From 3fb3da4f5c2a7e36b93812a74a3f1c4f765d0a1d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Mon, 10 Aug 2026 16:57:29 +0200
Subject: [PATCH 01/21] Adopt shoenig/test and go-snaps in output package tests

Co-Authored-By: Claude <noreply@anthropic.com>
---
 go.mod                                        | 13 ++++
 go.sum                                        | 32 +++++++++
 .../output/__snapshots__/plain_sink_test.snap | 23 +++++++
 internal/output/envelope_sink_test.go         | 65 +++++--------------
 internal/output/plain_sink_test.go            | 10 ++-
 internal/output/snapshot_sanitize_test.go     | 48 ++++++++++++++
 6 files changed, 138 insertions(+), 53 deletions(-)
 create mode 100644 internal/output/__snapshots__/plain_sink_test.snap
 create mode 100644 internal/output/snapshot_sanitize_test.go

diff --git a/go.mod b/go.mod
index 349d86e5..40129255 100644
--- a/go.mod
+++ b/go.mod
@@ -13,6 +13,7 @@ require (
 	github.com/containerd/errdefs v1.0.0
 	github.com/creack/pty v1.1.24
 	github.com/docker/go-units v0.5.0
+	github.com/gkampitakis/go-snaps v0.5.23
 	github.com/google/uuid v1.6.0
 	github.com/hashicorp/hcl/v2 v2.24.0
 	github.com/moby/moby/api v1.55.0
@@ -20,6 +21,7 @@ require (
 	github.com/muesli/termenv v0.16.0
 	github.com/pelletier/go-toml/v2 v2.4.3
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
+	github.com/shoenig/test v1.13.2
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/spf13/viper v1.21.0
@@ -63,14 +65,19 @@ require (
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/felixge/httpsnoop v1.1.0 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/gkampitakis/ciinfo v0.3.4 // indirect
 	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
+	github.com/goccy/go-yaml v1.19.2 // indirect
 	github.com/godbus/dbus/v5 v5.2.2 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
+	github.com/kr/text v0.2.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
+	github.com/maruel/natural v1.3.0 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
 	github.com/mattn/go-runewidth v0.0.19 // indirect
@@ -82,11 +89,17 @@ require (
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sagikazarmark/locafero v0.12.0 // indirect
+	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
+	github.com/tidwall/gjson v1.19.0 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/tidwall/sjson v1.2.5 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
diff --git a/go.sum b/go.sum
index 616823e9..7520a444 100644
--- a/go.sum
+++ b/go.sum
@@ -44,6 +44,7 @@ github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151X
 github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
 github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/danieljoos/wincred v1.2.3 h1:v7dZC2x32Ut3nEfRH+vhoZGvN72+dQ/snVXo/vMFLdQ=
@@ -65,6 +66,10 @@ github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHk
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/gkampitakis/ciinfo v0.3.4 h1:5eBSibVuSMbb/H6Elc0IIEFbkzCJi3lm94n0+U7Z0KY=
+github.com/gkampitakis/ciinfo v0.3.4/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=
+github.com/gkampitakis/go-snaps v0.5.23 h1:okh5QR48zpUjpWtu65AtqxdCY8huJq+dEDuUzd1PuKg=
+github.com/gkampitakis/go-snaps v0.5.23/go.mod h1:uy3lVzCCRRsAwYqSocyw5fY8xRLCYEfqoOJNxr8HonM=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
 github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -74,6 +79,8 @@ github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
 github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
+github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
 github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
@@ -88,12 +95,17 @@ github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQx
 github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=
 github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/maruel/natural v1.3.0 h1:VsmCsBmEyrR46RomtgHs5hbKADGRVtliHTyCOLFBpsg=
+github.com/maruel/natural v1.3.0/go.mod h1:v+Rfd79xlw1AgVBjbO0BEQmptqb5HvL/k9GRHB7ZKEg=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
@@ -122,16 +134,22 @@ github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdD
 github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sagikazarmark/locafero v0.12.0 h1:/NQhBAkUb4+fH1jivKHWusDYFjMOOKU88eegjfxfHb4=
 github.com/sagikazarmark/locafero v0.12.0/go.mod h1:sZh36u/YSZ918v0Io+U9ogLYQJ9tLLBmM4eneO6WwsI=
+github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
+github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
+github.com/shoenig/test v1.13.2 h1:SaGxHxg7xkRuKuNtuFmHf0LgNGaAgcBT7HN4WHCKfqU=
+github.com/shoenig/test v1.13.2/go.mod h1:MKmiRyEeuFl8y9PCoThaRDgYQZeWBhRQlH99poXz5LI=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
@@ -148,6 +166,7 @@ github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSS
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
@@ -155,6 +174,16 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
+github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.19.0 h1:xwxm7n691Uf3u5OFjzngavjGTh55KX5q/9w9xHW88JU=
+github.com/tidwall/gjson v1.19.0/go.mod h1:V37/opeE/JbLUOfH0QTXiNez2l0RUjYUhpT4szFQAfc=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
+github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPccHs=
@@ -219,10 +248,13 @@ google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4J
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/ini.v1 v1.67.3 h1:iM9Lhz5MRSGhHVGGwCuzG9KO8PoirCXj/m/qTmOJJQw=
 gopkg.in/ini.v1 v1.67.3/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/internal/output/__snapshots__/plain_sink_test.snap b/internal/output/__snapshots__/plain_sink_test.snap
new file mode 100644
index 00000000..c2fe05bd
--- /dev/null
+++ b/internal/output/__snapshots__/plain_sink_test.snap
@@ -0,0 +1,23 @@
+
+[TestPlainSink_EmitsErrorEvent - 1]
+Error: Connection failed
+  Cannot connect to Docker
+  ==> Start Docker: open -a Docker
+
+---
+
+[TestPlainSink_EmitsInstanceInfoEvent/full - 1]
+✔︎ LocalStack AWS Emulator is running
+• Endpoint: localhost.localstack.cloud:4566
+• Persistence: Enabled
+• Container: localstack-aws
+• Version: <version>
+• Uptime: <time>
+
+---
+
+[TestPlainSink_EmitsInstanceInfoEvent/minimal - 1]
+✔︎ LocalStack AWS Emulator is running
+• Endpoint: 127.0.0.1:4566
+
+---
diff --git a/internal/output/envelope_sink_test.go b/internal/output/envelope_sink_test.go
index 4532ed60..6053b502 100644
--- a/internal/output/envelope_sink_test.go
+++ b/internal/output/envelope_sink_test.go
@@ -3,6 +3,8 @@ package output
 import (
 	"errors"
 	"testing"
+
+	"github.com/shoenig/test/must"
 )
 
 func TestEnvelopeSink_SuccessWithNoEvents(t *testing.T) {
@@ -40,30 +42,13 @@ func TestEnvelopeSink_EmulatorStoppedEventAccumulates(t *testing.T) {
 
 	envelope := sink.Result("stop", nil)
 	data, ok := envelope.Data.(map[string]any)
-	if !ok {
-		t.Fatalf("expected map[string]any data, got %T", envelope.Data)
-	}
+	must.True(t, ok)
 	entries, ok := data["emulators"].([]JsonEmulatorEntry)
-	if !ok {
-		t.Fatalf("expected []JsonEmulatorEntry emulators, got %T", data["emulators"])
-	}
-	if len(entries) != 2 {
-		t.Fatalf("expected 2 emulators, got %d", len(entries))
-	}
-	emulators := make([]JsonStoppedEmulator, len(entries))
-	for i, entry := range entries {
-		stopped, ok := entry.(JsonStoppedEmulator)
-		if !ok {
-			t.Fatalf("expected entry %d to be a JsonStoppedEmulator, got %T", i, entry)
-		}
-		emulators[i] = stopped
-	}
-	if emulators[0].Type != "aws" || emulators[0].Name != "localstack-aws" || !emulators[0].WasRunning {
-		t.Fatalf("unexpected first emulator entry: %+v", emulators[0])
-	}
-	if emulators[1].Type != "snowflake" {
-		t.Fatalf("unexpected second emulator entry: %+v", emulators[1])
-	}
+	must.True(t, ok)
+	must.Eq(t, []JsonEmulatorEntry{
+		JsonStoppedEmulator{JsonEmulatorRef: JsonEmulatorRef{Type: "aws", Name: "localstack-aws"}, WasRunning: true},
+		JsonStoppedEmulator{JsonEmulatorRef: JsonEmulatorRef{Type: "snowflake", Name: "localstack-snowflake"}, WasRunning: true},
+	}, entries)
 }
 
 func TestEnvelopeSink_EmulatorResetEvent(t *testing.T) {
@@ -153,30 +138,16 @@ func TestEnvelopeSink_ErrorEventSetsClassifiedError(t *testing.T) {
 	})
 
 	envelope := sink.Result("reset", errors.New("LocalStack is not running"))
-	if envelope.Status != StatusError {
-		t.Fatalf("expected status %q, got %q", StatusError, envelope.Status)
-	}
-	if envelope.Data != nil {
-		t.Fatalf("expected nil data on error, got %+v", envelope.Data)
-	}
-	if envelope.Error == nil {
-		t.Fatal("expected non-nil error")
-	}
-	if envelope.Error.Code != ErrEmulatorNotRunning {
-		t.Fatalf("expected code %q, got %q", ErrEmulatorNotRunning, envelope.Error.Code)
-	}
-	if envelope.Error.Category != CategoryEmulator {
-		t.Fatalf("expected category %q, got %q", CategoryEmulator, envelope.Error.Category)
-	}
-	if envelope.Error.Retryable != ErrEmulatorNotRunning.Retryable() {
-		t.Fatalf("expected retryable %v to match the code's static classification", ErrEmulatorNotRunning.Retryable())
-	}
-	if envelope.Error.Message != "LocalStack is not running" {
-		t.Fatalf("expected message %q, got %q", "LocalStack is not running", envelope.Error.Message)
-	}
-	if len(envelope.Error.Actions) != 1 || envelope.Error.Actions[0].ID != "start-localstack" || envelope.Error.Actions[0].Command != "lstk" {
-		t.Fatalf("unexpected actions: %+v", envelope.Error.Actions)
-	}
+	must.Eq(t, StatusError, envelope.Status)
+	must.Nil(t, envelope.Data)
+	must.NotNil(t, envelope.Error)
+	must.Eq(t, &EnvelopeError{
+		Code:      ErrEmulatorNotRunning,
+		Category:  CategoryEmulator,
+		Message:   "LocalStack is not running",
+		Retryable: ErrEmulatorNotRunning.Retryable(),
+		Actions:   []EnvelopeAction{{ID: "start-localstack", Command: "lstk"}},
+	}, envelope.Error)
 }
 
 // TestEnvelopeSink_ErrorEventIncludesSummaryInDetails covers PR #374's report
diff --git a/internal/output/plain_sink_test.go b/internal/output/plain_sink_test.go
index 379745c7..f2f5b92f 100644
--- a/internal/output/plain_sink_test.go
+++ b/internal/output/plain_sink_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/gkampitakis/go-snaps/snaps"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -155,8 +156,7 @@ func TestPlainSink_EmitsErrorEvent(t *testing.T) {
 		Actions: []ErrorAction{{Label: "Start Docker:", Value: "open -a Docker"}},
 	})
 
-	expected := "Error: Connection failed\n  Cannot connect to Docker\n  ==> Start Docker: open -a Docker\n"
-	assert.Equal(t, expected, out.String())
+	snaps.MatchSnapshot(t, out.String())
 }
 
 func TestPlainSink_EmitsInstanceInfoEvent(t *testing.T) {
@@ -173,8 +173,7 @@ func TestPlainSink_EmitsInstanceInfoEvent(t *testing.T) {
 			Persistence:   true,
 		})
 
-		expected := SuccessMarker() + " LocalStack AWS Emulator is running\n• Endpoint: localhost.localstack.cloud:4566\n• Persistence: Enabled\n• Container: localstack-aws\n• Version: 4.14.1\n• Uptime: 4m 23s\n"
-		assert.Equal(t, expected, out.String())
+		snaps.MatchSnapshot(t, sanitizeSnapshot(out.String()))
 		assert.NoError(t, sink.Err())
 	})
 
@@ -187,8 +186,7 @@ func TestPlainSink_EmitsInstanceInfoEvent(t *testing.T) {
 			Host:         "127.0.0.1:4566",
 		})
 
-		expected := SuccessMarker() + " LocalStack AWS Emulator is running\n• Endpoint: 127.0.0.1:4566\n"
-		assert.Equal(t, expected, out.String())
+		snaps.MatchSnapshot(t, out.String())
 		assert.NoError(t, sink.Err())
 	})
 
diff --git a/internal/output/snapshot_sanitize_test.go b/internal/output/snapshot_sanitize_test.go
new file mode 100644
index 00000000..7d95e706
--- /dev/null
+++ b/internal/output/snapshot_sanitize_test.go
@@ -0,0 +1,48 @@
+package output
+
+import (
+	"regexp"
+	"testing"
+)
+
+// go-snaps supports value placeholders only for MatchJSON (via the match
+// package); plain-text MatchSnapshot has no matcher hook. sanitizeSnapshot
+// fills that gap: it replaces volatile values in rendered CLI output with
+// stable placeholders so text snapshots stay deterministic across runs.
+//
+// The patterns are label-anchored rather than value-shaped on purpose: Go's
+// RE2 has no lookahead, so a bare semver pattern (\d+\.\d+\.\d+) would also
+// match inside IPv4 addresses ("127.0.0.1" contains "0.0.1" at a word
+// boundary). Anchoring on the rendered label sidesteps that class of
+// collision; add a new labeled pattern here when another volatile value
+// shows up in snapshot output.
+var (
+	snapshotVersionRe = regexp.MustCompile(`(Version: )\S+`)
+	snapshotUptimeRe  = regexp.MustCompile(`(?m)(Uptime: ).+$`)
+)
+
+func sanitizeSnapshot(s string) string {
+	s = snapshotVersionRe.ReplaceAllString(s, "${1}<version>")
+	s = snapshotUptimeRe.ReplaceAllString(s, "${1}<time>")
+	return s
+}
+
+func TestSanitizeSnapshot(t *testing.T) {
+	t.Parallel()
+
+	cases := map[string]string{
+		"• Version: 4.14.1":            "• Version: <version>",
+		"• Version: v2.3.0-rc1":        "• Version: <version>",
+		"• Uptime: 4m 23s":             "• Uptime: <time>",
+		"• Uptime: 1h 2m 3s":           "• Uptime: <time>",
+		"• Uptime: 42s":                "• Uptime: <time>",
+		"• Endpoint: 127.0.0.1:4566":   "• Endpoint: 127.0.0.1:4566",
+		"plain text untouched":         "plain text untouched",
+		"• Version: 4.14.1\n• Uptime: 4m 23s\n• Container: localstack-aws": "• Version: <version>\n• Uptime: <time>\n• Container: localstack-aws",
+	}
+	for in, want := range cases {
+		if got := sanitizeSnapshot(in); got != want {
+			t.Errorf("sanitizeSnapshot(%q) = %q, want %q", in, got, want)
+		}
+	}
+}

From f3cd58b3e182bf4f882aabf5e44cc02902cf0845 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Tue, 11 Aug 2026 14:31:51 +0200
Subject: [PATCH 02/21] Replace test assertion/snapshot deps with in-house must
 and snap helpers

Co-Authored-By: Claude <noreply@anthropic.com>
---
 CLAUDE.md                                     |   1 +
 go.mod                                        |  15 +-
 go.sum                                        |  32 ---
 internal/must/must.go                         |  65 ++++++
 internal/must/must_test.go                    | 104 +++++++++
 .../TestPlainSink_EmitsErrorEvent_1.snap      |   3 +
 ...ainSink_EmitsInstanceInfoEvent_full_1.snap |   6 +
 ...Sink_EmitsInstanceInfoEvent_minimal_1.snap |   2 +
 .../output/__snapshots__/plain_sink_test.snap |  23 --
 internal/output/envelope_sink_test.go         |   2 +-
 internal/output/main_test.go                  |  14 ++
 internal/output/plain_sink_test.go            |   8 +-
 internal/snap/snap.go                         | 170 ++++++++++++++
 internal/snap/snap_test.go                    | 211 ++++++++++++++++++
 14 files changed, 582 insertions(+), 74 deletions(-)
 create mode 100644 internal/must/must.go
 create mode 100644 internal/must/must_test.go
 create mode 100644 internal/output/__snapshots__/TestPlainSink_EmitsErrorEvent_1.snap
 create mode 100644 internal/output/__snapshots__/TestPlainSink_EmitsInstanceInfoEvent_full_1.snap
 create mode 100644 internal/output/__snapshots__/TestPlainSink_EmitsInstanceInfoEvent_minimal_1.snap
 delete mode 100644 internal/output/__snapshots__/plain_sink_test.snap
 create mode 100644 internal/output/main_test.go
 create mode 100644 internal/snap/snap.go
 create mode 100644 internal/snap/snap_test.go

diff --git a/CLAUDE.md b/CLAUDE.md
index 075638ba..8ab793b3 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -233,6 +233,7 @@ When drafting Slack messages, PR descriptions, review replies, release notes, or
 # Testing
 
 - Prefer integration tests to cover most cases. Use unit tests when integration tests are not practical.
+- In-house test helpers (no external assertion/snapshot deps): `internal/must` for fatal generic assertions (`must.Eq` renders go-cmp diffs; `must.Nil`/`NotNil` handle typed nils), and `internal/snap` for file-snapshot tests. `snap.Match(t, s)` stores one file per snapshot under `__snapshots__/` next to the test; missing snapshots are created locally but fail in CI; `UPDATE_SNAPS=true go test ./...` rewrites them. A package using snapshots must wire `func TestMain(m *testing.M) { os.Exit(snap.Clean(m)) }` — obsolete snapshots then fail the run (or are deleted under `UPDATE_SNAPS=true`); cleanup is skipped on filtered (`-run`/`-skip`) or failed runs. Sanitize volatile values before matching with label-anchored regexes, not value-shaped ones (see `sanitizeSnapshot` in `internal/output`; RE2 has no lookahead, so a bare semver pattern corrupts IPv4 strings).
 - **When fixing a bug, always add an integration test** that fails before the fix and passes after. This prevents regressions and documents the exact scenario that was broken.
 - Integration tests that run the CLI binary with Bubble Tea must use a PTY (`github.com/creack/pty`) since Bubble Tea requires a terminal. Use `pty.Start(cmd)` instead of `cmd.CombinedOutput()`, read output with `io.Copy()`, and send keystrokes by writing to the PTY (e.g., `ptmx.Write([]byte("\r"))` for Enter).
 - Mark every integration test with `t.Parallel()` unless it shares external state with other tests. Today the main blocker is the Docker daemon: tests that start LocalStack containers cannot run concurrently because lstk's container discovery matches by `(image, internal port)`, so two parallel runs would cross-contaminate. Tests that only touch the filesystem, mock servers, or the CLI binary itself should be parallel.
diff --git a/go.mod b/go.mod
index 40129255..24a92fc0 100644
--- a/go.mod
+++ b/go.mod
@@ -13,7 +13,7 @@ require (
 	github.com/containerd/errdefs v1.0.0
 	github.com/creack/pty v1.1.24
 	github.com/docker/go-units v0.5.0
-	github.com/gkampitakis/go-snaps v0.5.23
+	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
 	github.com/hashicorp/hcl/v2 v2.24.0
 	github.com/moby/moby/api v1.55.0
@@ -21,7 +21,6 @@ require (
 	github.com/muesli/termenv v0.16.0
 	github.com/pelletier/go-toml/v2 v2.4.3
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
-	github.com/shoenig/test v1.13.2
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/spf13/viper v1.21.0
@@ -65,19 +64,13 @@ require (
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/felixge/httpsnoop v1.1.0 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/gkampitakis/ciinfo v0.3.4 // indirect
 	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
-	github.com/goccy/go-yaml v1.19.2 // indirect
 	github.com/godbus/dbus/v5 v5.2.2 // indirect
-	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/kr/pretty v0.3.1 // indirect
-	github.com/kr/text v0.2.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
-	github.com/maruel/natural v1.3.0 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
 	github.com/mattn/go-runewidth v0.0.19 // indirect
@@ -89,17 +82,11 @@ require (
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sagikazarmark/locafero v0.12.0 // indirect
-	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/tidwall/gjson v1.19.0 // indirect
-	github.com/tidwall/match v1.1.1 // indirect
-	github.com/tidwall/pretty v1.2.1 // indirect
-	github.com/tidwall/sjson v1.2.5 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
diff --git a/go.sum b/go.sum
index 7520a444..616823e9 100644
--- a/go.sum
+++ b/go.sum
@@ -44,7 +44,6 @@ github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151X
 github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
 github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/danieljoos/wincred v1.2.3 h1:v7dZC2x32Ut3nEfRH+vhoZGvN72+dQ/snVXo/vMFLdQ=
@@ -66,10 +65,6 @@ github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHk
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/gkampitakis/ciinfo v0.3.4 h1:5eBSibVuSMbb/H6Elc0IIEFbkzCJi3lm94n0+U7Z0KY=
-github.com/gkampitakis/ciinfo v0.3.4/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=
-github.com/gkampitakis/go-snaps v0.5.23 h1:okh5QR48zpUjpWtu65AtqxdCY8huJq+dEDuUzd1PuKg=
-github.com/gkampitakis/go-snaps v0.5.23/go.mod h1:uy3lVzCCRRsAwYqSocyw5fY8xRLCYEfqoOJNxr8HonM=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
 github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -79,8 +74,6 @@ github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
 github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
-github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
-github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
 github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
@@ -95,17 +88,12 @@ github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQx
 github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=
 github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
-github.com/maruel/natural v1.3.0 h1:VsmCsBmEyrR46RomtgHs5hbKADGRVtliHTyCOLFBpsg=
-github.com/maruel/natural v1.3.0/go.mod h1:v+Rfd79xlw1AgVBjbO0BEQmptqb5HvL/k9GRHB7ZKEg=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
@@ -134,22 +122,16 @@ github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdD
 github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
-github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
-github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sagikazarmark/locafero v0.12.0 h1:/NQhBAkUb4+fH1jivKHWusDYFjMOOKU88eegjfxfHb4=
 github.com/sagikazarmark/locafero v0.12.0/go.mod h1:sZh36u/YSZ918v0Io+U9ogLYQJ9tLLBmM4eneO6WwsI=
-github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
-github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
-github.com/shoenig/test v1.13.2 h1:SaGxHxg7xkRuKuNtuFmHf0LgNGaAgcBT7HN4WHCKfqU=
-github.com/shoenig/test v1.13.2/go.mod h1:MKmiRyEeuFl8y9PCoThaRDgYQZeWBhRQlH99poXz5LI=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
@@ -166,7 +148,6 @@ github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSS
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
@@ -174,16 +155,6 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
-github.com/tidwall/gjson v1.19.0 h1:xwxm7n691Uf3u5OFjzngavjGTh55KX5q/9w9xHW88JU=
-github.com/tidwall/gjson v1.19.0/go.mod h1:V37/opeE/JbLUOfH0QTXiNez2l0RUjYUhpT4szFQAfc=
-github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
-github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
-github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
-github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
-github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
-github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
-github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPccHs=
@@ -248,13 +219,10 @@ google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4J
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/ini.v1 v1.67.3 h1:iM9Lhz5MRSGhHVGGwCuzG9KO8PoirCXj/m/qTmOJJQw=
 gopkg.in/ini.v1 v1.67.3/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/internal/must/must.go b/internal/must/must.go
new file mode 100644
index 00000000..8221819e
--- /dev/null
+++ b/internal/must/must.go
@@ -0,0 +1,65 @@
+// Package must provides minimal generic test assertions that fail the test
+// immediately (t.Fatal semantics). In-house replacement for the subset of
+// github.com/shoenig/test/must that lstk uses; diffing is delegated to
+// go-cmp, which renders readable struct/slice mismatches.
+package must
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+// Eq fails the test if want and got are not deeply equal (go-cmp semantics).
+func Eq[A any](t testing.TB, want, got A, opts ...cmp.Option) {
+	t.Helper()
+	if diff := cmp.Diff(want, got, opts...); diff != "" {
+		t.Fatalf("mismatch (-want +got):\n%s", diff)
+	}
+}
+
+// True fails the test if ok is false.
+func True(t testing.TB, ok bool) {
+	t.Helper()
+	if !ok {
+		t.Fatal("expected condition to be true")
+	}
+}
+
+// NoError fails the test if err is non-nil.
+func NoError(t testing.TB, err error) {
+	t.Helper()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+// Nil fails the test if v is non-nil. Typed nils inside interfaces (e.g. a
+// nil *T stored in an any) count as nil.
+func Nil(t testing.TB, v any) {
+	t.Helper()
+	if !isNil(v) {
+		t.Fatalf("expected nil, got %#v", v)
+	}
+}
+
+// NotNil fails the test if v is nil (including typed nils, see Nil).
+func NotNil(t testing.TB, v any) {
+	t.Helper()
+	if isNil(v) {
+		t.Fatal("expected non-nil value")
+	}
+}
+
+func isNil(v any) bool {
+	if v == nil {
+		return true
+	}
+	rv := reflect.ValueOf(v)
+	switch rv.Kind() {
+	case reflect.Chan, reflect.Func, reflect.Interface, reflect.Map, reflect.Pointer, reflect.Slice:
+		return rv.IsNil()
+	}
+	return false
+}
diff --git a/internal/must/must_test.go b/internal/must/must_test.go
new file mode 100644
index 00000000..0233b6fd
--- /dev/null
+++ b/internal/must/must_test.go
@@ -0,0 +1,104 @@
+package must
+
+import (
+	"errors"
+	"strings"
+	"testing"
+)
+
+// fakeT records failures instead of failing the real test. Only the methods
+// the assertions use are implemented; anything else nil-panics loudly.
+type fakeT struct {
+	testing.TB
+	failed bool
+	msg    string
+}
+
+func (f *fakeT) Helper() {}
+
+func (f *fakeT) Fatal(args ...any) {
+	f.failed = true
+}
+
+func (f *fakeT) Fatalf(format string, args ...any) {
+	f.failed = true
+	f.msg = format
+}
+
+func TestEq(t *testing.T) {
+	t.Parallel()
+
+	ft := &fakeT{}
+	Eq(ft, []int{1, 2}, []int{1, 2})
+	if ft.failed {
+		t.Fatal("Eq failed on equal values")
+	}
+
+	ft = &fakeT{}
+	Eq(ft, []int{1, 2}, []int{1, 3})
+	if !ft.failed {
+		t.Fatal("Eq passed on unequal values")
+	}
+	if !strings.Contains(ft.msg, "-want +got") {
+		t.Fatalf("Eq failure should carry a diff, got %q", ft.msg)
+	}
+}
+
+func TestTrue(t *testing.T) {
+	t.Parallel()
+
+	ft := &fakeT{}
+	True(ft, true)
+	if ft.failed {
+		t.Fatal("True failed on true")
+	}
+	True(ft, false)
+	if !ft.failed {
+		t.Fatal("True passed on false")
+	}
+}
+
+func TestNoError(t *testing.T) {
+	t.Parallel()
+
+	ft := &fakeT{}
+	NoError(ft, nil)
+	if ft.failed {
+		t.Fatal("NoError failed on nil error")
+	}
+	NoError(ft, errors.New("boom"))
+	if !ft.failed {
+		t.Fatal("NoError passed on non-nil error")
+	}
+}
+
+func TestNilHandlesTypedNil(t *testing.T) {
+	t.Parallel()
+
+	var p *int
+	cases := map[string]struct {
+		v       any
+		wantNil bool
+	}{
+		"untyped nil":           {nil, true},
+		"typed nil pointer":     {p, true},
+		"nil slice":             {[]int(nil), true},
+		"nil map":               {map[string]int(nil), true},
+		"non-nil value":         {42, false},
+		"non-nil pointer":       {new(int), false},
+		"empty non-nil slice":   {[]int{}, false},
+		"zero non-pointer kind": {0, false},
+	}
+	for name, tc := range cases {
+		ft := &fakeT{}
+		Nil(ft, tc.v)
+		if ft.failed == tc.wantNil {
+			t.Errorf("%s: Nil failed=%v, want failure=%v", name, ft.failed, !tc.wantNil)
+		}
+		ft = &fakeT{}
+		NotNil(ft, tc.v)
+		if ft.failed != tc.wantNil {
+			t.Errorf("%s: NotNil failed=%v, want failure=%v", name, ft.failed, tc.wantNil)
+		}
+	}
+}
diff --git a/internal/output/__snapshots__/TestPlainSink_EmitsErrorEvent_1.snap b/internal/output/__snapshots__/TestPlainSink_EmitsErrorEvent_1.snap
new file mode 100644
index 00000000..6ba95312
--- /dev/null
+++ b/internal/output/__snapshots__/TestPlainSink_EmitsErrorEvent_1.snap
@@ -0,0 +1,3 @@
+Error: Connection failed
+  Cannot connect to Docker
+  ==> Start Docker: open -a Docker
diff --git a/internal/output/__snapshots__/TestPlainSink_EmitsInstanceInfoEvent_full_1.snap b/internal/output/__snapshots__/TestPlainSink_EmitsInstanceInfoEvent_full_1.snap
new file mode 100644
index 00000000..99846d9f
--- /dev/null
+++ b/internal/output/__snapshots__/TestPlainSink_EmitsInstanceInfoEvent_full_1.snap
@@ -0,0 +1,6 @@
+✔︎ LocalStack AWS Emulator is running
+• Endpoint: localhost.localstack.cloud:4566
+• Persistence: Enabled
+• Container: localstack-aws
+• Version: <version>
+• Uptime: <time>
diff --git a/internal/output/__snapshots__/TestPlainSink_EmitsInstanceInfoEvent_minimal_1.snap b/internal/output/__snapshots__/TestPlainSink_EmitsInstanceInfoEvent_minimal_1.snap
new file mode 100644
index 00000000..41de29b5
--- /dev/null
+++ b/internal/output/__snapshots__/TestPlainSink_EmitsInstanceInfoEvent_minimal_1.snap
@@ -0,0 +1,2 @@
+✔︎ LocalStack AWS Emulator is running
+• Endpoint: 127.0.0.1:4566
diff --git a/internal/output/__snapshots__/plain_sink_test.snap b/internal/output/__snapshots__/plain_sink_test.snap
deleted file mode 100644
index c2fe05bd..00000000
--- a/internal/output/__snapshots__/plain_sink_test.snap
+++ /dev/null
@@ -1,23 +0,0 @@
-
-[TestPlainSink_EmitsErrorEvent - 1]
-Error: Connection failed
-  Cannot connect to Docker
-  ==> Start Docker: open -a Docker
-
----
-
-[TestPlainSink_EmitsInstanceInfoEvent/full - 1]
-✔︎ LocalStack AWS Emulator is running
-• Endpoint: localhost.localstack.cloud:4566
-• Persistence: Enabled
-• Container: localstack-aws
-• Version: <version>
-• Uptime: <time>
-
----
-
-[TestPlainSink_EmitsInstanceInfoEvent/minimal - 1]
-✔︎ LocalStack AWS Emulator is running
-• Endpoint: 127.0.0.1:4566
-
----
diff --git a/internal/output/envelope_sink_test.go b/internal/output/envelope_sink_test.go
index 6053b502..93138776 100644
--- a/internal/output/envelope_sink_test.go
+++ b/internal/output/envelope_sink_test.go
@@ -4,7 +4,7 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/shoenig/test/must"
+	"github.com/localstack/lstk/internal/must"
 )
 
 func TestEnvelopeSink_SuccessWithNoEvents(t *testing.T) {
diff --git a/internal/output/main_test.go b/internal/output/main_test.go
new file mode 100644
index 00000000..ad1d1413
--- /dev/null
+++ b/internal/output/main_test.go
@@ -0,0 +1,14 @@
+package output
+
+import (
+	"os"
+	"testing"
+
+	"github.com/localstack/lstk/internal/snap"
+)
+
+// TestMain wires snapshot cleanup: snapshots no test uses anymore fail the
+// run (or are deleted with UPDATE_SNAPS=true).
+func TestMain(m *testing.M) {
+	os.Exit(snap.Clean(m))
+}
diff --git a/internal/output/plain_sink_test.go b/internal/output/plain_sink_test.go
index f2f5b92f..fede6cad 100644
--- a/internal/output/plain_sink_test.go
+++ b/internal/output/plain_sink_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/gkampitakis/go-snaps/snaps"
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -156,7 +156,7 @@ func TestPlainSink_EmitsErrorEvent(t *testing.T) {
 		Actions: []ErrorAction{{Label: "Start Docker:", Value: "open -a Docker"}},
 	})
 
-	snaps.MatchSnapshot(t, out.String())
+	snap.Match(t, out.String())
 }
 
 func TestPlainSink_EmitsInstanceInfoEvent(t *testing.T) {
@@ -173,7 +173,7 @@ func TestPlainSink_EmitsInstanceInfoEvent(t *testing.T) {
 			Persistence:   true,
 		})
 
-		snaps.MatchSnapshot(t, sanitizeSnapshot(out.String()))
+		snap.Match(t, sanitizeSnapshot(out.String()))
 		assert.NoError(t, sink.Err())
 	})
 
@@ -186,7 +186,7 @@ func TestPlainSink_EmitsInstanceInfoEvent(t *testing.T) {
 			Host:         "127.0.0.1:4566",
 		})
 
-		snaps.MatchSnapshot(t, out.String())
+		snap.Match(t, out.String())
 		assert.NoError(t, sink.Err())
 	})
 
diff --git a/internal/snap/snap.go b/internal/snap/snap.go
new file mode 100644
index 00000000..66af85d9
--- /dev/null
+++ b/internal/snap/snap.go
@@ -0,0 +1,170 @@
+// Package snap is a minimal file-snapshot testing helper: Match compares a
+// string against a snapshot stored under __snapshots__/ next to the calling
+// test file, and Clean (wired via TestMain) removes snapshots no test uses
+// anymore. In-house replacement for the subset of go-snaps that lstk uses.
+//
+// Workflow: a missing snapshot is created on the first local run (never in
+// CI, where it fails instead). On a mismatch the test fails with a diff;
+// UPDATE_SNAPS=true go test ./... rewrites snapshots and lets Clean delete
+// obsolete ones.
+//
+// One file per snapshot (TestName_N.snap, N = call number within the test),
+// so there is no snapshot-file format to parse and cleanup is a directory
+// listing.
+package snap
+
+import (
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"strconv"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+// Test-only helper state: the visited registry must span all tests in the
+// package so Clean can tell live snapshots from obsolete ones.
+var (
+	mu      sync.Mutex
+	visited = map[string]map[string]bool{} // snapshot dir -> filename -> seen
+	calls   = map[string]int{}             // dir + test name -> Match call count
+)
+
+var unsafeChars = regexp.MustCompile(`[^A-Za-z0-9._-]+`)
+
+// Match compares got against the stored snapshot for the calling test,
+// creating the snapshot on first local run or rewriting it when
+// UPDATE_SNAPS=true.
+func Match(t testing.TB, got string) {
+	t.Helper()
+	if n := flagValue("test.count"); n != "" && n != "1" {
+		t.Fatalf("snap: -count > 1 is not supported (snapshot call numbering would repeat)")
+	}
+	_, file, _, ok := runtime.Caller(1)
+	if !ok {
+		t.Fatal("snap: cannot resolve calling test file")
+	}
+	dir := filepath.Join(filepath.Dir(file), "__snapshots__")
+
+	mu.Lock()
+	key := dir + "|" + t.Name()
+	calls[key]++
+	name := unsafeChars.ReplaceAllString(t.Name(), "_") + "_" + strconv.Itoa(calls[key]) + ".snap"
+	if visited[dir] == nil {
+		visited[dir] = map[string]bool{}
+	}
+	visited[dir][name] = true
+	mu.Unlock()
+
+	path := filepath.Join(dir, name)
+	want, err := os.ReadFile(path)
+	update := os.Getenv("UPDATE_SNAPS") == "true"
+	switch {
+	case errors.Is(err, os.ErrNotExist):
+		if isCI() && !update {
+			t.Fatalf("snap: missing snapshot %s (snapshots are never created in CI; run the test locally and commit the file)", path)
+			return
+		}
+		write(t, path, got)
+		t.Logf("snap: created %s", path)
+	case err != nil:
+		t.Fatalf("snap: reading %s: %v", path, err)
+	case string(want) != got:
+		if update {
+			write(t, path, got)
+			t.Logf("snap: updated %s", path)
+			return
+		}
+		t.Errorf("snapshot mismatch (-want +got):\n%s\nrun UPDATE_SNAPS=true go test to update %s", cmp.Diff(string(want), got), path)
+	}
+}
+
+// Clean runs the package's tests and then handles obsolete snapshots: files
+// in visited __snapshots__ directories that no Match call used. They are
+// deleted when UPDATE_SNAPS=true, otherwise reported as an error (non-zero
+// exit) so stale snapshots can't linger unnoticed. Wire it in TestMain:
+//
+//	func TestMain(m *testing.M) { os.Exit(snap.Clean(m)) }
+//
+// Cleanup is skipped on failed or filtered runs (-run/-skip), where "not
+// visited" doesn't mean obsolete.
+func Clean(m *testing.M) int {
+	code := m.Run()
+	if code != 0 || flagValue("test.run") != "" || flagValue("test.skip") != "" {
+		return code
+	}
+	update := os.Getenv("UPDATE_SNAPS") == "true"
+	mu.Lock()
+	defer mu.Unlock()
+	for dir, seen := range visited {
+		if n, err := reportObsolete(dir, seen, update); err != nil {
+			fmt.Fprintf(os.Stderr, "snap: cleaning %s: %v\n", dir, err)
+			code = 1
+		} else if n > 0 && !update {
+			code = 1
+		}
+	}
+	return code
+}
+
+// reportObsolete deletes (update mode) or reports unvisited .snap files in
+// dir, returning how many it found.
+//
+// ponytail: only directories where at least one Match ran this process are
+// examined — deleting a whole test file orphans its snapshots until some
+// other test in the same directory runs Match. Acceptable: any later full
+// package run flags them.
+func reportObsolete(dir string, seen map[string]bool, update bool) (int, error) {
+	entries, err := os.ReadDir(dir)
+	if errors.Is(err, os.ErrNotExist) {
+		return 0, nil
+	}
+	if err != nil {
+		return 0, err
+	}
+	obsolete := 0
+	for _, e := range entries {
+		if e.IsDir() || !strings.HasSuffix(e.Name(), ".snap") || seen[e.Name()] {
+			continue
+		}
+		obsolete++
+		path := filepath.Join(dir, e.Name())
+		if update {
+			if err := os.Remove(path); err != nil {
+				return obsolete, err
+			}
+			fmt.Fprintf(os.Stderr, "snap: removed obsolete snapshot %s\n", path)
+		} else {
+			fmt.Fprintf(os.Stderr, "snap: obsolete snapshot %s (UPDATE_SNAPS=true go test to remove)\n", path)
+		}
+	}
+	return obsolete, nil
+}
+
+func write(t testing.TB, path, content string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatalf("snap: %v", err)
+	}
+	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+		t.Fatalf("snap: %v", err)
+	}
+}
+
+func isCI() bool {
+	return os.Getenv("CI") != ""
+}
+
+func flagValue(name string) string {
+	if f := flag.Lookup(name); f != nil {
+		return f.Value.String()
+	}
+	return ""
+}
diff --git a/internal/snap/snap_test.go b/internal/snap/snap_test.go
new file mode 100644
index 00000000..bccbb06f
--- /dev/null
+++ b/internal/snap/snap_test.go
@@ -0,0 +1,211 @@
+package snap
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// fakeT records failures instead of failing the real test. Only the methods
+// Match uses are implemented; anything else nil-panics loudly.
+type fakeT struct {
+	testing.TB
+	name    string
+	failed  bool
+	fatal   bool
+	msg     string
+	logs    []string
+}
+
+func (f *fakeT) Helper()      {}
+func (f *fakeT) Name() string { return f.name }
+
+func (f *fakeT) Fatal(args ...any) { f.failed, f.fatal = true, true }
+
+func (f *fakeT) Fatalf(format string, args ...any) {
+	f.failed, f.fatal = true, true
+	f.msg = format
+}
+
+func (f *fakeT) Errorf(format string, args ...any) {
+	f.failed = true
+	f.msg = format
+}
+
+func (f *fakeT) Logf(format string, args ...any) {
+	f.logs = append(f.logs, format)
+}
+
+// snapPath returns where Match will store snapshot n for the given fake test
+// name, and registers cleanup of the file and the registry entries so tests
+// stay independent.
+func snapPath(t *testing.T, fakeName string, n string) string {
+	t.Helper()
+	dir := filepath.Join(filepath.Dir(callerFile(t)), "__snapshots__")
+	path := filepath.Join(dir, fakeName+"_"+n+".snap")
+	t.Cleanup(func() {
+		_ = os.Remove(path)
+		mu.Lock()
+		defer mu.Unlock()
+		delete(calls, dir+"|"+fakeName)
+		if visited[dir] != nil {
+			delete(visited[dir], filepath.Base(path))
+		}
+	})
+	return path
+}
+
+func callerFile(t *testing.T) string {
+	t.Helper()
+	// Match resolves the caller's file; in these tests that is snap_test.go,
+	// so snapshots land in this package's __snapshots__ directory.
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return filepath.Join(wd, "snap_test.go")
+}
+
+func TestMatchCreatesThenMatches(t *testing.T) {
+	t.Setenv("CI", "")
+	t.Setenv("UPDATE_SNAPS", "")
+	path := snapPath(t, "TestFakeCreate", "1")
+
+	ft := &fakeT{name: "TestFakeCreate"}
+	Match(ft, "hello\nworld\n")
+	if ft.failed {
+		t.Fatalf("first Match should create, not fail: %q", ft.msg)
+	}
+	content, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("snapshot not written: %v", err)
+	}
+	if string(content) != "hello\nworld\n" {
+		t.Fatalf("snapshot content %q", content)
+	}
+
+	// Same test name matches again on a fresh run (reset the call counter).
+	mu.Lock()
+	delete(calls, filepath.Dir(path)+"|TestFakeCreate")
+	mu.Unlock()
+	ft = &fakeT{name: "TestFakeCreate"}
+	Match(ft, "hello\nworld\n")
+	if ft.failed {
+		t.Fatalf("re-Match against stored snapshot failed: %q", ft.msg)
+	}
+}
+
+func TestMatchFailsOnMismatch(t *testing.T) {
+	t.Setenv("CI", "")
+	t.Setenv("UPDATE_SNAPS", "")
+	path := snapPath(t, "TestFakeMismatch", "1")
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, []byte("old"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	ft := &fakeT{name: "TestFakeMismatch"}
+	Match(ft, "new")
+	if !ft.failed || ft.fatal {
+		t.Fatalf("mismatch should Errorf: failed=%v fatal=%v", ft.failed, ft.fatal)
+	}
+	if !strings.Contains(ft.msg, "-want +got") {
+		t.Fatalf("mismatch message should carry a diff, got %q", ft.msg)
+	}
+}
+
+func TestMatchUpdatesOnEnv(t *testing.T) {
+	t.Setenv("CI", "")
+	t.Setenv("UPDATE_SNAPS", "true")
+	path := snapPath(t, "TestFakeUpdate", "1")
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, []byte("old"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	ft := &fakeT{name: "TestFakeUpdate"}
+	Match(ft, "new")
+	if ft.failed {
+		t.Fatalf("update mode should rewrite, not fail: %q", ft.msg)
+	}
+	content, _ := os.ReadFile(path)
+	if string(content) != "new" {
+		t.Fatalf("snapshot not updated: %q", content)
+	}
+}
+
+func TestMatchMissingSnapshotFailsInCI(t *testing.T) {
+	t.Setenv("CI", "true")
+	t.Setenv("UPDATE_SNAPS", "")
+	path := snapPath(t, "TestFakeCI", "1")
+
+	ft := &fakeT{name: "TestFakeCI"}
+	Match(ft, "content")
+	if !ft.fatal {
+		t.Fatal("missing snapshot in CI must be fatal")
+	}
+	if _, err := os.Stat(path); err == nil {
+		t.Fatal("snapshot must not be created in CI")
+	}
+}
+
+func TestMatchCountsCallsWithinOneTest(t *testing.T) {
+	t.Setenv("CI", "")
+	t.Setenv("UPDATE_SNAPS", "")
+	path1 := snapPath(t, "TestFakeMulti", "1")
+	path2 := snapPath(t, "TestFakeMulti", "2")
+
+	ft := &fakeT{name: "TestFakeMulti"}
+	Match(ft, "first")
+	Match(ft, "second")
+	if ft.failed {
+		t.Fatalf("unexpected failure: %q", ft.msg)
+	}
+	for path, want := range map[string]string{path1: "first", path2: "second"} {
+		content, err := os.ReadFile(path)
+		if err != nil || string(content) != want {
+			t.Fatalf("%s: content=%q err=%v", path, content, err)
+		}
+	}
+}
+
+func TestReportObsolete(t *testing.T) {
+	dir := t.TempDir()
+	live := filepath.Join(dir, "TestLive_1.snap")
+	stale := filepath.Join(dir, "TestGone_1.snap")
+	other := filepath.Join(dir, "notes.txt")
+	for _, p := range []string{live, stale, other} {
+		if err := os.WriteFile(p, []byte("x"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	seen := map[string]bool{"TestLive_1.snap": true}
+
+	// Report mode: counts but keeps files.
+	n, err := reportObsolete(dir, seen, false)
+	if err != nil || n != 1 {
+		t.Fatalf("report mode: n=%d err=%v", n, err)
+	}
+	if _, err := os.Stat(stale); err != nil {
+		t.Fatal("report mode must not delete")
+	}
+
+	// Update mode: deletes the stale snapshot only.
+	n, err = reportObsolete(dir, seen, true)
+	if err != nil || n != 1 {
+		t.Fatalf("update mode: n=%d err=%v", n, err)
+	}
+	if _, err := os.Stat(stale); !os.IsNotExist(err) {
+		t.Fatal("stale snapshot should be deleted")
+	}
+	for _, p := range []string{live, other} {
+		if _, err := os.Stat(p); err != nil {
+			t.Fatalf("%s should survive cleanup: %v", p, err)
+		}
+	}
+}

From f22dd0d05afb3662c573308e99c1d2892c88500a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Tue, 11 Aug 2026 14:45:34 +0200
Subject: [PATCH 03/21] Add snap.MatchJSON with dotted-path value masking
 (#447)

