
 
 func (cli *client) UpdatePassword(ctx context.Context, email string, updater func(old storage.Password) (storage.Password, error)) error {