Co-authored-by: Claude <noreply@anthropic.com>
---
 CLAUDE.md                                     |  2 +-
 ...elopeSink_UpdateCheckedEnvelopeJSON_1.snap | 12 +++
 internal/output/envelope_sink_test.go         | 15 ++++
 internal/snap/snap.go                         | 74 ++++++++++++++++++-
 internal/snap/snap_test.go                    | 58 +++++++++++++++
 5 files changed, 156 insertions(+), 5 deletions(-)
 create mode 100644 internal/output/__snapshots__/TestEnvelopeSink_UpdateCheckedEnvelopeJSON_1.snap

diff --git a/CLAUDE.md b/CLAUDE.md
index 8ab793b3..d45c08d0 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -233,7 +233,7 @@ When drafting Slack messages, PR descriptions, review replies, release notes, or
 # Testing
 
 - Prefer integration tests to cover most cases. Use unit tests when integration tests are not practical.
-- In-house test helpers (no external assertion/snapshot deps): `internal/must` for fatal generic assertions (`must.Eq` renders go-cmp diffs; `must.Nil`/`NotNil` handle typed nils), and `internal/snap` for file-snapshot tests. `snap.Match(t, s)` stores one file per snapshot under `__snapshots__/` next to the test; missing snapshots are created locally but fail in CI; `UPDATE_SNAPS=true go test ./...` rewrites them. A package using snapshots must wire `func TestMain(m *testing.M) { os.Exit(snap.Clean(m)) }` — obsolete snapshots then fail the run (or are deleted under `UPDATE_SNAPS=true`); cleanup is skipped on filtered (`-run`/`-skip`) or failed runs. Sanitize volatile values before matching with label-anchored regexes, not value-shaped ones (see `sanitizeSnapshot` in `internal/output`; RE2 has no lookahead, so a bare semver pattern corrupts IPv4 strings).
+- In-house test helpers (no external assertion/snapshot deps): `internal/must` for fatal generic assertions (`must.Eq` renders go-cmp diffs; `must.Nil`/`NotNil` handle typed nils), and `internal/snap` for file-snapshot tests. `snap.Match(t, s)` stores one file per snapshot under `__snapshots__/` next to the test; missing snapshots are created locally but fail in CI; `UPDATE_SNAPS=true go test ./...` rewrites them. `snap.MatchJSON(t, raw, "data.currentVersion", ...)` snapshots a JSON document in canonical pretty-printed form, masking the values at the given dotted paths with `<any>` (a path that doesn't resolve fails the test; objects only, no array indexing). A package using snapshots must wire `func TestMain(m *testing.M) { os.Exit(snap.Clean(m)) }` — obsolete snapshots then fail the run (or are deleted under `UPDATE_SNAPS=true`); cleanup is skipped on filtered (`-run`/`-skip`) or failed runs. Sanitize volatile values before matching with label-anchored regexes, not value-shaped ones (see `sanitizeSnapshot` in `internal/output`; RE2 has no lookahead, so a bare semver pattern corrupts IPv4 strings).
 - **When fixing a bug, always add an integration test** that fails before the fix and passes after. This prevents regressions and documents the exact scenario that was broken.
 - Integration tests that run the CLI binary with Bubble Tea must use a PTY (`github.com/creack/pty`) since Bubble Tea requires a terminal. Use `pty.Start(cmd)` instead of `cmd.CombinedOutput()`, read output with `io.Copy()`, and send keystrokes by writing to the PTY (e.g., `ptmx.Write([]byte("\r"))` for Enter).
 - Mark every integration test with `t.Parallel()` unless it shares external state with other tests. Today the main blocker is the Docker daemon: tests that start LocalStack containers cannot run concurrently because lstk's container discovery matches by `(image, internal port)`, so two parallel runs would cross-contaminate. Tests that only touch the filesystem, mock servers, or the CLI binary itself should be parallel.
diff --git a/internal/output/__snapshots__/TestEnvelopeSink_UpdateCheckedEnvelopeJSON_1.snap b/internal/output/__snapshots__/TestEnvelopeSink_UpdateCheckedEnvelopeJSON_1.snap
new file mode 100644
index 00000000..18cb6cb4
--- /dev/null
+++ b/internal/output/__snapshots__/TestEnvelopeSink_UpdateCheckedEnvelopeJSON_1.snap
@@ -0,0 +1,12 @@
+{
+  "command": "update",
+  "data": {
+    "currentVersion": "<any>",
+    "latestVersion": "<any>",
+    "updateAvailable": true
+  },
+  "error": null,
+  "schemaVersion": 1,
+  "status": "ok",
+  "warnings": []
+}
diff --git a/internal/output/envelope_sink_test.go b/internal/output/envelope_sink_test.go
index 93138776..5e475728 100644
--- a/internal/output/envelope_sink_test.go
+++ b/internal/output/envelope_sink_test.go
@@ -1,10 +1,12 @@
 package output
 
 import (
+	"encoding/json"
 	"errors"
 	"testing"
 
 	"github.com/localstack/lstk/internal/must"
+	"github.com/localstack/lstk/internal/snap"
 )
 
 func TestEnvelopeSink_SuccessWithNoEvents(t *testing.T) {
@@ -87,6 +89,19 @@ func TestEnvelopeSink_UpdateCheckedEvent(t *testing.T) {
 	}
 }
 
+// TestEnvelopeSink_UpdateCheckedEnvelopeJSON pins the full serialized
+// envelope shape (schemaVersion, status, data, warnings) as a snapshot,
+// masking the version fields that vary in real runs.
+func TestEnvelopeSink_UpdateCheckedEnvelopeJSON(t *testing.T) {
+	sink := NewEnvelopeSink(FormatJSON)
+	sink.Emit(UpdateCheckedEvent{CurrentVersion: "2.2.1", LatestVersion: "2.3.0", Available: true})
+
+	envelope := sink.Result("update", nil)
+	raw, err := json.Marshal(envelope)
+	must.NoError(t, err)
+	snap.MatchJSON(t, raw, "data.currentVersion", "data.latestVersion")
+}
+
 func TestEnvelopeSink_UpdateAppliedEvent(t *testing.T) {
 	t.Parallel()
 
diff --git a/internal/snap/snap.go b/internal/snap/snap.go
index 66af85d9..fdee4d14 100644
--- a/internal/snap/snap.go
+++ b/internal/snap/snap.go
@@ -14,6 +14,8 @@
 package snap
 
 import (
+	"bytes"
+	"encoding/json"
 	"errors"
 	"flag"
 	"fmt"
@@ -44,14 +46,78 @@ var unsafeChars = regexp.MustCompile(`[^A-Za-z0-9._-]+`)
 // UPDATE_SNAPS=true.
 func Match(t testing.TB, got string) {
 	t.Helper()
-	if n := flagValue("test.count"); n != "" && n != "1" {
-		t.Fatalf("snap: -count > 1 is not supported (snapshot call numbering would repeat)")
+	match(t, got, callerSnapshotDir(t))
+}
+
+// MatchJSON snapshots got (a JSON document) in canonical pretty-printed form
+// (two-space indent, object keys sorted by encoding/json), after replacing
+// the values at the given dotted paths (e.g. "data.currentVersion") with the
+// placeholder "<any>". Use the paths to mask values that legitimately change
+// between runs. A path that doesn't resolve fails the test, so a masked
+// field disappearing is caught rather than silently ignored. Paths traverse
+// JSON objects only; there is no array-index syntax.
+func MatchJSON(t testing.TB, got []byte, maskPaths ...string) {
+	t.Helper()
+	// The returns after Fatalf matter: tests exercise this path with a fake
+	// TB whose Fatalf does not stop the goroutine like *testing.T's does,
+	// and a fallthrough would store a bogus snapshot.
+	var v any
+	if err := json.Unmarshal(got, &v); err != nil {
+		t.Fatalf("snap: value is not valid JSON: %v", err)
+		return
 	}
-	_, file, _, ok := runtime.Caller(1)
+	for _, path := range maskPaths {
+		if !mask(v, strings.Split(path, ".")) {
+			t.Fatalf("snap: mask path %q not found in JSON", path)
+			return
+		}
+	}
+	// An Encoder rather than MarshalIndent so the "<any>" placeholder isn't
+	// HTML-escaped (u003c/u003e) in the stored snapshot. Encode appends the
+	// trailing newline.
+	var buf bytes.Buffer
+	enc := json.NewEncoder(&buf)
+	enc.SetEscapeHTML(false)
+	enc.SetIndent("", "  ")
+	if err := enc.Encode(v); err != nil {
+		t.Fatalf("snap: %v", err)
+	}
+	match(t, buf.String(), callerSnapshotDir(t))
+}
+
+// mask walks nested JSON objects along path segments and replaces the final
+// value with "<any>", reporting whether the full path resolved.
+func mask(v any, segs []string) bool {
+	m, ok := v.(map[string]any)
+	if !ok {
+		return false
+	}
+	if len(segs) == 1 {
+		if _, ok := m[segs[0]]; !ok {
+			return false
+		}
+		m[segs[0]] = "<any>"
+		return true
+	}
+	return mask(m[segs[0]], segs[1:])
+}
+
+// callerSnapshotDir resolves the __snapshots__ directory next to the test
+// file that called the exported Match/MatchJSON function (two frames up).
+func callerSnapshotDir(t testing.TB) string {
+	t.Helper()
+	_, file, _, ok := runtime.Caller(2)
 	if !ok {
 		t.Fatal("snap: cannot resolve calling test file")
 	}
-	dir := filepath.Join(filepath.Dir(file), "__snapshots__")
+	return filepath.Join(filepath.Dir(file), "__snapshots__")
+}
+
+func match(t testing.TB, got, dir string) {
+	t.Helper()
+	if n := flagValue("test.count"); n != "" && n != "1" {
+		t.Fatalf("snap: -count > 1 is not supported (snapshot call numbering would repeat)")
+	}
 
 	mu.Lock()
 	key := dir + "|" + t.Name()
diff --git a/internal/snap/snap_test.go b/internal/snap/snap_test.go
index bccbb06f..0f6e9c6b 100644
--- a/internal/snap/snap_test.go
+++ b/internal/snap/snap_test.go
@@ -174,6 +174,50 @@ func TestMatchCountsCallsWithinOneTest(t *testing.T) {
 	}
 }
 
+func TestMatchJSONMasksAndCanonicalizes(t *testing.T) {
+	t.Setenv("CI", "")
+	t.Setenv("UPDATE_SNAPS", "")
+	path := snapPath(t, "TestFakeJSON", "1")
+
+	ft := &fakeT{name: "TestFakeJSON"}
+	MatchJSON(ft, []byte(`{"zebra":1,"data":{"version":"4.14.1","name":"aws"}}`), "data.version")
+	if ft.failed {
+		t.Fatalf("unexpected failure: %q", ft.msg)
+	}
+	content, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := string(content)
+	if !strings.Contains(got, `"version": "<any>"`) {
+		t.Fatalf("masked value missing: %s", got)
+	}
+	if strings.Contains(got, "4.14.1") {
+		t.Fatalf("volatile value leaked into snapshot: %s", got)
+	}
+	if strings.Index(got, `"data"`) > strings.Index(got, `"zebra"`) {
+		t.Fatalf("keys not sorted: %s", got)
+	}
+}
+
+func TestMatchJSONFailsOnMissingMaskPath(t *testing.T) {
+	t.Setenv("CI", "")
+	ft := &fakeT{name: "TestFakeJSONBadPath"}
+	MatchJSON(ft, []byte(`{"data":{}}`), "data.version")
+	if !ft.fatal {
+		t.Fatal("missing mask path must be fatal")
+	}
+}
+
+func TestMatchJSONFailsOnInvalidJSON(t *testing.T) {
+	t.Setenv("CI", "")
+	ft := &fakeT{name: "TestFakeJSONInvalid"}
+	MatchJSON(ft, []byte(`not json`))
+	if !ft.fatal {
+		t.Fatal("invalid JSON must be fatal")
+	}
+}
+
 func TestReportObsolete(t *testing.T) {
 	dir := t.TempDir()
 	live := filepath.Join(dir, "TestLive_1.snap")
@@ -209,3 +253,17 @@ func TestReportObsolete(t *testing.T) {
 		}
 	}
 }
+
+func TestMatchJSONFatalPathsWriteNoSnapshot(t *testing.T) {
+	t.Setenv("CI", "")
+	dir := filepath.Join(filepath.Dir(callerFile(t)), "__snapshots__")
+
+	MatchJSON(&fakeT{name: "TestFakeJSONInvalid"}, []byte(`not json`))
+	MatchJSON(&fakeT{name: "TestFakeJSONBadPath"}, []byte(`{"data":{}}`), "data.version")
+
+	for _, name := range []string{"TestFakeJSONInvalid_1.snap", "TestFakeJSONBadPath_1.snap"} {
+		if _, err := os.Stat(filepath.Join(dir, name)); !os.IsNotExist(err) {
+			t.Fatalf("fatal MatchJSON call must not write %s", name)
+		}
+	}
+}

From da2818729bc43e2688bf60896151885a8ad737f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Tue, 11 Aug 2026 15:06:35 +0200
Subject: [PATCH 04/21] Fix stale go-snaps reference in sanitizeSnapshot
 comment

Co-Authored-By: Claude <noreply@anthropic.com>
---
 internal/output/snapshot_sanitize_test.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/internal/output/snapshot_sanitize_test.go b/internal/output/snapshot_sanitize_test.go
index 7d95e706..201cca5d 100644
--- a/internal/output/snapshot_sanitize_test.go
+++ b/internal/output/snapshot_sanitize_test.go
@@ -5,10 +5,10 @@ import (
 	"testing"
 )
 
-// go-snaps supports value placeholders only for MatchJSON (via the match
-// package); plain-text MatchSnapshot has no matcher hook. sanitizeSnapshot
-// fills that gap: it replaces volatile values in rendered CLI output with
-// stable placeholders so text snapshots stay deterministic across runs.
+// snap.MatchJSON masks volatile values via dotted paths, but plain-text
+// snap.Match has no masking hook. sanitizeSnapshot fills that gap: it
+// replaces volatile values in rendered CLI output with stable placeholders
+// so text snapshots stay deterministic across runs.
 //
 // The patterns are label-anchored rather than value-shaped on purpose: Go's
 // RE2 has no lookahead, so a bare semver pattern (\d+\.\d+\.\d+) would also

From 6ae644e11e204689c8e99f4a4bcbc91357c5a5a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Wed, 12 Aug 2026 11:22:53 +0200
Subject: [PATCH 05/21] Migrate integration tests to in-house must/snap helpers

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .gitattributes                                |   1 +
 internal/must/must.go                         | 335 ++++++++++-
 internal/must/must_test.go                    | 187 +++++-
 .../TestCDKInjectsCleanAWSEnv_1.snap          |   9 +
 ...onfigLoadFailureRendersJSONEnvelope_1.snap |  13 +
 ...ndledWithDescriptionAndPathNameOnly_1.snap |  46 ++
 ...tExtensionReceivesJSONFlagInContext_1.snap |   8 +
 ...otJSONCapableCommandRendersEnvelope_1.snap |  13 +
 .../TestSAMInjectsCleanAWSEnv_1.snap          |  10 +
 ...estSnapshotListSuccessWithoutDocker_1.snap |   6 +
 .../TestSnapshotShowPinnedVersion_1.snap      |   9 +
 ...estSnapshotShowSuccessWithoutDocker_1.snap |  13 +
 ...pshotVersionsFiltersDeletedVersions_1.snap |   6 +
 ...napshotVersionsSuccessWithoutDocker_1.snap |   7 +
 ...ndpointURLHTTPSRendersReducedOutput_1.snap |   5 +
 ...atusEndpointURLRendersReducedOutput_1.snap |   5 +
 ...estTerraformDryRunGeneratesOverride_1.snap |  16 +
 ...TestUpdateBinaryMockGitHubHappyPath_1.snap |   4 +
 ...tUsageErrorAfterJSONRendersEnvelope_1.snap |  13 +
 .../integration/auth_token_precedence_test.go |  23 +-
 test/integration/aws_cmd_test.go              | 225 ++++----
 test/integration/aws_completion_test.go       |  41 +-
 test/integration/aws_e2e_test.go              |  14 +-
 .../aws_profile_precedence_test.go            |  21 +-
 test/integration/awsconfig_test.go            | 161 +++---
 test/integration/az_cmd_test.go               |  53 +-
 test/integration/az_e2e_test.go               |  27 +-
 test/integration/az_interception_test.go      |  63 +-
 test/integration/az_pty_test.go               |  21 +-
 test/integration/cdk_cmd_test.go              |  91 ++-
 test/integration/cdk_e2e_test.go              |  26 +-
 test/integration/completion_test.go           |  39 +-
 test/integration/config_test.go               |  67 ++-
 test/integration/docker_unhealthy_test.go     |  35 +-
 test/integration/docker_windows_test.go       |  13 +-
 test/integration/docs_test.go                 |  25 +-
 test/integration/emulator_select_test.go      | 137 +++--
 test/integration/emulator_type_test.go        | 113 ++--
 test/integration/endpoint_url_https_test.go   |  56 +-
 test/integration/endpoint_url_test.go         | 134 +++--
 test/integration/env/env.go                   |  34 +-
 test/integration/exit_code_test.go            |  11 +-
 test/integration/extension_test.go            | 123 ++--
 test/integration/go.mod                       |  30 +-
 test/integration/go.sum                       |  57 +-
 test/integration/json_envelope_test.go        |  55 +-
 test/integration/json_flag_test.go            |  81 ++-
 test/integration/license_test.go              |  61 +-
 test/integration/localstack_test.go           |   6 +-
 test/integration/logging_test.go              |  23 +-
 test/integration/login_test.go                |  93 ++-
 test/integration/logout_test.go               |  47 +-
 test/integration/logs_test.go                 |  63 +-
 test/integration/main_test.go                 |  42 +-
 test/integration/multiple_installs_test.go    |  30 +-
 test/integration/non_interactive_test.go      |  15 +-
 test/integration/reset_test.go                |  73 ++-
 test/integration/restart_test.go              |  59 +-
 test/integration/sam_cmd_test.go              | 133 ++---
 test/integration/sam_e2e_test.go              |  19 +-
 test/integration/setup_azure_test.go          |  63 +-
 test/integration/signal_forwarding_test.go    |  24 +-
 test/integration/snap_sanitize_test.go        |  59 ++
 .../integration/snapshot_experimental_test.go |  17 +-
 test/integration/snapshot_list_test.go        |  49 +-
 test/integration/snapshot_load_test.go        |  93 ++-
 .../integration/snapshot_load_version_test.go |  65 +--
 test/integration/snapshot_merge_e2e_test.go   |  55 +-
 test/integration/snapshot_remove_test.go      |  73 ++-
 test/integration/snapshot_save_test.go        | 153 +++--
 test/integration/snapshot_show_test.go        |  54 +-
 test/integration/snapshot_versions_test.go    |  90 ++-
 test/integration/start_snapshot_test.go       |  23 +-
 test/integration/start_test.go                | 545 +++++++++---------
 test/integration/status_test.go               |  84 +--
 test/integration/stop_test.go                 |  83 ++-
 test/integration/telemetry_test.go            |  89 ++-
 test/integration/terraform_cmd_test.go        | 157 +++--
 test/integration/terraform_e2e_test.go        |  51 +-
 .../terraform_s3backend_e2e_test.go           |  43 +-
 test/integration/update_test.go               | 218 +++----
 test/integration/version_resolution_test.go   |  37 +-
 test/integration/volume_test.go               | 103 ++--
 83 files changed, 2982 insertions(+), 2392 deletions(-)
 create mode 100644 .gitattributes
 create mode 100644 test/integration/__snapshots__/TestCDKInjectsCleanAWSEnv_1.snap
 create mode 100644 test/integration/__snapshots__/TestConfigLoadFailureRendersJSONEnvelope_1.snap
 create mode 100644 test/integration/__snapshots__/TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly_1.snap
 create mode 100644 test/integration/__snapshots__/TestExtensionReceivesJSONFlagInContext_1.snap
 create mode 100644 test/integration/__snapshots__/TestNotJSONCapableCommandRendersEnvelope_1.snap
 create mode 100644 test/integration/__snapshots__/TestSAMInjectsCleanAWSEnv_1.snap
 create mode 100644 test/integration/__snapshots__/TestSnapshotListSuccessWithoutDocker_1.snap
 create mode 100644 test/integration/__snapshots__/TestSnapshotShowPinnedVersion_1.snap
 create mode 100644 test/integration/__snapshots__/TestSnapshotShowSuccessWithoutDocker_1.snap
 create mode 100644 test/integration/__snapshots__/TestSnapshotVersionsFiltersDeletedVersions_1.snap
 create mode 100644 test/integration/__snapshots__/TestSnapshotVersionsSuccessWithoutDocker_1.snap
 create mode 100644 test/integration/__snapshots__/TestStatusEndpointURLHTTPSRendersReducedOutput_1.snap
 create mode 100644 test/integration/__snapshots__/TestStatusEndpointURLRendersReducedOutput_1.snap
 create mode 100644 test/integration/__snapshots__/TestTerraformDryRunGeneratesOverride_1.snap
 create mode 100644 test/integration/__snapshots__/TestUpdateBinaryMockGitHubHappyPath_1.snap
 create mode 100644 test/integration/__snapshots__/TestUsageErrorAfterJSONRendersEnvelope_1.snap
 create mode 100644 test/integration/snap_sanitize_test.go

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 00000000..bdae166c
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+*.snap -text
diff --git a/internal/must/must.go b/internal/must/must.go
index 8221819e..5f707a60 100644
--- a/internal/must/must.go
+++ b/internal/must/must.go
@@ -1,54 +1,129 @@
 // Package must provides minimal generic test assertions that fail the test
 // immediately (t.Fatal semantics). In-house replacement for the subset of
-// github.com/shoenig/test/must that lstk uses; diffing is delegated to
-// go-cmp, which renders readable struct/slice mismatches.
+// testify that lstk uses; diffing is delegated to go-cmp, which renders
+// readable struct/slice mismatches.
+//
+// Argument order and trailing msgAndArgs follow testify's conventions
+// (want/expected before got/actual; an optional format string plus args at
+// the end) so call sites migrate mechanically.
 package must
 
 import (
+	"errors"
+	"fmt"
+	"os"
 	"reflect"
+	"regexp"
+	"strings"
 	"testing"
+	"time"
 
 	"github.com/google/go-cmp/cmp"
 )
 
+// message renders testify-style trailing msgAndArgs: a lone value is printed
+// as-is, a leading string with further args is a Printf format.
+func message(msgAndArgs []any) string {
+	switch len(msgAndArgs) {
+	case 0:
+		return ""
+	case 1:
+		return fmt.Sprintf("%v", msgAndArgs[0])
+	default:
+		if format, ok := msgAndArgs[0].(string); ok {
+			return fmt.Sprintf(format, msgAndArgs[1:]...)
+		}
+		return fmt.Sprint(msgAndArgs...)
+	}
+}
+
+func fatalf(t testing.TB, msgAndArgs []any, format string, args ...any) {
+	t.Helper()
+	s := fmt.Sprintf(format, args...)
+	if m := message(msgAndArgs); m != "" {
+		s = m + "\n" + s
+	}
+	t.Fatalf("%s", s)
+}
+
 // Eq fails the test if want and got are not deeply equal (go-cmp semantics).
-func Eq[A any](t testing.TB, want, got A, opts ...cmp.Option) {
+func Eq[A any](t testing.TB, want, got A, msgAndArgs ...any) {
 	t.Helper()
-	if diff := cmp.Diff(want, got, opts...); diff != "" {
-		t.Fatalf("mismatch (-want +got):\n%s", diff)
+	if diff := cmp.Diff(want, got); diff != "" {
+		fatalf(t, msgAndArgs, "mismatch (-want +got):\n%s", diff)
+	}
+}
+
+// NotEq fails the test if want and got are deeply equal (go-cmp semantics).
+func NotEq[A any](t testing.TB, want, got A, msgAndArgs ...any) {
+	t.Helper()
+	if cmp.Diff(want, got) == "" {
+		fatalf(t, msgAndArgs, "expected values to differ, both were %#v", got)
 	}
 }
 
 // True fails the test if ok is false.
-func True(t testing.TB, ok bool) {
+func True(t testing.TB, ok bool, msgAndArgs ...any) {
 	t.Helper()
 	if !ok {
-		t.Fatal("expected condition to be true")
+		fatalf(t, msgAndArgs, "expected condition to be true")
+	}
+}
+
+// False fails the test if ok is true.
+func False(t testing.TB, ok bool, msgAndArgs ...any) {
+	t.Helper()
+	if ok {
+		fatalf(t, msgAndArgs, "expected condition to be false")
 	}
 }
 
 // NoError fails the test if err is non-nil.
-func NoError(t testing.TB, err error) {
+func NoError(t testing.TB, err error, msgAndArgs ...any) {
 	t.Helper()
 	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
+		fatalf(t, msgAndArgs, "unexpected error: %v", err)
+	}
+}
+
+// Error fails the test if err is nil.
+func Error(t testing.TB, err error, msgAndArgs ...any) {
+	t.Helper()
+	if err == nil {
+		fatalf(t, msgAndArgs, "expected an error, got nil")
+	}
+}
+
+// ErrorIs fails the test if errors.Is(err, target) is false.
+func ErrorIs(t testing.TB, err, target error, msgAndArgs ...any) {
+	t.Helper()
+	if !errors.Is(err, target) {
+		fatalf(t, msgAndArgs, "expected error chain to contain %v, got %v", target, err)
+	}
+}
+
+// ErrorAs fails the test if errors.As(err, target) is false.
+func ErrorAs(t testing.TB, err error, target any, msgAndArgs ...any) {
+	t.Helper()
+	if !errors.As(err, target) {
+		fatalf(t, msgAndArgs, "expected error chain to contain %T, got %v", target, err)
 	}
 }
 
 // Nil fails the test if v is non-nil. Typed nils inside interfaces (e.g. a
 // nil *T stored in an any) count as nil.
-func Nil(t testing.TB, v any) {
+func Nil(t testing.TB, v any, msgAndArgs ...any) {
 	t.Helper()
 	if !isNil(v) {
-		t.Fatalf("expected nil, got %#v", v)
+		fatalf(t, msgAndArgs, "expected nil, got %#v", v)
 	}
 }
 
 // NotNil fails the test if v is nil (including typed nils, see Nil).
-func NotNil(t testing.TB, v any) {
+func NotNil(t testing.TB, v any, msgAndArgs ...any) {
 	t.Helper()
 	if isNil(v) {
-		t.Fatal("expected non-nil value")
+		fatalf(t, msgAndArgs, "expected non-nil value")
 	}
 }
 
@@ -63,3 +138,237 @@ func isNil(v any) bool {
 	}
 	return false
 }
+
+// Contains fails the test unless container (a string, slice, array, or map)
+// contains item (substring, element, or key respectively).
+func Contains(t testing.TB, container, item any, msgAndArgs ...any) {
+	t.Helper()
+	if !contains(t, container, item) {
+		fatalf(t, msgAndArgs, "%#v\ndoes not contain\n%#v", container, item)
+	}
+}
+
+// NotContains is the inverse of Contains.
+func NotContains(t testing.TB, container, item any, msgAndArgs ...any) {
+	t.Helper()
+	if contains(t, container, item) {
+		fatalf(t, msgAndArgs, "%#v\nunexpectedly contains\n%#v", container, item)
+	}
+}
+
+func contains(t testing.TB, container, item any) bool {
+	t.Helper()
+	if s, ok := container.(string); ok {
+		sub, ok := item.(string)
+		if !ok {
+			t.Fatalf("Contains: string container needs a string item, got %T", item)
+		}
+		return strings.Contains(s, sub)
+	}
+	rv := reflect.ValueOf(container)
+	switch rv.Kind() {
+	case reflect.Slice, reflect.Array:
+		for i := 0; i < rv.Len(); i++ {
+			if reflect.DeepEqual(rv.Index(i).Interface(), item) {
+				return true
+			}
+		}
+		return false
+	case reflect.Map:
+		for _, k := range rv.MapKeys() {
+			if reflect.DeepEqual(k.Interface(), item) {
+				return true
+			}
+		}
+		return false
+	}
+	t.Fatalf("Contains: unsupported container type %T", container)
+	return false
+}
+
+// Empty fails the test unless v is empty: nil, a zero-length string/slice/
+// map/array/channel, or a zero value.
+func Empty(t testing.TB, v any, msgAndArgs ...any) {
+	t.Helper()
+	if !isEmpty(v) {
+		fatalf(t, msgAndArgs, "expected empty, got %#v", v)
+	}
+}
+
+// NotEmpty is the inverse of Empty.
+func NotEmpty(t testing.TB, v any, msgAndArgs ...any) {
+	t.Helper()
+	if isEmpty(v) {
+		fatalf(t, msgAndArgs, "expected non-empty value of type %T", v)
+	}
+}
+
+func isEmpty(v any) bool {
+	if v == nil {
+		return true
+	}
+	rv := reflect.ValueOf(v)
+	switch rv.Kind() {
+	case reflect.String, reflect.Slice, reflect.Map, reflect.Array, reflect.Chan:
+		return rv.Len() == 0
+	case reflect.Pointer:
+		return rv.IsNil() || isEmpty(rv.Elem().Interface())
+	}
+	return rv.IsZero()
+}
+
+// Len fails the test unless v (a string, slice, array, map, or channel) has
+// length n.
+func Len(t testing.TB, v any, n int, msgAndArgs ...any) {
+	t.Helper()
+	rv := reflect.ValueOf(v)
+	switch rv.Kind() {
+	case reflect.String, reflect.Slice, reflect.Map, reflect.Array, reflect.Chan:
+		if rv.Len() != n {
+			fatalf(t, msgAndArgs, "expected length %d, got %d: %#v", n, rv.Len(), v)
+		}
+	default:
+		t.Fatalf("Len: unsupported type %T", v)
+	}
+}
+
+// InDelta fails the test unless expected and actual (any numeric kinds) are
+// within delta of each other.
+func InDelta(t testing.TB, expected, actual any, delta float64, msgAndArgs ...any) {
+	t.Helper()
+	e, ok1 := toFloat(expected)
+	a, ok2 := toFloat(actual)
+	if !ok1 || !ok2 {
+		t.Fatalf("InDelta: non-numeric arguments %T, %T", expected, actual)
+	}
+	if diff := e - a; diff < -delta || diff > delta {
+		fatalf(t, msgAndArgs, "expected %v within %v of %v", actual, delta, expected)
+	}
+}
+
+func toFloat(v any) (float64, bool) {
+	rv := reflect.ValueOf(v)
+	switch rv.Kind() {
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return float64(rv.Int()), true
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		return float64(rv.Uint()), true
+	case reflect.Float32, reflect.Float64:
+		return rv.Float(), true
+	}
+	return 0, false
+}
+
+// Regexp fails the test unless s matches the pattern (compiled with
+// regexp.MustCompile).
+func Regexp(t testing.TB, pattern, s string, msgAndArgs ...any) {
+	t.Helper()
+	if !regexp.MustCompile(pattern).MatchString(s) {
+		fatalf(t, msgAndArgs, "%q does not match pattern %q", s, pattern)
+	}
+}
+
+// ElementsMatch fails the test unless want and got contain the same elements
+// the same number of times, ignoring order.
+//
+// ponytail: O(n²) multiset compare via DeepEqual — fine for test-sized lists,
+// revisit if a caller ever passes thousands of elements.
+func ElementsMatch[A any](t testing.TB, want, got []A, msgAndArgs ...any) {
+	t.Helper()
+	if len(want) != len(got) {
+		fatalf(t, msgAndArgs, "element count differs: want %d, got %d\nwant: %#v\ngot:  %#v", len(want), len(got), want, got)
+		return
+	}
+	used := make([]bool, len(got))
+outer:
+	for _, w := range want {
+		for i, g := range got {
+			if !used[i] && reflect.DeepEqual(w, g) {
+				used[i] = true
+				continue outer
+			}
+		}
+		fatalf(t, msgAndArgs, "missing element %#v\nwant: %#v\ngot:  %#v", w, want, got)
+		return
+	}
+}
+
+// Less fails the test unless a < b.
+func Less[A ~int | ~int64 | ~float64 | ~string](t testing.TB, a, b A, msgAndArgs ...any) {
+	t.Helper()
+	if a >= b {
+		fatalf(t, msgAndArgs, "expected %v < %v", a, b)
+	}
+}
+
+// Greater fails the test unless a > b.
+func Greater[A ~int | ~int64 | ~float64 | ~string](t testing.TB, a, b A, msgAndArgs ...any) {
+	t.Helper()
+	if a <= b {
+		fatalf(t, msgAndArgs, "expected %v > %v", a, b)
+	}
+}
+
+// GreaterOrEqual fails the test unless a >= b.
+func GreaterOrEqual[A ~int | ~int64 | ~float64 | ~string](t testing.TB, a, b A, msgAndArgs ...any) {
+	t.Helper()
+	if a < b {
+		fatalf(t, msgAndArgs, "expected %v >= %v", a, b)
+	}
+}
+
+// Eventually polls cond every tick until it returns true, failing the test
+// if it hasn't within waitFor.
+func Eventually(t testing.TB, cond func() bool, waitFor, tick time.Duration, msgAndArgs ...any) {
+	t.Helper()
+	deadline := time.Now().Add(waitFor)
+	for {
+		if cond() {
+			return
+		}
+		if time.Now().After(deadline) {
+			fatalf(t, msgAndArgs, "condition not met within %v", waitFor)
+			return
+		}
+		time.Sleep(tick)
+	}
+}
+
+// Never polls cond every tick for the full waitFor window, failing the test
+// if it ever returns true.
+func Never(t testing.TB, cond func() bool, waitFor, tick time.Duration, msgAndArgs ...any) {
+	t.Helper()
+	deadline := time.Now().Add(waitFor)
+	for time.Now().Before(deadline) {
+		if cond() {
+			fatalf(t, msgAndArgs, "condition unexpectedly became true within %v", waitFor)
+			return
+		}
+		time.Sleep(tick)
+	}
+}
+
+// FileExists fails the test unless path exists and is not a directory.
+func FileExists(t testing.TB, path string, msgAndArgs ...any) {
+	t.Helper()
+	info, err := os.Stat(path)
+	if err != nil {
+		fatalf(t, msgAndArgs, "expected file %q to exist: %v", path, err)
+		return
+	}
+	if info.IsDir() {
+		fatalf(t, msgAndArgs, "expected %q to be a file, it is a directory", path)
+	}
+}
+
+// NoFileExists fails the test if path exists as a file.
+func NoFileExists(t testing.TB, path string, msgAndArgs ...any) {
+	t.Helper()
+	info, err := os.Stat(path)
+	if err != nil {
+		return
+	}
+	if !info.IsDir() {
+		fatalf(t, msgAndArgs, "expected file %q to not exist", path)
+	}
+}
diff --git a/internal/must/must_test.go b/internal/must/must_test.go
index 0233b6fd..ddb1ad2d 100644
--- a/internal/must/must_test.go
+++ b/internal/must/must_test.go
@@ -2,8 +2,12 @@ package must
 
 import (
 	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
+	"time"
 )
 
 // fakeT records failures instead of failing the real test. Only the methods
@@ -18,11 +22,12 @@ func (f *fakeT) Helper() {}
 
 func (f *fakeT) Fatal(args ...any) {
 	f.failed = true
+	f.msg = fmt.Sprint(args...)
 }
 
 func (f *fakeT) Fatalf(format string, args ...any) {
 	f.failed = true
-	f.msg = format
+	f.msg = fmt.Sprintf(format, args...)
 }
 
 func TestEq(t *testing.T) {
@@ -44,31 +49,19 @@ func TestEq(t *testing.T) {
 	}
 }
 
-func TestTrue(t *testing.T) {
+func TestMessageRendering(t *testing.T) {
 	t.Parallel()
 
 	ft := &fakeT{}
-	True(ft, true)
-	if ft.failed {
-		t.Fatal("True failed on true")
-	}
-	True(ft, false)
-	if !ft.failed {
-		t.Fatal("True passed on false")
+	True(ft, false, "context %d", 42)
+	if !strings.Contains(ft.msg, "context 42") {
+		t.Fatalf("trailing msgAndArgs should be rendered, got %q", ft.msg)
 	}
-}
 
-func TestNoError(t *testing.T) {
-	t.Parallel()
-
-	ft := &fakeT{}
-	NoError(ft, nil)
-	if ft.failed {
-		t.Fatal("NoError failed on nil error")
-	}
-	NoError(ft, errors.New("boom"))
-	if !ft.failed {
-		t.Fatal("NoError passed on non-nil error")
+	ft = &fakeT{}
+	True(ft, false, "plain message")
+	if !strings.Contains(ft.msg, "plain message") {
+		t.Fatalf("lone message should be rendered, got %q", ft.msg)
 	}
 }
 
@@ -102,3 +95,155 @@ func TestNilHandlesTypedNil(t *testing.T) {
 		}
 	}
 }
+
+// TestAssertions table-drives the pass/fail behavior of the simpler
+// assertions: each case runs the assertion against a fakeT and checks
+// whether it failed.
+func TestAssertions(t *testing.T) {
+	t.Parallel()
+
+	sentinel := errors.New("sentinel")
+	wrapped := fmt.Errorf("outer: %w", sentinel)
+
+	cases := map[string]struct {
+		run      func(t testing.TB)
+		wantFail bool
+	}{
+		"True ok":            {func(t testing.TB) { True(t, true) }, false},
+		"True bad":           {func(t testing.TB) { True(t, false) }, true},
+		"False ok":           {func(t testing.TB) { False(t, false) }, false},
+		"False bad":          {func(t testing.TB) { False(t, true) }, true},
+		"NoError ok":         {func(t testing.TB) { NoError(t, nil) }, false},
+		"NoError bad":        {func(t testing.TB) { NoError(t, sentinel) }, true},
+		"Error ok":           {func(t testing.TB) { Error(t, sentinel) }, false},
+		"Error bad":          {func(t testing.TB) { Error(t, nil) }, true},
+		"ErrorIs ok":         {func(t testing.TB) { ErrorIs(t, wrapped, sentinel) }, false},
+		"ErrorIs bad":        {func(t testing.TB) { ErrorIs(t, errors.New("other"), sentinel) }, true},
+		"NotEq ok":           {func(t testing.TB) { NotEq(t, 1, 2) }, false},
+		"NotEq bad":          {func(t testing.TB) { NotEq(t, 1, 1) }, true},
+		"Contains string ok": {func(t testing.TB) { Contains(t, "hello world", "world") }, false},
+		"Contains string bad": {func(t testing.TB) {
+			Contains(t, "hello world", "mars")
+		}, true},
+		"Contains slice ok":    {func(t testing.TB) { Contains(t, []string{"a", "b"}, "b") }, false},
+		"Contains slice bad":   {func(t testing.TB) { Contains(t, []string{"a", "b"}, "c") }, true},
+		"Contains map key ok":  {func(t testing.TB) { Contains(t, map[string]int{"k": 1}, "k") }, false},
+		"Contains map key bad": {func(t testing.TB) { Contains(t, map[string]int{"k": 1}, "x") }, true},
+		"NotContains ok":       {func(t testing.TB) { NotContains(t, "hello", "mars") }, false},
+		"NotContains bad":      {func(t testing.TB) { NotContains(t, "hello", "ell") }, true},
+		"Empty string ok":      {func(t testing.TB) { Empty(t, "") }, false},
+		"Empty string bad":     {func(t testing.TB) { Empty(t, "x") }, true},
+		"Empty slice ok":       {func(t testing.TB) { Empty(t, []int{}) }, false},
+		"Empty nil ok":         {func(t testing.TB) { Empty(t, nil) }, false},
+		"NotEmpty ok":          {func(t testing.TB) { NotEmpty(t, "x") }, false},
+		"NotEmpty bad":         {func(t testing.TB) { NotEmpty(t, "") }, true},
+		"Len ok":               {func(t testing.TB) { Len(t, []int{1, 2}, 2) }, false},
+		"Len bad":              {func(t testing.TB) { Len(t, []int{1, 2}, 3) }, true},
+		"InDelta ok":           {func(t testing.TB) { InDelta(t, 1, 1.0, 0) }, false},
+		"InDelta mixed ok":     {func(t testing.TB) { InDelta(t, 252, float64(252), 0) }, false},
+		"InDelta bad":          {func(t testing.TB) { InDelta(t, 1, 2, 0.5) }, true},
+		"Regexp ok":            {func(t testing.TB) { Regexp(t, `wor\w+`, "hello world") }, false},
+		"Regexp bad":           {func(t testing.TB) { Regexp(t, `^world`, "hello world") }, true},
+		"ElementsMatch ok": {func(t testing.TB) {
+			ElementsMatch(t, []string{"a", "b", "b"}, []string{"b", "a", "b"})
+		}, false},
+		"ElementsMatch count bad": {func(t testing.TB) {
+			ElementsMatch(t, []string{"a"}, []string{"a", "a"})
+		}, true},
+		"ElementsMatch multiset bad": {func(t testing.TB) {
+			ElementsMatch(t, []string{"a", "a"}, []string{"a", "b"})
+		}, true},
+		"Less ok":            {func(t testing.TB) { Less(t, 1, 2) }, false},
+		"Less bad":           {func(t testing.TB) { Less(t, 2, 2) }, true},
+		"Greater ok":         {func(t testing.TB) { Greater(t, 2, 1) }, false},
+		"Greater bad":        {func(t testing.TB) { Greater(t, 1, 2) }, true},
+		"GreaterOrEqual ok":  {func(t testing.TB) { GreaterOrEqual(t, 2, 2) }, false},
+		"GreaterOrEqual bad": {func(t testing.TB) { GreaterOrEqual(t, 1, 2) }, true},
+	}
+	for name, tc := range cases {
+		ft := &fakeT{}
+		tc.run(ft)
+		if ft.failed != tc.wantFail {
+			t.Errorf("%s: failed=%v, want %v (msg: %s)", name, ft.failed, tc.wantFail, ft.msg)
+		}
+	}
+}
+
+func TestErrorAs(t *testing.T) {
+	t.Parallel()
+
+	pathErr := &os.PathError{Op: "open", Path: "/nope", Err: os.ErrNotExist}
+	wrapped := fmt.Errorf("outer: %w", pathErr)
+
+	ft := &fakeT{}
+	var target *os.PathError
+	ErrorAs(ft, wrapped, &target)
+	if ft.failed {
+		t.Fatal("ErrorAs failed on matching chain")
+	}
+
+	ft = &fakeT{}
+	var other *os.LinkError
+	ErrorAs(ft, wrapped, &other)
+	if !ft.failed {
+		t.Fatal("ErrorAs passed on non-matching chain")
+	}
+}
+
+func TestEventuallyAndNever(t *testing.T) {
+	t.Parallel()
+
+	ft := &fakeT{}
+	n := 0
+	Eventually(ft, func() bool { n++; return n >= 3 }, time.Second, time.Millisecond)
+	if ft.failed {
+		t.Fatal("Eventually failed on condition that becomes true")
+	}
+
+	ft = &fakeT{}
+	Eventually(ft, func() bool { return false }, 10*time.Millisecond, time.Millisecond)
+	if !ft.failed {
+		t.Fatal("Eventually passed on condition that never becomes true")
+	}
+
+	ft = &fakeT{}
+	Never(ft, func() bool { return false }, 10*time.Millisecond, time.Millisecond)
+	if ft.failed {
+		t.Fatal("Never failed on condition that stays false")
+	}
+
+	ft = &fakeT{}
+	Never(ft, func() bool { return true }, time.Second, time.Millisecond)
+	if !ft.failed {
+		t.Fatal("Never passed on condition that becomes true")
+	}
+}
+
+func TestFileExists(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	file := filepath.Join(dir, "f.txt")
+	if err := os.WriteFile(file, []byte("x"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	cases := map[string]struct {
+		run      func(t testing.TB)
+		wantFail bool
+	}{
+		"FileExists ok":         {func(t testing.TB) { FileExists(t, file) }, false},
+		"FileExists missing":    {func(t testing.TB) { FileExists(t, filepath.Join(dir, "nope")) }, true},
+		"FileExists dir":        {func(t testing.TB) { FileExists(t, dir) }, true},
+		"NoFileExists ok":       {func(t testing.TB) { NoFileExists(t, filepath.Join(dir, "nope")) }, false},
+		"NoFileExists bad":      {func(t testing.TB) { NoFileExists(t, file) }, true},
+		"NoFileExists dir okay": {func(t testing.TB) { NoFileExists(t, dir) }, false},
+	}
+	for name, tc := range cases {
+		ft := &fakeT{}
+		tc.run(ft)
+		if ft.failed != tc.wantFail {
+			t.Errorf("%s: failed=%v, want %v", name, ft.failed, tc.wantFail)
+		}
+	}
+}
diff --git a/test/integration/__snapshots__/TestCDKInjectsCleanAWSEnv_1.snap b/test/integration/__snapshots__/TestCDKInjectsCleanAWSEnv_1.snap
new file mode 100644
index 00000000..842e6097
--- /dev/null
+++ b/test/integration/__snapshots__/TestCDKInjectsCleanAWSEnv_1.snap
@@ -0,0 +1,9 @@
+ARGS:synth
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=eu-west-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
\ No newline at end of file
diff --git a/test/integration/__snapshots__/TestConfigLoadFailureRendersJSONEnvelope_1.snap b/test/integration/__snapshots__/TestConfigLoadFailureRendersJSONEnvelope_1.snap
new file mode 100644
index 00000000..e59c3cb6
--- /dev/null
+++ b/test/integration/__snapshots__/TestConfigLoadFailureRendersJSONEnvelope_1.snap
@@ -0,0 +1,13 @@
+{
+  "command": "stop",
+  "data": null,
+  "error": {
+    "category": "CONFIG",
+    "code": "CONFIG_INVALID",
+    "message": "<any>",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
diff --git a/test/integration/__snapshots__/TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly_1.snap b/test/integration/__snapshots__/TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly_1.snap
new file mode 100644
index 00000000..7309ab31
--- /dev/null
+++ b/test/integration/__snapshots__/TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly_1.snap
@@ -0,0 +1,46 @@
+Usage: lstk [options] [command]
+
+LSTK - LocalStack command-line interface
+
+Commands:
+  completion  Generate the autocompletion script for the specified shell
+  config      Manage configuration
+  help        Help about any command
+  load        Load a snapshot into the running emulator
+  login       Manage login
+  logout      Remove stored authentication credentials
+  logs        Show emulator logs
+  reset       Reset emulator state
+  restart     Restart emulator
+  save        Save a snapshot of the emulator state
+  setup       Set up emulator CLI integration
+  snapshot    Manage emulator snapshots
+  start       Start emulator
+  status      Show emulator status and deployed resources
+  stop        Stop emulator
+  update      Update lstk to the latest version
+  volume      Manage emulator volume
+
+Tools:
+  aws         Run AWS CLI commands against LocalStack
+  az          Run Azure CLI commands against LocalStack
+  cdk         Run AWS CDK against LocalStack
+  sam         Run the AWS SAM CLI against LocalStack
+  terraform   Run Terraform against LocalStack
+
+Extensions:
+  deploy      Deploy your application to LocalStack
+  hello
+
+Options:
+      --config string         Path to config file
+      --endpoint-url string   Target an existing, externally-managed emulator at this URL
+  -h, --help                  Show help
+      --json                  Output in JSON format (only supported by some commands)
+      --no-snapshot           Skip auto-loading the configured snapshot for this run
+      --non-interactive       Disable interactive mode
+      --persist               Persist emulator state across restarts
+      --snapshot string       Snapshot REF to load after start (overrides config for this run)
+      --timeout duration      Maximum time to wait for the emulator to become ready (overrides LSTK_STARTUP_TIMEOUT; 0 uses the default)
+  -t, --type string           Emulator type to start (aws, snowflake, azure)
+  -v, --version               Show version
\ No newline at end of file
diff --git a/test/integration/__snapshots__/TestExtensionReceivesJSONFlagInContext_1.snap b/test/integration/__snapshots__/TestExtensionReceivesJSONFlagInContext_1.snap
new file mode 100644
index 00000000..97c0187e
--- /dev/null
+++ b/test/integration/__snapshots__/TestExtensionReceivesJSONFlagInContext_1.snap
@@ -0,0 +1,8 @@
+ARGS=[--foo]
+SELF=<path>
+API_VERSION=1
+CONFIG_DIR=<path>
+NON_INTERACTIVE=true
+JSON=true
+SESSION_ID=<id>
+EMULATOR_COUNT=0
\ No newline at end of file
diff --git a/test/integration/__snapshots__/TestNotJSONCapableCommandRendersEnvelope_1.snap b/test/integration/__snapshots__/TestNotJSONCapableCommandRendersEnvelope_1.snap
new file mode 100644
index 00000000..bb5043dc
--- /dev/null
+++ b/test/integration/__snapshots__/TestNotJSONCapableCommandRendersEnvelope_1.snap
@@ -0,0 +1,13 @@
+{
+  "command": "login",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"login\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
diff --git a/test/integration/__snapshots__/TestSAMInjectsCleanAWSEnv_1.snap b/test/integration/__snapshots__/TestSAMInjectsCleanAWSEnv_1.snap
new file mode 100644
index 00000000..e10a4bd3
--- /dev/null
+++ b/test/integration/__snapshots__/TestSAMInjectsCleanAWSEnv_1.snap
@@ -0,0 +1,10 @@
+ARGS:build
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=eu-west-1
+ENV_AWS_DEFAULT_REGION=eu-west-1
+ENV_AWS_ACCESS_KEY_ID=111111111111
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
\ No newline at end of file
diff --git a/test/integration/__snapshots__/TestSnapshotListSuccessWithoutDocker_1.snap b/test/integration/__snapshots__/TestSnapshotListSuccessWithoutDocker_1.snap
new file mode 100644
index 00000000..41f587dd
--- /dev/null
+++ b/test/integration/__snapshots__/TestSnapshotListSuccessWithoutDocker_1.snap
@@ -0,0 +1,6 @@
+Fetching snapshots...
+~ 2 snapshots
+
+  NAME           VERSION  LAST CHANGED
+  baseline-q2    3        <date>
+  infra-2026-04  1        -
\ No newline at end of file
diff --git a/test/integration/__snapshots__/TestSnapshotShowPinnedVersion_1.snap b/test/integration/__snapshots__/TestSnapshotShowPinnedVersion_1.snap
new file mode 100644
index 00000000..d9561f9d
--- /dev/null
+++ b/test/integration/__snapshots__/TestSnapshotShowPinnedVersion_1.snap
@@ -0,0 +1,9 @@
+Fetching snapshot version 1...
+Name            my-baseline
+Version         1
+Created         <date>
+Size            <size>
+LocalStack      <calver>
+Message         the first one
+
+Services        s3
\ No newline at end of file
diff --git a/test/integration/__snapshots__/TestSnapshotShowSuccessWithoutDocker_1.snap b/test/integration/__snapshots__/TestSnapshotShowSuccessWithoutDocker_1.snap
new file mode 100644
index 00000000..643bcd22
--- /dev/null
+++ b/test/integration/__snapshots__/TestSnapshotShowSuccessWithoutDocker_1.snap
@@ -0,0 +1,13 @@
+Fetching snapshot...
+Name            my-baseline
+Version         1
+Created         <date>
+Size            <size>
+LocalStack      <calver>
+Message         Pre-refactor baseline
+
+Services        s3, lambda, dynamodb, sqs
+
+Resources
+  lambda        1 function
+  s3            3 buckets
\ No newline at end of file
diff --git a/test/integration/__snapshots__/TestSnapshotVersionsFiltersDeletedVersions_1.snap b/test/integration/__snapshots__/TestSnapshotVersionsFiltersDeletedVersions_1.snap
new file mode 100644
index 00000000..6ecde50f
--- /dev/null
+++ b/test/integration/__snapshots__/TestSnapshotVersionsFiltersDeletedVersions_1.snap
@@ -0,0 +1,6 @@
+Fetching versions...
+~ 2 versions
+
+  VERSION  CREATED  LOCALSTACK  SERVICES
+  3        -        keep-three  -
+  1        -        keep-one    -
\ No newline at end of file
diff --git a/test/integration/__snapshots__/TestSnapshotVersionsSuccessWithoutDocker_1.snap b/test/integration/__snapshots__/TestSnapshotVersionsSuccessWithoutDocker_1.snap
new file mode 100644
index 00000000..b6dc6777
--- /dev/null
+++ b/test/integration/__snapshots__/TestSnapshotVersionsSuccessWithoutDocker_1.snap
@@ -0,0 +1,7 @@
+Fetching versions...
+~ 3 versions
+
+  VERSION  CREATED               LOCALSTACK  SERVICES
+  3        <date>  <calver>     s3, lambda
+  2        <date>  <calver>     s3
+  1        <date>  <calver>     -
\ No newline at end of file
diff --git a/test/integration/__snapshots__/TestStatusEndpointURLHTTPSRendersReducedOutput_1.snap b/test/integration/__snapshots__/TestStatusEndpointURLHTTPSRendersReducedOutput_1.snap
new file mode 100644
index 00000000..8678671c
--- /dev/null
+++ b/test/integration/__snapshots__/TestStatusEndpointURLHTTPSRendersReducedOutput_1.snap
@@ -0,0 +1,5 @@
+Fetching LocalStack status...
+✔︎ LocalStack AWS Emulator is running
+• Endpoint: https://127.0.0.1:<port>
+• Version: <version>
+> Note: No resources deployed
\ No newline at end of file
diff --git a/test/integration/__snapshots__/TestStatusEndpointURLRendersReducedOutput_1.snap b/test/integration/__snapshots__/TestStatusEndpointURLRendersReducedOutput_1.snap
new file mode 100644
index 00000000..d75ab62c
--- /dev/null
+++ b/test/integration/__snapshots__/TestStatusEndpointURLRendersReducedOutput_1.snap
@@ -0,0 +1,5 @@
+Fetching LocalStack status...
+✔︎ LocalStack AWS Emulator is running
+• Endpoint: http://127.0.0.1:<port>
+• Version: <version>
+> Note: No resources deployed
\ No newline at end of file
diff --git a/test/integration/__snapshots__/TestTerraformDryRunGeneratesOverride_1.snap b/test/integration/__snapshots__/TestTerraformDryRunGeneratesOverride_1.snap
new file mode 100644
index 00000000..54a3f342
--- /dev/null
+++ b/test/integration/__snapshots__/TestTerraformDryRunGeneratesOverride_1.snap
@@ -0,0 +1,16 @@
+# Generated by lstk - do not edit. This file is removed automatically.
+
+provider "aws" {
+  access_key = "111111111111"
+  secret_key = "test"
+  region = "us-west-2"
+  skip_credentials_validation = true
+  skip_metadata_api_check = true
+  s3_use_path_style = false
+
+  endpoints {
+    s3 = "http://<endpoint-host>:4566"
+    sqs = "http://<endpoint-host>:4566"
+  }
+}
+
diff --git a/test/integration/__snapshots__/TestUpdateBinaryMockGitHubHappyPath_1.snap b/test/integration/__snapshots__/TestUpdateBinaryMockGitHubHappyPath_1.snap
new file mode 100644
index 00000000..a5df27b6
--- /dev/null
+++ b/test/integration/__snapshots__/TestUpdateBinaryMockGitHubHappyPath_1.snap
@@ -0,0 +1,4 @@
+Checking for updates...
+Update available: 0.0.1 → v0.0.2
+Downloading and verifying update...
+✔︎ Updated to v0.0.2
diff --git a/test/integration/__snapshots__/TestUsageErrorAfterJSONRendersEnvelope_1.snap b/test/integration/__snapshots__/TestUsageErrorAfterJSONRendersEnvelope_1.snap
new file mode 100644
index 00000000..281836cf
--- /dev/null
+++ b/test/integration/__snapshots__/TestUsageErrorAfterJSONRendersEnvelope_1.snap
@@ -0,0 +1,13 @@
+{
+  "command": "stop",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "USAGE_ERROR",
+    "message": "unknown flag: --bogus-flag",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
diff --git a/test/integration/auth_token_precedence_test.go b/test/integration/auth_token_precedence_test.go
index b56f9a3c..a45fd44e 100644
--- a/test/integration/auth_token_precedence_test.go
+++ b/test/integration/auth_token_precedence_test.go
@@ -8,9 +8,8 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // seedStoredAuthToken writes a stored credential into the file-based keyring of
@@ -18,8 +17,8 @@ import (
 func seedStoredAuthToken(t *testing.T, home, token string) {
 	t.Helper()
 	configDir := expectedOSConfigDir(home, "")
-	require.NoError(t, os.MkdirAll(configDir, 0700))
-	require.NoError(t, os.WriteFile(filepath.Join(configDir, "auth-token"), []byte(token), 0600))
+	must.NoError(t, os.MkdirAll(configDir, 0700))
+	must.NoError(t, os.WriteFile(filepath.Join(configDir, "auth-token"), []byte(token), 0600))
 }
 
 func basicAuthHeader(token string) string {
@@ -44,11 +43,11 @@ func TestEnvAuthTokenOverridesStoredToken(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ,
 		"--non-interactive", "snapshot", "list",
 	)
-	require.NoError(t, err, "lstk snapshot list failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot list failed: %s", stderr)
 
 	called, _, auth := cap.get()
-	require.True(t, called, "the platform list endpoint should have been called")
-	assert.Equal(t, basicAuthHeader("env-token"), auth, "LOCALSTACK_AUTH_TOKEN should override the stored token")
+	must.True(t, called, "the platform list endpoint should have been called")
+	must.Eq(t, basicAuthHeader("env-token"), auth, "LOCALSTACK_AUTH_TOKEN should override the stored token")
 }
 
 func TestStoredTokenUsedWithoutEnvAuthToken(t *testing.T) {
@@ -67,11 +66,11 @@ func TestStoredTokenUsedWithoutEnvAuthToken(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ,
 		"--non-interactive", "snapshot", "list",
 	)
-	require.NoError(t, err, "lstk snapshot list failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot list failed: %s", stderr)
 
 	called, _, auth := cap.get()
-	require.True(t, called, "the platform list endpoint should have been called")
-	assert.Equal(t, basicAuthHeader("stored-token"), auth, "the stored token should be used when no env token is set")
+	must.True(t, called, "the platform list endpoint should have been called")
+	must.Eq(t, basicAuthHeader("stored-token"), auth, "the stored token should be used when no env token is set")
 }
 
 func TestEnvAuthTokenOverridesStoredTokenForExternalEmulator(t *testing.T) {
@@ -102,11 +101,11 @@ func TestEnvAuthTokenOverridesStoredTokenForExternalEmulator(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ,
 		"--non-interactive", "--endpoint-url", srv.URL, "snapshot", "load", "pod:my-baseline",
 	)
-	require.NoError(t, err, "lstk snapshot load failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot load failed: %s", stderr)
 
 	select {
 	case auth := <-authHeader:
-		assert.Equal(t, basicAuthHeader("env-token"), auth, "LOCALSTACK_AUTH_TOKEN should override the stored token")
+		must.Eq(t, basicAuthHeader("env-token"), auth, "LOCALSTACK_AUTH_TOKEN should override the stored token")
 	default:
 		t.Fatal("the external emulator pod endpoint should have been called")
 	}
diff --git a/test/integration/aws_cmd_test.go b/test/integration/aws_cmd_test.go
index 2f1a5d3c..4dee1fe3 100644
--- a/test/integration/aws_cmd_test.go
+++ b/test/integration/aws_cmd_test.go
@@ -9,10 +9,9 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // writeFakeAWS creates a shell script that mimics `aws` by printing its args and env vars.
@@ -50,7 +49,7 @@ echo "AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION-<unset>}"
 echo "AWS_PROFILE=${AWS_PROFILE-<unset>}"
 `
 	path := filepath.Join(dir, "aws")
-	require.NoError(t, os.WriteFile(path, []byte(script), 0755))
+	must.NoError(t, os.WriteFile(path, []byte(script), 0755))
 	return dir
 }
 
@@ -58,10 +57,10 @@ echo "AWS_PROFILE=${AWS_PROFILE-<unset>}"
 func writeAWSProfile(t *testing.T, homeDir string) {
 	t.Helper()
 	awsDir := filepath.Join(homeDir, ".aws")
-	require.NoError(t, os.MkdirAll(awsDir, 0700))
-	require.NoError(t, os.WriteFile(filepath.Join(awsDir, "config"),
+	must.NoError(t, os.MkdirAll(awsDir, 0700))
+	must.NoError(t, os.WriteFile(filepath.Join(awsDir, "config"),
 		[]byte("[profile localstack]\nregion = us-east-1\noutput = json\nendpoint_url = http://localhost.localstack.cloud:4566\n"), 0600))
-	require.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
+	must.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
 		[]byte("[localstack]\naws_access_key_id = test\naws_secret_access_key = test\n"), 0600))
 }
 
@@ -79,10 +78,10 @@ func TestAWSCommandInjectsEndpointAndArgs(t *testing.T) {
 		With(env.AnalyticsEndpoint, analyticsSrv.URL)
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	require.NoError(t, err, "lstk aws failed: %s", stderr)
+	must.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	assert.Contains(t, stdout, "ENDPOINT:http://")
-	assert.Contains(t, stdout, "ARGS:s3 ls")
+	must.Contains(t, stdout, "ENDPOINT:http://")
+	must.Contains(t, stdout, "ARGS:s3 ls")
 	assertCommandTelemetry(t, events, "aws", 0)
 }
 
@@ -99,16 +98,16 @@ func TestAWSCommandStripsGlobalFlagsFromPassthrough(t *testing.T) {
 
 	// --config must resolve to this file, not be forwarded to the aws binary.
 	configPath := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configPath, []byte("# lstk test config\n"), 0600))
+	must.NoError(t, os.WriteFile(configPath, []byte("# lstk test config\n"), 0600))
 
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, homeDir)
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "--config", configPath, "--non-interactive", "aws", "s3", "ls")
-	require.NoError(t, err, "lstk aws failed: %s", stderr)
+	must.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	assert.Contains(t, stdout, "ARGS:s3 ls")
-	assert.NotContains(t, stdout, "--config")
-	assert.NotContains(t, stdout, "--non-interactive")
+	must.Contains(t, stdout, "ARGS:s3 ls")
+	must.NotContains(t, stdout, "--config")
+	must.NotContains(t, stdout, "--non-interactive")
 }
 
 func TestAWSCommandInjectsCredentials(t *testing.T) {
@@ -123,11 +122,11 @@ func TestAWSCommandInjectsCredentials(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "sts", "get-caller-identity")
-	require.NoError(t, err, "lstk aws failed: %s", stderr)
+	must.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=test")
-	assert.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=test")
-	assert.Contains(t, stdout, "AWS_DEFAULT_REGION=us-east-1")
+	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=test")
+	must.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=test")
+	must.Contains(t, stdout, "AWS_DEFAULT_REGION=us-east-1")
 }
 
 func TestAWSCommandRespectsExistingCredentials(t *testing.T) {
@@ -147,11 +146,11 @@ func TestAWSCommandRespectsExistingCredentials(t *testing.T) {
 		With("AWS_DEFAULT_REGION", "eu-west-1")
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	require.NoError(t, err, "lstk aws failed: %s", stderr)
+	must.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=custom-key")
-	assert.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=custom-secret")
-	assert.Contains(t, stdout, "AWS_DEFAULT_REGION=eu-west-1")
+	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=custom-key")
+	must.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=custom-secret")
+	must.Contains(t, stdout, "AWS_DEFAULT_REGION=eu-west-1")
 }
 
 // The profile is selected through AWS_PROFILE, never a --profile argument: an
@@ -171,17 +170,17 @@ func TestAWSCommandUsesProfileWhenAvailable(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, homeDir)
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	require.NoError(t, err, "lstk aws failed: %s", stderr)
+	must.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	assert.Contains(t, stdout, "AWS_PROFILE=localstack")
-	assert.NotContains(t, stdout, "--profile")
+	must.Contains(t, stdout, "AWS_PROFILE=localstack")
+	must.NotContains(t, stdout, "--profile")
 	// The profile is the sole credentials source: lstk removes the variables
 	// rather than seeding over them (7.10).
-	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=<unset>")
-	assert.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=<unset>")
-	assert.Contains(t, stdout, "AWS_SESSION_TOKEN=<unset>")
+	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=<unset>")
+	must.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=<unset>")
+	must.Contains(t, stdout, "AWS_SESSION_TOKEN=<unset>")
 	// No default region is seeded over the profile's own (7.12).
-	assert.Contains(t, stdout, "AWS_DEFAULT_REGION=<unset>")
+	must.Contains(t, stdout, "AWS_DEFAULT_REGION=<unset>")
 }
 
 // 7.1 — the path that already worked: with no profile configured, a 12-digit
@@ -200,9 +199,9 @@ func TestAWSCommandAccountFromEnvWithoutProfile(t *testing.T) {
 		With("AWS_ACCESS_KEY_ID", "111111111111")
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	require.NoError(t, err, "lstk aws failed: %s", stderr)
+	must.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
+	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
 }
 
 // 7.2 — the silent failure this change fixes: the same command stopped working
@@ -225,12 +224,12 @@ func TestAWSCommandAccountFromEnvWithProfile(t *testing.T) {
 		With("AWS_ACCESS_KEY_ID", "111111111111")
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	require.NoError(t, err, "lstk aws failed: %s", stderr)
+	must.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
-	assert.NotContains(t, stdout, "--profile")
+	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
+	must.NotContains(t, stdout, "--profile")
 	// The profile is still selected, so its other settings keep applying.
-	assert.Contains(t, stdout, "AWS_PROFILE=localstack")
+	must.Contains(t, stdout, "AWS_PROFILE=localstack")
 }
 
 // 7.3 — the flag, with the profile present so the bypass path is exercised.
@@ -248,16 +247,16 @@ func TestAWSCommandAccountFlag(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, homeDir)
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "--account", "111111111111", "s3", "ls")
-	require.NoError(t, err, "lstk aws failed: %s", stderr)
+	must.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
+	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
 	// The flag is lstk's: it must not reach the AWS CLI.
-	assert.Contains(t, stdout, "ARGS:s3 ls")
+	must.Contains(t, stdout, "ARGS:s3 ls")
 	// A secret is always supplied alongside the key — a lone access key id
 	// makes the AWS CLI fail with "Partial credentials found in env" (7.11).
-	assert.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=test")
+	must.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=test")
 	// No default region is seeded over the profile's own (7.12).
-	assert.Contains(t, stdout, "AWS_DEFAULT_REGION=<unset>")
+	must.Contains(t, stdout, "AWS_DEFAULT_REGION=<unset>")
 }
 
 // 7.4
@@ -275,10 +274,10 @@ func TestAWSCommandAccountFlagBeatsEnv(t *testing.T) {
 		With("AWS_ACCESS_KEY_ID", "111111111111")
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "--account=222222222222", "s3", "ls")
-	require.NoError(t, err, "lstk aws failed: %s", stderr)
+	must.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=222222222222")
-	assert.NotContains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
+	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=222222222222")
+	must.NotContains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
 }
 
 // 7.9 — a real key in the environment is not an account selection: the profile
@@ -302,14 +301,14 @@ func TestAWSCommandRealAccessKeyDoesNotDisplaceProfile(t *testing.T) {
 		With("AWS_SESSION_TOKEN", "realtoken")
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	require.NoError(t, err, "lstk aws failed: %s", stderr)
+	must.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	assert.Contains(t, stdout, "AWS_PROFILE=localstack")
-	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=<unset>")
-	assert.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=<unset>")
-	assert.Contains(t, stdout, "AWS_SESSION_TOKEN=<unset>")
-	assert.NotContains(t, stdout, "AKIAIOSFODNN7EXAMPLE")
-	assert.NotContains(t, stdout, "realsecret")
+	must.Contains(t, stdout, "AWS_PROFILE=localstack")
+	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=<unset>")
+	must.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=<unset>")
+	must.Contains(t, stdout, "AWS_SESSION_TOKEN=<unset>")
+	must.NotContains(t, stdout, "AKIAIOSFODNN7EXAMPLE")
+	must.NotContains(t, stdout, "realsecret")
 }
 
 // 7.9 (no-profile half) — with nothing else to supply credentials the key is
@@ -329,11 +328,11 @@ func TestAWSCommandDeactivatesRealAccessKeyWithoutProfile(t *testing.T) {
 		With("AWS_SESSION_TOKEN", "realtoken")
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	require.NoError(t, err, "lstk aws failed: %s", stderr)
+	must.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=LKIAIOSFODNN7EXAMPLE")
-	assert.NotContains(t, stdout, "AKIAIOSFODNN7EXAMPLE")
-	assert.Contains(t, stdout, "AWS_SESSION_TOKEN=<unset>")
+	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=LKIAIOSFODNN7EXAMPLE")
+	must.NotContains(t, stdout, "AKIAIOSFODNN7EXAMPLE")
+	must.Contains(t, stdout, "AWS_SESSION_TOKEN=<unset>")
 }
 
 // 7.7 — a --account after the AWS service belongs to the AWS CLI
@@ -349,10 +348,10 @@ func TestAWSCommandForwardsNonLeadingAccountFlag(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls", "--account", "111111111111")
-	require.NoError(t, err, "lstk aws failed: %s", stderr)
+	must.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	assert.Contains(t, stdout, "ARGS:s3 ls --account 111111111111")
-	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=test")
+	must.Contains(t, stdout, "ARGS:s3 ls --account 111111111111")
+	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=test")
 }
 
 // 7.8 — --region is the AWS CLI's own flag and is never consumed by lstk, even
@@ -368,9 +367,9 @@ func TestAWSCommandForwardsRegionFlag(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "--region", "us-west-2", "s3", "ls")
-	require.NoError(t, err, "lstk aws failed: %s", stderr)
+	must.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	assert.Contains(t, stdout, "ARGS:--region us-west-2 s3 ls")
+	must.Contains(t, stdout, "ARGS:--region us-west-2 s3 ls")
 }
 
 // 7.5 — rejected at the command boundary, before the AWS CLI is invoked. No
@@ -382,10 +381,10 @@ func TestAWSCommandRejectsInvalidAccount(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "--account", "12345", "s3", "ls")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "12-digit AWS account id")
+	must.Error(t, err)
+	must.Contains(t, stdout, "12-digit AWS account id")
 	// The AWS CLI must not have run.
-	assert.NotContains(t, stdout, "ARGS:")
+	must.NotContains(t, stdout, "ARGS:")
 }
 
 // 7.5 (missing value)
@@ -396,9 +395,9 @@ func TestAWSCommandRejectsAccountWithoutValue(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "--account")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "--account requires a value")
-	assert.NotContains(t, stdout, "ARGS:")
+	must.Error(t, err)
+	must.Contains(t, stdout, "--account requires a value")
+	must.NotContains(t, stdout, "ARGS:")
 }
 
 // 7.6 — a flag before the `aws` token would be eaten during Cobra's command
@@ -410,9 +409,9 @@ func TestAWSCommandRejectsPreSubcommandAccount(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "--account", "111111111111", "aws", "s3", "ls")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "must appear after the aws subcommand")
-	assert.NotContains(t, stdout, "ARGS:")
+	must.Error(t, err)
+	must.Contains(t, stdout, "must appear after the aws subcommand")
+	must.NotContains(t, stdout, "ARGS:")
 }
 
 // The leading flag is consumed before the help short-circuit, so help still
@@ -424,9 +423,9 @@ func TestAWSCommandAccountWithHelp(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "--account", "111111111111", "help")
-	require.NoError(t, err, "lstk aws help failed: %s", stderr)
+	must.NoError(t, err, "lstk aws help failed: %s", stderr)
 
-	assert.NotContains(t, stdout, "--account")
+	must.NotContains(t, stdout, "--account")
 }
 
 func TestAWSCommandFailsWhenAWSCLINotInstalled(t *testing.T) {
@@ -434,10 +433,10 @@ func TestAWSCommandFailsWhenAWSCLINotInstalled(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).With(env.Home, t.TempDir())
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "s3", "ls")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "aws CLI not found in PATH")
-	assert.Contains(t, stdout, "Install AWS CLI:")
-	assert.Contains(t, stdout, "https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html")
+	must.Error(t, err)
+	must.Contains(t, stdout, "aws CLI not found in PATH")
+	must.Contains(t, stdout, "Install AWS CLI:")
+	must.Contains(t, stdout, "https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html")
 }
 
 func TestAWSCommandUsesDefaultPortWithoutConfig(t *testing.T) {
@@ -454,9 +453,9 @@ func TestAWSCommandUsesDefaultPortWithoutConfig(t *testing.T) {
 		With(env.Home, t.TempDir()) // isolate from any real config file
 
 	stdout, stderr, err := runLstk(t, ctx, workDir, e, "aws", "s3", "ls")
-	require.NoError(t, err, "lstk aws failed: %s", stderr)
+	must.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	assert.Contains(t, stdout, ":4566")
+	must.Contains(t, stdout, ":4566")
 }
 
 func TestAWSCommandUsesPortFromConfig(t *testing.T) {
@@ -476,15 +475,15 @@ tag = "latest"
 port = "4599"
 `
 	lstkDir := filepath.Join(workDir, ".lstk")
-	require.NoError(t, os.MkdirAll(lstkDir, 0755))
-	require.NoError(t, os.WriteFile(filepath.Join(lstkDir, "config.toml"), []byte(configContent), 0644))
+	must.NoError(t, os.MkdirAll(lstkDir, 0755))
+	must.NoError(t, os.WriteFile(filepath.Join(lstkDir, "config.toml"), []byte(configContent), 0644))
 
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir)
 
 	stdout, stderr, err := runLstk(t, ctx, workDir, e, "aws", "s3", "ls")
-	require.NoError(t, err, "lstk aws failed: %s", stderr)
+	must.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	assert.Contains(t, stdout, ":4599")
+	must.Contains(t, stdout, ":4599")
 }
 
 // writeFakeAWSFailing creates a shell script that mimics a failing `aws` command.
@@ -502,7 +501,7 @@ echo "aws: error: simulated failure" >&2
 exit %d
 `, exitCode)
 	path := filepath.Join(dir, "aws")
-	require.NoError(t, os.WriteFile(path, []byte(script), 0755))
+	must.NoError(t, os.WriteFile(path, []byte(script), 0755))
 	return dir
 }
 
@@ -517,8 +516,8 @@ func TestAWSCommandPropagatesExitCode(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir)
 
 	_, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	require.Error(t, err, "lstk aws should fail when aws command fails")
-	assert.Contains(t, stderr, "simulated failure")
+	must.Error(t, err, "lstk aws should fail when aws command fails")
+	must.Contains(t, stderr, "simulated failure")
 	requireExitCode(t, 42, err)
 }
 
@@ -534,7 +533,7 @@ func TestAWSCommandHelpSkipsDockerAndEmulator(t *testing.T) {
 
 	dir := t.TempDir()
 	script := "#!/bin/sh\necho \"ARGS:$*\"\n"
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "aws"), []byte(script), 0755))
+	must.NoError(t, os.WriteFile(filepath.Join(dir, "aws"), []byte(script), 0755))
 
 	for _, args := range [][]string{{"--help"}, {"-h"}, {"s3", "--help"}, {"help"}, {"s3", "help"}} {
 		args := args
@@ -546,10 +545,10 @@ func TestAWSCommandHelpSkipsDockerAndEmulator(t *testing.T) {
 
 			cmdArgs := append([]string{"aws"}, args...)
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, cmdArgs...)
-			require.NoError(t, err, "stderr: %s", stderr)
+			must.NoError(t, err, "stderr: %s", stderr)
 
-			assert.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
-			assert.NotContains(t, stdout, "--endpoint-url")
+			must.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
+			must.NotContains(t, stdout, "--endpoint-url")
 		})
 	}
 }
@@ -565,8 +564,8 @@ func TestAWSCommandFailsWhenDockerNotRunning(t *testing.T) {
 		With(env.Key("DOCKER_HOST"), "tcp://localhost:1")
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "s3", "ls")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "Docker is not available")
+	must.Error(t, err)
+	must.Contains(t, stdout, "Docker is not available")
 }
 
 func TestAWSCommandFailsWhenEmulatorNotRunning(t *testing.T) {
@@ -580,10 +579,10 @@ func TestAWSCommandFailsWhenEmulatorNotRunning(t *testing.T) {
 		With(env.AnalyticsEndpoint, analyticsSrv.URL)
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "s3", "ls")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "is not running")
-	assert.Contains(t, stdout, "Start LocalStack:")
-	assert.Contains(t, stdout, "lstk")
+	must.Error(t, err)
+	must.Contains(t, stdout, "is not running")
+	must.Contains(t, stdout, "Start LocalStack:")
+	must.Contains(t, stdout, "lstk")
 	assertCommandTelemetry(t, events, "aws", 1)
 }
 
@@ -598,8 +597,8 @@ func TestAWSCommandHintsSetupCommandWhenProfileMissing(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	require.NoError(t, err)
-	assert.Contains(t, stdout, "lstk setup aws")
+	must.NoError(t, err)
+	must.Contains(t, stdout, "lstk setup aws")
 }
 
 func TestAWSCommandWorksWithExternalContainer(t *testing.T) {
@@ -611,7 +610,7 @@ func TestAWSCommandWorksWithExternalContainer(t *testing.T) {
 
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -622,8 +621,8 @@ func TestAWSCommandWorksWithExternalContainer(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	require.NoError(t, err, "lstk aws should work with externally-named container: %s", stderr)
-	assert.Contains(t, stdout, "ENDPOINT:http://")
+	must.NoError(t, err, "lstk aws should work with externally-named container: %s", stderr)
+	must.Contains(t, stdout, "ENDPOINT:http://")
 }
 
 // writeSlowFakeAWS creates a fake `aws` script that sleeps for the given duration
@@ -643,7 +642,7 @@ shift 2
 echo "ARGS:$@"
 `, sleepSeconds)
 	path := filepath.Join(dir, "aws")
-	require.NoError(t, os.WriteFile(path, []byte(script), 0755))
+	must.NoError(t, os.WriteFile(path, []byte(script), 0755))
 	return dir
 }
 
@@ -662,12 +661,12 @@ func TestAWSCommandShowsSpinnerForSlowOperation(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir+":/bin:/usr/bin").With(env.Home, homeDir)
 
 	out, err := runLstkInPTY(t, ctx, e, "aws", "s3", "ls")
-	require.NoError(t, err, "lstk aws failed: %s", out)
+	must.NoError(t, err, "lstk aws failed: %s", out)
 
-	assert.Contains(t, out, "Loading service")
-	assert.Contains(t, out, "ARGS:s3 ls")
+	must.Contains(t, out, "Loading service")
+	must.Contains(t, out, "ARGS:s3 ls")
 	// lstk selects the profile via AWS_PROFILE, never a --profile argument.
-	assert.NotContains(t, out, "--profile")
+	must.NotContains(t, out, "--profile")
 }
 
 func TestAWSCommandSuppressesSpinnerInNonInteractiveMode(t *testing.T) {
@@ -686,12 +685,12 @@ func TestAWSCommandSuppressesSpinnerInNonInteractiveMode(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir+":/bin:/usr/bin").With(env.Home, homeDir)
 
 	out, err := runLstkInPTY(t, ctx, e, "--non-interactive", "aws", "s3", "ls")
-	require.NoError(t, err, "lstk aws failed: %s", out)
+	must.NoError(t, err, "lstk aws failed: %s", out)
 
-	assert.NotContains(t, out, "Loading service")
-	assert.Contains(t, out, "ARGS:s3 ls")
+	must.NotContains(t, out, "Loading service")
+	must.Contains(t, out, "ARGS:s3 ls")
 	// lstk selects the profile via AWS_PROFILE, never a --profile argument.
-	assert.NotContains(t, out, "--profile")
+	must.NotContains(t, out, "--profile")
 }
 
 func TestAWSCommandSuppressesSpinnerForFastOperation(t *testing.T) {
@@ -708,12 +707,12 @@ func TestAWSCommandSuppressesSpinnerForFastOperation(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, homeDir)
 
 	out, err := runLstkInPTY(t, ctx, e, "aws", "s3", "ls")
-	require.NoError(t, err, "lstk aws failed: %s", out)
+	must.NoError(t, err, "lstk aws failed: %s", out)
 
-	assert.NotContains(t, out, "Loading service")
-	assert.Contains(t, out, "ARGS:s3 ls")
+	must.NotContains(t, out, "Loading service")
+	must.Contains(t, out, "ARGS:s3 ls")
 	// lstk selects the profile via AWS_PROFILE, never a --profile argument.
-	assert.NotContains(t, out, "--profile")
+	must.NotContains(t, out, "--profile")
 }
 
 func TestAWSCommandSuppressesHintWhenProfileExists(t *testing.T) {
@@ -730,6 +729,6 @@ func TestAWSCommandSuppressesHintWhenProfileExists(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, homeDir)
 
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	require.NoError(t, err)
-	assert.NotContains(t, stdout, "lstk setup aws")
+	must.NoError(t, err)
+	must.NotContains(t, stdout, "lstk setup aws")
 }
diff --git a/test/integration/aws_completion_test.go b/test/integration/aws_completion_test.go
index bbdb5164..37e1599d 100644
--- a/test/integration/aws_completion_test.go
+++ b/test/integration/aws_completion_test.go
@@ -7,8 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"github.com/localstack/lstk/internal/must"
 
 	"github.com/localstack/lstk/test/integration/env"
 )
@@ -29,7 +28,7 @@ echo "compline=[$COMP_LINE]"
 echo "ls"
 echo "list-buckets"
 `
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "aws_completer"), []byte(script), 0o755))
+	must.NoError(t, os.WriteFile(filepath.Join(dir, "aws_completer"), []byte(script), 0o755))
 	return dir
 }
 
@@ -44,16 +43,16 @@ func TestAWSCompletionDelegatesToAWSCompleter(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "__complete", "aws", "s3", "l")
-	require.NoError(t, err, "stderr: %s", stderr)
+	must.NoError(t, err, "stderr: %s", stderr)
 
 	// The completer strips the first word of COMP_LINE and resolves the rest
 	// against the aws command tree, so lstk's own name must not be in it.
-	assert.Contains(t, stdout, "compline=[aws s3 l]")
-	assert.NotContains(t, stdout, "compline=[lstk")
+	must.Contains(t, stdout, "compline=[aws s3 l]")
+	must.NotContains(t, stdout, "compline=[lstk")
 
 	completions := strings.Fields(stdout)
-	assert.Contains(t, completions, "ls")
-	assert.Contains(t, completions, "list-buckets")
+	must.Contains(t, completions, "ls")
+	must.Contains(t, completions, "list-buckets")
 }
 
 // TestAWSCompletionAppendsTrailingSpaceForNewWord verifies the cursor position
@@ -66,9 +65,9 @@ func TestAWSCompletionAppendsTrailingSpaceForNewWord(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "__complete", "aws", "s3", "")
-	require.NoError(t, err, "stderr: %s", stderr)
+	must.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "compline=[aws s3 ]")
+	must.Contains(t, stdout, "compline=[aws s3 ]")
 }
 
 // TestAWSCompletionStripsGlobalFlags keeps lstk's own persistent flags out of
@@ -82,9 +81,9 @@ func TestAWSCompletionStripsGlobalFlags(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"__complete", "aws", "--non-interactive", "s3", "l")
-	require.NoError(t, err, "stderr: %s", stderr)
+	must.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "compline=[aws s3 l]")
+	must.Contains(t, stdout, "compline=[aws s3 l]")
 }
 
 // TestAWSCompletionNeedsNoDockerOrEmulator guards the property that makes this
@@ -100,10 +99,10 @@ func TestAWSCompletionNeedsNoDockerOrEmulator(t *testing.T) {
 		With(env.Key("DOCKER_HOST"), "tcp://localhost:1")
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "__complete", "aws", "s3", "l")
-	require.NoError(t, err, "stderr: %s", stderr)
+	must.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "ls")
-	assert.NotContains(t, stdout, "Docker is not available")
+	must.Contains(t, stdout, "ls")
+	must.NotContains(t, stdout, "Docker is not available")
 }
 
 // TestAWSCompletionDegradesWhenCompleterMissing verifies a machine without
@@ -115,11 +114,11 @@ func TestAWSCompletionDegradesWhenCompleterMissing(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "__complete", "aws", "s3", "l")
-	require.NoError(t, err, "stderr: %s", stderr)
+	must.NoError(t, err, "stderr: %s", stderr)
 
 	// ShellCompDirectiveDefault (0) — hand the word back to the shell's own
 	// file completion rather than offering nothing at all.
-	assert.Equal(t, ":0", strings.TrimSpace(stdout))
+	must.Eq(t, ":0", strings.TrimSpace(stdout))
 }
 
 // TestBashCompletionForAWSSubcommand drives the real generated bash script the
@@ -132,10 +131,10 @@ func TestBashCompletionForAWSSubcommand(t *testing.T) {
 	driver := completeInDriver(`lstk aws s3 l`, 3, "lstk aws s3 l")
 
 	stdout, stderr, err := runBashCompletionDriver(t, driver, fakeDir)
-	require.NoError(t, err, "completion attempt failed\nstdout: %s\nstderr: %s", stdout, stderr)
-	assert.NotContains(t, stderr, "command not found")
+	must.NoError(t, err, "completion attempt failed\nstdout: %s\nstderr: %s", stdout, stderr)
+	must.NotContains(t, stderr, "command not found")
 
 	completions := strings.Fields(stdout)
-	assert.Contains(t, completions, "ls")
-	assert.Contains(t, completions, "list-buckets")
+	must.Contains(t, completions, "ls")
+	must.Contains(t, completions, "list-buckets")
 }
diff --git a/test/integration/aws_e2e_test.go b/test/integration/aws_e2e_test.go
index b2c0b527..10933476 100644
--- a/test/integration/aws_e2e_test.go
+++ b/test/integration/aws_e2e_test.go
@@ -10,8 +10,8 @@ import (
 	"time"
 
 	"github.com/creack/pty"
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/require"
 )
 
 // End-to-end tests for `lstk aws` that exercise the real aws CLI against a real
@@ -50,20 +50,20 @@ func TestAWSLogsTailFollowStreamsInPTY(t *testing.T) {
 	const marker = "hello-tail-follow"
 
 	_, stderr, err := runLstk(t, ctx, "", e, "aws", "logs", "create-log-group", "--log-group-name", logGroup)
-	require.NoError(t, err, "create-log-group failed: %s", stderr)
+	must.NoError(t, err, "create-log-group failed: %s", stderr)
 	_, stderr, err = runLstk(t, ctx, "", e, "aws", "logs", "create-log-stream", "--log-group-name", logGroup, "--log-stream-name", "s1")
-	require.NoError(t, err, "create-log-stream failed: %s", stderr)
+	must.NoError(t, err, "create-log-stream failed: %s", stderr)
 	events := fmt.Sprintf("timestamp=%d,message=%s", time.Now().UnixMilli(), marker)
 	_, stderr, err = runLstk(t, ctx, "", e, "aws", "logs", "put-log-events", "--log-group-name", logGroup, "--log-stream-name", "s1", "--log-events", events)
-	require.NoError(t, err, "put-log-events failed: %s", stderr)
+	must.NoError(t, err, "put-log-events failed: %s", stderr)
 
 	binPath, err := filepath.Abs(binaryPath())
-	require.NoError(t, err)
+	must.NoError(t, err)
 	cmd := exec.CommandContext(ctx, binPath, "aws", "logs", "tail", logGroup, "--follow", "--since", "1h")
 	cmd.Env = e
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start command in PTY")
+	must.NoError(t, err, "failed to start command in PTY")
 
 	out := &syncBuffer{}
 	go func() { _, _ = io.Copy(out, ptmx) }()
@@ -95,6 +95,6 @@ func TestAWSLogsTailFollowStreamsInPTY(t *testing.T) {
 	}
 	_ = ptmx.Close()
 
-	require.True(t, seen,
+	must.True(t, seen,
 		"tail --follow produced no output while running; event appeared only after exit (DEVX-1026). Output after exit:\n%s", out.String())
 }
diff --git a/test/integration/aws_profile_precedence_test.go b/test/integration/aws_profile_precedence_test.go
index f53b3aca..5dda9729 100644
--- a/test/integration/aws_profile_precedence_test.go
+++ b/test/integration/aws_profile_precedence_test.go
@@ -7,8 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"github.com/localstack/lstk/internal/must"
 )
 
 // These tests do not exercise lstk. They pin the botocore behavior lstk's
@@ -34,11 +33,11 @@ func awsProfileFixture(t *testing.T) []string {
 	dir := t.TempDir()
 
 	configPath := filepath.Join(dir, "config")
-	require.NoError(t, os.WriteFile(configPath, []byte(
+	must.NoError(t, os.WriteFile(configPath, []byte(
 		"[profile localstack]\nregion = eu-west-1\noutput = table\n"), 0600))
 
 	credsPath := filepath.Join(dir, "credentials")
-	require.NoError(t, os.WriteFile(credsPath, []byte(
+	must.NoError(t, os.WriteFile(credsPath, []byte(
 		"[localstack]\naws_access_key_id = test\naws_secret_access_key = test\n"), 0600))
 
 	return []string{
@@ -80,7 +79,7 @@ func awsConfigureList(t *testing.T, extraEnv ...string) string {
 	cmd.Env = awsProbeEnv(extraEnv...)
 
 	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, "aws configure list failed: %s", out)
+	must.NoError(t, err, "aws configure list failed: %s", out)
 	return string(out)
 }
 
@@ -98,9 +97,9 @@ func TestAWSProfileEnvVarLetsEnvironmentCredentialsWin(t *testing.T) {
 	)
 	out := awsConfigureList(t, e...)
 
-	assert.Regexp(t, `access_key\s*:\s*\**1111\s*:\s*env`, out,
+	must.Regexp(t, `access_key\s*:\s*\**1111\s*:\s*env`, out,
 		"credentials must come from the environment under AWS_PROFILE")
-	assert.Regexp(t, `region\s*:\s*eu-west-1\s*:\s*config-file`, out,
+	must.Regexp(t, `region\s*:\s*eu-west-1\s*:\s*config-file`, out,
 		"the profile must still supply the region")
 }
 
@@ -121,9 +120,9 @@ func TestAWSProfileFlagSuppressesEnvironmentCredentials(t *testing.T) {
 	)...)
 
 	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, "aws configure list failed: %s", out)
+	must.NoError(t, err, "aws configure list failed: %s", out)
 
-	assert.Regexp(t, `access_key\s*:\s*\**test\s*:\s*shared-credentials-file`, string(out),
+	must.Regexp(t, `access_key\s*:\s*\**test\s*:\s*shared-credentials-file`, string(out),
 		"--profile must suppress the environment credentials (the behavior lstk avoids)")
 }
 
@@ -140,7 +139,7 @@ func TestAWSEnvironmentRegionOverridesProfileRegion(t *testing.T) {
 	)
 	out := awsConfigureList(t, e...)
 
-	assert.Regexp(t, `region\s*:\s*us-east-1\s*:\s*env`, out,
+	must.Regexp(t, `region\s*:\s*us-east-1\s*:\s*env`, out,
 		"an environment region outranks the profile's, so lstk must not seed one")
 }
 
@@ -156,5 +155,5 @@ func TestAWSProfileOutranksDefaultProfile(t *testing.T) {
 	)
 	out := awsConfigureList(t, e...)
 
-	assert.Regexp(t, `region\s*:\s*eu-west-1\s*:\s*config-file`, out)
+	must.Regexp(t, `region\s*:\s*eu-west-1\s*:\s*config-file`, out)
 }
diff --git a/test/integration/awsconfig_test.go b/test/integration/awsconfig_test.go
index e216435d..0a0b9bb5 100644
--- a/test/integration/awsconfig_test.go
+++ b/test/integration/awsconfig_test.go
@@ -12,9 +12,8 @@ import (
 	"time"
 
 	"github.com/creack/pty"
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // awsConfigEnv returns a base environment with the home directory set to an
@@ -62,7 +61,7 @@ func TestStartPromptsWhenAWSProfileMissingEverywhere(t *testing.T) {
 	cmd.Env = baseEnv.With(env.APIEndpoint, mockServer.URL)
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start command in PTY")
+	must.NoError(t, err, "failed to start command in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	out := &syncBuffer{}
@@ -73,28 +72,28 @@ func TestStartPromptsWhenAWSProfileMissingEverywhere(t *testing.T) {
 	}()
 
 	// Wait for the prompt emitted after the container becomes ready.
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(out.Bytes(), []byte(awsSetupPrompt))
 	}, 2*time.Minute, 200*time.Millisecond, "AWS profile prompt should appear")
 
 	_, err = ptmx.Write([]byte("y"))
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	err = cmd.Wait()
 	<-outputCh
-	require.NoError(t, err, "lstk start should exit successfully")
+	must.NoError(t, err, "lstk start should exit successfully")
 
 	configContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "config"))
-	require.NoError(t, err, "~/.aws/config should have been created")
-	assert.Contains(t, string(configContent), "[profile localstack]")
-	assert.Contains(t, string(configContent), "endpoint_url")
+	must.NoError(t, err, "~/.aws/config should have been created")
+	must.Contains(t, string(configContent), "[profile localstack]")
+	must.Contains(t, string(configContent), "endpoint_url")
 
 	credsContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "credentials"))
-	require.NoError(t, err, "~/.aws/credentials should have been created")
+	must.NoError(t, err, "~/.aws/credentials should have been created")
 	normalizedCreds := strings.Join(strings.Fields(string(credsContent)), " ")
-	assert.Contains(t, normalizedCreds, "[localstack]")
-	assert.Contains(t, normalizedCreds, "aws_access_key_id = test")
-	assert.Contains(t, normalizedCreds, "aws_secret_access_key = test")
+	must.Contains(t, normalizedCreds, "[localstack]")
+	must.Contains(t, normalizedCreds, "aws_access_key_id = test")
+	must.Contains(t, normalizedCreds, "aws_secret_access_key = test")
 }
 
 func TestStartSkipsAWSProfilePromptWhenAlreadyConfigured(t *testing.T) {
@@ -112,10 +111,10 @@ func TestStartSkipsAWSProfilePromptWhenAlreadyConfigured(t *testing.T) {
 
 	// Pre-write a valid LocalStack AWS profile in the isolated home.
 	awsDir := filepath.Join(tmpHome, ".aws")
-	require.NoError(t, os.MkdirAll(awsDir, 0700))
-	require.NoError(t, os.WriteFile(filepath.Join(awsDir, "config"),
+	must.NoError(t, os.MkdirAll(awsDir, 0700))
+	must.NoError(t, os.WriteFile(filepath.Join(awsDir, "config"),
 		[]byte("[profile localstack]\nregion = us-east-1\noutput = json\nendpoint_url = http://127.0.0.1:4566\n"), 0600))
-	require.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
+	must.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
 		[]byte("[localstack]\naws_access_key_id = test\naws_secret_access_key = test\n"), 0600))
 
 	ctx := testContext(t)
@@ -123,7 +122,7 @@ func TestStartSkipsAWSProfilePromptWhenAlreadyConfigured(t *testing.T) {
 	cmd.Env = baseEnv.With(env.APIEndpoint, mockServer.URL)
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start command in PTY")
+	must.NoError(t, err, "failed to start command in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	out := &syncBuffer{}
@@ -135,7 +134,7 @@ func TestStartSkipsAWSProfilePromptWhenAlreadyConfigured(t *testing.T) {
 
 	// Wait until the container is ready — that's the point at which post-start setup
 	// runs, so if the prompt were going to appear it would already be in the output.
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(out.Bytes(), []byte("LocalStack is running"))
 	}, 2*time.Minute, 200*time.Millisecond, "container should become ready")
 
@@ -144,7 +143,7 @@ func TestStartSkipsAWSProfilePromptWhenAlreadyConfigured(t *testing.T) {
 	_ = cmd.Wait()
 	<-outputCh
 
-	assert.NotContains(t, out.String(), awsSetupPrompt,
+	must.NotContains(t, out.String(), awsSetupPrompt,
 		"profile prompt should not appear when profile is already correctly configured")
 }
 
@@ -164,9 +163,9 @@ func TestStartNonInteractiveEmitsNoteWhenAWSProfileMissing(t *testing.T) {
 		baseEnv.With(env.APIEndpoint, mockServer.URL),
 		"start",
 	)
-	require.NoError(t, err)
+	must.NoError(t, err)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "LocalStack AWS profile is incomplete. Run 'lstk setup aws'.")
+	must.Contains(t, stdout, "LocalStack AWS profile is incomplete. Run 'lstk setup aws'.")
 }
 
 func TestStartEmitsNoteWhenAWSProfileIsPartial(t *testing.T) {
@@ -183,8 +182,8 @@ func TestStartEmitsNoteWhenAWSProfileIsPartial(t *testing.T) {
 	defer mockServer.Close()
 
 	awsDir := filepath.Join(tmpHome, ".aws")
-	require.NoError(t, os.MkdirAll(awsDir, 0700))
-	require.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
+	must.NoError(t, os.MkdirAll(awsDir, 0700))
+	must.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
 		[]byte("[localstack]\naws_access_key_id = test\naws_secret_access_key = test\n"), 0600))
 
 	ctx := testContext(t)
@@ -192,7 +191,7 @@ func TestStartEmitsNoteWhenAWSProfileIsPartial(t *testing.T) {
 	cmd.Env = baseEnv.With(env.APIEndpoint, mockServer.URL)
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start command in PTY")
+	must.NoError(t, err, "failed to start command in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	out := &syncBuffer{}
@@ -202,15 +201,15 @@ func TestStartEmitsNoteWhenAWSProfileIsPartial(t *testing.T) {
 		close(outputCh)
 	}()
 
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(out.Bytes(), []byte("LocalStack AWS profile is incomplete. Run 'lstk setup aws'."))
 	}, 2*time.Minute, 200*time.Millisecond, "AWS profile note should appear")
 
 	err = cmd.Wait()
 	<-outputCh
-	require.NoError(t, err, "lstk start should exit successfully")
+	must.NoError(t, err, "lstk start should exit successfully")
 
-	assert.NotContains(t, out.String(), "Set up a LocalStack profile for AWS CLI and SDKs in ~/.aws?",
+	must.NotContains(t, out.String(), "Set up a LocalStack profile for AWS CLI and SDKs in ~/.aws?",
 		"profile prompt should not appear for a partial setup")
 }
 
@@ -226,7 +225,7 @@ func TestSetupAWSCreatesAWSProfileWhenConfirmed(t *testing.T) {
 	cmd.Env = baseEnv
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start command in PTY")
+	must.NoError(t, err, "failed to start command in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	out := &syncBuffer{}
@@ -237,32 +236,32 @@ func TestSetupAWSCreatesAWSProfileWhenConfirmed(t *testing.T) {
 	}()
 
 	// Wait for the AWS profile prompt.
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(out.Bytes(), []byte(awsSetupPrompt))
 	}, 2*time.Minute, 200*time.Millisecond, "AWS profile prompt should appear")
 
 	// Press Y to confirm.
 	_, err = ptmx.Write([]byte("y"))
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	err = cmd.Wait()
 	<-outputCh
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	configContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "config"))
-	require.NoError(t, err, "~/.aws/config should have been created")
-	assert.Contains(t, string(configContent), "[profile localstack]")
-	assert.Contains(t, string(configContent), "endpoint_url")
+	must.NoError(t, err, "~/.aws/config should have been created")
+	must.Contains(t, string(configContent), "[profile localstack]")
+	must.Contains(t, string(configContent), "endpoint_url")
 
 	credsContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "credentials"))
-	require.NoError(t, err, "~/.aws/credentials should have been created")
+	must.NoError(t, err, "~/.aws/credentials should have been created")
 	normalizedCreds := strings.Join(strings.Fields(string(credsContent)), " ")
-	assert.Contains(t, normalizedCreds, "[localstack]")
-	assert.Contains(t, normalizedCreds, "aws_access_key_id = test")
-	assert.Contains(t, normalizedCreds, "aws_secret_access_key = test")
+	must.Contains(t, normalizedCreds, "[localstack]")
+	must.Contains(t, normalizedCreds, "aws_access_key_id = test")
+	must.Contains(t, normalizedCreds, "aws_secret_access_key = test")
 
-	assert.Contains(t, out.String(), "Created LocalStack profile in ~/.aws")
-	assert.NotContains(t, out.String(), "Skipped adding LocalStack AWS profile.")
+	must.Contains(t, out.String(), "Created LocalStack profile in ~/.aws")
+	must.NotContains(t, out.String(), "Skipped adding LocalStack AWS profile.")
 }
 
 // TestSetupAWSExitsNonZeroWhenProfileWriteFails guards DEVX-941. Writing the
@@ -284,7 +283,7 @@ func TestSetupAWSExitsNonZeroWhenProfileWriteFails(t *testing.T) {
 	// A read-only ~/.aws keeps the profile files absent (so the prompt still appears)
 	// while making their creation fail inside upsertSection's SaveTo.
 	awsDir := filepath.Join(tmpHome, ".aws")
-	require.NoError(t, os.MkdirAll(awsDir, 0500))
+	must.NoError(t, os.MkdirAll(awsDir, 0500))
 	// Restore write permission before t.TempDir cleanup so the dir can be removed.
 	t.Cleanup(func() { _ = os.Chmod(awsDir, 0700) })
 
@@ -293,7 +292,7 @@ func TestSetupAWSExitsNonZeroWhenProfileWriteFails(t *testing.T) {
 	cmd.Env = baseEnv
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start command in PTY")
+	must.NoError(t, err, "failed to start command in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	out := &syncBuffer{}
@@ -303,19 +302,19 @@ func TestSetupAWSExitsNonZeroWhenProfileWriteFails(t *testing.T) {
 		close(outputCh)
 	}()
 
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(out.Bytes(), []byte(awsSetupPrompt))
 	}, 2*time.Minute, 200*time.Millisecond, "AWS profile prompt should appear")
 
 	_, err = ptmx.Write([]byte("y"))
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	err = cmd.Wait()
 	<-outputCh
 	requireExitCode(t, 1, err)
 
-	assert.Contains(t, out.String(), "Could not set up the LocalStack AWS profile")
-	assert.NotContains(t, out.String(), "Created LocalStack profile")
+	must.Contains(t, out.String(), "Could not set up the LocalStack AWS profile")
+	must.NotContains(t, out.String(), "Created LocalStack profile")
 }
 
 func TestSetupAWSDoesNotCreateAWSProfileWhenDeclined(t *testing.T) {
@@ -330,7 +329,7 @@ func TestSetupAWSDoesNotCreateAWSProfileWhenDeclined(t *testing.T) {
 	cmd.Env = baseEnv
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start command in PTY")
+	must.NoError(t, err, "failed to start command in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	out := &syncBuffer{}
@@ -340,24 +339,24 @@ func TestSetupAWSDoesNotCreateAWSProfileWhenDeclined(t *testing.T) {
 		close(outputCh)
 	}()
 
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(out.Bytes(), []byte(awsSetupPrompt))
 	}, 2*time.Minute, 200*time.Millisecond, "AWS profile prompt should appear")
 
 	_, err = ptmx.Write([]byte("n"))
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	err = cmd.Wait()
 	<-outputCh
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	_, err = os.Stat(filepath.Join(tmpHome, ".aws", "config"))
-	assert.ErrorIs(t, err, os.ErrNotExist)
+	must.ErrorIs(t, err, os.ErrNotExist)
 	_, err = os.Stat(filepath.Join(tmpHome, ".aws", "credentials"))
-	assert.ErrorIs(t, err, os.ErrNotExist)
+	must.ErrorIs(t, err, os.ErrNotExist)
 
-	assert.Contains(t, out.String(), "Skipped adding LocalStack AWS profile.")
-	assert.NotContains(t, out.String(), "Created LocalStack profile in ~/.aws/config")
+	must.Contains(t, out.String(), "Skipped adding LocalStack AWS profile.")
+	must.NotContains(t, out.String(), "Created LocalStack profile in ~/.aws/config")
 }
 
 func TestSetupAWSNonInteractiveCreatesProfile(t *testing.T) {
@@ -369,20 +368,20 @@ func TestSetupAWSNonInteractiveCreatesProfile(t *testing.T) {
 		"setup", "aws",
 	)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "Created LocalStack profile in ~/.aws")
-	assert.NotContains(t, stdout, "requires an interactive terminal")
+	must.Contains(t, stdout, "Created LocalStack profile in ~/.aws")
+	must.NotContains(t, stdout, "requires an interactive terminal")
 
 	configContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "config"))
-	require.NoError(t, err, "~/.aws/config should have been created")
-	assert.Contains(t, string(configContent), "[profile localstack]")
-	assert.Contains(t, string(configContent), "endpoint_url")
+	must.NoError(t, err, "~/.aws/config should have been created")
+	must.Contains(t, string(configContent), "[profile localstack]")
+	must.Contains(t, string(configContent), "endpoint_url")
 
 	credsContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "credentials"))
-	require.NoError(t, err, "~/.aws/credentials should have been created")
+	must.NoError(t, err, "~/.aws/credentials should have been created")
 	normalizedCreds := strings.Join(strings.Fields(string(credsContent)), " ")
-	assert.Contains(t, normalizedCreds, "[localstack]")
-	assert.Contains(t, normalizedCreds, "aws_access_key_id = test")
-	assert.Contains(t, normalizedCreds, "aws_secret_access_key = test")
+	must.Contains(t, normalizedCreds, "[localstack]")
+	must.Contains(t, normalizedCreds, "aws_access_key_id = test")
+	must.Contains(t, normalizedCreds, "aws_secret_access_key = test")
 }
 
 func TestSetupAWSNonInteractiveIsIdempotent(t *testing.T) {
@@ -397,7 +396,7 @@ func TestSetupAWSNonInteractiveIsIdempotent(t *testing.T) {
 	// not be treated as an overwrite (no --force required).
 	stdout, _, err := runLstk(t, testContext(t), "", baseEnv, "setup", "aws")
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "already configured")
+	must.Contains(t, stdout, "already configured")
 }
 
 func TestSetupAWSNonInteractiveOverwriteRequiresForce(t *testing.T) {
@@ -406,23 +405,23 @@ func TestSetupAWSNonInteractiveOverwriteRequiresForce(t *testing.T) {
 
 	// Pre-seed a localstack profile with different values.
 	awsDir := filepath.Join(tmpHome, ".aws")
-	require.NoError(t, os.MkdirAll(awsDir, 0700))
-	require.NoError(t, os.WriteFile(filepath.Join(awsDir, "config"),
+	must.NoError(t, os.MkdirAll(awsDir, 0700))
+	must.NoError(t, os.WriteFile(filepath.Join(awsDir, "config"),
 		[]byte("[profile localstack]\nregion = us-east-1\noutput = json\nendpoint_url = http://example.com:9999\n"), 0600))
-	require.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
+	must.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
 		[]byte("[localstack]\naws_access_key_id = WRONG\naws_secret_access_key = WRONG\n"), 0600))
 
 	stdout, _, err := runLstk(t, testContext(t), "", baseEnv, "setup", "aws")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "--force")
+	must.Contains(t, stdout, "--force")
 
 	// The existing profile must be left untouched.
 	configContent, err := os.ReadFile(filepath.Join(awsDir, "config"))
-	require.NoError(t, err)
-	assert.Contains(t, string(configContent), "example.com:9999", "config must not be overwritten without --force")
+	must.NoError(t, err)
+	must.Contains(t, string(configContent), "example.com:9999", "config must not be overwritten without --force")
 	credsContent, err := os.ReadFile(filepath.Join(awsDir, "credentials"))
-	require.NoError(t, err)
-	assert.Contains(t, string(credsContent), "WRONG", "credentials must not be overwritten without --force")
+	must.NoError(t, err)
+	must.Contains(t, string(credsContent), "WRONG", "credentials must not be overwritten without --force")
 }
 
 func TestSetupAWSNonInteractiveForceOverwrites(t *testing.T) {
@@ -430,22 +429,22 @@ func TestSetupAWSNonInteractiveForceOverwrites(t *testing.T) {
 	baseEnv, tmpHome := awsConfigEnv(t)
 
 	awsDir := filepath.Join(tmpHome, ".aws")
-	require.NoError(t, os.MkdirAll(awsDir, 0700))
-	require.NoError(t, os.WriteFile(filepath.Join(awsDir, "config"),
+	must.NoError(t, os.MkdirAll(awsDir, 0700))
+	must.NoError(t, os.WriteFile(filepath.Join(awsDir, "config"),
 		[]byte("[profile localstack]\nregion = us-east-1\noutput = json\nendpoint_url = http://example.com:9999\n"), 0600))
-	require.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
+	must.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
 		[]byte("[localstack]\naws_access_key_id = WRONG\naws_secret_access_key = WRONG\n"), 0600))
 
 	_, _, err := runLstk(t, testContext(t), "", baseEnv, "setup", "aws", "--force")
 	requireExitCode(t, 0, err)
 
 	configContent, err := os.ReadFile(filepath.Join(awsDir, "config"))
-	require.NoError(t, err)
-	assert.NotContains(t, string(configContent), "example.com", "--force should overwrite the stale endpoint")
-	assert.Contains(t, string(configContent), "endpoint_url")
+	must.NoError(t, err)
+	must.NotContains(t, string(configContent), "example.com", "--force should overwrite the stale endpoint")
+	must.Contains(t, string(configContent), "endpoint_url")
 	credsContent, err := os.ReadFile(filepath.Join(awsDir, "credentials"))
-	require.NoError(t, err)
+	must.NoError(t, err)
 	normalizedCreds := strings.Join(strings.Fields(string(credsContent)), " ")
-	assert.NotContains(t, normalizedCreds, "WRONG", "--force should overwrite stale credentials")
-	assert.Contains(t, normalizedCreds, "aws_access_key_id = test")
+	must.NotContains(t, normalizedCreds, "WRONG", "--force should overwrite stale credentials")
+	must.Contains(t, normalizedCreds, "aws_access_key_id = test")
 }
diff --git a/test/integration/az_cmd_test.go b/test/integration/az_cmd_test.go
index a9b82dbf..3b3f3046 100644
--- a/test/integration/az_cmd_test.go
+++ b/test/integration/az_cmd_test.go
@@ -10,9 +10,8 @@ import (
 	"runtime"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestAzCommandFailsWhenAzureCLINotInstalled(t *testing.T) {
@@ -23,10 +22,10 @@ func TestAzCommandFailsWhenAzureCLINotInstalled(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).With(env.Home, t.TempDir())
 
 	stdout, _, err := runLstk(t, testContext(t), workDir, e, "az", "group", "list")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "az CLI not found in PATH")
-	assert.Contains(t, stdout, "Install Azure CLI:")
-	assert.Contains(t, stdout, "https://learn.microsoft.com/en-us/cli/azure/")
+	must.Error(t, err)
+	must.Contains(t, stdout, "az CLI not found in PATH")
+	must.Contains(t, stdout, "Install Azure CLI:")
+	must.Contains(t, stdout, "https://learn.microsoft.com/en-us/cli/azure/")
 }
 
 // azureHealthServer answers like an Azure-flavored emulator: /_localstack/health
@@ -64,7 +63,7 @@ func writeFakeAz(t *testing.T, sleepSeconds int) string {
 	}
 	script += `echo "AZ_ARGS:$@"
 `
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "az"), []byte(script), 0755))
+	must.NoError(t, os.WriteFile(filepath.Join(dir, "az"), []byte(script), 0755))
 	return dir
 }
 
@@ -77,15 +76,15 @@ func azureConfigWithSetupMarker(t *testing.T) string {
 	t.Helper()
 	dir := t.TempDir()
 	configPath := filepath.Join(dir, "config.toml")
-	require.NoError(t, os.WriteFile(configPath, []byte(`
+	must.NoError(t, os.WriteFile(configPath, []byte(`
 [[containers]]
 type = "azure"
 tag  = "latest"
 port = "4566"
 `), 0644))
 	markerDir := filepath.Join(dir, "azure")
-	require.NoError(t, os.MkdirAll(markerDir, 0700))
-	require.NoError(t, os.WriteFile(filepath.Join(markerDir, ".lstk-setup-complete"), []byte("ok\n"), 0600))
+	must.NoError(t, os.MkdirAll(markerDir, 0700))
+	must.NoError(t, os.WriteFile(filepath.Join(markerDir, ".lstk-setup-complete"), []byte("ok\n"), 0600))
 	return configPath
 }
 
@@ -106,14 +105,14 @@ func azureHomeWithSetupMarker(t *testing.T) string {
 	t.Helper()
 	homeDir := t.TempDir()
 	lstkDir := filepath.Join(homeDir, ".config", "lstk")
-	require.NoError(t, os.MkdirAll(filepath.Join(lstkDir, "azure"), 0700))
-	require.NoError(t, os.WriteFile(filepath.Join(lstkDir, "config.toml"), []byte(`
+	must.NoError(t, os.MkdirAll(filepath.Join(lstkDir, "azure"), 0700))
+	must.NoError(t, os.WriteFile(filepath.Join(lstkDir, "config.toml"), []byte(`
 [[containers]]
 type = "azure"
 tag  = "latest"
 port = "4566"
 `), 0644))
-	require.NoError(t, os.WriteFile(filepath.Join(lstkDir, "azure", ".lstk-setup-complete"), []byte("ok\n"), 0600))
+	must.NoError(t, os.WriteFile(filepath.Join(lstkDir, "azure", ".lstk-setup-complete"), []byte("ok\n"), 0600))
 	return homeDir
 }
 
@@ -127,11 +126,11 @@ func TestAzCommandStripsGlobalFlagsFromPassthrough(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), azFakeEnv(t, writeFakeAz(t, 0), t.TempDir()),
 		"--endpoint-url", srv.URL, "--config", configPath, "--non-interactive", "az", "group", "list")
-	require.NoError(t, err, "stderr: %s", stderr)
+	must.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "AZ_ARGS:group list")
-	assert.NotContains(t, stdout, "--non-interactive")
-	assert.NotContains(t, stdout, "--config")
+	must.Contains(t, stdout, "AZ_ARGS:group list")
+	must.NotContains(t, stdout, "--non-interactive")
+	must.NotContains(t, stdout, "--config")
 }
 
 // --config must select the given config file for `lstk az` too: the Azure setup
@@ -146,13 +145,13 @@ func TestAzCommandConfigFlagSelectsConfigFile(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "--config", configPath, "az", "group", "list")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "AZ_ARGS:group list")
+	must.NoError(t, err, "stderr: %s", stderr)
+	must.Contains(t, stdout, "AZ_ARGS:group list")
 
 	stdout, _, err = runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "az", "group", "list")
-	require.Error(t, err, "without --config the azure setup marker must not be found")
-	assert.Contains(t, stdout, "Azure CLI integration is not set up")
+	must.Error(t, err, "without --config the azure setup marker must not be found")
+	must.Contains(t, stdout, "Azure CLI integration is not set up")
 }
 
 func TestAzCommandShowsSpinnerForSlowOperation(t *testing.T) {
@@ -162,10 +161,10 @@ func TestAzCommandShowsSpinnerForSlowOperation(t *testing.T) {
 	// The spinner only renders after 4s, so the fake `az` must outlast that.
 	out, err := runLstkInPTY(t, testContext(t), azFakeEnv(t, writeFakeAz(t, 5), azureHomeWithSetupMarker(t)),
 		"--endpoint-url", srv.URL, "az", "group", "list")
-	require.NoError(t, err, "lstk az failed: %s", out)
+	must.NoError(t, err, "lstk az failed: %s", out)
 
-	assert.Contains(t, out, "Loading service")
-	assert.Contains(t, out, "AZ_ARGS:group list")
+	must.Contains(t, out, "Loading service")
+	must.Contains(t, out, "AZ_ARGS:group list")
 }
 
 // --non-interactive must suppress the spinner: before the flag was stripped in
@@ -177,8 +176,8 @@ func TestAzCommandSuppressesSpinnerInNonInteractiveMode(t *testing.T) {
 
 	out, err := runLstkInPTY(t, testContext(t), azFakeEnv(t, writeFakeAz(t, 5), azureHomeWithSetupMarker(t)),
 		"--endpoint-url", srv.URL, "--non-interactive", "az", "group", "list")
-	require.NoError(t, err, "lstk az failed: %s", out)
+	must.NoError(t, err, "lstk az failed: %s", out)
 
-	assert.NotContains(t, out, "Loading service")
-	assert.Contains(t, out, "AZ_ARGS:group list")
+	must.NotContains(t, out, "Loading service")
+	must.Contains(t, out, "AZ_ARGS:group list")
 }
diff --git a/test/integration/az_e2e_test.go b/test/integration/az_e2e_test.go
index 33a44ad6..4c2fff66 100644
--- a/test/integration/az_e2e_test.go
+++ b/test/integration/az_e2e_test.go
@@ -13,9 +13,8 @@ import (
 	"time"
 
 	"github.com/creack/pty"
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // End-to-end tests for `lstk az` that exercise the *real* Azure CLI against a
@@ -81,27 +80,27 @@ func TestAzE2ERealCLIOnPTYPreservesOutput(t *testing.T) {
 	ctx := testContext(t)
 
 	_, stderr, err := runLstk(t, ctx, workDir, baseEnv, "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 
 	// Registers the LocalStack cloud in an isolated AZURE_CONFIG_DIR and writes
 	// the setup marker `lstk az` requires. Non-interactive because runLstk is not
 	// on a terminal.
 	_, stderr, err = runLstk(t, ctx, workDir, baseEnv, "setup", "azure")
-	require.NoError(t, err, "lstk setup azure failed: %s", stderr)
+	must.NoError(t, err, "lstk setup azure failed: %s", stderr)
 
 	// Pipe path: no PTY, so no CR at all, and the JSON is byte-clean.
 	pipedOut, stderr, err := runLstk(t, ctx, workDir, baseEnv, "az", "cloud", "show", "-o", "json")
-	require.NoError(t, err, "lstk az cloud show failed: %s", stderr)
-	assert.NotContains(t, pipedOut, "\r", "a redirected stdout must stay a pipe, so the Azure CLI emits bare LFs")
-	assert.Equal(t, "LocalStack", cloudNameFromJSON(t, pipedOut))
+	must.NoError(t, err, "lstk az cloud show failed: %s", stderr)
+	must.NotContains(t, pipedOut, "\r", "a redirected stdout must stay a pipe, so the Azure CLI emits bare LFs")
+	must.Eq(t, "LocalStack", cloudNameFromJSON(t, pipedOut))
 
 	// PTY path: the real az ran on a terminal, and its output is still valid JSON
 	// once the PTY's CRs are stripped — the property a `lstk az ... -o json`
 	// consumer depends on.
 	ptyOut := runLstkAzInPTY(t, ctx, workDir, baseEnv, "az", "cloud", "show", "-o", "json")
-	assert.True(t, hasInnerPTYLineEndings(ptyOut),
+	must.True(t, hasInnerPTYLineEndings(ptyOut),
 		"the real Azure CLI must run on a PTY when lstk's stdout and stderr are terminals (DEVX-1028); got:\n%q", ptyOut)
-	assert.Equal(t, "LocalStack", cloudNameFromJSON(t, ptyOut))
+	must.Eq(t, "LocalStack", cloudNameFromJSON(t, ptyOut))
 }
 
 // cloudNameFromJSON extracts .name from an `az cloud show -o json` payload,
@@ -111,12 +110,12 @@ func cloudNameFromJSON(t *testing.T, out string) string {
 	t.Helper()
 	clean := strings.ReplaceAll(out, "\r", "")
 	start := strings.Index(clean, "{")
-	require.GreaterOrEqual(t, start, 0, "no JSON object in az output:\n%q", out)
+	must.GreaterOrEqual(t, start, 0, "no JSON object in az output:\n%q", out)
 
 	var payload struct {
 		Name string `json:"name"`
 	}
-	require.NoError(t, json.Unmarshal([]byte(clean[start:]), &payload),
+	must.NoError(t, json.Unmarshal([]byte(clean[start:]), &payload),
 		"az output is not valid JSON after stripping CRs:\n%q", clean[start:])
 	return payload.Name
 }
@@ -127,14 +126,14 @@ func cloudNameFromJSON(t *testing.T, out string) string {
 func runLstkAzInPTY(t *testing.T, ctx context.Context, workDir string, environ []string, args ...string) string {
 	t.Helper()
 	binPath, err := filepath.Abs(binaryPath())
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	cmd := exec.CommandContext(ctx, binPath, args...)
 	cmd.Dir = workDir
 	cmd.Env = environ
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start command in PTY")
+	must.NoError(t, err, "failed to start command in PTY")
 	t.Cleanup(func() { _ = ptmx.Close() })
 
 	out := &syncBuffer{}
@@ -152,7 +151,7 @@ func runLstkAzInPTY(t *testing.T, ctx context.Context, workDir string, environ [
 		_ = cmd.Process.Kill()
 		err = <-waitErr
 	}
-	require.NoError(t, err, "lstk %v failed on a PTY; output:\n%s", args, out.String())
+	must.NoError(t, err, "lstk %v failed on a PTY; output:\n%s", args, out.String())
 
 	// Let the copier drain the slave's remaining bytes before reading.
 	select {
diff --git a/test/integration/az_interception_test.go b/test/integration/az_interception_test.go
index 9ee73dfe..618d18e2 100644
--- a/test/integration/az_interception_test.go
+++ b/test/integration/az_interception_test.go
@@ -10,9 +10,8 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // runAzRaw runs `az <args>` directly (not via lstk) with the given environment. The
@@ -22,7 +21,7 @@ import (
 func runAzRaw(t *testing.T, ctx context.Context, environ []string, args ...string) (string, error) {
 	t.Helper()
 	azBin, err := exec.LookPath("az")
-	require.NoError(t, err)
+	must.NoError(t, err)
 	cmd := exec.CommandContext(ctx, azBin, args...)
 	cmd.Env = environ
 	var out, errb bytes.Buffer
@@ -43,9 +42,9 @@ func TestAzStartInterceptionRoutesToSubcommand(t *testing.T) {
 		env.With(env.Home, t.TempDir()).With("PATH", t.TempDir()),
 		"az", "start-interception",
 	)
-	require.Error(t, err)
-	assert.Contains(t, stdout, "az CLI not found in PATH")
-	assert.NotContains(t, stdout, "not set up")
+	must.Error(t, err)
+	must.Contains(t, stdout, "az CLI not found in PATH")
+	must.NotContains(t, stdout, "not set up")
 }
 
 // stop-interception is a safe no-op when LocalStack is not the active cloud — e.g.
@@ -62,13 +61,13 @@ func TestAzStopInterceptionNoOpWhenNotIntercepting(t *testing.T) {
 		env.With(env.Home, home),
 		"az", "stop-interception",
 	)
-	require.NoError(t, err, "stop-interception must not fail when LocalStack is not active")
-	assert.Contains(t, stdout, "not the active Azure cloud")
+	must.NoError(t, err, "stop-interception must not fail when LocalStack is not active")
+	must.Contains(t, stdout, "not the active Azure cloud")
 
 	// It must not have switched the active cloud to anything.
 	active, azErr := runAzRaw(t, testContext(t), env.With(env.Home, home), "cloud", "show", "--query", "name", "-o", "tsv")
-	require.NoError(t, azErr)
-	assert.Equal(t, "AzureCloud", active)
+	must.NoError(t, azErr)
+	must.Eq(t, "AzureCloud", active)
 }
 
 func TestAzStopInterceptionFailsWhenAzureCLINotInstalled(t *testing.T) {
@@ -79,9 +78,9 @@ func TestAzStopInterceptionFailsWhenAzureCLINotInstalled(t *testing.T) {
 		env.With(env.Home, t.TempDir()).With("PATH", t.TempDir()),
 		"az", "stop-interception",
 	)
-	require.Error(t, err)
-	assert.Contains(t, stdout, "az CLI not found in PATH")
-	assert.Contains(t, stdout, "Install Azure CLI:")
+	must.Error(t, err)
+	must.Contains(t, stdout, "az CLI not found in PATH")
+	must.Contains(t, stdout, "Install Azure CLI:")
 }
 
 // TestAzInterception exercises the full start/stop-interception lifecycle against a real
@@ -119,46 +118,46 @@ func TestAzInterception(t *testing.T) {
 	ctx := testContext(t)
 
 	_, stderr, err := runLstk(t, ctx, workDir, baseEnv, "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 
 	activeCloud := func() string {
 		// baseEnv carries HOME=tmpHome and no AZURE_CONFIG_DIR, so this reads the same
 		// global config that interception mutated.
 		name, azErr := runAzRaw(t, ctx, baseEnv, "cloud", "show", "--query", "name", "-o", "tsv")
-		require.NoError(t, azErr)
+		must.NoError(t, azErr)
 		return name
 	}
 
 	// start-interception: global `az` now points at LocalStack.
 	stdout, stderr, err := runLstk(t, ctx, workDir, baseEnv, "az", "start-interception")
-	require.NoError(t, err, "start-interception failed: stdout=%s stderr=%s", stdout, stderr)
-	assert.Contains(t, stdout, "Interception active")
-	assert.Contains(t, stdout, "stop-interception")
-	assert.Equal(t, "LocalStack", activeCloud(), "LocalStack should be the active global cloud after start-interception")
+	must.NoError(t, err, "start-interception failed: stdout=%s stderr=%s", stdout, stderr)
+	must.Contains(t, stdout, "Interception active")
+	must.Contains(t, stdout, "stop-interception")
+	must.Eq(t, "LocalStack", activeCloud(), "LocalStack should be the active global cloud after start-interception")
 
 	// stop-interception (default): back to AzureCloud.
 	stdout, stderr, err = runLstk(t, ctx, workDir, baseEnv, "az", "stop-interception")
-	require.NoError(t, err, "stop-interception failed: stdout=%s stderr=%s", stdout, stderr)
-	assert.Contains(t, stdout, "Interception stopped")
-	assert.Equal(t, "AzureCloud", activeCloud())
+	must.NoError(t, err, "stop-interception failed: stdout=%s stderr=%s", stdout, stderr)
+	must.Contains(t, stdout, "Interception stopped")
+	must.Eq(t, "AzureCloud", activeCloud())
 
 	// no-op guard: LocalStack is no longer active, so stop must not clobber AzureCloud.
 	stdout, _, err = runLstk(t, ctx, workDir, baseEnv, "az", "stop-interception")
-	require.NoError(t, err)
-	assert.Contains(t, stdout, "not the active Azure cloud")
-	assert.Equal(t, "AzureCloud", activeCloud())
+	must.NoError(t, err)
+	must.Contains(t, stdout, "not the active Azure cloud")
+	must.Eq(t, "AzureCloud", activeCloud())
 
 	// unknown --cloud is rejected (only reached because LocalStack is active again).
 	_, _, err = runLstk(t, ctx, workDir, baseEnv, "az", "start-interception")
-	require.NoError(t, err)
-	require.Equal(t, "LocalStack", activeCloud())
+	must.NoError(t, err)
+	must.Eq(t, "LocalStack", activeCloud())
 	_, stderr, err = runLstk(t, ctx, workDir, baseEnv, "az", "stop-interception", "--cloud", "NotARealCloud")
-	require.Error(t, err)
-	assert.Contains(t, stderr, "unknown Azure cloud 'NotARealCloud'")
-	assert.Equal(t, "LocalStack", activeCloud(), "rejected --cloud must not change the active cloud")
+	must.Error(t, err)
+	must.Contains(t, stderr, "unknown Azure cloud 'NotARealCloud'")
+	must.Eq(t, "LocalStack", activeCloud(), "rejected --cloud must not change the active cloud")
 
 	// --cloud override switches to the requested registered cloud.
 	stdout, stderr, err = runLstk(t, ctx, workDir, baseEnv, "az", "stop-interception", "--cloud", "AzureChinaCloud")
-	require.NoError(t, err, "stop-interception --cloud failed: stdout=%s stderr=%s", stdout, stderr)
-	assert.Equal(t, "AzureChinaCloud", activeCloud())
+	must.NoError(t, err, "stop-interception --cloud failed: stdout=%s stderr=%s", stdout, stderr)
+	must.Eq(t, "AzureChinaCloud", activeCloud())
 }
diff --git a/test/integration/az_pty_test.go b/test/integration/az_pty_test.go
index f0ed0fb5..80b487a2 100644
--- a/test/integration/az_pty_test.go
+++ b/test/integration/az_pty_test.go
@@ -15,9 +15,8 @@ import (
 	"time"
 
 	"github.com/creack/pty"
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // azureLikeHealthServer answers the endpoint probe the way the Azure emulator
@@ -71,7 +70,7 @@ print("PYTHONUNBUFFERED:" + os.environ.get("PYTHONUNBUFFERED", "<unset>"))
 print(%q)
 time.sleep(%f)
 `, python, marker, holdFor.Seconds())
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "az"), []byte(script), 0755))
+	must.NoError(t, os.WriteFile(filepath.Join(dir, "az"), []byte(script), 0755))
 	return dir
 }
 
@@ -99,14 +98,14 @@ func TestAzStreamsInPTY(t *testing.T) {
 		unreachableDockerHost)
 
 	binPath, err := filepath.Abs(binaryPath())
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	cmd := exec.CommandContext(testContext(t), binPath, "--endpoint-url", srv.URL, "az", "webapp", "log", "tail")
 	cmd.Dir = workDir
 	cmd.Env = e
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start command in PTY")
+	must.NoError(t, err, "failed to start command in PTY")
 	t.Cleanup(func() { _ = ptmx.Close() })
 
 	out := &syncBuffer{}
@@ -124,12 +123,12 @@ func TestAzStreamsInPTY(t *testing.T) {
 		}
 		time.Sleep(100 * time.Millisecond)
 	}
-	require.True(t, seen, "az produced no output while the child was still running — it was withheld in the CLI's stdout buffer until exit (DEVX-1028); output so far:\n%s", out.String())
+	must.True(t, seen, "az produced no output while the child was still running — it was withheld in the CLI's stdout buffer until exit (DEVX-1028); output so far:\n%s", out.String())
 
 	// The two mechanisms that keep the symptom above from returning, asserted
 	// separately so a regression in either one is named rather than inferred.
-	assert.Contains(t, out.String(), "STDOUT_TTY:yes", "the Azure CLI must be handed a terminal, not a pipe (DEVX-1028)")
-	assert.Contains(t, out.String(), "PYTHONUNBUFFERED:1")
+	must.Contains(t, out.String(), "STDOUT_TTY:yes", "the Azure CLI must be handed a terminal, not a pipe (DEVX-1028)")
+	must.Contains(t, out.String(), "PYTHONUNBUFFERED:1")
 
 	// Ctrl-C via the PTY reaches the whole foreground process group (lstk and
 	// the az child), matching how a user stops a streaming command.
@@ -159,7 +158,7 @@ func TestAzWithPipedStdoutKeepsPipe(t *testing.T) {
 		unreachableDockerHost)
 
 	stdout, stderr, err := runLstk(t, testContext(t), workDir, e, "--endpoint-url", srv.URL, "az", "group", "list")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "STDOUT_TTY:no")
-	assert.Contains(t, stdout, "piped")
+	must.NoError(t, err, "stderr: %s", stderr)
+	must.Contains(t, stdout, "STDOUT_TTY:no")
+	must.Contains(t, stdout, "piped")
 }
diff --git a/test/integration/cdk_cmd_test.go b/test/integration/cdk_cmd_test.go
index 3c5050fa..c4d58a81 100644
--- a/test/integration/cdk_cmd_test.go
+++ b/test/integration/cdk_cmd_test.go
@@ -8,9 +8,9 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // writeFakeCDK creates a stub `cdk` that answers `--version` with the given
@@ -37,7 +37,7 @@ echo "ENV_AWS_PROFILE=${AWS_PROFILE:-<unset>}"
 echo "ENV_AWS_DEFAULT_PROFILE=${AWS_DEFAULT_PROFILE:-<unset>}"
 echo "ENV_AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN:-<unset>}"
 `, version)
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "cdk"), []byte(script), 0755))
+	must.NoError(t, os.WriteFile(filepath.Join(dir, "cdk"), []byte(script), 0755))
 	return dir
 }
 
@@ -54,7 +54,7 @@ if [ "$1" = "--version" ]; then echo "2.177.0"; exit 0; fi
 echo "cdk: simulated failure" >&2
 exit %d
 `, code)
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "cdk"), []byte(script), 0755))
+	must.NoError(t, os.WriteFile(filepath.Join(dir, "cdk"), []byte(script), 0755))
 	return dir
 }
 
@@ -65,8 +65,8 @@ func TestCDKForwardsArgs(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:synth")
+	must.NoError(t, err, "stderr: %s", stderr)
+	must.Contains(t, stdout, "ARGS:synth")
 }
 
 // 7.1 — propagates the cdk exit code.
@@ -76,8 +76,8 @@ func TestCDKPropagatesExitCode(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
-	require.Error(t, err)
-	assert.Contains(t, stderr, "simulated failure")
+	must.Error(t, err)
+	must.Contains(t, stderr, "simulated failure")
 	requireExitCode(t, 7, err)
 }
 
@@ -97,18 +97,13 @@ func TestCDKInjectsCleanAWSEnv(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"cdk", "--region", "eu-west-1", "synth")
-	require.NoError(t, err, "stderr: %s", stderr)
-
-	assert.Contains(t, stdout, "ENV_AWS_ENDPOINT_URL=http")
-	assert.Contains(t, stdout, ":4566")
-	assert.Contains(t, stdout, "ENV_AWS_ENDPOINT_URL_S3=http")
-	assert.Contains(t, stdout, "ENV_AWS_REGION=eu-west-1")
-	assert.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=test")
-	assert.Contains(t, stdout, "ENV_AWS_SECRET_ACCESS_KEY=test")
-	// Ambient AWS config is stripped.
-	assert.Contains(t, stdout, "ENV_AWS_PROFILE=<unset>")
-	assert.Contains(t, stdout, "ENV_AWS_DEFAULT_PROFILE=<unset>")
-	assert.Contains(t, stdout, "ENV_AWS_SESSION_TOKEN=<unset>")
+	must.NoError(t, err, "stderr: %s", stderr)
+
+	// The snapshot pins the full env contract: both endpoints' scheme+port
+	// (host is DNS-dependent, masked), the region, the forced "test" access
+	// key (a real-looking ambient key must not select a custom account), and
+	// ambient AWS config stripped to <unset>.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.4 — offline subcommands run without a running emulator, even with a leading
@@ -124,10 +119,10 @@ func TestCDKOfflineCommandsNoEmulator(t *testing.T) {
 
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 				"cdk", "--region", "us-west-2", sub)
-			require.NoError(t, err, "stderr: %s", stderr)
+			must.NoError(t, err, "stderr: %s", stderr)
 
-			assert.Contains(t, stdout, "ARGS:"+sub)
-			assert.NotContains(t, stdout, "--region")
+			must.Contains(t, stdout, "ARGS:"+sub)
+			must.NotContains(t, stdout, "--region")
 		})
 	}
 }
@@ -146,8 +141,8 @@ func TestCDKHelpNoEmulator(t *testing.T) {
 
 			cmdArgs := append([]string{"cdk"}, args...)
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, cmdArgs...)
-			require.NoError(t, err, "stderr: %s", stderr)
-			assert.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
+			must.NoError(t, err, "stderr: %s", stderr)
+			must.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
 		})
 	}
 }
@@ -159,10 +154,10 @@ func TestCDKVersionTooOld(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
-	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "2.177.0")
+	must.Error(t, err)
+	must.Contains(t, stderr+stdout, "2.177.0")
 	// cdk was never run for real.
-	assert.NotContains(t, stdout, "ARGS:synth")
+	must.NotContains(t, stdout, "ARGS:synth")
 }
 
 // 7.5 — a missing cdk binary yields the install error.
@@ -171,8 +166,8 @@ func TestCDKMissingBinary(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
-	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "not found in PATH")
+	must.Error(t, err)
+	must.Contains(t, stderr+stdout, "not found in PATH")
 }
 
 // 7.6 — --account is not supported for cdk and is rejected at the command
@@ -188,9 +183,9 @@ func TestCDKAccountRejected(t *testing.T) {
 
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 				"cdk", "--account", value, "synth")
-			require.Error(t, err)
-			assert.Contains(t, stderr+stdout, "not supported")
-			assert.NotContains(t, stdout, "ARGS:synth")
+			must.Error(t, err)
+			must.Contains(t, stderr+stdout, "not supported")
+			must.NotContains(t, stdout, "ARGS:synth")
 		})
 	}
 }
@@ -203,8 +198,8 @@ func TestCDKFlagsAfterActionAreForwarded(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"cdk", "synth", "--region", "us-west-2")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:synth --region us-west-2")
+	must.NoError(t, err, "stderr: %s", stderr)
+	must.Contains(t, stdout, "ARGS:synth --region us-west-2")
 }
 
 // 7.6 — a flag before the subcommand is rejected with a clear message.
@@ -215,8 +210,8 @@ func TestCDKFlagBeforeSubcommandRejected(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--account", "111111111111", "cdk", "synth")
-	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "must appear after the cdk subcommand")
+	must.Error(t, err)
+	must.Contains(t, stderr+stdout, "must appear after the cdk subcommand")
 }
 
 // 7.7 — LSTK_CDK_CMD selects the binary to invoke.
@@ -226,14 +221,14 @@ func TestCDKHonorsLstkCdkCmd(t *testing.T) {
 		t.Skip("fake cdk script not supported on Windows")
 	}
 	dir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "mycdk"),
+	must.NoError(t, os.WriteFile(filepath.Join(dir, "mycdk"),
 		[]byte("#!/bin/sh\nif [ \"$1\" = \"--version\" ]; then echo \"2.177.0\"; exit 0; fi\necho \"MYCDK:$*\"\n"), 0755))
 	e := env.With(env.DisableEvents, "1").With("PATH", dir).With(env.Home, t.TempDir()).
 		With(env.Key("LSTK_CDK_CMD"), "mycdk")
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "MYCDK:synth")
+	must.NoError(t, err, "stderr: %s", stderr)
+	must.Contains(t, stdout, "MYCDK:synth")
 }
 
 // 7.3 — an AWS-contacting command with no running emulator fails with "not
@@ -247,10 +242,10 @@ func TestCDKFailsWhenEmulatorNotRunning(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "deploy")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "is not running")
-	assert.Contains(t, stdout, "Start LocalStack:")
-	assert.NotContains(t, stdout, "ARGS:deploy")
+	must.Error(t, err)
+	must.Contains(t, stdout, "is not running")
+	must.Contains(t, stdout, "Start LocalStack:")
+	must.NotContains(t, stdout, "ARGS:deploy")
 }
 
 // 7.3 — an AWS-contacting command fails with an AWS-specific error naming the
@@ -269,8 +264,8 @@ func TestCDKRequiresAWSEmulator(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), e, "cdk", "deploy")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "requires the")
-	assert.Contains(t, stdout, "Snowflake")
-	assert.NotContains(t, stdout, "ARGS:deploy")
+	must.Error(t, err)
+	must.Contains(t, stdout, "requires the")
+	must.Contains(t, stdout, "Snowflake")
+	must.NotContains(t, stdout, "ARGS:deploy")
 }
diff --git a/test/integration/cdk_e2e_test.go b/test/integration/cdk_e2e_test.go
index 24c2714e..e2f0e830 100644
--- a/test/integration/cdk_e2e_test.go
+++ b/test/integration/cdk_e2e_test.go
@@ -7,8 +7,8 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/require"
 )
 
 // End-to-end tests for `lstk cdk` that exercise the real AWS CDK CLI against a
@@ -45,7 +45,7 @@ func copyCDKSample(t *testing.T, name string) string {
 	t.Helper()
 	work := t.TempDir()
 	src := filepath.Join("test-samples", "iac", "cdk", name)
-	require.NoError(t, os.CopyFS(work, os.DirFS(src)))
+	must.NoError(t, os.CopyFS(work, os.DirFS(src)))
 	return work
 }
 
@@ -90,7 +90,7 @@ func TestCDKE2ESynthOffline(t *testing.T) {
 	npmInstall(t, ctx, work, e)
 
 	_, stderr, err := runCDK(t, ctx, work, e, "synth")
-	require.NoError(t, err, "cdk synth stderr: %s", stderr)
+	must.NoError(t, err, "cdk synth stderr: %s", stderr)
 }
 
 // 8.1 + 8.2 — `cdk bootstrap` succeeds against a real LocalStack (also
@@ -110,7 +110,7 @@ func TestCDKE2EBootstrap(t *testing.T) {
 	npmInstall(t, ctx, work, e)
 
 	_, stderr, err := runCDK(t, ctx, work, e, "bootstrap")
-	require.NoError(t, err, "cdk bootstrap stderr: %s", stderr)
+	must.NoError(t, err, "cdk bootstrap stderr: %s", stderr)
 }
 
 // 8.3 — `cdk deploy` of a single bucket succeeds against LocalStack, and
@@ -130,13 +130,13 @@ func TestCDKE2EDeployDestroy(t *testing.T) {
 	npmInstall(t, ctx, work, e)
 
 	_, stderr, err := runCDK(t, ctx, work, e, "bootstrap")
-	require.NoError(t, err, "cdk bootstrap stderr: %s", stderr)
+	must.NoError(t, err, "cdk bootstrap stderr: %s", stderr)
 
 	_, stderr, err = runCDK(t, ctx, work, e, "deploy", "--require-approval", "never")
-	require.NoError(t, err, "cdk deploy stderr: %s", stderr)
+	must.NoError(t, err, "cdk deploy stderr: %s", stderr)
 
 	_, stderr, err = runCDK(t, ctx, work, e, "destroy", "--force")
-	require.NoError(t, err, "cdk destroy stderr: %s", stderr)
+	must.NoError(t, err, "cdk destroy stderr: %s", stderr)
 }
 
 // 8.6 + 8.7 — full Lambda round-trip against LocalStack. Unlike the single-bucket
@@ -165,10 +165,10 @@ func TestCDKE2ELambdaAssetDeployDestroy(t *testing.T) {
 	npmInstall(t, ctx, work, e)
 
 	_, stderr, err := runCDK(t, ctx, work, e, "bootstrap")
-	require.NoError(t, err, "cdk bootstrap stderr: %s", stderr)
+	must.NoError(t, err, "cdk bootstrap stderr: %s", stderr)
 
 	_, stderr, err = runCDK(t, ctx, work, e, "deploy", "--require-approval", "never")
-	require.NoError(t, err, "cdk deploy stderr: %s", stderr)
+	must.NoError(t, err, "cdk deploy stderr: %s", stderr)
 
 	// Strongest proof when available: invoke the function (provisioned from the
 	// uploaded asset) and assert the handler's response. lstk aws shells out to
@@ -178,15 +178,15 @@ func TestCDKE2ELambdaAssetDeployDestroy(t *testing.T) {
 		outFile := filepath.Join(work, "invoke-out.json")
 		_, stderr, err = runLstk(t, ctx, work, e, "aws", "lambda", "invoke",
 			"--function-name", "lstk-cdk-e2e-fn", outFile)
-		require.NoError(t, err, "lstk aws lambda invoke stderr: %s", stderr)
+		must.NoError(t, err, "lstk aws lambda invoke stderr: %s", stderr)
 
 		out, readErr := os.ReadFile(outFile)
-		require.NoError(t, readErr)
-		require.Contains(t, string(out), "ok from lstk cdk lambda", "lambda response: %s", out)
+		must.NoError(t, readErr)
+		must.Contains(t, string(out), "ok from lstk cdk lambda", "lambda response: %s", out)
 	} else {
 		t.Log("aws CLI not on PATH; skipping lambda invoke verification (deploy already exercised the S3 asset path)")
 	}
 
 	_, stderr, err = runCDK(t, ctx, work, e, "destroy", "--force")
-	require.NoError(t, err, "cdk destroy stderr: %s", stderr)
+	must.NoError(t, err, "cdk destroy stderr: %s", stderr)
 }
diff --git a/test/integration/completion_test.go b/test/integration/completion_test.go
index 948eb114..db1eefbb 100644
--- a/test/integration/completion_test.go
+++ b/test/integration/completion_test.go
@@ -9,8 +9,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"github.com/localstack/lstk/internal/must"
 
 	"github.com/localstack/lstk/test/integration/env"
 )
@@ -48,16 +47,16 @@ func runBashCompletionDriver(t *testing.T, driver string, extraPath ...string) (
 
 	tmpHome := t.TempDir()
 	script, genStderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(tmpHome, ""), "completion", "bash")
-	require.NoError(t, err, "lstk completion bash failed: %s", genStderr)
+	must.NoError(t, err, "lstk completion bash failed: %s", genStderr)
 
 	dir := t.TempDir()
 	scriptPath := filepath.Join(dir, "lstk-completion.bash")
-	require.NoError(t, os.WriteFile(scriptPath, []byte(script), 0o600))
+	must.NoError(t, os.WriteFile(scriptPath, []byte(script), 0o600))
 	driverPath := filepath.Join(dir, "driver.bash")
-	require.NoError(t, os.WriteFile(driverPath, []byte(driver), 0o600))
+	must.NoError(t, os.WriteFile(driverPath, []byte(driver), 0o600))
 
 	binDir, err := filepath.Abs(filepath.Dir(binaryPath()))
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	cmd := exec.CommandContext(testContext(t), bashPath, "--noprofile", "--norc", driverPath, scriptPath)
 	cmd.Dir = dir
@@ -102,13 +101,13 @@ func TestBashCompletionWorksWithoutBashCompletionPackage(t *testing.T) {
 	t.Parallel()
 
 	stdout, stderr, err := runBashCompletionDriver(t, completeInDriver("lstk st", 1, "lstk st"))
-	require.NoError(t, err, "completion attempt failed\nstdout: %s\nstderr: %s", stdout, stderr)
-	assert.NotContains(t, stderr, "command not found")
+	must.NoError(t, err, "completion attempt failed\nstdout: %s\nstderr: %s", stdout, stderr)
+	must.NotContains(t, stderr, "command not found")
 
 	completions := strings.Fields(stdout)
-	assert.Contains(t, completions, "start")
-	assert.Contains(t, completions, "status")
-	assert.Contains(t, completions, "stop")
+	must.Contains(t, completions, "start")
+	must.Contains(t, completions, "status")
+	must.Contains(t, completions, "stop")
 }
 
 // TestBashCompletionAfterWhitespaceSeparatedFlagValue covers the shape that
@@ -120,12 +119,12 @@ func TestBashCompletionAfterWhitespaceSeparatedFlagValue(t *testing.T) {
 	t.Parallel()
 
 	stdout, stderr, err := runBashCompletionDriver(t, completeInDriver(`lstk --config = st`, 3, "lstk --config= st"))
-	require.NoError(t, err, "completion attempt failed\nstdout: %s\nstderr: %s", stdout, stderr)
+	must.NoError(t, err, "completion attempt failed\nstdout: %s\nstderr: %s", stdout, stderr)
 
 	completions := strings.Fields(stdout)
-	assert.Contains(t, completions, "start")
-	assert.Contains(t, completions, "status")
-	assert.Contains(t, completions, "stop")
+	must.Contains(t, completions, "start")
+	must.Contains(t, completions, "status")
+	must.Contains(t, completions, "stop")
 }
 
 // TestBashCompletionReassemblesWordbreakSplits verifies the self-contained
@@ -194,11 +193,11 @@ run_reassembly
 `, tc.compWords, tc.cword, tc.line, len(tc.line))
 
 			stdout, stderr, err := runBashCompletionDriver(t, driver)
-			require.NoError(t, err, "driver failed\nstdout: %s\nstderr: %s", stdout, stderr)
-			assert.NotContains(t, stderr, "command not found")
+			must.NoError(t, err, "driver failed\nstdout: %s\nstderr: %s", stdout, stderr)
+			must.NotContains(t, stderr, "command not found")
 
 			lines := strings.Split(strings.TrimRight(stdout, "\n"), "\n")
-			assert.Equal(t, tc.expect, lines)
+			must.Eq(t, tc.expect, lines)
 		})
 	}
 }
@@ -214,6 +213,6 @@ source "$1" || exit 1
 _get_comp_words_by_ref
 `
 	stdout, stderr, err := runBashCompletionDriver(t, driver)
-	require.NoError(t, err, "driver failed\nstdout: %s\nstderr: %s", stdout, stderr)
-	assert.Contains(t, stdout, "package version")
+	must.NoError(t, err, "driver failed\nstdout: %s\nstderr: %s", stdout, stderr)
+	must.Contains(t, stdout, "package version")
 }
diff --git a/test/integration/config_test.go b/test/integration/config_test.go
index f1fbbb41..d6975507 100644
--- a/test/integration/config_test.go
+++ b/test/integration/config_test.go
@@ -7,10 +7,9 @@ import (
 	"runtime"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestConfigFlagEnvVarsPassedToContainer(t *testing.T) {
@@ -34,16 +33,16 @@ env = ["test"]
 IAM_SOFT_MODE = "1"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
-	assert.Contains(t, inspect.Container.Config.Env, "IAM_SOFT_MODE=1")
+	must.NoError(t, err, "failed to inspect container")
+	must.Contains(t, inspect.Container.Config.Env, "IAM_SOFT_MODE=1")
 }
 
 func TestConfigFlagOverridesConfigPath(t *testing.T) {
@@ -52,7 +51,7 @@ func TestConfigFlagOverridesConfigPath(t *testing.T) {
 	writeConfigFile(t, customConfig)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", customConfig, "config", "path")
-	require.NoError(t, err, stderr)
+	must.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 
 	assertSamePath(t, customConfig, stdout)
@@ -71,11 +70,11 @@ func TestLocalConfigTakesPrecedence(t *testing.T) {
 
 	e := testEnvWithHome(tmpHome, xdgOverride)
 	stdout, stderr, err := runLstk(t, testContext(t), workDir, e, "config", "path")
-	require.NoError(t, err, stderr)
+	must.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 
 	expectedLocalPath, err := filepath.Abs(localConfigFile)
-	require.NoError(t, err)
+	must.NoError(t, err)
 	assertSamePath(t, expectedLocalPath, stdout)
 }
 
@@ -92,7 +91,7 @@ func TestXDGConfigTakesPrecedence(t *testing.T) {
 
 	e := testEnvWithHome(tmpHome, xdgOverride)
 	stdout, stderr, err := runLstk(t, testContext(t), workDir, e, "config", "path")
-	require.NoError(t, err, stderr)
+	must.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 
 	assertSamePath(t, xdgConfigFile, stdout)
@@ -108,7 +107,7 @@ func TestConfigPathCommand(t *testing.T) {
 	analyticsSrv, events := mockAnalyticsServer(t)
 	e := env.Environ(testEnvWithHome(tmpHome, filepath.Join(tmpHome, "xdg-config-home"))).With(env.AnalyticsEndpoint, analyticsSrv.URL)
 	stdout, stderr, err := runLstk(t, testContext(t), workDir, e, "config", "path")
-	require.NoError(t, err, stderr)
+	must.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 
 	assertSamePath(t, xdgConfigFile, stdout)
@@ -124,11 +123,11 @@ func TestConfigPathCommandDoesNotCreateConfig(t *testing.T) {
 
 	e := testEnvWithHome(tmpHome, xdgOverride)
 	stdout, stderr, err := runLstk(t, testContext(t), workDir, e, "config", "path")
-	require.NoError(t, err, stderr)
+	must.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 
 	assertSamePath(t, expectedConfigFile, stdout)
-	assert.NoFileExists(t, expectedConfigFile)
+	must.NoFileExists(t, expectedConfigFile)
 }
 
 func TestConfigWithUnknownFieldsIsAccepted(t *testing.T) {
@@ -143,10 +142,10 @@ port = "4566"
 future_field = "should be ignored"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "config", "path")
-	require.NoError(t, err, stderr)
+	must.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 }
 
@@ -158,12 +157,12 @@ type = "aws"
 tag = "latest"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "stop")
-	require.Error(t, err)
+	must.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "port is required")
+	must.Contains(t, stderr, "port is required")
 }
 
 func TestConfigWithInvalidContainerNameFails(t *testing.T) {
@@ -176,13 +175,13 @@ port = "4566"
 container_name = "my emulator"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	// Rejected at config load, so the failure needs no Docker daemon and no token.
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "stop")
-	require.Error(t, err)
+	must.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout+stderr, `invalid container name "my emulator"`)
+	must.Contains(t, stdout+stderr, `invalid container name "my emulator"`)
 }
 
 func TestStartWithMultipleContainersFailsFast(t *testing.T) {
@@ -197,14 +196,14 @@ type = "snowflake"
 port = "4567"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	// The guard runs at the very top of container.Start, before any Docker health
 	// check, auth, or image pull — so start fails fast even without a daemon/token.
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "start")
-	require.Error(t, err)
+	must.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout+stderr, "only one is supported at a time")
+	must.Contains(t, stdout+stderr, "only one is supported at a time")
 }
 
 func TestLegacyYAMLConfigGivesHelpfulError(t *testing.T) {
@@ -214,8 +213,8 @@ func TestLegacyYAMLConfigGivesHelpfulError(t *testing.T) {
 	xdgOverride := filepath.Join(tmpHome, "xdg-config-home")
 
 	legacyConfigDir := filepath.Join(tmpHome, ".config", "lstk")
-	require.NoError(t, os.MkdirAll(legacyConfigDir, 0755))
-	require.NoError(t, os.WriteFile(
+	must.NoError(t, os.MkdirAll(legacyConfigDir, 0755))
+	must.NoError(t, os.WriteFile(
 		filepath.Join(legacyConfigDir, "config.yaml"),
 		[]byte("emulators:\n  - type: aws\n    port: 4566\n"),
 		0644,
@@ -223,10 +222,10 @@ func TestLegacyYAMLConfigGivesHelpfulError(t *testing.T) {
 
 	e := testEnvWithHome(tmpHome, xdgOverride)
 	_, stderr, err := runLstk(t, testContext(t), workDir, e, "logout")
-	require.Error(t, err)
+	must.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "config.yaml")
-	assert.Contains(t, stderr, "TOML")
+	must.Contains(t, stderr, "config.yaml")
+	must.Contains(t, stderr, "TOML")
 }
 
 func TestConfigWithMissingOptionalTagSucceeds(t *testing.T) {
@@ -237,10 +236,10 @@ type = "aws"
 port = "4566"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "config", "path")
-	require.NoError(t, err, stderr)
+	must.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 }
 
@@ -276,14 +275,14 @@ func expectedOSConfigDir(tmpHome, xdgConfigHome string) string {
 
 func writeConfigFile(t *testing.T, path string) {
 	t.Helper()
-	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0755))
+	must.NoError(t, os.MkdirAll(filepath.Dir(path), 0755))
 	content := "[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"
-	require.NoError(t, os.WriteFile(path, []byte(content), 0644))
+	must.NoError(t, os.WriteFile(path, []byte(content), 0644))
 }
 
 func assertSamePath(t *testing.T, expectedPath, actualPath string) {
 	t.Helper()
-	assert.Equal(
+	must.Eq(
 		t,
 		normalizedPath(expectedPath),
 		normalizedPath(actualPath),
diff --git a/test/integration/docker_unhealthy_test.go b/test/integration/docker_unhealthy_test.go
index e925d18c..0c502809 100644
--- a/test/integration/docker_unhealthy_test.go
+++ b/test/integration/docker_unhealthy_test.go
@@ -4,9 +4,8 @@ import (
 	"runtime"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // unhealthyDockerEnv returns an environment with DOCKER_HOST pointing to a
@@ -22,10 +21,10 @@ func TestStartShowsDockerErrorWhenUnhealthy(t *testing.T) {
 	}
 
 	stdout, _, err := runLstk(t, testContext(t), "", unhealthyDockerEnv(), "start")
-	require.Error(t, err)
+	must.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Docker is not available")
-	assert.Contains(t, stdout, "Install Docker:")
+	must.Contains(t, stdout, "Docker is not available")
+	must.Contains(t, stdout, "Install Docker:")
 }
 
 func TestStopShowsDockerErrorWhenUnhealthy(t *testing.T) {
@@ -35,10 +34,10 @@ func TestStopShowsDockerErrorWhenUnhealthy(t *testing.T) {
 	}
 
 	stdout, _, err := runLstk(t, testContext(t), "", unhealthyDockerEnv(), "stop")
-	require.Error(t, err)
+	must.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Docker is not available")
-	assert.Contains(t, stdout, "Install Docker:")
+	must.Contains(t, stdout, "Docker is not available")
+	must.Contains(t, stdout, "Install Docker:")
 }
 
 // TestStopJSONIncludesDockerErrorDetail covers PR #374's report that --json
@@ -55,11 +54,11 @@ func TestStopJSONIncludesDockerErrorDetail(t *testing.T) {
 	requireExitCode(t, 1, err)
 
 	envelope := decodeEnvelope(t, stdout)
-	require.NotNil(t, envelope.Error)
-	assert.Equal(t, "RUNTIME_UNAVAILABLE", envelope.Error.Code)
-	assert.Equal(t, "Docker is not available", envelope.Error.Message)
+	must.NotNil(t, envelope.Error)
+	must.Eq(t, "RUNTIME_UNAVAILABLE", envelope.Error.Code)
+	must.Eq(t, "Docker is not available", envelope.Error.Message)
 	summary, _ := envelope.Error.Details["summary"].(string)
-	assert.Contains(t, summary, "cannot connect to Docker daemon")
+	must.Contains(t, summary, "cannot connect to Docker daemon")
 }
 
 func TestStatusShowsDockerErrorWhenUnhealthy(t *testing.T) {
@@ -69,10 +68,10 @@ func TestStatusShowsDockerErrorWhenUnhealthy(t *testing.T) {
 	}
 
 	stdout, _, err := runLstk(t, testContext(t), "", unhealthyDockerEnv(), "status")
-	require.Error(t, err)
+	must.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Docker is not available")
-	assert.Contains(t, stdout, "Install Docker:")
+	must.Contains(t, stdout, "Docker is not available")
+	must.Contains(t, stdout, "Install Docker:")
 }
 
 func TestLogsShowsDockerErrorWhenUnhealthy(t *testing.T) {
@@ -82,8 +81,8 @@ func TestLogsShowsDockerErrorWhenUnhealthy(t *testing.T) {
 	}
 
 	stdout, _, err := runLstk(t, testContext(t), "", unhealthyDockerEnv(), "logs")
-	require.Error(t, err)
+	must.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Docker is not available")
-	assert.Contains(t, stdout, "Install Docker:")
+	must.Contains(t, stdout, "Docker is not available")
+	must.Contains(t, stdout, "Install Docker:")
 }
diff --git a/test/integration/docker_windows_test.go b/test/integration/docker_windows_test.go
index 01f314f0..14c3b26a 100644
--- a/test/integration/docker_windows_test.go
+++ b/test/integration/docker_windows_test.go
@@ -4,9 +4,8 @@ import (
 	"runtime"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // windowsDockerErrorEnv returns an Environ with an invalid DOCKER_HOST and no PSModulePath.
@@ -24,9 +23,9 @@ func TestWindowsDockerErrorShowsDockerCLICommand(t *testing.T) {
 	}
 
 	stdout, _, err := runLstk(t, testContext(t), "", windowsDockerErrorEnv(), "start")
-	require.Error(t, err)
+	must.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "docker desktop start")
+	must.Contains(t, stdout, "docker desktop start")
 }
 
 // Verifies that the verbose Docker error message is suppressed on Windows.
@@ -37,8 +36,8 @@ func TestWindowsDockerErrorOmitsVerboseSummary(t *testing.T) {
 	}
 
 	stdout, _, err := runLstk(t, testContext(t), "", windowsDockerErrorEnv(), "start")
-	require.Error(t, err)
+	must.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Docker is not available")
-	assert.NotContains(t, stdout, "cannot connect to Docker daemon")
+	must.Contains(t, stdout, "Docker is not available")
+	must.NotContains(t, stdout, "cannot connect to Docker daemon")
 }
diff --git a/test/integration/docs_test.go b/test/integration/docs_test.go
index 00d3e37b..eeebf23b 100644
--- a/test/integration/docs_test.go
+++ b/test/integration/docs_test.go
@@ -4,8 +4,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"github.com/localstack/lstk/internal/must"
 )
 
 func TestDocsCommandGeneratesManPages(t *testing.T) {
@@ -13,12 +12,12 @@ func TestDocsCommandGeneratesManPages(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "manpages")
 
 	_, stderr, err := runLstk(t, testContext(t), "", testEnvWithHome(t.TempDir(), ""), "docs", "--format", "man", "--dir", dir)
-	require.NoError(t, err, stderr)
+	must.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 
-	assert.FileExists(t, filepath.Join(dir, "lstk.1"))
-	assert.FileExists(t, filepath.Join(dir, "lstk-start.1"))
-	assert.FileExists(t, filepath.Join(dir, "lstk-stop.1"))
+	must.FileExists(t, filepath.Join(dir, "lstk.1"))
+	must.FileExists(t, filepath.Join(dir, "lstk-start.1"))
+	must.FileExists(t, filepath.Join(dir, "lstk-stop.1"))
 }
 
 func TestDocsCommandGeneratesMarkdown(t *testing.T) {
@@ -26,12 +25,12 @@ func TestDocsCommandGeneratesMarkdown(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "markdown")
 
 	_, stderr, err := runLstk(t, testContext(t), "", testEnvWithHome(t.TempDir(), ""), "docs", "--format", "markdown", "--dir", dir)
-	require.NoError(t, err, stderr)
+	must.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 
-	assert.FileExists(t, filepath.Join(dir, "lstk.md"))
-	assert.FileExists(t, filepath.Join(dir, "lstk_start.md"))
-	assert.FileExists(t, filepath.Join(dir, "lstk_stop.md"))
+	must.FileExists(t, filepath.Join(dir, "lstk.md"))
+	must.FileExists(t, filepath.Join(dir, "lstk_start.md"))
+	must.FileExists(t, filepath.Join(dir, "lstk_stop.md"))
 }
 
 func TestDocsCommandRejectsInvalidFormat(t *testing.T) {
@@ -39,14 +38,14 @@ func TestDocsCommandRejectsInvalidFormat(t *testing.T) {
 	dir := t.TempDir()
 
 	_, _, err := runLstk(t, testContext(t), "", testEnvWithHome(t.TempDir(), ""), "docs", "--format", "invalid", "--dir", dir)
-	require.Error(t, err)
+	must.Error(t, err)
 	requireExitCode(t, 1, err)
 }
 
 func TestDocsCommandIsHidden(t *testing.T) {
 	t.Parallel()
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--help")
-	require.NoError(t, err, stderr)
+	must.NoError(t, err, stderr)
 
-	assert.NotContains(t, stdout, "docs")
+	must.NotContains(t, stdout, "docs")
 }
diff --git a/test/integration/emulator_select_test.go b/test/integration/emulator_select_test.go
index 49175df9..90f0d0bd 100644
--- a/test/integration/emulator_select_test.go
+++ b/test/integration/emulator_select_test.go
@@ -12,9 +12,8 @@ import (
 	"time"
 
 	"github.com/creack/pty"
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestNoEmulatorSelectionWhenConfigExists(t *testing.T) {
@@ -24,15 +23,15 @@ func TestNoEmulatorSelectionWhenConfigExists(t *testing.T) {
 	}
 
 	tmpHome := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).
 		With(env.DisableEvents, "1")
 
 	// Pre-create the config so lstk does not treat this as a first run.
 	configPath, _, err := runLstk(t, testContext(t), "", e, "config", "path")
-	require.NoError(t, err)
-	require.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
-	require.NoError(t, os.WriteFile(configPath, []byte("[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
+	must.NoError(t, err)
+	must.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
+	must.NoError(t, os.WriteFile(configPath, []byte("[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
@@ -41,7 +40,7 @@ func TestNoEmulatorSelectionWhenConfigExists(t *testing.T) {
 	cmd.Env = e
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start lstk in PTY")
+	must.NoError(t, err, "failed to start lstk in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	out := &syncBuffer{}
@@ -51,7 +50,7 @@ func TestNoEmulatorSelectionWhenConfigExists(t *testing.T) {
 		close(outputCh)
 	}()
 
-	assert.Never(t, func() bool {
+	must.Never(t, func() bool {
 		return bytes.Contains(out.Bytes(), []byte("Which emulator would you like to use?"))
 	}, 2*time.Second, 100*time.Millisecond, "emulator selection prompt should not appear when config already exists")
 
@@ -67,14 +66,14 @@ func TestFirstRunShowsEmulatorSelectionPrompt(t *testing.T) {
 	}
 
 	tmpHome := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).
 		With(env.DisableEvents, "1")
 
 	// Confirm no config exists at the path lstk would use — this is what triggers first-run.
 	configPath, _, err := runLstk(t, testContext(t), "", e, "config", "path")
-	require.NoError(t, err)
-	require.NoFileExists(t, configPath)
+	must.NoError(t, err)
+	must.NoFileExists(t, configPath)
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
@@ -83,7 +82,7 @@ func TestFirstRunShowsEmulatorSelectionPrompt(t *testing.T) {
 	cmd.Env = e
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start lstk in PTY")
+	must.NoError(t, err, "failed to start lstk in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	out := &syncBuffer{}
@@ -93,23 +92,23 @@ func TestFirstRunShowsEmulatorSelectionPrompt(t *testing.T) {
 		close(outputCh)
 	}()
 
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(out.Bytes(), []byte("Which emulator would you like to use?"))
 	}, 10*time.Second, 100*time.Millisecond, "emulator selection prompt should appear on first run")
 
 	// Confirm the default-highlighted option (AWS) by pressing Enter.
 	_, err = ptmx.Write([]byte("\r"))
-	require.NoError(t, err)
+	must.NoError(t, err)
 
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(out.Bytes(), []byte("AWS emulator selected."))
 	}, 10*time.Second, 100*time.Millisecond, "selection confirmation should appear after pressing Enter")
 
 	// SetEmulatorType writes the config before emitting the confirmation message,
 	// so the file is guaranteed to exist and contain the selection by this point.
 	configData, err := os.ReadFile(configPath)
-	require.NoError(t, err)
-	assert.Contains(t, string(configData), `type = "aws"`)
+	must.NoError(t, err)
+	must.Contains(t, string(configData), `type = "aws"`)
 
 	cancel()
 	<-outputCh
@@ -129,20 +128,20 @@ func TestFirstRunStillShowsSelectionPromptAfterRunningAnotherCommand(t *testing.
 	}
 
 	tmpHome := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).
 		With(env.DisableEvents, "1")
 
 	configPath, _, err := runLstk(t, testContext(t), "", e, "config", "path")
-	require.NoError(t, err)
-	require.NoFileExists(t, configPath)
+	must.NoError(t, err)
+	must.NoFileExists(t, configPath)
 
 	// Run a command that doesn't start the emulator — this used to eagerly
 	// create the default (type = "aws") config via config.Init, consuming
 	// firstRun before the user ever saw the selector.
 	_, _, err = runLstk(t, testContext(t), "", e, "volume", "path")
-	require.NoError(t, err)
-	require.NoFileExists(t, configPath, "running an unrelated command must not create the default config")
+	must.NoError(t, err)
+	must.NoFileExists(t, configPath, "running an unrelated command must not create the default config")
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
@@ -151,7 +150,7 @@ func TestFirstRunStillShowsSelectionPromptAfterRunningAnotherCommand(t *testing.
 	cmd.Env = e
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start lstk in PTY")
+	must.NoError(t, err, "failed to start lstk in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	out := &syncBuffer{}
@@ -161,7 +160,7 @@ func TestFirstRunStillShowsSelectionPromptAfterRunningAnotherCommand(t *testing.
 		close(outputCh)
 	}()
 
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(out.Bytes(), []byte("Which emulator would you like to use?"))
 	}, 10*time.Second, 100*time.Millisecond,
 		"emulator selection prompt should still appear on first `start` even after running another command first")
@@ -178,13 +177,13 @@ func TestFirstRunCanSelectAzureEmulator(t *testing.T) {
 	}
 
 	tmpHome := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).
 		With(env.DisableEvents, "1")
 
 	configPath, _, err := runLstk(t, testContext(t), "", e, "config", "path")
-	require.NoError(t, err)
-	require.NoFileExists(t, configPath)
+	must.NoError(t, err)
+	must.NoFileExists(t, configPath)
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
@@ -193,7 +192,7 @@ func TestFirstRunCanSelectAzureEmulator(t *testing.T) {
 	cmd.Env = e
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start lstk in PTY")
+	must.NoError(t, err, "failed to start lstk in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	out := &syncBuffer{}
@@ -203,23 +202,23 @@ func TestFirstRunCanSelectAzureEmulator(t *testing.T) {
 		close(outputCh)
 	}()
 
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(out.Bytes(), []byte("Which emulator would you like to use?"))
 	}, 10*time.Second, 100*time.Millisecond, "emulator selection prompt should appear on first run")
 
-	assert.Contains(t, out.String(), "Azure", "Azure should be offered as a selectable emulator")
+	must.Contains(t, out.String(), "Azure", "Azure should be offered as a selectable emulator")
 
 	// Press the Azure selection key ('z') instead of the default-highlighted AWS.
 	_, err = ptmx.Write([]byte("z"))
-	require.NoError(t, err)
+	must.NoError(t, err)
 
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(out.Bytes(), []byte("Azure emulator selected."))
 	}, 10*time.Second, 100*time.Millisecond, "Azure selection confirmation should appear")
 
 	configData, err := os.ReadFile(configPath)
-	require.NoError(t, err)
-	assert.Contains(t, string(configData), `type = "azure"`)
+	must.NoError(t, err)
+	must.Contains(t, string(configData), `type = "azure"`)
 
 	cancel()
 	<-outputCh
@@ -236,7 +235,7 @@ func TestFirstRunPromptsForLoginBeforeEmulatorSelection(t *testing.T) {
 	defer mockServer.Close()
 
 	tmpHome := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).
 		Without(env.AuthToken).
 		With(env.APIEndpoint, mockServer.URL).
@@ -244,8 +243,8 @@ func TestFirstRunPromptsForLoginBeforeEmulatorSelection(t *testing.T) {
 
 	// No config exists so this is a first run; no token means login fires before emulator selection.
 	configPath, _, err := runLstk(t, testContext(t), "", e, "config", "path")
-	require.NoError(t, err)
-	require.NoFileExists(t, configPath)
+	must.NoError(t, err)
+	must.NoFileExists(t, configPath)
 
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
@@ -254,7 +253,7 @@ func TestFirstRunPromptsForLoginBeforeEmulatorSelection(t *testing.T) {
 	cmd.Env = e
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start lstk in PTY")
+	must.NoError(t, err, "failed to start lstk in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	out := &syncBuffer{}
@@ -264,17 +263,17 @@ func TestFirstRunPromptsForLoginBeforeEmulatorSelection(t *testing.T) {
 		close(outputCh)
 	}()
 
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(out.Bytes(), []byte("Press any key when complete"))
 	}, 10*time.Second, 100*time.Millisecond, "auth prompt should appear on first run when no token is set")
 
-	assert.NotContains(t, out.String(), "Which emulator would you like to use?",
+	must.NotContains(t, out.String(), "Which emulator would you like to use?",
 		"emulator selection prompt must not appear before auth completes")
 
 	_, err = ptmx.Write([]byte("\r"))
-	require.NoError(t, err)
+	must.NoError(t, err)
 
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(out.Bytes(), []byte("Which emulator would you like to use?"))
 	}, 10*time.Second, 100*time.Millisecond, "emulator selection prompt should appear after auth completes")
 
@@ -285,18 +284,18 @@ func TestFirstRunPromptsForLoginBeforeEmulatorSelection(t *testing.T) {
 func TestFirstRunNonInteractiveEmitsDefaultEmulatorNote(t *testing.T) {
 	t.Parallel()
 	tmpHome := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).With(env.DisableEvents, "1")
 
 	// Verify no config exists — this is what triggers first-run.
 	configPath, _, err := runLstk(t, testContext(t), "", e, "config", "path")
-	require.NoError(t, err)
-	require.NoFileExists(t, configPath)
+	must.NoError(t, err)
+	must.NoFileExists(t, configPath)
 
 	// Process fails at container.Start (no Docker), but the note is emitted before that.
 	stdout, _, runErr := runLstk(t, testContext(t), "", e.With(env.AuthToken, "test-token"), "--non-interactive")
-	assert.Error(t, runErr, "expected failure: no Docker available")
-	assert.Contains(t, stdout, "Configured with default emulator", "non-interactive first run should note the default emulator")
+	must.Error(t, runErr, "expected failure: no Docker available")
+	must.Contains(t, stdout, "Configured with default emulator", "non-interactive first run should note the default emulator")
 }
 
 // A first run that fails before doing any work (no Docker) leaves no config, so
@@ -309,18 +308,18 @@ func TestEmulatorSelectionReappearsAfterFailedFirstRun(t *testing.T) {
 	}
 
 	tmpHome := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	base := env.Environ(testEnvWithHome(tmpHome, tmpHome)).With(env.DisableEvents, "1")
 
 	configPath, _, err := runLstk(t, testContext(t), "", base, "config", "path")
-	require.NoError(t, err)
-	require.NoFileExists(t, configPath)
+	must.NoError(t, err)
+	must.NoFileExists(t, configPath)
 
 	noDocker := base.With(env.Key("DOCKER_HOST"), "unix:///var/run/docker-does-not-exist.sock")
 	stdout, _, runErr := runLstk(t, testContext(t), "", noDocker, "--non-interactive")
-	require.Error(t, runErr, "first run should fail when Docker is unavailable")
-	assert.Contains(t, stdout, "Docker is not available")
-	require.NoFileExists(t, configPath, "a run that fails before doing any work must not create a config")
+	must.Error(t, runErr, "first run should fail when Docker is unavailable")
+	must.Contains(t, stdout, "Docker is not available")
+	must.NoFileExists(t, configPath, "a run that fails before doing any work must not create a config")
 
 	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
 	defer cancel()
@@ -329,7 +328,7 @@ func TestEmulatorSelectionReappearsAfterFailedFirstRun(t *testing.T) {
 	cmd.Env = base
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start lstk in PTY")
+	must.NoError(t, err, "failed to start lstk in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	out := &syncBuffer{}
@@ -339,7 +338,7 @@ func TestEmulatorSelectionReappearsAfterFailedFirstRun(t *testing.T) {
 		close(outputCh)
 	}()
 
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(out.Bytes(), []byte("Which emulator would you like to use?"))
 	}, 10*time.Second, 100*time.Millisecond,
 		"emulator selection prompt should reappear after a first run that failed before selection")
@@ -359,7 +358,7 @@ func TestEmulatorSelectionReappearsAfterConfigDirDeleted(t *testing.T) {
 	}
 
 	tmpHome := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).
 		With(env.DisableEvents, "1").
 		With(env.AuthToken, "test-token")
@@ -367,14 +366,14 @@ func TestEmulatorSelectionReappearsAfterConfigDirDeleted(t *testing.T) {
 	// Resolve where lstk would create the config, then pre-create it so lstk
 	// believes this is not a first run (simulates a previous successful start).
 	configPath, _, err := runLstk(t, testContext(t), "", e, "config", "path")
-	require.NoError(t, err)
-	require.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
-	require.NoError(t, os.WriteFile(configPath, []byte("[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
-	require.FileExists(t, configPath)
+	must.NoError(t, err)
+	must.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
+	must.NoError(t, os.WriteFile(configPath, []byte("[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
+	must.FileExists(t, configPath)
 
 	// Delete the entire config directory — this is what the user reported.
-	require.NoError(t, os.RemoveAll(filepath.Dir(configPath)))
-	require.NoFileExists(t, configPath)
+	must.NoError(t, os.RemoveAll(filepath.Dir(configPath)))
+	must.NoFileExists(t, configPath)
 
 	// The next run must show the emulator selector again, not silently default to AWS.
 	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
@@ -384,7 +383,7 @@ func TestEmulatorSelectionReappearsAfterConfigDirDeleted(t *testing.T) {
 	cmd.Env = e
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start lstk in PTY")
+	must.NoError(t, err, "failed to start lstk in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	out := &syncBuffer{}
@@ -394,7 +393,7 @@ func TestEmulatorSelectionReappearsAfterConfigDirDeleted(t *testing.T) {
 		close(outputCh)
 	}()
 
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(out.Bytes(), []byte("Which emulator would you like to use?"))
 	}, 10*time.Second, 100*time.Millisecond,
 		"emulator selection prompt should reappear after the config directory is deleted")
@@ -413,7 +412,7 @@ func TestFirstRunChecksDockerBeforeAuthAndSelection(t *testing.T) {
 	defer mockServer.Close()
 
 	tmpHome := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).
 		Without(env.AuthToken).
 		With(env.APIEndpoint, mockServer.URL).
@@ -424,11 +423,11 @@ func TestFirstRunChecksDockerBeforeAuthAndSelection(t *testing.T) {
 	defer cancel()
 
 	out, err := runLstkInPTY(t, ctx, e, "start")
-	require.Error(t, err)
+	must.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, out, "Docker is not available")
-	assert.NotContains(t, out, "Press any key when complete",
+	must.Contains(t, out, "Docker is not available")
+	must.NotContains(t, out, "Press any key when complete",
 		"login prompt must not appear when the runtime is unavailable")
-	assert.NotContains(t, out, "Which emulator would you like to use?",
+	must.NotContains(t, out, "Which emulator would you like to use?",
 		"emulator selection must not appear when the runtime is unavailable")
 }
diff --git a/test/integration/emulator_type_test.go b/test/integration/emulator_type_test.go
index e11109ea..76b69806 100644
--- a/test/integration/emulator_type_test.go
+++ b/test/integration/emulator_type_test.go
@@ -6,10 +6,9 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // dockerHostKey points the binary at a non-existent Docker socket so that
@@ -22,7 +21,7 @@ const dockerHostKey = env.Key("DOCKER_HOST")
 func typeTestEnv(t *testing.T) (env.Environ, string) {
 	t.Helper()
 	tmpHome := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).
 		With(env.DisableEvents, "1").
 		With(env.AuthToken, "dummy-token").
@@ -36,7 +35,7 @@ func typeTestEnv(t *testing.T) (env.Environ, string) {
 func typeTestEnvWithDocker(t *testing.T) (env.Environ, string) {
 	t.Helper()
 	tmpHome := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).
 		With(env.DisableEvents, "1").
 		With(env.AuthToken, "fake-token")
@@ -46,7 +45,7 @@ func typeTestEnvWithDocker(t *testing.T) (env.Environ, string) {
 func resolvedConfigPath(t *testing.T, e env.Environ) string {
 	t.Helper()
 	configPath, _, err := runLstk(t, testContext(t), t.TempDir(), e, "config", "path")
-	require.NoError(t, err)
+	must.NoError(t, err)
 	return configPath
 }
 
@@ -54,14 +53,14 @@ func TestStartTypeFlagFirstRunCreatesConfig(t *testing.T) {
 	t.Parallel()
 	e, _ := typeTestEnv(t)
 	configPath := resolvedConfigPath(t, e)
-	require.NoFileExists(t, configPath)
+	must.NoFileExists(t, configPath)
 
 	stdout, _, _ := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "snowflake", "--non-interactive")
 
-	assert.Contains(t, stdout, "Snowflake emulator selected.")
+	must.Contains(t, stdout, "Snowflake emulator selected.")
 	data, err := os.ReadFile(configPath)
-	require.NoError(t, err)
-	assert.Contains(t, string(data), `type = "snowflake"`)
+	must.NoError(t, err)
+	must.Contains(t, string(data), `type = "snowflake"`)
 }
 
 // TestBareRootTypeFlagCreatesConfig covers the bare-root form (no "start"
@@ -72,66 +71,66 @@ func TestBareRootTypeFlagCreatesConfig(t *testing.T) {
 	t.Parallel()
 	e, _ := typeTestEnv(t)
 	configPath := resolvedConfigPath(t, e)
-	require.NoFileExists(t, configPath)
+	must.NoFileExists(t, configPath)
 
 	stdout, _, _ := runLstk(t, testContext(t), t.TempDir(), e, "--type", "azure", "--non-interactive")
 
-	assert.Contains(t, stdout, "Azure emulator selected.")
+	must.Contains(t, stdout, "Azure emulator selected.")
 	data, err := os.ReadFile(configPath)
-	require.NoError(t, err)
-	assert.Contains(t, string(data), `type = "azure"`)
+	must.NoError(t, err)
+	must.Contains(t, string(data), `type = "azure"`)
 }
 
 func TestStartTypeFlagSwitchesInPlace(t *testing.T) {
 	t.Parallel()
 	e, _ := typeTestEnv(t)
 	configPath := resolvedConfigPath(t, e)
-	require.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
-	require.NoError(t, os.WriteFile(configPath, []byte("[[containers]]\ntype = \"aws\"     # keep me\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
+	must.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
+	must.NoError(t, os.WriteFile(configPath, []byte("[[containers]]\ntype = \"aws\"     # keep me\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
 
 	stdout, _, _ := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "azure", "--non-interactive")
 
-	assert.Contains(t, stdout, "Switched configured emulator to Azure")
+	must.Contains(t, stdout, "Switched configured emulator to Azure")
 	data, err := os.ReadFile(configPath)
-	require.NoError(t, err)
-	assert.Contains(t, string(data), `type = "azure"`)
+	must.NoError(t, err)
+	must.Contains(t, string(data), `type = "azure"`)
 	// The surgical rewrite preserves the inline comment and other fields.
-	assert.Contains(t, string(data), "# keep me")
-	assert.Contains(t, string(data), `port = "4566"`)
+	must.Contains(t, string(data), "# keep me")
+	must.Contains(t, string(data), `port = "4566"`)
 }
 
 func TestStartTypeFlagNoOpWhenMatching(t *testing.T) {
 	t.Parallel()
 	e, _ := typeTestEnv(t)
 	configPath := resolvedConfigPath(t, e)
-	require.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
+	must.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
 	content := "[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"
-	require.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
+	must.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
 
 	stdout, _, _ := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "aws", "--non-interactive")
 
-	assert.NotContains(t, stdout, "Switched configured emulator")
+	must.NotContains(t, stdout, "Switched configured emulator")
 	data, err := os.ReadFile(configPath)
-	require.NoError(t, err)
-	assert.Equal(t, content, string(data))
+	must.NoError(t, err)
+	must.Eq(t, content, string(data))
 }
 
 func TestStartTypeFlagErrorsWhenImageSet(t *testing.T) {
 	t.Parallel()
 	e, _ := typeTestEnv(t)
 	configPath := resolvedConfigPath(t, e)
-	require.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
+	must.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
 	content := "[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\nimage = \"my-registry.example.com/localstack-pro:3.0\"\n"
-	require.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
+	must.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "snowflake", "--non-interactive")
 
-	require.Error(t, err)
-	assert.Contains(t, stdout, "Cannot switch emulator to Snowflake while a custom image is set")
+	must.Error(t, err)
+	must.Contains(t, stdout, "Cannot switch emulator to Snowflake while a custom image is set")
 	// Config must be left untouched.
 	data, readErr := os.ReadFile(configPath)
-	require.NoError(t, readErr)
-	assert.Equal(t, content, string(data))
+	must.NoError(t, readErr)
+	must.Eq(t, content, string(data))
 }
 
 // TestStartTypeErrorsOnMultipleBlocks verifies the switch refuses a config with
@@ -141,18 +140,18 @@ func TestStartTypeErrorsOnMultipleBlocks(t *testing.T) {
 	t.Parallel()
 	e, _ := typeTestEnv(t)
 	configPath := resolvedConfigPath(t, e)
-	require.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
+	must.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
 	content := "[[containers]]\ntype = \"aws\"\nport = \"4566\"\n\n[[containers]]\ntype = \"snowflake\"\nport = \"4567\"\n"
-	require.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
+	must.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "azure", "--non-interactive")
 
-	require.Error(t, err)
-	assert.Contains(t, stdout, "Unsupported configuration")
+	must.Error(t, err)
+	must.Contains(t, stdout, "Unsupported configuration")
 	// Config must be left untouched — neither block's type is rewritten.
 	data, readErr := os.ReadFile(configPath)
-	require.NoError(t, readErr)
-	assert.Equal(t, content, string(data))
+	must.NoError(t, readErr)
+	must.Eq(t, content, string(data))
 }
 
 // TestStartTypePositionalRejected pins that the emulator is a flag only: a
@@ -167,9 +166,9 @@ func TestStartTypePositionalRejected(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "azure", "--non-interactive")
 
-	require.Error(t, err)
-	assert.Contains(t, stderr, "select the emulator with --type")
-	require.NoFileExists(t, configPath)
+	must.Error(t, err)
+	must.Contains(t, stderr, "select the emulator with --type")
+	must.NoFileExists(t, configPath)
 }
 
 // TestStartTypeErrorsWhenNoContainersBlock is the end-to-end regression for the
@@ -180,18 +179,18 @@ func TestStartTypeErrorsWhenNoContainersBlock(t *testing.T) {
 	t.Parallel()
 	e, _ := typeTestEnv(t)
 	configPath := resolvedConfigPath(t, e)
-	require.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
+	must.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
 	content := "[env.default]\ntype = \"custom\"\n"
-	require.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
+	must.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "azure", "--non-interactive")
 
-	require.Error(t, err)
-	assert.Contains(t, stderr, "[[containers]] block")
+	must.Error(t, err)
+	must.Contains(t, stderr, "[[containers]] block")
 	// The env table's type key must be left untouched, not corrupted to "azure".
 	data, readErr := os.ReadFile(configPath)
-	require.NoError(t, readErr)
-	assert.Equal(t, content, string(data))
+	must.NoError(t, readErr)
+	must.Eq(t, content, string(data))
 }
 
 func TestStartTypeInvalidValue(t *testing.T) {
@@ -200,8 +199,8 @@ func TestStartTypeInvalidValue(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "bogus", "--non-interactive")
 
-	require.Error(t, err)
-	assert.Contains(t, stderr, `invalid emulator type "bogus"`)
+	must.Error(t, err)
+	must.Contains(t, stderr, `invalid emulator type "bogus"`)
 }
 
 // TestStartTypeFlagRefusesSwitchWhenDifferentEmulatorRunning is the end-to-end
@@ -224,7 +223,7 @@ func TestStartTypeFlagRefusesSwitchWhenDifferentEmulatorRunning(t *testing.T) {
 
 	const fakeImage = "localstack/localstack-azure:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -232,19 +231,19 @@ func TestStartTypeFlagRefusesSwitchWhenDifferentEmulatorRunning(t *testing.T) {
 
 	e, _ := typeTestEnvWithDocker(t)
 	configPath := resolvedConfigPath(t, e)
-	require.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
+	must.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
 	content := "[[containers]]\ntype = \"azure\"\ntag = \"latest\"\nport = \"4566\"\n"
-	require.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
+	must.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
 
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), e, "start", "--type", "snowflake", "--non-interactive")
 
-	require.Error(t, err)
-	assert.Contains(t, stdout, "LocalStack Azure Emulator is running on port 4566")
-	assert.Contains(t, stdout, "config was not changed")
-	assert.Contains(t, stdout, "docker stop localstack-external-azure")
+	must.Error(t, err)
+	must.Contains(t, stdout, "LocalStack Azure Emulator is running on port 4566")
+	must.Contains(t, stdout, "config was not changed")
+	must.Contains(t, stdout, "docker stop localstack-external-azure")
 
 	// Config must be left untouched: still Azure, not rewritten to Snowflake.
 	data, readErr := os.ReadFile(configPath)
-	require.NoError(t, readErr)
-	assert.Equal(t, content, string(data))
+	must.NoError(t, readErr)
+	must.Eq(t, content, string(data))
 }
diff --git a/test/integration/endpoint_url_https_test.go b/test/integration/endpoint_url_https_test.go
index b1915ed9..86c33745 100644
--- a/test/integration/endpoint_url_https_test.go
+++ b/test/integration/endpoint_url_https_test.go
@@ -13,9 +13,9 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // minimalStateZip builds a minimal valid state export ZIP, mirroring
@@ -25,10 +25,10 @@ func minimalStateZip(t *testing.T) []byte {
 	var buf bytes.Buffer
 	zw := zip.NewWriter(&buf)
 	f, err := zw.Create("state.json")
-	require.NoError(t, err)
+	must.NoError(t, err)
 	_, err = f.Write([]byte(`{"services":{}}`))
-	require.NoError(t, err)
-	require.NoError(t, zw.Close())
+	must.NoError(t, err)
+	must.NoError(t, zw.Close())
 	return buf.Bytes()
 }
 
@@ -48,7 +48,7 @@ func httpsCertFileEnv(t *testing.T, srv *httptest.Server) string {
 	t.Helper()
 	path := filepath.Join(t.TempDir(), "test-ca.pem")
 	pemBytes := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: srv.Certificate().Raw})
-	require.NoError(t, os.WriteFile(path, pemBytes, 0o600))
+	must.NoError(t, os.WriteFile(path, pemBytes, 0o600))
 	return "SSL_CERT_FILE=" + path
 }
 
@@ -83,9 +83,9 @@ func TestAWSCommandEndpointURLHTTPSNoDockerRequired(t *testing.T) {
 	e = append(e, unreachableDockerHost, httpsCertFileEnv(t, srv))
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "aws", "s3", "ls")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ENDPOINT:"+srv.URL)
-	assert.Contains(t, stdout, "ARGS:s3 ls")
+	must.NoError(t, err, "stderr: %s", stderr)
+	must.Contains(t, stdout, "ENDPOINT:"+srv.URL)
+	must.Contains(t, stdout, "ARGS:s3 ls")
 }
 
 // TestCDKCommandEndpointURLHTTPSNoDockerRequired mirrors
@@ -105,8 +105,8 @@ func TestCDKCommandEndpointURLHTTPSNoDockerRequired(t *testing.T) {
 	e = append(e, unreachableDockerHost, httpsCertFileEnv(t, srv))
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "cdk", "deploy", "MyStack")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ENV_AWS_ENDPOINT_URL="+srv.URL)
+	must.NoError(t, err, "stderr: %s", stderr)
+	must.Contains(t, stdout, "ENV_AWS_ENDPOINT_URL="+srv.URL)
 }
 
 // TestSnapshotSaveEndpointURLHTTPSNoDockerRequired proves the emulator-client
@@ -142,9 +142,9 @@ func TestSnapshotSaveEndpointURLHTTPSNoDockerRequired(t *testing.T) {
 	e = append(e, unreachableDockerHost, httpsCertFileEnv(t, srv))
 
 	stdout, stderr, err := runLstk(t, testContext(t), dir, e, "--endpoint-url", srv.URL, "snapshot", "save")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "Snapshot saved")
-	assert.Equal(t, "/_localstack/pods/state", gotPath)
+	must.NoError(t, err, "stderr: %s", stderr)
+	must.Contains(t, stdout, "Snapshot saved")
+	must.Eq(t, "/_localstack/pods/state", gotPath)
 }
 
 // TestStatusEndpointURLHTTPSchemeMismatchSuggestsHTTPS covers the confusing
@@ -164,11 +164,11 @@ func TestStatusEndpointURLHTTPSchemeMismatchSuggestsHTTPS(t *testing.T) {
 	e = append(e, unreachableDockerHost, httpsCertFileEnv(t, srv))
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", httpURL, "status")
-	require.Error(t, err)
-	assert.Contains(t, stderr, "could not reach LocalStack emulator at "+httpURL)
-	assert.Contains(t, stderr, srv.URL+" responded")
-	assert.Contains(t, stderr, "retry with that URL")
-	assert.NotContains(t, stderr, "lstk start")
+	must.Error(t, err)
+	must.Contains(t, stderr, "could not reach LocalStack emulator at "+httpURL)
+	must.Contains(t, stderr, srv.URL+" responded")
+	must.Contains(t, stderr, "retry with that URL")
+	must.NotContains(t, stderr, "lstk start")
 }
 
 // TestStatusEndpointURLHTTPSSchemeMismatchSuggestsHTTP is the mirror image:
@@ -186,10 +186,10 @@ func TestStatusEndpointURLHTTPSSchemeMismatchSuggestsHTTP(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", httpsURL, "status")
-	require.Error(t, err)
-	assert.Contains(t, stderr, "could not reach LocalStack emulator at "+httpsURL)
-	assert.Contains(t, stderr, srv.URL+" responded")
-	assert.Contains(t, stderr, "retry with that URL")
+	must.Error(t, err)
+	must.Contains(t, stderr, "could not reach LocalStack emulator at "+httpsURL)
+	must.Contains(t, stderr, srv.URL+" responded")
+	must.Contains(t, stderr, "retry with that URL")
 }
 
 // TestStatusEndpointURLHTTPSRendersReducedOutput is the https counterpart of
@@ -205,10 +205,8 @@ func TestStatusEndpointURLHTTPSRendersReducedOutput(t *testing.T) {
 	e = append(e, unreachableDockerHost, httpsCertFileEnv(t, srv))
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "status")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "running")
-	assert.Contains(t, stdout, srv.URL)
-	assert.Contains(t, stdout, "3.0.2")
-	assert.NotContains(t, stdout, "Container:")
-	assert.NotContains(t, stdout, "Uptime:")
+	must.NoError(t, err, "stderr: %s", stderr)
+	// The snapshot pins the reduced remote-status card: running headline and
+	// endpoint only — no Container/Uptime lines, which need local Docker.
+	snap.Match(t, sanitizeOutput(stdout))
 }
diff --git a/test/integration/endpoint_url_test.go b/test/integration/endpoint_url_test.go
index 5db273f5..04af3678 100644
--- a/test/integration/endpoint_url_test.go
+++ b/test/integration/endpoint_url_test.go
@@ -15,9 +15,9 @@ import (
 	"testing"
 
 	"github.com/creack/pty"
+	"github.com/localstack/lstk/internal/must"
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // unreachableDockerHost points DOCKER_HOST at a socket that can't possibly
@@ -69,7 +69,7 @@ echo "ENDPOINT:$2"
 shift 2
 echo "ARGS:$@"
 `
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "aws"), []byte(script), 0755))
+	must.NoError(t, os.WriteFile(filepath.Join(dir, "aws"), []byte(script), 0755))
 	return dir
 }
 
@@ -87,9 +87,9 @@ func TestAWSCommandEndpointURLNoDockerRequired(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "aws", "s3", "ls")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ENDPOINT:"+srv.URL)
-	assert.Contains(t, stdout, "ARGS:s3 ls")
+	must.NoError(t, err, "stderr: %s", stderr)
+	must.Contains(t, stdout, "ENDPOINT:"+srv.URL)
+	must.Contains(t, stdout, "ARGS:s3 ls")
 }
 
 // TestAWSCommandEndpointURLAfterSubcommandPassesThrough proves the aws-CLI
@@ -111,13 +111,13 @@ func TestAWSCommandEndpointURLAfterSubcommandPassesThrough(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "aws", "--endpoint-url", "http://127.0.0.1:9", "s3", "ls")
-	require.NoError(t, err, "stderr: %s", stderr)
+	must.NoError(t, err, "stderr: %s", stderr)
 	// lstk's own resolution used the pre-command mock — proven by succeeding
 	// at all with DOCKER_HOST broken.
-	assert.Contains(t, stdout, "ENDPOINT:"+srv.URL)
+	must.Contains(t, stdout, "ENDPOINT:"+srv.URL)
 	// The user's own post-command --endpoint-url reached the wrapped aws
 	// binary untouched, appearing in its forwarded args.
-	assert.Contains(t, stdout, "ARGS:--endpoint-url http://127.0.0.1:9 s3 ls")
+	must.Contains(t, stdout, "ARGS:--endpoint-url http://127.0.0.1:9 s3 ls")
 }
 
 // TestLogsRejectsExplicitEndpointURL proves logs (a Docker-lifecycle command
@@ -132,9 +132,9 @@ func TestLogsRejectsExplicitEndpointURL(t *testing.T) {
 	// (stdout), with a silent error returned so the top-level handler doesn't
 	// print a second copy to stderr.
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "logs", "--endpoint-url", "http://localhost:4566")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "logs")
-	assert.Contains(t, stdout, "does not support --endpoint-url")
+	must.Error(t, err)
+	must.Contains(t, stdout, "logs")
+	must.Contains(t, stdout, "does not support --endpoint-url")
 }
 
 // TestVolumePathRejectsExplicitEndpointURL mirrors the logs case for the
@@ -144,8 +144,8 @@ func TestVolumePathRejectsExplicitEndpointURL(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With(env.Home, t.TempDir())
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "volume", "path", "--endpoint-url", "http://localhost:4566")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "does not support --endpoint-url")
+	must.Error(t, err)
+	must.Contains(t, stdout, "does not support --endpoint-url")
 }
 
 // TestStartRejectsExplicitEndpointURL proves `start` (previously missing from
@@ -157,9 +157,9 @@ func TestStartRejectsExplicitEndpointURL(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--endpoint-url", "http://localhost:4566")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "start")
-	assert.Contains(t, stdout, "does not support --endpoint-url")
+	must.Error(t, err)
+	must.Contains(t, stdout, "start")
+	must.Contains(t, stdout, "does not support --endpoint-url")
 }
 
 // The following tests prove the corrected behavior from design.md's Decision
@@ -175,10 +175,10 @@ func TestLogsRejectsAmbientEndpointURL(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "logs")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "logs")
-	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
-	assert.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
+	must.Error(t, err)
+	must.Contains(t, stdout, "logs")
+	must.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	must.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
 }
 
 func TestStopRejectsAmbientEndpointURL(t *testing.T) {
@@ -187,8 +187,8 @@ func TestStopRejectsAmbientEndpointURL(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "stop")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	must.Error(t, err)
+	must.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
 }
 
 func TestRestartRejectsAmbientEndpointURL(t *testing.T) {
@@ -197,9 +197,9 @@ func TestRestartRejectsAmbientEndpointURL(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "restart")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "does not support AWS_ENDPOINT_URL")
-	assert.Contains(t, stdout, "AWS_ENDPOINT_URL is set")
+	must.Error(t, err)
+	must.Contains(t, stdout, "does not support AWS_ENDPOINT_URL")
+	must.Contains(t, stdout, "AWS_ENDPOINT_URL is set")
 }
 
 func TestVolumePathRejectsAmbientEndpointURL(t *testing.T) {
@@ -207,8 +207,8 @@ func TestVolumePathRejectsAmbientEndpointURL(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With(env.Home, t.TempDir()).With("LSTK_ENDPOINT_URL", "http://localhost:4566")
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "volume", "path")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	must.Error(t, err)
+	must.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
 }
 
 func TestVolumeClearRejectsAmbientEndpointURL(t *testing.T) {
@@ -216,8 +216,8 @@ func TestVolumeClearRejectsAmbientEndpointURL(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With(env.Home, t.TempDir()).With("LSTK_ENDPOINT_URL", "http://localhost:4566")
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "volume", "clear")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	must.Error(t, err)
+	must.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
 }
 
 func TestStartRejectsAmbientEndpointURL(t *testing.T) {
@@ -226,9 +226,9 @@ func TestStartRejectsAmbientEndpointURL(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "start")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "start")
-	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	must.Error(t, err)
+	must.Contains(t, stdout, "start")
+	must.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
 }
 
 // TestSnapshotShowIgnoresEndpointURL proves `snapshot show` silently ignores
@@ -241,9 +241,9 @@ func TestSnapshotShowIgnoresEndpointURL(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With(env.Home, t.TempDir()).With(env.APIEndpoint, "http://127.0.0.1:1")
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "snapshot", "show", "pod:my-baseline", "--endpoint-url", "http://localhost:4566")
-	require.Error(t, err)
-	assert.NotContains(t, stdout, "does not support --endpoint-url")
-	assert.NotContains(t, stderr, "does not support --endpoint-url")
+	must.Error(t, err)
+	must.NotContains(t, stdout, "does not support --endpoint-url")
+	must.NotContains(t, stderr, "does not support --endpoint-url")
 }
 
 // TestSnapshotListBareIgnoresEndpointURL mirrors the show case for `snapshot
@@ -253,9 +253,9 @@ func TestSnapshotListBareIgnoresEndpointURL(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With(env.Home, t.TempDir()).With(env.APIEndpoint, "http://127.0.0.1:1")
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "snapshot", "list", "--endpoint-url", "http://localhost:4566")
-	require.Error(t, err)
-	assert.NotContains(t, stdout, "does not support --endpoint-url")
-	assert.NotContains(t, stderr, "does not support --endpoint-url")
+	must.Error(t, err)
+	must.NotContains(t, stdout, "does not support --endpoint-url")
+	must.NotContains(t, stderr, "does not support --endpoint-url")
 }
 
 // TestStatusEndpointURLRendersReducedOutput proves `status` skips Docker
@@ -270,12 +270,10 @@ func TestStatusEndpointURLRendersReducedOutput(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "status")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "running")
-	assert.Contains(t, stdout, srv.URL[len("http://"):])
-	assert.Contains(t, stdout, "3.0.2")
-	assert.NotContains(t, stdout, "Container:")
-	assert.NotContains(t, stdout, "Uptime:")
+	must.NoError(t, err, "stderr: %s", stderr)
+	// The snapshot pins the reduced remote-status card: running headline and
+	// endpoint only — no Container/Uptime lines, which need local Docker.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestStatusEndpointURLShowsResources proves the resources bug fix: `status`
@@ -307,11 +305,11 @@ func TestStatusEndpointURLShowsResources(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "status")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "SERVICE")
-	assert.Contains(t, stdout, "RESOURCE")
-	assert.Contains(t, stdout, "S3")
-	assert.Contains(t, stdout, "my-test-bucket")
+	must.NoError(t, err, "stderr: %s", stderr)
+	must.Contains(t, stdout, "SERVICE")
+	must.Contains(t, stdout, "RESOURCE")
+	must.Contains(t, stdout, "S3")
+	must.Contains(t, stdout, "my-test-bucket")
 }
 
 // TestStatusEndpointURLInteractiveRendersTUI proves `status` against an
@@ -343,12 +341,12 @@ func TestStatusEndpointURLInteractiveRendersTUI(t *testing.T) {
 	defer srv.Close()
 
 	binPath, err := filepath.Abs(binaryPath())
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	cmd := exec.CommandContext(testContext(t), binPath, "--endpoint-url", srv.URL, "status")
 	cmd.Env = append(env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.DisableEvents, "1"), unreachableDockerHost)
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start command in PTY")
+	must.NoError(t, err, "failed to start command in PTY")
 	t.Cleanup(func() { _ = ptmx.Close() })
 
 	out := &syncBuffer{}
@@ -357,7 +355,7 @@ func TestStatusEndpointURLInteractiveRendersTUI(t *testing.T) {
 		_, _ = io.Copy(out, ptmx)
 		close(outputCh)
 	}()
-	require.NoError(t, cmd.Wait())
+	must.NoError(t, cmd.Wait())
 	<-outputCh
 
 	lines := ptyLines(out.String())
@@ -368,15 +366,15 @@ func TestStatusEndpointURLInteractiveRendersTUI(t *testing.T) {
 			break
 		}
 	}
-	require.NotEqual(t, -1, summary, "resource summary should be rendered, got:\n%s", strings.Join(lines, "\n"))
-	require.Greater(t, summary, 0)
-	assert.Empty(t, lines[summary-1], "TUI puts a blank line before the resource summary")
-	assert.Empty(t, lines[summary+1], "TUI puts a blank line after the resource summary")
+	must.NotEq(t, -1, summary, "resource summary should be rendered, got:\n%s", strings.Join(lines, "\n"))
+	must.Greater(t, summary, 0)
+	must.Empty(t, lines[summary-1], "TUI puts a blank line before the resource summary")
+	must.Empty(t, lines[summary+1], "TUI puts a blank line after the resource summary")
 
 	joined := strings.Join(lines, "\n")
-	assert.Contains(t, joined, "my-test-bucket")
-	assert.NotContains(t, joined, "Container:")
-	assert.NotContains(t, joined, "Uptime:")
+	must.Contains(t, joined, "my-test-bucket")
+	must.NotContains(t, joined, "Container:")
+	must.NotContains(t, joined, "Uptime:")
 }
 
 // ptyLines splits raw PTY output into display lines, dropping ANSI escape
@@ -408,9 +406,9 @@ func TestStatusUnreachableEndpointURLFailsClosed(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", notLocalStack.URL, "status")
-	require.Error(t, err)
-	assert.Contains(t, stderr, "could not reach")
-	assert.NotContains(t, stderr, "lstk start")
+	must.Error(t, err)
+	must.Contains(t, stderr, "could not reach")
+	must.NotContains(t, stderr, "lstk start")
 }
 
 // TestCDKAWSEndpointURLBypassesDockerCheck proves the BREAKING change:
@@ -428,8 +426,8 @@ func TestCDKAWSEndpointURLBypassesDockerCheck(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "deploy", "MyStack")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, fmt.Sprintf("ENV_AWS_ENDPOINT_URL=%s", srv.URL))
+	must.NoError(t, err, "stderr: %s", stderr)
+	must.Contains(t, stdout, fmt.Sprintf("ENV_AWS_ENDPOINT_URL=%s", srv.URL))
 }
 
 // TestCDKAWSEndpointURLWrongTypeFails proves the type-detection gate: an
@@ -454,7 +452,7 @@ func TestCDKAWSEndpointURLWrongTypeFails(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", azureLike.URL, "cdk", "deploy", "MyStack")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "requires the AWS emulator")
-	assert.Contains(t, stdout, "Azure")
+	must.Error(t, err)
+	must.Contains(t, stdout, "requires the AWS emulator")
+	must.Contains(t, stdout, "Azure")
 }
diff --git a/test/integration/env/env.go b/test/integration/env/env.go
index 364ef331..8e41ed3b 100644
--- a/test/integration/env/env.go
+++ b/test/integration/env/env.go
@@ -9,28 +9,28 @@ import (
 type Key string
 
 const (
-	AuthToken          Key = "LOCALSTACK_AUTH_TOKEN"
-	LocalStackHost     Key = "LOCALSTACK_HOST"
-	APIEndpoint        Key = "LSTK_API_ENDPOINT"
-	WebAppURL          Key = "LSTK_WEB_APP_URL"
-	Keyring            Key = "LSTK_KEYRING"
-	CI                 Key = "CI"
-	AnalyticsEndpoint  Key = "LSTK_ANALYTICS_ENDPOINT"
-	DisableEvents      Key = "LOCALSTACK_DISABLE_EVENTS"
-	Home               Key = "HOME"
-	UserProfile        Key = "USERPROFILE"
-	Path               Key = "PATH"
-	Persistence        Key = "LOCALSTACK_PERSISTENCE"
-	Otel               Key = "LSTK_OTEL"
-	OtelEndpoint       Key = "OTEL_EXPORTER_OTLP_ENDPOINT"
-	StartupTimeout     Key = "LSTK_STARTUP_TIMEOUT"
+	AuthToken         Key = "LOCALSTACK_AUTH_TOKEN"
+	LocalStackHost    Key = "LOCALSTACK_HOST"
+	APIEndpoint       Key = "LSTK_API_ENDPOINT"
+	WebAppURL         Key = "LSTK_WEB_APP_URL"
+	Keyring           Key = "LSTK_KEYRING"
+	CI                Key = "CI"
+	AnalyticsEndpoint Key = "LSTK_ANALYTICS_ENDPOINT"
+	DisableEvents     Key = "LOCALSTACK_DISABLE_EVENTS"
+	Home              Key = "HOME"
+	UserProfile       Key = "USERPROFILE"
+	Path              Key = "PATH"
+	Persistence       Key = "LOCALSTACK_PERSISTENCE"
+	Otel              Key = "LSTK_OTEL"
+	OtelEndpoint      Key = "OTEL_EXPORTER_OTLP_ENDPOINT"
+	StartupTimeout    Key = "LSTK_STARTUP_TIMEOUT"
 	// UpdateGitHubAPIEndpoint and UpdateGitHubDownloadEndpoint point the
 	// updater's release-metadata API (api.github.com) and asset downloads
 	// (github.com) at mock servers (undocumented, test-only).
 	UpdateGitHubAPIEndpoint      Key = "LSTK_UPDATE_GITHUB_API_ENDPOINT"
 	UpdateGitHubDownloadEndpoint Key = "LSTK_UPDATE_GITHUB_DOWNLOAD_ENDPOINT"
-	AWSAccessKeyID     Key = "AWS_ACCESS_KEY_ID"
-	AWSSecretAccessKey Key = "AWS_SECRET_ACCESS_KEY"
+	AWSAccessKeyID               Key = "AWS_ACCESS_KEY_ID"
+	AWSSecretAccessKey           Key = "AWS_SECRET_ACCESS_KEY"
 	// AzureCollectTelemetry controls the Azure CLI's usage telemetry. Defaulted to
 	// "false" in every test environment: an enabled `az` spawns a background uploader
 	// that keeps a handle on the test's temp dir, breaking t.TempDir() cleanup on Windows.
diff --git a/test/integration/exit_code_test.go b/test/integration/exit_code_test.go
index afbd0ba4..6690ef6f 100644
--- a/test/integration/exit_code_test.go
+++ b/test/integration/exit_code_test.go
@@ -3,8 +3,7 @@ package integration_test
 import (
 	"testing"
 
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"github.com/localstack/lstk/internal/must"
 )
 
 // TestInvalidUsageExitsNonZero guards against regressions of DEVX-941, where
@@ -39,9 +38,9 @@ func TestInvalidUsageExitsNonZero(t *testing.T) {
 			t.Parallel()
 			e := testEnvWithHome(t.TempDir(), "")
 			_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, tc.args...)
-			require.Error(t, err, "expected %v to fail", tc.args)
+			must.Error(t, err, "expected %v to fail", tc.args)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, tc.wantText)
+			must.Contains(t, stderr, tc.wantText)
 		})
 	}
 }
@@ -58,9 +57,9 @@ func TestBareParentCommandExitsZero(t *testing.T) {
 			t.Parallel()
 			e := testEnvWithHome(t.TempDir(), "")
 			stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, parent)
-			require.NoError(t, err)
+			must.NoError(t, err)
 			requireExitCode(t, 0, err)
-			assert.Contains(t, stdout, "Usage:")
+			must.Contains(t, stdout, "Usage:")
 		})
 	}
 }
diff --git a/test/integration/extension_test.go b/test/integration/extension_test.go
index 31463cfe..55ad6b30 100644
--- a/test/integration/extension_test.go
+++ b/test/integration/extension_test.go
@@ -12,8 +12,9 @@ import (
 	"testing"
 
 	"github.com/google/uuid"
+	"github.com/localstack/lstk/internal/must"
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/require"
 )
 
 // The extension mechanism resolves and execs `lstk-<name>` executables for
@@ -56,7 +57,7 @@ func referenceExtensionBinary(t *testing.T) string {
 		}
 		refExtPath = out
 	})
-	require.NoError(t, refExtErr)
+	must.NoError(t, refExtErr)
 	return refExtPath
 }
 
@@ -70,13 +71,13 @@ func execName(base string) string {
 func copyExecutable(t *testing.T, src, dst string) {
 	t.Helper()
 	in, err := os.Open(src)
-	require.NoError(t, err)
+	must.NoError(t, err)
 	defer func() { _ = in.Close() }()
 	out, err := os.OpenFile(dst, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o755)
-	require.NoError(t, err)
+	must.NoError(t, err)
 	_, err = io.Copy(out, in)
-	require.NoError(t, err)
-	require.NoError(t, out.Close())
+	must.NoError(t, err)
+	must.NoError(t, out.Close())
 }
 
 // installExtension places the reference extension under the name `lstk-<name>`
@@ -92,7 +93,7 @@ func installExtension(t *testing.T, dir, name string) {
 func installLstkBundle(t *testing.T, dir string) string {
 	t.Helper()
 	binPath, err := filepath.Abs(binaryPath())
-	require.NoError(t, err)
+	must.NoError(t, err)
 	dst := filepath.Join(dir, execName("lstk"))
 	copyExecutable(t, binPath, dst)
 	return dst
@@ -129,10 +130,10 @@ func TestExtensionBuiltinTakesPrecedence(t *testing.T) {
 
 	tmpHome := t.TempDir()
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), envWithPath(tmpHome, extDir), "config", "path")
-	require.NoError(t, err, stderr)
+	must.NoError(t, err, stderr)
 	// The built-in prints a config path; the extension would have printed ARGS=.
-	require.Contains(t, stdout, "config.toml")
-	require.NotContains(t, stdout, "ARGS=")
+	must.Contains(t, stdout, "config.toml")
+	must.NotContains(t, stdout, "ARGS=")
 }
 
 func TestExtensionUnknownCommandDispatches(t *testing.T) {
@@ -142,10 +143,10 @@ func TestExtensionUnknownCommandDispatches(t *testing.T) {
 
 	tmpHome := t.TempDir()
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), envWithPath(tmpHome, extDir), "hello", "world")
-	require.NoError(t, err, stderr)
-	require.Contains(t, stdout, "ARGS=[world]")
-	require.Contains(t, stdout, "API_VERSION=1")
-	require.Contains(t, stdout, "CONFIG_DIR=")
+	must.NoError(t, err, stderr)
+	must.Contains(t, stdout, "ARGS=[world]")
+	must.Contains(t, stdout, "API_VERSION=1")
+	must.Contains(t, stdout, "CONFIG_DIR=")
 }
 
 func TestExtensionUnknownCommandNoExtensionErrors(t *testing.T) {
@@ -155,7 +156,7 @@ func TestExtensionUnknownCommandNoExtensionErrors(t *testing.T) {
 	// goes to stderr, matching Cobra's own unknown-command output.
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), envWithPath(tmpHome, t.TempDir()), "nope")
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "unknown command")
+	must.Contains(t, stderr, "unknown command")
 }
 
 func TestExtensionExitCodePropagates(t *testing.T) {
@@ -175,10 +176,10 @@ func TestExtensionGlobalFlagConveyedNotForwarded(t *testing.T) {
 
 	tmpHome := t.TempDir()
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), envWithPath(tmpHome, extDir), "--non-interactive", "hello", "--foo")
-	require.NoError(t, err, stderr)
+	must.NoError(t, err, stderr)
 	// --non-interactive is consumed by lstk and conveyed via env, not forwarded.
-	require.Contains(t, stdout, "ARGS=[--foo]")
-	require.Contains(t, stdout, "NON_INTERACTIVE=true")
+	must.Contains(t, stdout, "ARGS=[--foo]")
+	must.Contains(t, stdout, "NON_INTERACTIVE=true")
 }
 
 func TestExtensionAuthTokenConveyedWhenAuthed(t *testing.T) {
@@ -190,8 +191,8 @@ func TestExtensionAuthTokenConveyedWhenAuthed(t *testing.T) {
 	environ := envWithPath(tmpHome, extDir)
 	environ = append(environ, string(env.AuthToken)+"=tok-abc-123")
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "ref")
-	require.NoError(t, err, stderr)
-	require.Contains(t, stdout, "AUTH_TOKEN=tok-abc-123")
+	must.NoError(t, err, stderr)
+	must.Contains(t, stdout, "AUTH_TOKEN=tok-abc-123")
 }
 
 func TestExtensionEndpointOmittedWhenNoRuntime(t *testing.T) {
@@ -205,11 +206,11 @@ func TestExtensionEndpointOmittedWhenNoRuntime(t *testing.T) {
 	// emulator context is deterministically omitted.
 	environ = append(environ, "DOCKER_HOST=tcp://127.0.0.1:1")
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "ref")
-	require.NoError(t, err, stderr)
-	require.Contains(t, stdout, "EMULATOR_COUNT=0")
-	require.NotContains(t, stdout, "EMULATOR=")
+	must.NoError(t, err, stderr)
+	must.Contains(t, stdout, "EMULATOR_COUNT=0")
+	must.NotContains(t, stdout, "EMULATOR=")
 	// The extension still runs and still receives the always-present variables.
-	require.Contains(t, stdout, "API_VERSION=1")
+	must.Contains(t, stdout, "API_VERSION=1")
 }
 
 func TestExtensionSelfAuthorizationRefusesWithoutToken(t *testing.T) {
@@ -224,7 +225,7 @@ func TestExtensionSelfAuthorizationRefusesWithoutToken(t *testing.T) {
 	environ = append(environ, "DOCKER_HOST=tcp://127.0.0.1:1")
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "deploy", "auth")
 	requireExitCode(t, 13, err)
-	require.Contains(t, stderr, "not authorized")
+	must.Contains(t, stderr, "not authorized")
 }
 
 func TestExtensionInvocationRecordedInTelemetry(t *testing.T) {
@@ -239,7 +240,7 @@ func TestExtensionInvocationRecordedInTelemetry(t *testing.T) {
 		With(env.AnalyticsEndpoint, analyticsSrv.URL)
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "hello", "world")
-	require.NoError(t, err, stderr)
+	must.NoError(t, err, stderr)
 
 	// The invocation is recorded in product telemetry as ext:<name>, so the
 	// warehouse tracks which extension ran — and is NOT mislabeled as "start".
@@ -264,16 +265,16 @@ func TestExtensionSessionIDConveyedAndMatchesCommandEvent(t *testing.T) {
 		With(env.Key("DOCKER_HOST"), "tcp://127.0.0.1:1")
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "ref")
-	require.NoError(t, err, stderr)
+	must.NoError(t, err, stderr)
 
 	conveyed := echoedValue(t, stdout, "SESSION_ID")
 	_, parseErr := uuid.Parse(conveyed)
-	require.NoError(t, parseErr, "conveyed sessionId must be a UUID, got %q", conveyed)
+	must.NoError(t, parseErr, "conveyed sessionId must be a UUID, got %q", conveyed)
 
 	event := receiveEventByName(t, events, "lstk_command")
 	metadata, ok := event["metadata"].(map[string]any)
-	require.True(t, ok, "event has no metadata object: %v", event)
-	require.Equal(t, conveyed, metadata["session_id"],
+	must.True(t, ok, "event has no metadata object: %v", event)
+	must.Eq[any](t, conveyed, metadata["session_id"],
 		"conveyed sessionId must equal the session id on the ext:<name> event")
 }
 
@@ -294,10 +295,10 @@ func TestExtensionSessionIDOmittedWhenTelemetryDisabled(t *testing.T) {
 
 	// No session exists, so the field is omitted rather than conveyed empty (the
 	// JSON-level omission is asserted in internal/extension).
-	require.NotContains(t, stdout, "SESSION_ID=",
+	must.NotContains(t, stdout, "SESSION_ID=",
 		"no sessionId may be conveyed when telemetry is disabled")
-	require.Contains(t, stdout, "API_VERSION=1")
-	require.Contains(t, stdout, "ARGS=[exit 7]")
+	must.Contains(t, stdout, "API_VERSION=1")
+	must.Contains(t, stdout, "ARGS=[exit 7]")
 }
 
 // echoedValue returns the value of a `KEY=value` line the reference extension
@@ -328,9 +329,9 @@ func TestExtensionEndpointConveyedWhenEmulatorRunning(t *testing.T) {
 	environ := envWithPath(tmpHome, extDir)
 	environ = append(environ, string(env.AuthToken)+"=tok-xyz")
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), environ, "ref")
-	require.NoError(t, err, stderr)
-	require.Contains(t, stdout, "EMULATOR=aws http")
-	require.Contains(t, stdout, "AUTH_TOKEN=tok-xyz")
+	must.NoError(t, err, stderr)
+	must.Contains(t, stdout, "EMULATOR=aws http")
+	must.Contains(t, stdout, "AUTH_TOKEN=tok-xyz")
 }
 
 func TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly(t *testing.T) {
@@ -338,7 +339,7 @@ func TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly(t *testing.T) {
 	bundleDir := t.TempDir()
 	lstkBin := installLstkBundle(t, bundleDir)
 	installExtension(t, bundleDir, "deploy") // bundled
-	require.NoError(t, os.WriteFile(
+	must.NoError(t, os.WriteFile(
 		filepath.Join(bundleDir, "lstk-extensions.toml"),
 		[]byte("deploy = \"Deploy your application to LocalStack\"\n"), 0o644))
 
@@ -347,14 +348,12 @@ func TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly(t *testing.T) {
 
 	tmpHome := t.TempDir()
 	stdout, stderr, err := runBinary(t, t.TempDir(), envWithPath(tmpHome, extDir), lstkBin, "--help")
-	require.NoError(t, err, stderr)
-
-	require.Contains(t, stdout, "Extensions:")
-	require.Contains(t, stdout, "deploy")
-	require.Contains(t, stdout, "Deploy your application to LocalStack")
-	require.Contains(t, stdout, "hello")
-	// Help must not execute any extension.
-	require.NotContains(t, stdout, "ARGS=")
+	must.NoError(t, err, stderr)
+
+	// The snapshot pins the Extensions section (bundled `deploy` with its
+	// description, PATH-only `hello` without) and that no extension was
+	// executed (no ARGS= line).
+	snap.Match(t, stdout)
 }
 
 // TestExtensionHelpDescriptionColumnAlignsWithCommands guards the bug where the
@@ -367,19 +366,19 @@ func TestExtensionHelpDescriptionColumnAlignsWithCommands(t *testing.T) {
 	bundleDir := t.TempDir()
 	lstkBin := installLstkBundle(t, bundleDir)
 	installExtension(t, bundleDir, "deploy")
-	require.NoError(t, os.WriteFile(
+	must.NoError(t, os.WriteFile(
 		filepath.Join(bundleDir, "lstk-extensions.toml"),
 		[]byte("deploy = \"Deploy your application to LocalStack\"\n"), 0o644))
 
 	tmpHome := t.TempDir()
 	stdout, stderr, err := runBinary(t, t.TempDir(), envWithPath(tmpHome, t.TempDir()), lstkBin, "--help")
-	require.NoError(t, err, stderr)
+	must.NoError(t, err, stderr)
 
 	lines := strings.Split(stdout, "\n")
 	// The built-in `aws` command (in the Tools group) sets the reference column.
 	cmdCol := descriptionColumn(t, lines, "aws", "Run AWS CLI commands against LocalStack")
 	extCol := descriptionColumn(t, lines, "deploy", "Deploy your application to LocalStack")
-	require.Equal(t, cmdCol, extCol,
+	must.Eq(t, cmdCol, extCol,
 		"extension description column (%d) must align with command description column (%d)", extCol, cmdCol)
 }
 
@@ -405,9 +404,9 @@ func TestExtensionHelpMissingDescriptionsFileDegrades(t *testing.T) {
 
 	tmpHome := t.TempDir()
 	stdout, stderr, err := runBinary(t, t.TempDir(), envWithPath(tmpHome, t.TempDir()), lstkBin, "--help")
-	require.NoError(t, err, stderr)
-	require.Contains(t, stdout, "Extensions:")
-	require.Contains(t, stdout, "deploy")
+	must.NoError(t, err, stderr)
+	must.Contains(t, stdout, "Extensions:")
+	must.Contains(t, stdout, "deploy")
 }
 
 func TestExtensionResolvableViaSymlinkedLstk(t *testing.T) {
@@ -424,13 +423,13 @@ func TestExtensionResolvableViaSymlinkedLstk(t *testing.T) {
 
 	linkDir := t.TempDir()
 	link := filepath.Join(linkDir, "lstk")
-	require.NoError(t, os.Symlink(realLstk, link))
+	must.NoError(t, os.Symlink(realLstk, link))
 
 	tmpHome := t.TempDir()
 	// Empty PATH extension dir: deploy can only come from the bundled location.
 	stdout, stderr, err := runBinary(t, t.TempDir(), envWithPath(tmpHome, t.TempDir()), link, "deploy", "ok")
-	require.NoError(t, err, stderr)
-	require.Contains(t, stdout, "ARGS=[ok]")
+	must.NoError(t, err, stderr)
+	must.Contains(t, stdout, "ARGS=[ok]")
 }
 
 func TestExtensionBundledPremiumSelfAuthorizes(t *testing.T) {
@@ -452,8 +451,8 @@ func TestExtensionBundledPremiumSelfAuthorizes(t *testing.T) {
 	// Authed: the bundled extension authorizes successfully.
 	authed := append(noRuntime, string(env.AuthToken)+"=tok-premium")
 	stdout, stderr, err := runBinary(t, t.TempDir(), authed, lstkBin, "deploy", "auth")
-	require.NoError(t, err, stderr)
-	require.Contains(t, stdout, "authorized")
+	must.NoError(t, err, stderr)
+	must.Contains(t, stdout, "authorized")
 }
 
 func TestExtensionBundledWinsOverPath(t *testing.T) {
@@ -469,17 +468,17 @@ func TestExtensionBundledWinsOverPath(t *testing.T) {
 	// The reference extension echoes its own resolved executable path as SELF=,
 	// so we can confirm the *bundled* copy ran, not the same-named PATH copy.
 	stdout, stderr, err := runBinary(t, t.TempDir(), envWithPath(tmpHome, extDir), lstkBin, "deploy", "world")
-	require.NoError(t, err, stderr)
-	require.Contains(t, stdout, "ARGS=[world]")
+	must.NoError(t, err, stderr)
+	must.Contains(t, stdout, "ARGS=[world]")
 	// lstk derives its bundled dir from the symlink-resolved executable path, so
 	// compare SELF against the resolved bundle dir (TempDir may be a symlink,
 	// e.g. /var → /private/var on macOS).
 	resolvedBundle, err := filepath.EvalSymlinks(bundleDir)
-	require.NoError(t, err)
-	require.Contains(t, stdout, "SELF="+resolvedBundle, "expected the bundled extension to run, not the PATH one")
+	must.NoError(t, err)
+	must.Contains(t, stdout, "SELF="+resolvedBundle, "expected the bundled extension to run, not the PATH one")
 
 	// Help lists the de-duplicated name exactly once.
 	helpOut, _, err := runBinary(t, t.TempDir(), envWithPath(tmpHome, extDir), lstkBin, "--help")
-	require.NoError(t, err)
-	require.Equal(t, 1, strings.Count(helpOut, "\n  deploy"))
+	must.NoError(t, err)
+	must.Eq(t, 1, strings.Count(helpOut, "\n  deploy"))
 }
diff --git a/test/integration/go.mod b/test/integration/go.mod
index 7980b72f..c23629e2 100644
--- a/test/integration/go.mod
+++ b/test/integration/go.mod
@@ -12,10 +12,10 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sqs v1.42.24
 	github.com/creack/pty v1.1.24
 	github.com/google/uuid v1.6.0
-	github.com/moby/moby/api v1.54.2
-	github.com/moby/moby/client v0.4.1
-	github.com/stretchr/testify v1.11.1
-	github.com/zalando/go-keyring v0.2.7
+	github.com/localstack/lstk v0.0.0-00010101000000-000000000000
+	github.com/moby/moby/api v1.55.0
+	github.com/moby/moby/client v0.5.1
+	github.com/zalando/go-keyring v0.2.8
 )
 
 require (
@@ -39,25 +39,23 @@ require (
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/danieljoos/wincred v1.2.3 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-connections v0.7.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/felixge/httpsnoop v1.1.0 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/godbus/dbus/v5 v5.2.2 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
-	golang.org/x/sys v0.42.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 // indirect
+	go.opentelemetry.io/otel v1.45.0 // indirect
+	go.opentelemetry.io/otel/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/trace v1.45.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
 )
+
+replace github.com/localstack/lstk => ../..
diff --git a/test/integration/go.sum b/test/integration/go.sum
index 00aabeb3..671183d1 100644
--- a/test/integration/go.sum
+++ b/test/integration/go.sum
@@ -58,11 +58,11 @@ github.com/docker/go-connections v0.7.0 h1:6SsRfJddP22WMrCkj19x9WKjEDTB+ahsdiGYf
 github.com/docker/go-connections v0.7.0/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
-github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
+github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
@@ -71,49 +71,40 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
-github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/moby/api v1.54.2 h1:wiat9QAhnDQjA7wk1kh/TqHz2I1uUA7M7t9SAl/JNXg=
-github.com/moby/moby/api v1.54.2/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
-github.com/moby/moby/client v0.4.1 h1:DMQgisVoMkmMs7fp3ROSdiBnoAu8+vo3GggFl06M/wY=
-github.com/moby/moby/client v0.4.1/go.mod h1:z52C9O2POPOsnxZAy//WtKcQ32P+jT/NGeXu/7nfjGQ=
+github.com/moby/moby/api v1.55.0 h1:2/sexvQyqIWS8pRSCFddBfpW2qE7vR7FCL+vN8pxwMc=
+github.com/moby/moby/api v1.55.0/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
+github.com/moby/moby/client v0.5.1 h1:tYNaJno4c0HXz12y5BiqEDy0rVTYkWzI26lGvnTMiJw=
+github.com/moby/moby/client v0.5.1/go.mod h1:odLstlZ6uSnfvAgVxMpvgmb8SUdd+siH2T0GBuxVAlM=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/zalando/go-keyring v0.2.7 h1:YbqBw40+g4g69UNk4WsRM/fV9YErfVWwozE2+7Bn+7g=
-github.com/zalando/go-keyring v0.2.7/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0=
+github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPccHs=
+github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 h1:7iP2uCb7sGddAr30RRS6xjKy7AZ2JtTOPA3oolgVSw8=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0/go.mod h1:c7hN3ddxs/z6q9xwvfLPk+UHlWRQyaeR1LdgfL/66l0=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04=
+go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
+go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
+go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
+go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
+go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=
+go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=
+go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=
+go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=
+go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
+go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
diff --git a/test/integration/json_envelope_test.go b/test/integration/json_envelope_test.go
index c7820243..8d40e71a 100644
--- a/test/integration/json_envelope_test.go
+++ b/test/integration/json_envelope_test.go
@@ -6,8 +6,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"github.com/localstack/lstk/internal/must"
+	"github.com/localstack/lstk/internal/snap"
 )
 
 // jsonEnvelope mirrors the shape documented in output-envelope/spec.md and
@@ -40,8 +40,8 @@ type jsonError struct {
 func decodeEnvelope(t *testing.T, stdout string) jsonEnvelope {
 	t.Helper()
 	var envelope jsonEnvelope
-	require.NoError(t, json.Unmarshal([]byte(stdout), &envelope), "stdout should be exactly one JSON object: %s", stdout)
-	require.NotNil(t, envelope.Warnings, "warnings should always be an array, never omitted/null")
+	must.NoError(t, json.Unmarshal([]byte(stdout), &envelope), "stdout should be exactly one JSON object: %s", stdout)
+	must.NotNil(t, envelope.Warnings, "warnings should always be an array, never omitted/null")
 	return envelope
 }
 
@@ -55,12 +55,8 @@ func TestNotJSONCapableCommandRendersEnvelope(t *testing.T) {
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), testEnvWithHome(t.TempDir(), ""), "login", "--json")
 	requireExitCode(t, 1, err)
 
-	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "error", envelope.Status)
-	assert.Equal(t, "login", envelope.Command)
-	require.NotNil(t, envelope.Error)
-	assert.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
-	assert.Equal(t, "USAGE", envelope.Error.Category)
+	decodeEnvelope(t, stdout)
+	snap.MatchJSON(t, []byte(stdout))
 }
 
 func TestUsageErrorAfterJSONRendersEnvelope(t *testing.T) {
@@ -73,11 +69,8 @@ func TestUsageErrorAfterJSONRendersEnvelope(t *testing.T) {
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), testEnvWithHome(t.TempDir(), ""), "stop", "--json", "--bogus-flag")
 	requireExitCode(t, 1, err)
 
-	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "error", envelope.Status)
-	require.NotNil(t, envelope.Error)
-	assert.Equal(t, "USAGE_ERROR", envelope.Error.Code)
-	assert.Equal(t, "USAGE", envelope.Error.Category)
+	decodeEnvelope(t, stdout)
+	snap.MatchJSON(t, []byte(stdout))
 }
 
 func TestUsageErrorBeforeJSONFallsBackToPlainText(t *testing.T) {
@@ -90,8 +83,8 @@ func TestUsageErrorBeforeJSONFallsBackToPlainText(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), testEnvWithHome(t.TempDir(), ""), "stop", "--bogus-flag", "--json")
 	requireExitCode(t, 1, err)
 
-	assert.Empty(t, stdout, "no JSON should be attempted when --json wasn't parsed yet")
-	assert.Contains(t, stderr, "bogus-flag")
+	must.Empty(t, stdout, "no JSON should be attempted when --json wasn't parsed yet")
+	must.Contains(t, stderr, "bogus-flag")
 }
 
 // TestConfigLoadFailureRendersJSONEnvelope covers PR #374's review comment:
@@ -106,20 +99,16 @@ func TestConfigLoadFailureRendersJSONEnvelope(t *testing.T) {
 
 	workDir := t.TempDir()
 	lstkDir := filepath.Join(workDir, ".lstk")
-	require.NoError(t, os.MkdirAll(lstkDir, 0755))
-	require.NoError(t, os.WriteFile(filepath.Join(lstkDir, "config.toml"), []byte("[[containers]\ntype = \"aws\"\n"), 0644))
+	must.NoError(t, os.MkdirAll(lstkDir, 0755))
+	must.NoError(t, os.WriteFile(filepath.Join(lstkDir, "config.toml"), []byte("[[containers]\ntype = \"aws\"\n"), 0644))
 
 	stdout, stderr, err := runLstk(t, ctx, workDir, testEnvWithHome(t.TempDir(), ""), "stop", "--json")
 	requireExitCode(t, 1, err)
-	assert.Empty(t, stderr, "the plain-text fallback in Execute() must not also fire alongside the envelope")
+	must.Empty(t, stderr, "the plain-text fallback in Execute() must not also fire alongside the envelope")
 
-	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "error", envelope.Status)
-	assert.Equal(t, "stop", envelope.Command)
-	require.NotNil(t, envelope.Error)
-	assert.Equal(t, "CONFIG_INVALID", envelope.Error.Code)
-	assert.Equal(t, "CONFIG", envelope.Error.Category)
-	assert.False(t, envelope.Error.Retryable)
+	decodeEnvelope(t, stdout)
+	// error.message embeds the temp-dir config path, so it is masked.
+	snap.MatchJSON(t, []byte(stdout), "error.message")
 }
 
 // TestConfigNotFoundRendersJSONEnvelope covers the CONFIG_NOT_FOUND half of
@@ -133,12 +122,12 @@ func TestConfigNotFoundRendersJSONEnvelope(t *testing.T) {
 		"--config", missingConfig, "reset", "--force", "--json",
 	)
 	requireExitCode(t, 1, err)
-	assert.Empty(t, stderr, "the plain-text fallback in Execute() must not also fire alongside the envelope")
+	must.Empty(t, stderr, "the plain-text fallback in Execute() must not also fire alongside the envelope")
 
 	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "error", envelope.Status)
-	assert.Equal(t, "reset", envelope.Command)
-	require.NotNil(t, envelope.Error)
-	assert.Equal(t, "CONFIG_NOT_FOUND", envelope.Error.Code)
-	assert.Equal(t, "CONFIG", envelope.Error.Category)
+	must.Eq(t, "error", envelope.Status)
+	must.Eq(t, "reset", envelope.Command)
+	must.NotNil(t, envelope.Error)
+	must.Eq(t, "CONFIG_NOT_FOUND", envelope.Error.Code)
+	must.Eq(t, "CONFIG", envelope.Error.Category)
 }
diff --git a/test/integration/json_flag_test.go b/test/integration/json_flag_test.go
index 122708db..f645cfba 100644
--- a/test/integration/json_flag_test.go
+++ b/test/integration/json_flag_test.go
@@ -4,9 +4,9 @@ import (
 	"runtime"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // Most built-in commands haven't opted into --json output yet (see
@@ -20,12 +20,12 @@ func TestJSONFlagRejectsUnannotatedBuiltinCommand(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "status", "--json")
 	requireExitCode(t, 1, err)
 	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "status", envelope.Command)
-	assert.Equal(t, "error", envelope.Status)
-	require.NotNil(t, envelope.Error)
-	assert.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
-	assert.Contains(t, envelope.Error.Message, "status")
-	assert.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
+	must.Eq(t, "status", envelope.Command)
+	must.Eq(t, "error", envelope.Status)
+	must.NotNil(t, envelope.Error)
+	must.Eq(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
+	must.Contains(t, envelope.Error.Message, "status")
+	must.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
 }
 
 func TestJSONFlagRejectsDefaultStartBehavior(t *testing.T) {
@@ -33,11 +33,11 @@ func TestJSONFlagRejectsDefaultStartBehavior(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--json")
 	requireExitCode(t, 1, err)
 	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "start", envelope.Command)
-	assert.Equal(t, "error", envelope.Status)
-	require.NotNil(t, envelope.Error)
-	assert.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
-	assert.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
+	must.Eq(t, "start", envelope.Command)
+	must.Eq(t, "error", envelope.Status)
+	must.NotNil(t, envelope.Error)
+	must.Eq(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
+	must.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
 }
 
 func TestJSONFlagDoesNotLaunchTUIOnPTY(t *testing.T) {
@@ -48,10 +48,10 @@ func TestJSONFlagDoesNotLaunchTUIOnPTY(t *testing.T) {
 
 	out, err := runLstkInPTY(t, testContext(t), testEnvWithHome(t.TempDir(), ""), "start", "--json")
 	requireExitCode(t, 1, err)
-	require.Contains(t, out, "start")
+	must.Contains(t, out, "start")
 	// If the TUI had launched, it would have shown the auth prompt (start with
 	// no auth token requires interactive login) rather than exiting immediately.
-	require.NotContains(t, out, "Press any key")
+	must.NotContains(t, out, "Press any key")
 }
 
 // proxyCase describes one proxy command's forwarding/rejection setup, shared
@@ -105,10 +105,10 @@ func TestJSONFlagProxyCommandsForwardJSON(t *testing.T) {
 			workDir, environ := tc.setup(t)
 			args := append([]string{tc.name, "--json"}, tc.args...)
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, environ, args...)
-			require.Error(t, err)
+			must.Error(t, err)
 			combined := stdout + stderr
-			require.Contains(t, combined, "not found in PATH", "--json should have been forwarded to the wrapped tool, not rejected by lstk")
-			require.NotContains(t, combined, "is not able to provide output in JSON format")
+			must.Contains(t, combined, "not found in PATH", "--json should have been forwarded to the wrapped tool, not rejected by lstk")
+			must.NotContains(t, combined, "is not able to provide output in JSON format")
 		})
 
 		t.Run(tc.name+"/json after the wrapped tool's own action", func(t *testing.T) {
@@ -116,10 +116,10 @@ func TestJSONFlagProxyCommandsForwardJSON(t *testing.T) {
 			workDir, environ := tc.setup(t)
 			args := append(append([]string{tc.name}, tc.args...), "--json")
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, environ, args...)
-			require.Error(t, err)
+			must.Error(t, err)
 			combined := stdout + stderr
-			require.Contains(t, combined, "not found in PATH", "--json should have been forwarded to the wrapped tool, not rejected by lstk")
-			require.NotContains(t, combined, "is not able to provide output in JSON format")
+			must.Contains(t, combined, "not found in PATH", "--json should have been forwarded to the wrapped tool, not rejected by lstk")
+			must.NotContains(t, combined, "is not able to provide output in JSON format")
 		})
 	}
 }
@@ -142,10 +142,10 @@ func TestJSONFlagProxyCommandsRejectBeforeCommandName(t *testing.T) {
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, environ, args...)
 			requireExitCode(t, 1, err)
 			envelope := decodeEnvelope(t, stdout)
-			assert.Equal(t, tc.name, envelope.Command)
-			require.NotNil(t, envelope.Error)
-			assert.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
-			assert.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
+			must.Eq(t, tc.name, envelope.Command)
+			must.NotNil(t, envelope.Error)
+			must.Eq(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
+			must.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
 		})
 	}
 }
@@ -163,18 +163,18 @@ func TestJSONFlagBeforeCommandNameBooleanValues(t *testing.T) {
 		stdout, _, err := runLstk(t, testContext(t), t.TempDir(), env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).With(env.Home, t.TempDir()), "--json=true", "aws", "s3", "ls")
 		requireExitCode(t, 1, err)
 		envelope := decodeEnvelope(t, stdout)
-		assert.Equal(t, "aws", envelope.Command)
-		require.NotNil(t, envelope.Error)
-		assert.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
+		must.Eq(t, "aws", envelope.Command)
+		must.NotNil(t, envelope.Error)
+		must.Eq(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
 	})
 
 	t.Run("--json=false before the command name is not rejected", func(t *testing.T) {
 		t.Parallel()
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).With(env.Home, t.TempDir()), "--json=false", "aws", "s3", "ls")
-		require.Error(t, err)
+		must.Error(t, err)
 		combined := stdout + stderr
-		require.Contains(t, combined, "not found in PATH", "the wrapped tool should have run (and failed for its own, unrelated reason)")
-		require.NotContains(t, combined, "is not able to provide output in JSON format")
+		must.Contains(t, combined, "not found in PATH", "the wrapped tool should have run (and failed for its own, unrelated reason)")
+		must.NotContains(t, combined, "is not able to provide output in JSON format")
 	})
 
 	t.Run("a malformed value before the command name is rejected", func(t *testing.T) {
@@ -182,9 +182,9 @@ func TestJSONFlagBeforeCommandNameBooleanValues(t *testing.T) {
 		stdout, _, err := runLstk(t, testContext(t), t.TempDir(), env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).With(env.Home, t.TempDir()), "--json=notabool", "aws", "s3", "ls")
 		requireExitCode(t, 1, err)
 		envelope := decodeEnvelope(t, stdout)
-		assert.Equal(t, "aws", envelope.Command)
-		require.NotNil(t, envelope.Error)
-		assert.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
+		must.Eq(t, "aws", envelope.Command)
+		must.NotNil(t, envelope.Error)
+		must.Eq(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
 	})
 }
 
@@ -196,13 +196,12 @@ func TestExtensionReceivesJSONFlagInContext(t *testing.T) {
 	environ := envWithPath(tmpHome, extDir)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "--json", "hello", "--foo")
-	require.NoError(t, err, stderr)
-	require.Contains(t, stdout, "ARGS=[--foo]", "--json is consumed by lstk and conveyed via env, not forwarded")
-	require.Contains(t, stdout, "JSON=true")
-	// --json forces non-interactive rendering, so the extension sees that too.
-	require.Contains(t, stdout, "NON_INTERACTIVE=true")
+	must.NoError(t, err, stderr)
+	// --json is consumed by lstk and conveyed via env, not forwarded; it also
+	// forces non-interactive rendering, so the extension sees that too.
+	snap.Match(t, sanitizeOutput(stdout))
 
 	stdoutDefault, stderrDefault, errDefault := runLstk(t, testContext(t), t.TempDir(), environ, "hello", "--foo")
-	require.NoError(t, errDefault, stderrDefault)
-	require.Contains(t, stdoutDefault, "JSON=false")
+	must.NoError(t, errDefault, stderrDefault)
+	must.Contains(t, stdoutDefault, "JSON=false")
 }
diff --git a/test/integration/license_test.go b/test/integration/license_test.go
index 005a1c88..ea45fbd2 100644
--- a/test/integration/license_test.go
+++ b/test/integration/license_test.go
@@ -19,10 +19,9 @@ import (
 
 	"github.com/creack/pty"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestLicenseValidationSuccess(t *testing.T) {
@@ -77,12 +76,12 @@ func TestLicenseValidationSuccess(t *testing.T) {
 	default:
 	}
 
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
-	assert.True(t, inspect.Container.State.Running, "container should be running")
+	must.NoError(t, err, "failed to inspect container")
+	must.True(t, inspect.Container.State.Running, "container should be running")
 }
 
 func TestLicenseValidationFailure(t *testing.T) {
@@ -95,15 +94,15 @@ func TestLicenseValidationFailure(t *testing.T) {
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL).With(env.AuthToken, "test-token-for-license-validation"), "start")
-	require.Error(t, err, "expected lstk start to fail with forbidden license")
+	must.Error(t, err, "expected lstk start to fail with forbidden license")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "License validation failed")
-	assert.Contains(t, stdout, "invalid, inactive, or expired")
-	assert.Contains(t, stdout, "lstk logout", "the error should point at re-authentication")
-	assert.NotContains(t, stderr, "license validation failed", "the error event replaces the raw stderr error")
+	must.Contains(t, stdout, "License validation failed")
+	must.Contains(t, stdout, "invalid, inactive, or expired")
+	must.Contains(t, stdout, "lstk logout", "the error should point at re-authentication")
+	must.NotContains(t, stderr, "license validation failed", "the error event replaces the raw stderr error")
 
 	_, err = dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	assert.Error(t, err, "container should not exist after license failure")
+	must.Error(t, err, "container should not exist after license failure")
 }
 
 // TestLicenseRejectionOffersReloginAndRetries covers DEVX-658: a definitively
@@ -173,12 +172,12 @@ func TestLicenseRejectionOffersReloginAndRetries(t *testing.T) {
 	// An explicit config prevents firstRun=true, which would block the TUI on the
 	// emulator selection prompt before the license check runs.
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte("[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte("[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
 
 	cmd := exec.CommandContext(ctx, binaryPath(), "start", "--config", configFile)
 	cmd.Env = environ
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start command in PTY")
+	must.NoError(t, err, "failed to start command in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	out := &syncBuffer{}
@@ -190,18 +189,18 @@ func TestLicenseRejectionOffersReloginAndRetries(t *testing.T) {
 
 	// The stale token is rejected; the re-login prompt appears. Press ENTER.
 	// The wait covers a cold image pull on CI runners.
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(out.Bytes(), []byte("Log in again"))
 	}, 3*time.Minute, 100*time.Millisecond, "the re-login prompt should appear after the license rejection")
 	_, err = ptmx.Write([]byte("\r"))
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	// The login flow runs; confirm it once the completion prompt appears.
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(out.Bytes(), []byte("key when complete"))
 	}, 30*time.Second, 100*time.Millisecond, "the login completion prompt should appear")
 	_, err = ptmx.Write([]byte("\r"))
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	// After a successful start, the post-start AWS profile setup asks a Y/n
 	// question when the runner's ~/.aws has no matching profile. It is
@@ -243,13 +242,13 @@ func TestLicenseRejectionOffersReloginAndRetries(t *testing.T) {
 			t.Logf("health endpoint unreachable: %v", herr)
 		}
 	}
-	require.NoError(t, err, "start should succeed after re-login: %s", out.String())
-	assert.True(t, staleRejected.Load(), "the stale token must have been rejected by the license server first")
-	assert.Contains(t, out.String(), "Valid license")
+	must.NoError(t, err, "start should succeed after re-login: %s", out.String())
+	must.True(t, staleRejected.Load(), "the stale token must have been rejected by the license server first")
+	must.Contains(t, out.String(), "Valid license")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
-	assert.True(t, inspect.Container.State.Running, "container should be running after the retried start")
+	must.NoError(t, err, "failed to inspect container")
+	must.True(t, inspect.Container.State.Running, "container should be running after the retried start")
 
 	// lstk's file-keyring fallback stores the token next to the active config
 	// file (ConfigDir follows --config), so on headless CI runners the token
@@ -258,19 +257,19 @@ func TestLicenseRejectionOffersReloginAndRetries(t *testing.T) {
 	var storedToken string
 	if useFileKeyring {
 		data, rerr := os.ReadFile(filepath.Join(filepath.Dir(configFile), authTokenFile))
-		require.NoError(t, rerr, "the re-logged-in token should be stored in the file keyring next to the config file")
+		must.NoError(t, rerr, "the re-logged-in token should be stored in the file keyring next to the config file")
 		storedToken = string(data)
 	} else {
 		storedToken, err = GetAuthTokenFromKeyring()
-		require.NoError(t, err, "the re-logged-in token should be stored in the system keyring")
+		must.NoError(t, err, "the re-logged-in token should be stored in the system keyring")
 	}
-	assert.Equal(t, realToken, storedToken, "the fresh token must replace the rejected one")
+	must.Eq(t, realToken, storedToken, "the fresh token must replace the rejected one")
 }
 
 func licenseFilePath(t *testing.T) string {
 	t.Helper()
 	cacheDir, err := os.UserCacheDir()
-	require.NoError(t, err)
+	must.NoError(t, err)
 	return filepath.Join(cacheDir, "lstk", "license.json")
 }
 
@@ -295,14 +294,14 @@ func TestLicenseCacheAndMount(t *testing.T) {
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 
 	data, err := os.ReadFile(licenseFilePath(t))
-	require.NoError(t, err, "license cache file should exist after successful start")
-	assert.Equal(t, licenseBody, string(data))
+	must.NoError(t, err, "license cache file should exist after successful start")
+	must.Eq(t, licenseBody, string(data))
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
+	must.NoError(t, err, "failed to inspect container")
 
 	var mounted bool
 	for _, m := range inspect.Container.Mounts {
@@ -311,5 +310,5 @@ func TestLicenseCacheAndMount(t *testing.T) {
 			break
 		}
 	}
-	assert.True(t, mounted, "license file should be mounted into container at /etc/localstack/conf.d/license.json")
+	must.True(t, mounted, "license file should be mounted into container at /etc/localstack/conf.d/license.json")
 }
diff --git a/test/integration/localstack_test.go b/test/integration/localstack_test.go
index a6ba92f5..e85a7ed8 100644
--- a/test/integration/localstack_test.go
+++ b/test/integration/localstack_test.go
@@ -5,8 +5,8 @@ import (
 	"os"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/require"
 )
 
 // Helpers for e2e tests that need a *real* LocalStack — one that serves the AWS
@@ -53,7 +53,7 @@ func startRealLocalStack(t *testing.T, ctx context.Context, token string) {
 func startRealLocalStackWithConfig(t *testing.T, ctx context.Context, token, configPath string) {
 	t.Helper()
 	home, err := os.MkdirTemp("", "lstk-e2e-home")
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() { _ = os.RemoveAll(home) })
 
 	e := env.With(env.DisableEvents, "1").With(env.Home, home).With(env.AuthToken, token)
@@ -63,5 +63,5 @@ func startRealLocalStackWithConfig(t *testing.T, ctx context.Context, token, con
 	}
 	args = append(args, "start")
 	_, stderr, err := runLstk(t, ctx, "", e, args...)
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 }
diff --git a/test/integration/logging_test.go b/test/integration/logging_test.go
index cfe6535a..c7819923 100644
--- a/test/integration/logging_test.go
+++ b/test/integration/logging_test.go
@@ -6,8 +6,7 @@ import (
 	"runtime"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"github.com/localstack/lstk/internal/must"
 )
 
 func TestLogging_NonTTY_WritesToLogFile(t *testing.T) {
@@ -18,19 +17,19 @@ func TestLogging_NonTTY_WritesToLogFile(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		logPath = filepath.Join(tmpHome, "AppData", "Roaming", "lstk", "lstk.log")
 	} else {
-		require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+		must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 		logPath = filepath.Join(tmpHome, ".config", "lstk", "lstk.log")
 	}
 	e := testEnvWithHome(tmpHome, "")
 
 	ctx := testContext(t)
 	_, _, err := runLstk(t, ctx, "", e, "--version")
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	logContents, err := os.ReadFile(logPath)
-	require.NoError(t, err, "expected lstk.log to be created at %s", logPath)
-	assert.Contains(t, string(logContents), "[INFO] lstk")
-	assert.Contains(t, string(logContents), "starting")
+	must.NoError(t, err, "expected lstk.log to be created at %s", logPath)
+	must.Contains(t, string(logContents), "[INFO] lstk")
+	must.Contains(t, string(logContents), "starting")
 }
 
 func TestLogging_TTY_WritesToLogFile(t *testing.T) {
@@ -40,16 +39,16 @@ func TestLogging_TTY_WritesToLogFile(t *testing.T) {
 	}
 
 	tmpHome := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	logPath := filepath.Join(tmpHome, ".config", "lstk", "lstk.log")
 	e := testEnvWithHome(tmpHome, "")
 
 	ctx := testContext(t)
 	_, err := runLstkInPTY(t, ctx, e, "--version")
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	logContents, err := os.ReadFile(logPath)
-	require.NoError(t, err, "expected lstk.log to be created at %s", logPath)
-	assert.Contains(t, string(logContents), "[INFO] lstk")
-	assert.Contains(t, string(logContents), "starting")
+	must.NoError(t, err, "expected lstk.log to be created at %s", logPath)
+	must.Contains(t, string(logContents), "[INFO] lstk")
+	must.Contains(t, string(logContents), "starting")
 }
diff --git a/test/integration/login_test.go b/test/integration/login_test.go
index e2a71eb3..10cb4c97 100644
--- a/test/integration/login_test.go
+++ b/test/integration/login_test.go
@@ -16,9 +16,8 @@ import (
 	"time"
 
 	"github.com/creack/pty"
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // createMockAPIServer creates a mock LocalStack API server for testing
@@ -33,9 +32,9 @@ func createMockAPIServer(t *testing.T, licenseToken string, confirmed bool) *htt
 			// Validate request payload
 			var payload map[string]string
 			err := json.NewDecoder(r.Body).Decode(&payload)
-			require.NoError(t, err, "failed to decode auth request payload")
-			assert.Equal(t, "lstk", payload["actor"], "actor should be lstk")
-			assert.NotEmpty(t, payload["version"], "version should not be empty")
+			must.NoError(t, err, "failed to decode auth request payload")
+			must.Eq(t, "lstk", payload["actor"], "actor should be lstk")
+			must.NotEmpty(t, payload["version"], "version should not be empty")
 
 			w.WriteHeader(http.StatusCreated)
 			err = json.NewEncoder(w).Encode(map[string]string{
@@ -43,14 +42,14 @@ func createMockAPIServer(t *testing.T, licenseToken string, confirmed bool) *htt
 				"code":           "TEST123",
 				"exchange_token": exchangeToken,
 			})
-			require.NoError(t, err)
+			must.NoError(t, err)
 
 		case r.Method == "GET" && r.URL.Path == fmt.Sprintf("/v1/auth/request/%s", authReqID):
 			w.WriteHeader(http.StatusOK)
 			err := json.NewEncoder(w).Encode(map[string]bool{
 				"confirmed": confirmed,
 			})
-			require.NoError(t, err)
+			must.NoError(t, err)
 
 		case r.Method == "POST" && r.URL.Path == fmt.Sprintf("/v1/auth/request/%s/exchange", authReqID):
 			w.WriteHeader(http.StatusOK)
@@ -58,14 +57,14 @@ func createMockAPIServer(t *testing.T, licenseToken string, confirmed bool) *htt
 				"id":         authReqID,
 				"auth_token": bearerToken,
 			})
-			require.NoError(t, err)
+			must.NoError(t, err)
 
 		case r.Method == "GET" && r.URL.Path == "/v1/license/credentials":
 			w.WriteHeader(http.StatusOK)
 			err := json.NewEncoder(w).Encode(map[string]string{
 				"token": licenseToken,
 			})
-			require.NoError(t, err)
+			must.NoError(t, err)
 
 		case r.Method == "POST" && r.URL.Path == "/v1/license/request":
 			w.WriteHeader(http.StatusOK)
@@ -88,7 +87,7 @@ func fakeBrowserOpener(t *testing.T, environ env.Environ) (env.Environ, func() s
 	record := filepath.Join(dir, "opened-url")
 	script := fmt.Sprintf("#!/bin/sh\nprintf '%%s' \"$1\" > %q\n", record)
 	for _, name := range []string{"open", "xdg-open", "x-www-browser", "www-browser"} {
-		require.NoError(t, os.WriteFile(filepath.Join(dir, name), []byte(script), 0o755))
+		must.NoError(t, os.WriteFile(filepath.Join(dir, name), []byte(script), 0o755))
 	}
 	environ = environ.With(env.Path, dir+string(os.PathListSeparator)+os.Getenv("PATH"))
 	return environ, func() string {
@@ -122,7 +121,7 @@ func TestDeviceFlowSuccess(t *testing.T) {
 	cmd.Env = environ
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start command in PTY")
+	must.NoError(t, err, "failed to start command in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	output := &syncBuffer{}
@@ -133,33 +132,33 @@ func TestDeviceFlowSuccess(t *testing.T) {
 	}()
 
 	// Wait for the auth completion prompt, then press ENTER.
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(output.Bytes(), []byte("Press any key when complete"))
 	}, 10*time.Second, 100*time.Millisecond, "auth completion prompt should appear")
 	_, err = ptmx.Write([]byte("\r"))
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	// Wait for process to complete
 	err = cmd.Wait()
 	<-outputCh
 
 	out := output.String()
-	require.NoError(t, err, "login should succeed: %s", out)
+	must.NoError(t, err, "login should succeed: %s", out)
 	requireExitCode(t, 0, err)
-	assert.Equal(t, mockServer.URL+"/auth/request/test-auth-req-id?code=TEST123", openedURL(), "login should open the auth URL in a browser")
-	assert.Contains(t, out, "Opening browser to login...")
-	assert.Contains(t, out, "Browser didn't open? Visit")
-	assert.Contains(t, out, "/auth/request/test-auth-req-id?code=TEST123")
-	assert.Contains(t, out, "Waiting for authorization")
-	assert.Contains(t, out, "Checking if auth request is confirmed")
-	assert.Contains(t, out, "Auth request confirmed")
-	assert.Contains(t, out, "Fetching license token")
-	assert.Contains(t, out, "Login successful")
+	must.Eq(t, mockServer.URL+"/auth/request/test-auth-req-id?code=TEST123", openedURL(), "login should open the auth URL in a browser")
+	must.Contains(t, out, "Opening browser to login...")
+	must.Contains(t, out, "Browser didn't open? Visit")
+	must.Contains(t, out, "/auth/request/test-auth-req-id?code=TEST123")
+	must.Contains(t, out, "Waiting for authorization")
+	must.Contains(t, out, "Checking if auth request is confirmed")
+	must.Contains(t, out, "Auth request confirmed")
+	must.Contains(t, out, "Fetching license token")
+	must.Contains(t, out, "Login successful")
 
 	// Verify token was stored in keyring
 	storedToken, err := GetAuthTokenFromKeyring()
-	require.NoError(t, err)
-	assert.Equal(t, licenseToken, storedToken)
+	must.NoError(t, err)
+	must.Eq(t, licenseToken, storedToken)
 	assertCommandTelemetry(t, events, "login", 0)
 }
 
@@ -185,7 +184,7 @@ func TestDeviceFlowFailure_RequestNotConfirmed(t *testing.T) {
 	cmd.Env = environ
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start command in PTY")
+	must.NoError(t, err, "failed to start command in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	output := &syncBuffer{}
@@ -196,30 +195,30 @@ func TestDeviceFlowFailure_RequestNotConfirmed(t *testing.T) {
 	}()
 
 	// Wait for the auth completion prompt, then press ENTER.
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(output.Bytes(), []byte("Press any key when complete"))
 	}, 10*time.Second, 100*time.Millisecond, "auth completion prompt should appear")
 	_, err = ptmx.Write([]byte("\r"))
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	// Wait for process to complete
 	err = cmd.Wait()
 	<-outputCh
 
 	out := output.String()
-	require.Error(t, err, "expected login to fail when request not confirmed")
+	must.Error(t, err, "expected login to fail when request not confirmed")
 	requireExitCode(t, 1, err)
-	assert.Equal(t, mockServer.URL+"/auth/request/test-auth-req-id?code=TEST123", openedURL(), "login should open the auth URL in a browser")
-	assert.Contains(t, out, "Opening browser to login...")
-	assert.Contains(t, out, "Browser didn't open? Visit")
-	assert.Contains(t, out, "/auth/request/test-auth-req-id?code=TEST123")
-	assert.Contains(t, out, "Waiting for authorization")
-	assert.Contains(t, out, "Checking if auth request is confirmed")
-	assert.Contains(t, out, "auth request not confirmed")
+	must.Eq(t, mockServer.URL+"/auth/request/test-auth-req-id?code=TEST123", openedURL(), "login should open the auth URL in a browser")
+	must.Contains(t, out, "Opening browser to login...")
+	must.Contains(t, out, "Browser didn't open? Visit")
+	must.Contains(t, out, "/auth/request/test-auth-req-id?code=TEST123")
+	must.Contains(t, out, "Waiting for authorization")
+	must.Contains(t, out, "Checking if auth request is confirmed")
+	must.Contains(t, out, "auth request not confirmed")
 
 	// Verify no token was stored in keyring
 	_, err = GetAuthTokenFromKeyring()
-	assert.Error(t, err, "no token should be stored when login fails")
+	must.Error(t, err, "no token should be stored when login fails")
 	assertCommandTelemetry(t, events, "login", 1)
 }
 
@@ -232,11 +231,11 @@ func TestLoginShortCircuitsWhenEnvTokenSet(t *testing.T) {
 	environ := append(testEnvWithHome(t.TempDir(), ""), string(env.AuthToken)+"=fake-env-token")
 
 	out, err := runLstkInPTY(t, testContext(t), environ, "login")
-	require.NoError(t, err, "login should succeed when env token is set: %s", out)
+	must.NoError(t, err, "login should succeed when env token is set: %s", out)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, out, "You're already logged in")
-	assert.NotContains(t, out, "Opening browser")
-	assert.NotContains(t, out, "Waiting for authorization")
+	must.Contains(t, out, "You're already logged in")
+	must.NotContains(t, out, "Opening browser")
+	must.NotContains(t, out, "Waiting for authorization")
 }
 
 func TestLoginShortCircuitsWhenStoredTokenExists(t *testing.T) {
@@ -247,15 +246,15 @@ func TestLoginShortCircuitsWhenStoredTokenExists(t *testing.T) {
 
 	tmpHome := t.TempDir()
 	tokenDir := filepath.Join(tmpHome, ".config", "lstk")
-	require.NoError(t, os.MkdirAll(tokenDir, 0700))
-	require.NoError(t, os.WriteFile(filepath.Join(tokenDir, "auth-token"), []byte("stored-token"), 0600))
+	must.NoError(t, os.MkdirAll(tokenDir, 0700))
+	must.NoError(t, os.WriteFile(filepath.Join(tokenDir, "auth-token"), []byte("stored-token"), 0600))
 
 	environ := env.Environ(testEnvWithHome(tmpHome, "")).Without(env.AuthToken)
 
 	out, err := runLstkInPTY(t, testContext(t), environ, "login")
-	require.NoError(t, err, "login should succeed when stored token exists: %s", out)
+	must.NoError(t, err, "login should succeed when stored token exists: %s", out)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, out, "You're already logged in")
-	assert.NotContains(t, out, "Opening browser")
-	assert.NotContains(t, out, "Waiting for authorization")
+	must.Contains(t, out, "You're already logged in")
+	must.NotContains(t, out, "Opening browser")
+	must.NotContains(t, out, "Waiting for authorization")
 }
diff --git a/test/integration/logout_test.go b/test/integration/logout_test.go
index b3d92a2c..658244a8 100644
--- a/test/integration/logout_test.go
+++ b/test/integration/logout_test.go
@@ -6,10 +6,9 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/moby/moby/client"
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"github.com/moby/moby/client"
 )
 
 func TestLogoutCommandRemovesToken(t *testing.T) {
@@ -19,16 +18,16 @@ func TestLogoutCommandRemovesToken(t *testing.T) {
 	})
 
 	err := SetAuthTokenInKeyring("test-token")
-	require.NoError(t, err, "failed to store token in keyring")
+	must.NoError(t, err, "failed to store token in keyring")
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, stderr, err := runLstk(t, testContext(t), "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "logout")
-	require.NoError(t, err, "lstk logout failed: %s", stderr)
+	must.NoError(t, err, "lstk logout failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "Logged out successfully")
+	must.Contains(t, stdout, "Logged out successfully")
 
 	_, err = GetAuthTokenFromKeyring()
-	assert.Error(t, err, "token should be removed from keyring")
+	must.Error(t, err, "token should be removed from keyring")
 	assertCommandTelemetry(t, events, "logout", 0)
 }
 
@@ -37,9 +36,9 @@ func TestLogoutCommandSucceedsWhenNoToken(t *testing.T) {
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, stderr, err := runLstk(t, testContext(t), "", env.Without(env.AuthToken).With(env.AnalyticsEndpoint, analyticsSrv.URL), "logout")
-	require.NoError(t, err, "lstk logout should succeed even with no token: %s", stderr)
+	must.NoError(t, err, "lstk logout should succeed even with no token: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "Not currently logged in")
+	must.Contains(t, stdout, "Not currently logged in")
 	assertCommandTelemetry(t, events, "logout", 0)
 }
 
@@ -47,9 +46,9 @@ func TestLogoutCommandWithEnvVarToken(t *testing.T) {
 	_ = DeleteAuthTokenFromKeyring()
 
 	stdout, stderr, err := runLstk(t, testContext(t), "", env.Without(env.AuthToken).With(env.AuthToken, "test-env-token"), "logout")
-	require.NoError(t, err, "lstk logout should succeed: %s", stderr)
+	must.NoError(t, err, "lstk logout should succeed: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "LOCALSTACK_AUTH_TOKEN")
+	must.Contains(t, stdout, "LOCALSTACK_AUTH_TOKEN")
 }
 
 func TestLogoutCommandNotesWhenEmulatorStillRunning(t *testing.T) {
@@ -64,12 +63,12 @@ func TestLogoutCommandNotesWhenEmulatorStillRunning(t *testing.T) {
 	startTestContainer(t, ctx)
 
 	err := SetAuthTokenInKeyring("test-token")
-	require.NoError(t, err, "failed to store token in keyring")
+	must.NoError(t, err, "failed to store token in keyring")
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "logout")
-	require.NoError(t, err, "lstk logout failed: %s", stderr)
+	must.NoError(t, err, "lstk logout failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "LocalStack AWS Emulator is still running in the background")
+	must.Contains(t, stdout, "LocalStack AWS Emulator is still running in the background")
 }
 
 func TestLogoutCommandReportsBothEmulatorsWhenMultipleRunning(t *testing.T) {
@@ -87,9 +86,9 @@ func TestLogoutCommandReportsBothEmulatorsWhenMultipleRunning(t *testing.T) {
 	const fakeAWSImage = "localstack/localstack-pro:test-fake"
 	const fakeSnowflakeImage = "localstack/snowflake:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeAWSImage})
-	require.NoError(t, err)
+	must.NoError(t, err)
 	_, err = dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeSnowflakeImage})
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeAWSImage, client.ImageRemoveOptions{})
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeSnowflakeImage, client.ImageRemoveOptions{})
@@ -97,10 +96,10 @@ func TestLogoutCommandReportsBothEmulatorsWhenMultipleRunning(t *testing.T) {
 	startExternalContainer(t, ctx, fakeAWSImage, "localstack-external-aws", "4566")
 	startExternalContainer(t, ctx, fakeSnowflakeImage, "localstack-external-snowflake", "4567")
 
-	require.NoError(t, SetAuthTokenInKeyring("test-token"), "failed to store token in keyring")
+	must.NoError(t, SetAuthTokenInKeyring("test-token"), "failed to store token in keyring")
 
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(`
+	must.NoError(t, os.WriteFile(configFile, []byte(`
 [[containers]]
 type = "aws"
 tag  = "test-fake"
@@ -113,9 +112,9 @@ port = "4567"
 `), 0644))
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "--config", configFile, "logout")
-	require.NoError(t, err, "lstk logout failed: %s", stderr)
+	must.NoError(t, err, "lstk logout failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "LocalStack AWS Emulator, LocalStack Snowflake Emulator are still running in the background")
+	must.Contains(t, stdout, "LocalStack AWS Emulator, LocalStack Snowflake Emulator are still running in the background")
 }
 
 func TestLogoutCommandDoesNotReportForeignEmulatorAsRunning(t *testing.T) {
@@ -133,19 +132,19 @@ func TestLogoutCommandDoesNotReportForeignEmulatorAsRunning(t *testing.T) {
 	// AWS image running on 4566 while config targets snowflake.
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
 	startExternalContainer(t, ctx, fakeImage, "localstack-external-aws", "4566")
 
-	require.NoError(t, SetAuthTokenInKeyring("test-token"), "failed to store token in keyring")
+	must.NoError(t, SetAuthTokenInKeyring("test-token"), "failed to store token in keyring")
 
 	configFile := writeSnowflakeConfig(t, "4566")
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "--config", configFile, "logout")
-	require.NoError(t, err, "lstk logout failed: %s", stderr)
+	must.NoError(t, err, "lstk logout failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.NotContains(t, stdout, "still running",
+	must.NotContains(t, stdout, "still running",
 		"snowflake-targeted logout should not detect the AWS container as the configured emulator")
 }
diff --git a/test/integration/logs_test.go b/test/integration/logs_test.go
index ac0916da..ab5c5b15 100644
--- a/test/integration/logs_test.go
+++ b/test/integration/logs_test.go
@@ -12,10 +12,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/moby/moby/client"
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"github.com/moby/moby/client"
 )
 
 // writeAwsConfig writes a minimal aws-only config so tests don't inherit the
@@ -24,7 +23,7 @@ import (
 func writeAwsConfig(t *testing.T) string {
 	t.Helper()
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(`
+	must.NoError(t, os.WriteFile(configFile, []byte(`
 [[containers]]
 type = "aws"
 tag  = "latest"
@@ -44,7 +43,7 @@ func TestLogsExitsByDefault(t *testing.T) {
 	configFile := writeAwsConfig(t)
 	analyticsSrv, events := mockAnalyticsServer(t)
 	_, _, err := runLstk(t, ctx, "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "--config", configFile, "logs")
-	require.NoError(t, err, "lstk logs should exit cleanly when container is running")
+	must.NoError(t, err, "lstk logs should exit cleanly when container is running")
 	requireExitCode(t, 0, err)
 	assertCommandTelemetry(t, events, "logs", 0)
 }
@@ -57,9 +56,9 @@ func TestLogsCommandFailsWhenNotRunning(t *testing.T) {
 	configFile := writeAwsConfig(t)
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "--config", configFile, "logs", "--follow")
-	require.Error(t, err, "expected lstk logs --follow to fail when container not running")
+	must.Error(t, err, "expected lstk logs --follow to fail when container not running")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "LocalStack AWS Emulator is not running")
+	must.Contains(t, stdout, "LocalStack AWS Emulator is not running")
 	assertCommandTelemetry(t, events, "logs", 1)
 }
 
@@ -75,7 +74,7 @@ func TestLogsWorksWithExternalContainer(t *testing.T) {
 
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -85,7 +84,7 @@ func TestLogsWorksWithExternalContainer(t *testing.T) {
 	configFile := writeAwsConfig(t)
 	analyticsSrv, events := mockAnalyticsServer(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "--config", configFile, "logs")
-	require.NoError(t, err, "lstk logs should work with externally-named container: %s", stderr)
+	must.NoError(t, err, "lstk logs should work with externally-named container: %s", stderr)
 	requireExitCode(t, 0, err)
 	assertCommandTelemetry(t, events, "logs", 0)
 }
@@ -120,11 +119,11 @@ func writeContainerLogs(t *testing.T, ctx context.Context, script, lastMarker st
 	execResp, err := dockerClient.ExecCreate(ctx, containerName, client.ExecCreateOptions{
 		Cmd: []string{"sh", "-c", "{ " + script + " } >/proc/1/fd/1"},
 	})
-	require.NoError(t, err, "failed to create exec")
+	must.NoError(t, err, "failed to create exec")
 	_, err = dockerClient.ExecStart(ctx, execResp.ID, client.ExecStartOptions{Detach: true})
-	require.NoError(t, err, "failed to start exec")
+	must.NoError(t, err, "failed to start exec")
 
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		reader, err := dockerClient.ContainerLogs(ctx, containerName, client.ContainerLogsOptions{
 			ShowStdout: true,
 			ShowStderr: true,
@@ -159,9 +158,9 @@ func TestLogsTailCountsVisibleLinesNotFilteredOnes(t *testing.T) {
 
 	configFile := writeAwsConfig(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.Without(), "--config", configFile, "logs", "--tail", "1")
-	require.NoError(t, err, "lstk logs --tail 1 should exit cleanly, stderr: %s", stderr)
-	assert.Contains(t, stdout, "tail-visible-marker", "--tail 1 must show the newest visible line, not an empty result")
-	assert.NotContains(t, stdout, "tail-filtered-marker", "filtered request logs must stay hidden")
+	must.NoError(t, err, "lstk logs --tail 1 should exit cleanly, stderr: %s", stderr)
+	must.Contains(t, stdout, "tail-visible-marker", "--tail 1 must show the newest visible line, not an empty result")
+	must.NotContains(t, stdout, "tail-filtered-marker", "filtered request logs must stay hidden")
 }
 
 func TestLogsTailLimitsOutput(t *testing.T) {
@@ -178,12 +177,12 @@ func TestLogsTailLimitsOutput(t *testing.T) {
 	for _, flags := range [][]string{{"--tail", "3"}, {"-n", "3"}} {
 		args := append([]string{"--config", configFile, "logs"}, flags...)
 		stdout, stderr, err := runLstk(t, ctx, "", env.Without(), args...)
-		require.NoError(t, err, "lstk logs %s should exit cleanly, stderr: %s", strings.Join(flags, " "), stderr)
+		must.NoError(t, err, "lstk logs %s should exit cleanly, stderr: %s", strings.Join(flags, " "), stderr)
 		for i := 8; i <= 10; i++ {
-			assert.Contains(t, stdout, fmt.Sprintf("tail-marker-%d", i), "last 3 lines should be shown with %s", strings.Join(flags, " "))
+			must.Contains(t, stdout, fmt.Sprintf("tail-marker-%d", i), "last 3 lines should be shown with %s", strings.Join(flags, " "))
 		}
 		for i := 1; i <= 7; i++ {
-			assert.NotContains(t, stdout, fmt.Sprintf("tail-marker-%d\n", i), "older lines should be cut off with %s", strings.Join(flags, " "))
+			must.NotContains(t, stdout, fmt.Sprintf("tail-marker-%d\n", i), "older lines should be cut off with %s", strings.Join(flags, " "))
 		}
 	}
 }
@@ -199,9 +198,9 @@ func TestLogsWithoutTailShowsAllLines(t *testing.T) {
 
 	configFile := writeAwsConfig(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.Without(), "--config", configFile, "logs")
-	require.NoError(t, err, "lstk logs should exit cleanly, stderr: %s", stderr)
+	must.NoError(t, err, "lstk logs should exit cleanly, stderr: %s", stderr)
 	for i := 1; i <= 10; i++ {
-		assert.Contains(t, stdout, fmt.Sprintf("tail-marker-%d", i), "all lines should be shown without --tail")
+		must.Contains(t, stdout, fmt.Sprintf("tail-marker-%d", i), "all lines should be shown without --tail")
 	}
 }
 
@@ -210,10 +209,10 @@ func TestLogsTailRejectsInvalidValue(t *testing.T) {
 
 	configFile := writeAwsConfig(t)
 	_, stderr, err := runLstk(t, testContext(t), "", env.Without(), "--config", configFile, "logs", "--tail", "bogus")
-	require.Error(t, err, "expected lstk logs --tail bogus to fail")
+	must.Error(t, err, "expected lstk logs --tail bogus to fail")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "bogus", "error should name the invalid value")
-	assert.Contains(t, stderr, "--tail", "error should name the flag")
+	must.Contains(t, stderr, "bogus", "error should name the invalid value")
+	must.Contains(t, stderr, "--tail", "error should name the flag")
 }
 
 func TestLogsTailWithFollowStartsFromTail(t *testing.T) {
@@ -230,10 +229,10 @@ func TestLogsTailWithFollowStartsFromTail(t *testing.T) {
 	logsCmd := exec.CommandContext(ctx, binaryPath(), "--config", configFile, "logs", "--follow", "--tail", "3")
 	logsCmd.Env = env.Without()
 	stdout, err := logsCmd.StdoutPipe()
-	require.NoError(t, err, "failed to get stdout pipe")
+	must.NoError(t, err, "failed to get stdout pipe")
 
 	err = logsCmd.Start()
-	require.NoError(t, err, "failed to start lstk logs --follow --tail 3")
+	must.NoError(t, err, "failed to start lstk logs --follow --tail 3")
 	t.Cleanup(func() { _ = logsCmd.Process.Kill() })
 
 	// The backlog is capped at the last 3 lines, so the first line streamed
@@ -252,7 +251,7 @@ func TestLogsTailWithFollowStartsFromTail(t *testing.T) {
 
 	select {
 	case line := <-firstLine:
-		assert.Contains(t, line, "tail-marker-8", "follow should start from the last 3 lines")
+		must.Contains(t, line, "tail-marker-8", "follow should start from the last 3 lines")
 	case <-ctx.Done():
 		t.Fatal("no marker appeared in lstk logs --follow --tail output within timeout")
 	}
@@ -274,10 +273,10 @@ func TestLogsInteractivePreservesFullScrollback(t *testing.T) {
 
 	configFile := writeAwsConfig(t)
 	out, err := runLstkInPTY(t, ctx, env.Without(), "--config", configFile, "logs")
-	require.NoError(t, err, "lstk logs should exit cleanly in interactive mode, output: %s", out)
+	must.NoError(t, err, "lstk logs should exit cleanly in interactive mode, output: %s", out)
 
 	for i := 1; i <= lineCount; i++ {
-		assert.Contains(t, out, fmt.Sprintf("tail-marker-%d", i), "expected tail-marker-%d to survive scrollback", i)
+		must.Contains(t, out, fmt.Sprintf("tail-marker-%d", i), "expected tail-marker-%d to survive scrollback", i)
 	}
 }
 
@@ -295,10 +294,10 @@ func TestLogsFollowStreamsOutput(t *testing.T) {
 	// Uses StdoutPipe for streaming — cannot use runLstk.
 	logsCmd := exec.CommandContext(ctx, binaryPath(), "--config", configFile, "logs", "--follow")
 	stdout, err := logsCmd.StdoutPipe()
-	require.NoError(t, err, "failed to get stdout pipe")
+	must.NoError(t, err, "failed to get stdout pipe")
 
 	err = logsCmd.Start()
-	require.NoError(t, err, "failed to start lstk logs --follow")
+	must.NoError(t, err, "failed to start lstk logs --follow")
 	t.Cleanup(func() { _ = logsCmd.Process.Kill() })
 
 	// Give lstk logs a moment to connect before generating output
@@ -308,9 +307,9 @@ func TestLogsFollowStreamsOutput(t *testing.T) {
 	execResp, err := dockerClient.ExecCreate(ctx, containerName, client.ExecCreateOptions{
 		Cmd: []string{"sh", "-c", "echo " + marker + " >/proc/1/fd/1"},
 	})
-	require.NoError(t, err, "failed to create exec")
+	must.NoError(t, err, "failed to create exec")
 	_, err = dockerClient.ExecStart(ctx, execResp.ID, client.ExecStartOptions{Detach: true})
-	require.NoError(t, err, "failed to start exec")
+	must.NoError(t, err, "failed to start exec")
 
 	// Scan lines in a goroutine because reading from the pipe blocks until lstk logs exits, which it never does on its own.
 	found := make(chan struct{}, 1)
diff --git a/test/integration/main_test.go b/test/integration/main_test.go
index c356d1e2..ac63028c 100644
--- a/test/integration/main_test.go
+++ b/test/integration/main_test.go
@@ -20,11 +20,11 @@ import (
 	"net/netip"
 
 	"github.com/creack/pty"
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/api/types/network"
 	"github.com/moby/moby/client"
-	"github.com/stretchr/testify/require"
 	"github.com/zalando/go-keyring"
 )
 
@@ -107,6 +107,12 @@ func TestMain(m *testing.M) {
 		}
 	}
 
+	// snap.Clean is deliberately NOT wired here (unlike unit-test packages):
+	// it treats unvisited snapshots as obsolete, but this package skips whole
+	// test groups per platform (Docker on Windows CI, PTY/sh fakes on Windows,
+	// TLS trust on non-Linux), so a full run on any one OS never visits the
+	// other platforms' snapshots — Clean would flag them (or delete them under
+	// UPDATE_SNAPS=true). Stale snapshots here are caught by review instead.
 	m.Run()
 }
 
@@ -178,7 +184,7 @@ func startTestContainer(t *testing.T, ctx context.Context, hostPort ...string) {
 	t.Helper()
 
 	reader, err := dockerClient.ImagePull(ctx, testImage, client.ImagePullOptions{})
-	require.NoError(t, err, "failed to pull test image")
+	must.NoError(t, err, "failed to pull test image")
 	_, _ = io.Copy(io.Discard, reader)
 	_ = reader.Close()
 
@@ -203,9 +209,9 @@ func startTestContainer(t *testing.T, ctx context.Context, hostPort ...string) {
 		HostConfig: hostCfg,
 		Name:       containerName,
 	})
-	require.NoError(t, err, "failed to create test container")
+	must.NoError(t, err, "failed to create test container")
 	_, err = dockerClient.ContainerStart(ctx, resp.ID, client.ContainerStartOptions{})
-	require.NoError(t, err, "failed to start test container")
+	must.NoError(t, err, "failed to start test container")
 }
 
 // Use this to simulate a LocalStack container started outside lstk.
@@ -226,9 +232,9 @@ func startExternalContainer(t *testing.T, ctx context.Context, imgName, name, ho
 		},
 		Name: name,
 	})
-	require.NoError(t, err, "failed to create external container")
+	must.NoError(t, err, "failed to create external container")
 	_, err = dockerClient.ContainerStart(ctx, resp.ID, client.ContainerStartOptions{})
-	require.NoError(t, err, "failed to start external container")
+	must.NoError(t, err, "failed to start external container")
 	t.Cleanup(func() {
 		_, _ = dockerClient.ContainerRemove(context.Background(), name, client.ContainerRemoveOptions{Force: true})
 	})
@@ -246,7 +252,7 @@ func commitNeverHealthyImage(t *testing.T, ctx context.Context) string {
 	t.Helper()
 
 	reader, err := dockerClient.ImagePull(ctx, testImage, client.ImagePullOptions{})
-	require.NoError(t, err, "failed to pull test image")
+	must.NoError(t, err, "failed to pull test image")
 	_, _ = io.Copy(io.Discard, reader)
 	_ = reader.Close()
 
@@ -254,7 +260,7 @@ func commitNeverHealthyImage(t *testing.T, ctx context.Context) string {
 		Config: &container.Config{Image: testImage},
 		Name:   "lstk-never-healthy-src",
 	})
-	require.NoError(t, err, "failed to create source container")
+	must.NoError(t, err, "failed to create source container")
 	t.Cleanup(func() {
 		_, _ = dockerClient.ContainerRemove(context.Background(), resp.ID, client.ContainerRemoveOptions{Force: true})
 	})
@@ -264,7 +270,7 @@ func commitNeverHealthyImage(t *testing.T, ctx context.Context) string {
 		Reference: imageRef,
 		Changes:   []string{`CMD ["sleep", "infinity"]`},
 	})
-	require.NoError(t, err, "failed to commit never-healthy image")
+	must.NoError(t, err, "failed to commit never-healthy image")
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), imageRef, client.ImageRemoveOptions{Force: true})
 	})
@@ -287,7 +293,7 @@ func startNamedTestContainer(t *testing.T, ctx context.Context, name, label stri
 	t.Helper()
 
 	reader, err := dockerClient.ImagePull(ctx, testImage, client.ImagePullOptions{})
-	require.NoError(t, err, "failed to pull test image")
+	must.NoError(t, err, "failed to pull test image")
 	_, _ = io.Copy(io.Discard, reader)
 	_ = reader.Close()
 
@@ -298,9 +304,9 @@ func startNamedTestContainer(t *testing.T, ctx context.Context, name, label stri
 		},
 		Name: name,
 	})
-	require.NoError(t, err, "failed to create %s test container", label)
+	must.NoError(t, err, "failed to create %s test container", label)
 	_, err = dockerClient.ContainerStart(ctx, resp.ID, client.ContainerStartOptions{})
-	require.NoError(t, err, "failed to start %s test container", label)
+	must.NoError(t, err, "failed to start %s test container", label)
 }
 
 func testContext(t *testing.T) context.Context {
@@ -314,7 +320,7 @@ func runLstk(t *testing.T, ctx context.Context, dir string, env []string, args .
 	t.Helper()
 
 	binPath, err := filepath.Abs(binaryPath())
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	cmd := exec.CommandContext(ctx, binPath, args...)
 	cmd.Dir = dir
@@ -340,7 +346,7 @@ func runLstkInPTY(t *testing.T, ctx context.Context, environ []string, args ...s
 	}
 
 	binPath, err := filepath.Abs(binaryPath())
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	cmd := exec.CommandContext(ctx, binPath, args...)
 	if environ != nil {
@@ -348,7 +354,7 @@ func runLstkInPTY(t *testing.T, ctx context.Context, environ []string, args ...s
 	}
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start command in PTY")
+	must.NoError(t, err, "failed to start command in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	out := &syncBuffer{}
@@ -366,12 +372,12 @@ func runLstkInPTY(t *testing.T, ctx context.Context, environ []string, args ...s
 func requireExitCode(t *testing.T, expected int, err error) {
 	t.Helper()
 	if expected == 0 {
-		require.NoError(t, err)
+		must.NoError(t, err)
 		return
 	}
 	var exitErr *exec.ExitError
-	require.ErrorAs(t, err, &exitErr)
-	require.Equal(t, expected, exitErr.ExitCode())
+	must.ErrorAs(t, err, &exitErr)
+	must.Eq(t, expected, exitErr.ExitCode())
 }
 
 func createMockLicenseServer(success bool) *httptest.Server {
diff --git a/test/integration/multiple_installs_test.go b/test/integration/multiple_installs_test.go
index 083f2b15..4ad60d73 100644
--- a/test/integration/multiple_installs_test.go
+++ b/test/integration/multiple_installs_test.go
@@ -6,8 +6,8 @@ import (
 	"runtime"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/require"
 )
 
 // copyBinaryTo copies the built lstk binary into dir under the platform's
@@ -16,15 +16,15 @@ import (
 func copyBinaryTo(t *testing.T, dir string) string {
 	t.Helper()
 	src, err := filepath.Abs(binaryPath())
-	require.NoError(t, err)
+	must.NoError(t, err)
 	data, err := os.ReadFile(src)
-	require.NoError(t, err)
+	must.NoError(t, err)
 	name := "lstk"
 	if runtime.GOOS == "windows" {
 		name = "lstk.exe"
 	}
 	dst := filepath.Join(dir, name)
-	require.NoError(t, os.WriteFile(dst, data, 0o755))
+	must.NoError(t, os.WriteFile(dst, data, 0o755))
 	return dst
 }
 
@@ -38,10 +38,10 @@ func TestUpdateCheckWarnsOnMultipleInstallsOnPath(t *testing.T) {
 		With(env.Path, dirA+string(os.PathListSeparator)+dirB)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "update", "--check")
-	require.NoError(t, err, stderr)
-	require.Contains(t, stdout, "Multiple lstk installations found on PATH:")
-	require.Contains(t, stdout, pathA)
-	require.Contains(t, stdout, pathB)
+	must.NoError(t, err, stderr)
+	must.Contains(t, stdout, "Multiple lstk installations found on PATH:")
+	must.Contains(t, stdout, pathA)
+	must.Contains(t, stdout, pathB)
 }
 
 func TestUpdateCheckDoesNotWarnOnSingleInstall(t *testing.T) {
@@ -52,8 +52,8 @@ func TestUpdateCheckDoesNotWarnOnSingleInstall(t *testing.T) {
 	environ := env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.Path, dir)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "update", "--check")
-	require.NoError(t, err, stderr)
-	require.NotContains(t, stdout, "Multiple lstk installations found")
+	must.NoError(t, err, stderr)
+	must.NotContains(t, stdout, "Multiple lstk installations found")
 }
 
 func TestUpdateCheckDoesNotWarnOnSymlinkedAliases(t *testing.T) {
@@ -63,14 +63,14 @@ func TestUpdateCheckDoesNotWarnOnSymlinkedAliases(t *testing.T) {
 	t.Parallel()
 	dirA, dirB := t.TempDir(), t.TempDir()
 	pathA := copyBinaryTo(t, dirA)
-	require.NoError(t, os.Symlink(pathA, filepath.Join(dirB, "lstk")))
+	must.NoError(t, os.Symlink(pathA, filepath.Join(dirB, "lstk")))
 
 	environ := env.Environ(testEnvWithHome(t.TempDir(), "")).
 		With(env.Path, dirA+string(os.PathListSeparator)+dirB)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "update", "--check")
-	require.NoError(t, err, stderr)
-	require.NotContains(t, stdout, "Multiple lstk installations found")
+	must.NoError(t, err, stderr)
+	must.NotContains(t, stdout, "Multiple lstk installations found")
 }
 
 func TestUpdateCheckJSONReportsMultipleInstallsWarning(t *testing.T) {
@@ -83,6 +83,6 @@ func TestUpdateCheckJSONReportsMultipleInstallsWarning(t *testing.T) {
 		With(env.Path, dirA+string(os.PathListSeparator)+dirB)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "update", "--check", "--json")
-	require.NoError(t, err, stderr)
-	require.Contains(t, stdout, `"MULTIPLE_INSTALLS"`)
+	must.NoError(t, err, stderr)
+	must.Contains(t, stdout, `"MULTIPLE_INSTALLS"`)
 }
diff --git a/test/integration/non_interactive_test.go b/test/integration/non_interactive_test.go
index 138750f5..a8419acf 100644
--- a/test/integration/non_interactive_test.go
+++ b/test/integration/non_interactive_test.go
@@ -3,17 +3,16 @@ package integration_test
 import (
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestNonInteractiveFlagBlocksLogin(t *testing.T) {
 	t.Parallel()
 	out, err := runLstkInPTY(t, testContext(t), testEnvWithHome(t.TempDir(), ""), "login", "--non-interactive")
-	require.Error(t, err, "expected login --non-interactive to fail")
+	must.Error(t, err, "expected login --non-interactive to fail")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, out, "login requires an interactive terminal")
+	must.Contains(t, out, "login requires an interactive terminal")
 }
 
 func TestNonInteractiveFlagFailsWithoutToken(t *testing.T) {
@@ -25,9 +24,9 @@ func TestNonInteractiveFlagFailsWithoutToken(t *testing.T) {
 	defer mockServer.Close()
 
 	out, err := runLstkInPTY(t, testContext(t), env.Without(env.AuthToken).With(env.APIEndpoint, mockServer.URL), "start", "--non-interactive")
-	require.Error(t, err, "expected start --non-interactive to fail with no auth token")
+	must.Error(t, err, "expected start --non-interactive to fail with no auth token")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, out, "authentication required: set LOCALSTACK_AUTH_TOKEN or run in interactive mode")
+	must.Contains(t, out, "authentication required: set LOCALSTACK_AUTH_TOKEN or run in interactive mode")
 }
 
 func TestRootNonInteractiveFlagFailsWithoutToken(t *testing.T) {
@@ -39,7 +38,7 @@ func TestRootNonInteractiveFlagFailsWithoutToken(t *testing.T) {
 	defer mockServer.Close()
 
 	out, err := runLstkInPTY(t, testContext(t), env.Without(env.AuthToken).With(env.APIEndpoint, mockServer.URL), "--non-interactive")
-	require.Error(t, err, "expected lstk --non-interactive to fail with no auth token")
+	must.Error(t, err, "expected lstk --non-interactive to fail with no auth token")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, out, "authentication required: set LOCALSTACK_AUTH_TOKEN or run in interactive mode")
+	must.Contains(t, out, "authentication required: set LOCALSTACK_AUTH_TOKEN or run in interactive mode")
 }
diff --git a/test/integration/reset_test.go b/test/integration/reset_test.go
index 714139f9..cf7ac533 100644
--- a/test/integration/reset_test.go
+++ b/test/integration/reset_test.go
@@ -15,9 +15,8 @@ import (
 	"time"
 
 	"github.com/creack/pty"
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // mockResetServer returns a test server that records POST /_localstack/state/reset calls and replies with status.
@@ -49,9 +48,9 @@ func TestResetSucceedsWithForce(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "reset", "--force",
 	)
-	require.NoError(t, err, "lstk reset failed: %s", stderr)
-	assert.Contains(t, stdout, "Emulator state reset")
-	assert.Equal(t, int32(1), calls.Load(), "reset endpoint should be called exactly once")
+	must.NoError(t, err, "lstk reset failed: %s", stderr)
+	must.Contains(t, stdout, "Emulator state reset")
+	must.Eq(t, int32(1), calls.Load(), "reset endpoint should be called exactly once")
 }
 
 func TestResetFailsWithoutForceInNonInteractive(t *testing.T) {
@@ -70,8 +69,8 @@ func TestResetFailsWithoutForceInNonInteractive(t *testing.T) {
 		"--non-interactive", "reset",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "--force")
-	assert.Equal(t, int32(0), calls.Load(), "reset endpoint should not be called when confirmation is required")
+	must.Contains(t, stderr, "--force")
+	must.Eq(t, int32(0), calls.Load(), "reset endpoint should not be called when confirmation is required")
 }
 
 func TestResetLocalStackNotRunning(t *testing.T) {
@@ -86,7 +85,7 @@ func TestResetLocalStackNotRunning(t *testing.T) {
 		"--non-interactive", "reset", "--force",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "not running")
+	must.Contains(t, stdout, "not running")
 }
 
 func TestResetReturnsErrorOnAPIFailure(t *testing.T) {
@@ -103,7 +102,7 @@ func TestResetReturnsErrorOnAPIFailure(t *testing.T) {
 		"--non-interactive", "reset", "--force",
 	)
 	requireExitCode(t, 1, err)
-	assert.NotEmpty(t, stderr)
+	must.NotEmpty(t, stderr)
 }
 
 func TestResetTelemetryEmitted(t *testing.T) {
@@ -122,7 +121,7 @@ func TestResetTelemetryEmitted(t *testing.T) {
 			With(env.AnalyticsEndpoint, analyticsSrv.URL),
 		"--non-interactive", "reset", "--force",
 	)
-	require.NoError(t, err, "lstk reset failed: %s", stderr)
+	must.NoError(t, err, "lstk reset failed: %s", stderr)
 	assertCommandTelemetry(t, events, "reset", 0)
 }
 
@@ -156,12 +155,12 @@ func TestResetInteractive(t *testing.T) {
 	startReset := func(t *testing.T, srv *httptest.Server) (*os.File, *syncBuffer, chan struct{}, *exec.Cmd) {
 		t.Helper()
 		binPath, err := filepath.Abs(binaryPath())
-		require.NoError(t, err)
+		must.NoError(t, err)
 
 		cmd := exec.CommandContext(testContext(t), binPath, "reset")
 		cmd.Env = env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv))
 		ptmx, err := pty.Start(cmd)
-		require.NoError(t, err, "failed to start command in PTY")
+		must.NoError(t, err, "failed to start command in PTY")
 		t.Cleanup(func() { _ = ptmx.Close() })
 
 		out := &syncBuffer{}
@@ -170,7 +169,7 @@ func TestResetInteractive(t *testing.T) {
 			_, _ = io.Copy(out, ptmx)
 			close(outputCh)
 		}()
-		require.Eventually(t, func() bool {
+		must.Eventually(t, func() bool {
 			return bytes.Contains(out.Bytes(), []byte("Reset emulator state?"))
 		}, 10*time.Second, 100*time.Millisecond, "confirmation prompt should appear")
 		return ptmx, out, outputCh, cmd
@@ -180,24 +179,24 @@ func TestResetInteractive(t *testing.T) {
 		srv, calls := mockResetServer(t, http.StatusOK)
 		ptmx, out, outputCh, cmd := startReset(t, srv)
 		_, err := ptmx.Write([]byte("y"))
-		require.NoError(t, err)
-		require.NoError(t, cmd.Wait())
+		must.NoError(t, err)
+		must.NoError(t, cmd.Wait())
 		<-outputCh
 
-		assert.Contains(t, out.String(), "Emulator state reset")
-		assert.Equal(t, int32(1), calls.Load(), "reset endpoint should be called after confirmation")
+		must.Contains(t, out.String(), "Emulator state reset")
+		must.Eq(t, int32(1), calls.Load(), "reset endpoint should be called after confirmation")
 	})
 
 	t.Run("cancels with n", func(t *testing.T) {
 		srv, calls := mockResetServer(t, http.StatusOK)
 		ptmx, out, outputCh, cmd := startReset(t, srv)
 		_, err := ptmx.Write([]byte("n"))
-		require.NoError(t, err)
-		require.NoError(t, cmd.Wait())
+		must.NoError(t, err)
+		must.NoError(t, cmd.Wait())
 		<-outputCh
 
-		assert.Contains(t, out.String(), "Cancelled")
-		assert.Equal(t, int32(0), calls.Load(), "reset endpoint must not be called when user cancels")
+		must.Contains(t, out.String(), "Cancelled")
+		must.Eq(t, int32(0), calls.Load(), "reset endpoint must not be called when user cancels")
 	})
 }
 
@@ -214,13 +213,13 @@ func TestResetJSONSucceeds(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"reset", "--force", "--json",
 	)
-	require.NoError(t, err, "lstk reset --json failed: %s", stderr)
+	must.NoError(t, err, "lstk reset --json failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Equal(t, int32(1), calls.Load(), "reset endpoint should be called exactly once")
+	must.Eq(t, int32(1), calls.Load(), "reset endpoint should be called exactly once")
 
 	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "ok", envelope.Status)
-	assert.Equal(t, "reset", envelope.Command)
+	must.Eq(t, "ok", envelope.Status)
+	must.Eq(t, "reset", envelope.Command)
 
 	var data struct {
 		Emulator struct {
@@ -229,9 +228,9 @@ func TestResetJSONSucceeds(t *testing.T) {
 		} `json:"emulator"`
 		Reset bool `json:"reset"`
 	}
-	require.NoError(t, json.Unmarshal(envelope.Data, &data))
-	assert.Equal(t, "aws", data.Emulator.Type)
-	assert.True(t, data.Reset)
+	must.NoError(t, json.Unmarshal(envelope.Data, &data))
+	must.Eq(t, "aws", data.Emulator.Type)
+	must.True(t, data.Reset)
 }
 
 func TestResetJSONRequiresConfirmation(t *testing.T) {
@@ -248,11 +247,11 @@ func TestResetJSONRequiresConfirmation(t *testing.T) {
 	requireExitCode(t, 3, err)
 
 	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "error", envelope.Status)
-	require.NotNil(t, envelope.Error)
-	assert.Equal(t, "CONFIRMATION_REQUIRED", envelope.Error.Code)
-	assert.Equal(t, "USAGE", envelope.Error.Category)
-	assert.False(t, envelope.Error.Retryable)
+	must.Eq(t, "error", envelope.Status)
+	must.NotNil(t, envelope.Error)
+	must.Eq(t, "CONFIRMATION_REQUIRED", envelope.Error.Code)
+	must.Eq(t, "USAGE", envelope.Error.Category)
+	must.False(t, envelope.Error.Retryable)
 }
 
 func TestResetJSONNotConfigured(t *testing.T) {
@@ -267,8 +266,8 @@ func TestResetJSONNotConfigured(t *testing.T) {
 	requireExitCode(t, 1, err)
 
 	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "error", envelope.Status)
-	require.NotNil(t, envelope.Error)
-	assert.Equal(t, "EMULATOR_NOT_CONFIGURED", envelope.Error.Code)
-	assert.Equal(t, "EMULATOR", envelope.Error.Category)
+	must.Eq(t, "error", envelope.Status)
+	must.NotNil(t, envelope.Error)
+	must.Eq(t, "EMULATOR_NOT_CONFIGURED", envelope.Error.Code)
+	must.Eq(t, "EMULATOR", envelope.Error.Category)
 }
diff --git a/test/integration/restart_test.go b/test/integration/restart_test.go
index 5b00744b..c0360485 100644
--- a/test/integration/restart_test.go
+++ b/test/integration/restart_test.go
@@ -3,10 +3,9 @@ package integration_test
 import (
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestRestartCommandSucceeds(t *testing.T) {
@@ -21,28 +20,30 @@ func TestRestartCommandSucceeds(t *testing.T) {
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL).With(env.AnalyticsEndpoint, analyticsSrv.URL), "restart")
-	require.NoError(t, err, "lstk restart failed: %s", stderr)
+	must.NoError(t, err, "lstk restart failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "stopped")
-	assert.Contains(t, stdout, "LocalStack")
+	must.Contains(t, stdout, "stopped")
+	must.Contains(t, stdout, "LocalStack")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container after restart")
-	assert.True(t, inspect.Container.State.Running, "container should be running after restart")
+	must.NoError(t, err, "failed to inspect container after restart")
+	must.True(t, inspect.Container.State.Running, "container should be running after restart")
 
 	// Both lstk_lifecycle (stop + start) and lstk_command events should be emitted.
 	byName := collectTelemetryByName(t, events, 2)
-	assert.Contains(t, byName, "lstk_lifecycle")
-	if cmdEvent, ok := byName["lstk_command"]; assert.True(t, ok, "lstk_command event not received") {
+	must.Contains(t, byName, "lstk_lifecycle")
+	cmdEvent, ok := byName["lstk_command"]
+	must.True(t, ok, "lstk_command event not received")
+	{
 		payload, _ := cmdEvent["payload"].(map[string]any)
 		params, _ := payload["parameters"].(map[string]any)
-		assert.Equal(t, "restart", params["command"])
+		must.Eq(t, "restart", params["command"])
 		result, _ := payload["result"].(map[string]any)
-		assert.InDelta(t, 0, result["exit_code"], 0)
+		must.InDelta(t, 0, result["exit_code"], 0)
 	}
 }
 
@@ -63,13 +64,13 @@ func TestRestartCommandRejectsAmbientEndpointURLEvenWithLocalContainerRunning(t
 	startTestContainer(t, ctx)
 
 	stdout, _, err := runLstk(t, ctx, "", env.With(env.DisableEvents, "1").With("LSTK_ENDPOINT_URL", "http://127.0.0.1:1"), "restart")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
-	assert.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
+	must.Error(t, err)
+	must.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	must.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "container should still exist — restart must reject before stopping/restarting it")
-	assert.True(t, inspect.Container.State.Running, "container should still be running, untouched")
+	must.NoError(t, err, "container should still exist — restart must reject before stopping/restarting it")
+	must.True(t, inspect.Container.State.Running, "container should still be running, untouched")
 }
 
 func TestRestartCommandPersistFlagSetsPersistenceEnv(t *testing.T) {
@@ -84,18 +85,18 @@ func TestRestartCommandPersistFlagSetsPersistenceEnv(t *testing.T) {
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 
 	_, stderr, err = runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "restart", "--persist")
-	require.NoError(t, err, "lstk restart --persist failed: %s", stderr)
+	must.NoError(t, err, "lstk restart --persist failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container after restart")
-	require.True(t, inspect.Container.State.Running)
+	must.NoError(t, err, "failed to inspect container after restart")
+	must.True(t, inspect.Container.State.Running)
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	assert.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
+	must.Eq(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
 }
 
 func TestRestartCommandPreservesPersistenceWithoutFlag(t *testing.T) {
@@ -110,19 +111,19 @@ func TestRestartCommandPreservesPersistenceWithoutFlag(t *testing.T) {
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start", "--persist")
-	require.NoError(t, err, "lstk start --persist failed: %s", stderr)
+	must.NoError(t, err, "lstk start --persist failed: %s", stderr)
 
 	// Restart without --persist should carry the setting forward from the running instance.
 	_, stderr, err = runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "restart")
-	require.NoError(t, err, "lstk restart failed: %s", stderr)
+	must.NoError(t, err, "lstk restart failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container after restart")
-	require.True(t, inspect.Container.State.Running)
+	must.NoError(t, err, "failed to inspect container after restart")
+	must.True(t, inspect.Container.State.Running)
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	assert.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
+	must.Eq(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
 }
 
 func TestRestartCommandFailsWhenNotRunning(t *testing.T) {
@@ -132,8 +133,8 @@ func TestRestartCommandFailsWhenNotRunning(t *testing.T) {
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "restart")
-	require.Error(t, err, "expected lstk restart to fail when emulator is not running")
+	must.Error(t, err, "expected lstk restart to fail when emulator is not running")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "LocalStack AWS Emulator is not running")
+	must.Contains(t, stdout, "LocalStack AWS Emulator is not running")
 	assertCommandTelemetry(t, events, "restart", 1)
 }
diff --git a/test/integration/sam_cmd_test.go b/test/integration/sam_cmd_test.go
index f7140a56..8f5057f4 100644
--- a/test/integration/sam_cmd_test.go
+++ b/test/integration/sam_cmd_test.go
@@ -8,9 +8,9 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // writeFakeSAM creates a stub `sam` that answers `--version` with the given
@@ -38,7 +38,7 @@ echo "ENV_AWS_PROFILE=${AWS_PROFILE:-<unset>}"
 echo "ENV_AWS_DEFAULT_PROFILE=${AWS_DEFAULT_PROFILE:-<unset>}"
 echo "ENV_AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN:-<unset>}"
 `, version)
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "sam"), []byte(script), 0755))
+	must.NoError(t, os.WriteFile(filepath.Join(dir, "sam"), []byte(script), 0755))
 	return dir
 }
 
@@ -55,7 +55,7 @@ if [ "$1" = "--version" ]; then echo "SAM CLI, version 1.95.0"; exit 0; fi
 echo "sam: simulated failure" >&2
 exit %d
 `, code)
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "sam"), []byte(script), 0755))
+	must.NoError(t, os.WriteFile(filepath.Join(dir, "sam"), []byte(script), 0755))
 	return dir
 }
 
@@ -66,8 +66,8 @@ func TestSAMForwardsArgs(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:build")
+	must.NoError(t, err, "stderr: %s", stderr)
+	must.Contains(t, stdout, "ARGS:build")
 }
 
 // propagates the sam exit code.
@@ -77,8 +77,8 @@ func TestSAMPropagatesExitCode(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
-	require.Error(t, err)
-	assert.Contains(t, stderr, "simulated failure")
+	must.Error(t, err)
+	must.Contains(t, stderr, "simulated failure")
 	requireExitCode(t, 7, err)
 }
 
@@ -95,22 +95,13 @@ func TestSAMInjectsCleanAWSEnv(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"sam", "--region", "eu-west-1", "--account", "111111111111", "build")
-	require.NoError(t, err, "stderr: %s", stderr)
-
-	assert.Contains(t, stdout, "ENV_AWS_ENDPOINT_URL=http")
-	assert.Contains(t, stdout, ":4566")
-	// SAM reads AWS_DEFAULT_REGION; lstk sets both region vars.
-	assert.Contains(t, stdout, "ENV_AWS_REGION=eu-west-1")
-	assert.Contains(t, stdout, "ENV_AWS_DEFAULT_REGION=eu-west-1")
-	// A custom --account flows through to AWS_ACCESS_KEY_ID (Terraform model).
-	assert.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=111111111111")
-	assert.Contains(t, stdout, "ENV_AWS_SECRET_ACCESS_KEY=test")
-	// lstk never sets an S3-specific endpoint for SAM.
-	assert.Contains(t, stdout, "ENV_AWS_ENDPOINT_URL_S3=<unset>")
-	// Ambient AWS config is stripped.
-	assert.Contains(t, stdout, "ENV_AWS_PROFILE=<unset>")
-	assert.Contains(t, stdout, "ENV_AWS_DEFAULT_PROFILE=<unset>")
-	assert.Contains(t, stdout, "ENV_AWS_SESSION_TOKEN=<unset>")
+	must.NoError(t, err, "stderr: %s", stderr)
+
+	// The snapshot pins the full env contract: endpoint scheme+port (host is
+	// DNS-dependent, masked), both region vars, --account in the access key
+	// (Terraform model), no S3-specific endpoint, and ambient AWS config
+	// (profile/session token) stripped to <unset>.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // offline subcommands run without a running emulator, even with a leading
@@ -126,10 +117,10 @@ func TestSAMOfflineCommandsNoEmulator(t *testing.T) {
 
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 				"sam", "--region", "us-west-2", sub)
-			require.NoError(t, err, "stderr: %s", stderr)
+			must.NoError(t, err, "stderr: %s", stderr)
 
-			assert.Contains(t, stdout, "ARGS:"+sub)
-			assert.NotContains(t, stdout, "--region")
+			must.Contains(t, stdout, "ARGS:"+sub)
+			must.NotContains(t, stdout, "--region")
 		})
 	}
 }
@@ -147,8 +138,8 @@ func TestSAMHelpNoEmulator(t *testing.T) {
 
 			cmdArgs := append([]string{"sam"}, args...)
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, cmdArgs...)
-			require.NoError(t, err, "stderr: %s", stderr)
-			assert.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
+			must.NoError(t, err, "stderr: %s", stderr)
+			must.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
 		})
 	}
 }
@@ -160,10 +151,10 @@ func TestSAMVersionTooOld(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
-	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "1.95.0")
+	must.Error(t, err)
+	must.Contains(t, stderr+stdout, "1.95.0")
 	// sam was never run for real.
-	assert.NotContains(t, stdout, "ARGS:build")
+	must.NotContains(t, stdout, "ARGS:build")
 }
 
 // a missing sam binary yields the install error.
@@ -172,8 +163,8 @@ func TestSAMMissingBinary(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
-	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "not found in PATH")
+	must.Error(t, err)
+	must.Contains(t, stderr+stdout, "not found in PATH")
 }
 
 // --account is supported for sam (unlike cdk): a valid 12-digit value is
@@ -185,8 +176,8 @@ func TestSAMAccountSupported(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"sam", "--account", "123456789012", "build")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=123456789012")
+	must.NoError(t, err, "stderr: %s", stderr)
+	must.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=123456789012")
 }
 
 // an invalid --account value is rejected at the command boundary before sam runs.
@@ -197,9 +188,9 @@ func TestSAMInvalidAccountRejected(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"sam", "--account", "12345", "build")
-	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "12-digit")
-	assert.NotContains(t, stdout, "ARGS:build")
+	must.Error(t, err)
+	must.Contains(t, stderr+stdout, "12-digit")
+	must.NotContains(t, stdout, "ARGS:build")
 }
 
 // flags after the subcommand are forwarded to sam unchanged.
@@ -210,8 +201,8 @@ func TestSAMFlagsAfterActionAreForwarded(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"sam", "build", "--region", "us-west-2")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:build --region us-west-2")
+	must.NoError(t, err, "stderr: %s", stderr)
+	must.Contains(t, stdout, "ARGS:build --region us-west-2")
 }
 
 // a flag before the subcommand is rejected with a clear message.
@@ -222,8 +213,8 @@ func TestSAMFlagBeforeSubcommandRejected(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--account", "111111111111", "sam", "build")
-	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "must appear after the sam subcommand")
+	must.Error(t, err)
+	must.Contains(t, stderr+stdout, "must appear after the sam subcommand")
 }
 
 // LSTK_SAM_CMD selects the binary to invoke.
@@ -233,14 +224,14 @@ func TestSAMHonorsLstkSamCmd(t *testing.T) {
 		t.Skip("fake sam script not supported on Windows")
 	}
 	dir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "mysam"),
+	must.NoError(t, os.WriteFile(filepath.Join(dir, "mysam"),
 		[]byte("#!/bin/sh\nif [ \"$1\" = \"--version\" ]; then echo \"SAM CLI, version 1.95.0\"; exit 0; fi\necho \"MYSAM:$*\"\n"), 0755))
 	e := env.With(env.DisableEvents, "1").With("PATH", dir).With(env.Home, t.TempDir()).
 		With(env.Key("LSTK_SAM_CMD"), "mysam")
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "MYSAM:build")
+	must.NoError(t, err, "stderr: %s", stderr)
+	must.Contains(t, stdout, "MYSAM:build")
 }
 
 // an AWS-contacting command with no running emulator fails with "not running"
@@ -254,10 +245,10 @@ func TestSAMFailsWhenEmulatorNotRunning(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "deploy")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "is not running")
-	assert.Contains(t, stdout, "Start LocalStack:")
-	assert.NotContains(t, stdout, "ARGS:deploy")
+	must.Error(t, err)
+	must.Contains(t, stdout, "is not running")
+	must.Contains(t, stdout, "Start LocalStack:")
+	must.NotContains(t, stdout, "ARGS:deploy")
 }
 
 // an AWS-contacting command fails with an AWS-specific error naming the running
@@ -276,10 +267,10 @@ func TestSAMRequiresAWSEmulator(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), e, "sam", "deploy")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "requires the")
-	assert.Contains(t, stdout, "Snowflake")
-	assert.NotContains(t, stdout, "ARGS:deploy")
+	must.Error(t, err)
+	must.Contains(t, stdout, "requires the")
+	must.Contains(t, stdout, "Snowflake")
+	must.NotContains(t, stdout, "ARGS:deploy")
 }
 
 // The region must reach SAM on its command line, not only through AWS_REGION.
@@ -295,11 +286,11 @@ func TestSAMPutsSelectedRegionOnTheCommandLine(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "sam", "--region", "ap-northeast-1", "--account", "121212122323", "deploy")
-	require.NoError(t, err, "stderr: %s", stderr)
+	must.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "--region ap-northeast-1", "the region must be on sam's command line")
-	assert.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
-	assert.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=121212122323")
+	must.Contains(t, stdout, "--region ap-northeast-1", "the region must be on sam's command line")
+	must.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
+	must.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=121212122323")
 }
 
 // Without lstk's --region there is nothing to assert over samconfig.toml, so
@@ -313,11 +304,11 @@ func TestSAMDoesNotInjectRegionWhenNotSelected(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "sam", "deploy")
-	require.NoError(t, err, "stderr: %s", stderr)
+	must.NoError(t, err, "stderr: %s", stderr)
 
-	assert.NotContains(t, stdout, "--region")
+	must.NotContains(t, stdout, "--region")
 	// The environment still carries the default, as before.
-	assert.Contains(t, stdout, "ENV_AWS_REGION=us-east-1")
+	must.Contains(t, stdout, "ENV_AWS_REGION=us-east-1")
 }
 
 // An ambient AWS_REGION is used but is not a selection: it is commonly exported
@@ -331,10 +322,10 @@ func TestSAMDoesNotInjectAmbientRegion(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "sam", "deploy")
-	require.NoError(t, err, "stderr: %s", stderr)
+	must.NoError(t, err, "stderr: %s", stderr)
 
-	assert.NotContains(t, stdout, "--region")
-	assert.Contains(t, stdout, "ENV_AWS_REGION=eu-west-1")
+	must.NotContains(t, stdout, "--region")
+	must.Contains(t, stdout, "ENV_AWS_REGION=eu-west-1")
 }
 
 // Offline subcommands never get the flag: `init` and `docs` reject --region
@@ -346,11 +337,11 @@ func TestSAMDoesNotInjectRegionForOfflineSubcommand(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"sam", "--region", "ap-northeast-1", "build")
-	require.NoError(t, err, "stderr: %s", stderr)
+	must.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "ARGS:build")
-	assert.NotContains(t, stdout, "--region")
-	assert.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
+	must.Contains(t, stdout, "ARGS:build")
+	must.NotContains(t, stdout, "--region")
+	must.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
 }
 
 // A --region the user addressed to sam directly wins: appending lstk's after it
@@ -363,11 +354,11 @@ func TestSAMLeavesUserSuppliedRegionFlagAlone(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "sam", "--region", "ap-northeast-1", "deploy", "--region", "us-west-1")
-	require.NoError(t, err, "stderr: %s", stderr)
+	must.NoError(t, err, "stderr: %s", stderr)
 
 	// Pinned to the whole ARGS line: lstk must not append a second --region.
-	assert.Contains(t, stdout, "ARGS:deploy --region us-west-1\n")
+	must.Contains(t, stdout, "ARGS:deploy --region us-west-1\n")
 	// The environment still carries lstk's resolved region, as it always has;
 	// sam's own command-line flag is what outranks it.
-	assert.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
+	must.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
 }
diff --git a/test/integration/sam_e2e_test.go b/test/integration/sam_e2e_test.go
index 05108e38..7845003a 100644
--- a/test/integration/sam_e2e_test.go
+++ b/test/integration/sam_e2e_test.go
@@ -7,9 +7,8 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // End-to-end tests for `lstk sam` that exercise the real AWS SAM CLI against a
@@ -38,7 +37,7 @@ func copySAMSample(t *testing.T, name string) string {
 	t.Helper()
 	work := t.TempDir()
 	src := filepath.Join("test-samples", "iac", "sam", name)
-	require.NoError(t, os.CopyFS(work, os.DirFS(src)))
+	must.NoError(t, os.CopyFS(work, os.DirFS(src)))
 	return work
 }
 
@@ -64,7 +63,7 @@ func TestSAME2EValidateOffline(t *testing.T) {
 	e := samE2EEnv(t)
 
 	_, stderr, err := runSAM(t, ctx, work, e, "validate", "--lint")
-	require.NoError(t, err, "sam validate stderr: %s", stderr)
+	must.NoError(t, err, "sam validate stderr: %s", stderr)
 }
 
 // `sam deploy` of a single function succeeds against LocalStack, and `sam delete`
@@ -86,11 +85,11 @@ func TestSAME2EDeployDelete(t *testing.T) {
 	_, stderr, err := runSAM(t, ctx, work, e, "deploy",
 		"--stack-name", stack, "--resolve-s3", "--no-confirm-changeset",
 		"--no-fail-on-empty-changeset", "--capabilities", "CAPABILITY_IAM", "--region", "us-east-1")
-	require.NoError(t, err, "sam deploy stderr: %s", stderr)
+	must.NoError(t, err, "sam deploy stderr: %s", stderr)
 
 	_, stderr, err = runSAM(t, ctx, work, e, "delete",
 		"--stack-name", stack, "--no-prompts", "--region", "us-east-1")
-	require.NoError(t, err, "sam delete stderr: %s", stderr)
+	must.NoError(t, err, "sam delete stderr: %s", stderr)
 }
 
 // `sam deploy --account <id>` lands the stack under that LocalStack account: the
@@ -113,14 +112,14 @@ func TestSAME2EDeployCustomAccount(t *testing.T) {
 	_, stderr, err := runSAM(t, ctx, work, e, "--account", account, "deploy",
 		"--stack-name", stack, "--resolve-s3", "--no-confirm-changeset",
 		"--no-fail-on-empty-changeset", "--capabilities", "CAPABILITY_IAM", "--region", "us-east-1")
-	require.NoError(t, err, "sam deploy stderr: %s", stderr)
+	must.NoError(t, err, "sam deploy stderr: %s", stderr)
 
 	stdout, stderr, err := runSAM(t, ctx, work, e, "--account", account, "list", "stack-outputs",
 		"--stack-name", stack, "--output", "json", "--region", "us-east-1")
-	require.NoError(t, err, "sam list stack-outputs stderr: %s", stderr)
-	assert.Contains(t, stdout, account, "function ARN should carry the custom account id")
+	must.NoError(t, err, "sam list stack-outputs stderr: %s", stderr)
+	must.Contains(t, stdout, account, "function ARN should carry the custom account id")
 
 	_, stderr, err = runSAM(t, ctx, work, e, "--account", account, "delete",
 		"--stack-name", stack, "--no-prompts", "--region", "us-east-1")
-	require.NoError(t, err, "sam delete stderr: %s", stderr)
+	must.NoError(t, err, "sam delete stderr: %s", stderr)
 }
diff --git a/test/integration/setup_azure_test.go b/test/integration/setup_azure_test.go
index d5dbf61a..12f29520 100644
--- a/test/integration/setup_azure_test.go
+++ b/test/integration/setup_azure_test.go
@@ -10,9 +10,8 @@ import (
 	"testing"
 
 	"github.com/creack/pty"
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func requireAzCLI(t *testing.T) {
@@ -30,7 +29,7 @@ func requireAzCLI(t *testing.T) {
 func azTempHome(t *testing.T) string {
 	t.Helper()
 	dir, err := os.MkdirTemp("", "lstk-az-home-")
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() { _ = os.RemoveAll(dir) })
 	return dir
 }
@@ -45,8 +44,8 @@ func azureWorkDir(t *testing.T) string {
 	t.Helper()
 	workDir := t.TempDir()
 	lstkDir := filepath.Join(workDir, ".lstk")
-	require.NoError(t, os.MkdirAll(lstkDir, 0755))
-	require.NoError(t, os.WriteFile(filepath.Join(lstkDir, "config.toml"), []byte(`
+	must.NoError(t, os.MkdirAll(lstkDir, 0755))
+	must.NoError(t, os.WriteFile(filepath.Join(lstkDir, "config.toml"), []byte(`
 [[containers]]
 type = "azure"
 tag  = "latest"
@@ -58,8 +57,8 @@ port = "4566"
 func writeAzureSetupMarker(t *testing.T, workDir string) {
 	t.Helper()
 	dir := filepath.Join(workDir, ".lstk", "azure")
-	require.NoError(t, os.MkdirAll(dir, 0700))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, ".lstk-setup-complete"), []byte("ok\n"), 0600))
+	must.NoError(t, os.MkdirAll(dir, 0700))
+	must.NoError(t, os.WriteFile(filepath.Join(dir, ".lstk-setup-complete"), []byte("ok\n"), 0600))
 }
 
 func TestAzCommandErrorsWhenNotSetUp(t *testing.T) {
@@ -70,10 +69,10 @@ func TestAzCommandErrorsWhenNotSetUp(t *testing.T) {
 		env.With(env.Home, t.TempDir()),
 		"az", "group", "list",
 	)
-	require.Error(t, err)
+	must.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Azure CLI integration is not set up")
-	assert.Contains(t, stdout, "lstk setup azure")
+	must.Contains(t, stdout, "Azure CLI integration is not set up")
+	must.Contains(t, stdout, "lstk setup azure")
 }
 
 // Non-interactive mode must not be rejected upfront (CI use case): with no
@@ -86,9 +85,9 @@ func TestSetupAzureNonInteractiveRunsWithoutTerminal(t *testing.T) {
 		env.With(env.Home, t.TempDir()),
 		"setup", "azure",
 	)
-	require.Error(t, err)
-	assert.Contains(t, stderr, "no azure emulator configured")
-	assert.NotContains(t, stderr, "interactive terminal")
+	must.Error(t, err)
+	must.Contains(t, stderr, "no azure emulator configured")
+	must.NotContains(t, stderr, "interactive terminal")
 }
 
 // `lstk setup az` must resolve to `setup azure`: the Azure tool-proxy command
@@ -102,9 +101,9 @@ func TestSetupAzureAliasAz(t *testing.T) {
 		env.With(env.Home, t.TempDir()),
 		"setup", "az",
 	)
-	require.Error(t, err)
-	assert.NotContains(t, stderr, "unknown command")
-	assert.Contains(t, stderr, "no azure emulator configured")
+	must.Error(t, err)
+	must.NotContains(t, stderr, "unknown command")
+	must.Contains(t, stderr, "no azure emulator configured")
 }
 
 // When the az CLI is missing, the error must be reported exactly once —
@@ -117,10 +116,10 @@ func TestSetupAzureReportsMissingAzCLIOnce(t *testing.T) {
 		env.With(env.Home, t.TempDir()).With("PATH", t.TempDir()),
 		"setup", "azure",
 	)
-	require.Error(t, err)
-	assert.Contains(t, stderr, "az CLI not found in PATH")
+	must.Error(t, err)
+	must.Contains(t, stderr, "az CLI not found in PATH")
 	combined := stdout + stderr
-	assert.Equal(t, 1, strings.Count(combined, "az CLI not found in PATH"),
+	must.Eq(t, 1, strings.Count(combined, "az CLI not found in PATH"),
 		"missing az CLI must be reported exactly once, got:\n%s", combined)
 }
 
@@ -139,10 +138,10 @@ func TestAzCommandErrorsWhenEmulatorNotRunning(t *testing.T) {
 		env.With(env.Home, t.TempDir()),
 		"az", "group", "list",
 	)
-	require.Error(t, err)
+	must.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "is not running")
-	assert.Contains(t, stdout, "Start LocalStack")
+	must.Contains(t, stdout, "is not running")
+	must.Contains(t, stdout, "Start LocalStack")
 }
 
 // TestSetupAzureAndAzCommandSucceed requires Docker, the Azure CLI, and LOCALSTACK_AUTH_TOKEN.
@@ -180,15 +179,15 @@ func TestSetupAzureAndAzCommandSucceed(t *testing.T) {
 		baseEnv.With(env.APIEndpoint, mockServer.URL),
 		"start",
 	)
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 
 	binPath, err := filepath.Abs(binaryPath())
-	require.NoError(t, err)
+	must.NoError(t, err)
 	cmd := exec.CommandContext(ctx, binPath, "setup", "azure")
 	cmd.Dir = workDir
 	cmd.Env = baseEnv.With(env.APIEndpoint, mockServer.URL)
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start setup azure in PTY")
+	must.NoError(t, err, "failed to start setup azure in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	out := &syncBuffer{}
@@ -197,13 +196,13 @@ func TestSetupAzureAndAzCommandSucceed(t *testing.T) {
 		_, _ = io.Copy(out, ptmx)
 		close(outputCh)
 	}()
-	require.NoError(t, cmd.Wait(), "setup azure should succeed; output:\n%s", out.String())
+	must.NoError(t, cmd.Wait(), "setup azure should succeed; output:\n%s", out.String())
 	<-outputCh
-	assert.Contains(t, out.String(), "Azure CLI integration ready")
+	must.Contains(t, out.String(), "Azure CLI integration ready")
 
 	markerPath := filepath.Join(workDir, ".lstk", "azure", ".lstk-setup-complete")
 	_, err = os.Stat(markerPath)
-	require.NoError(t, err, "marker file should be written on successful setup")
+	must.NoError(t, err, "marker file should be written on successful setup")
 
 	// `az cloud show` reads the isolated config dir locally, so the assertion
 	// doesn't depend on emulator-side behaviour for any specific Azure service.
@@ -211,8 +210,8 @@ func TestSetupAzureAndAzCommandSucceed(t *testing.T) {
 		baseEnv.With(env.APIEndpoint, mockServer.URL),
 		"az", "cloud", "show", "--name", "LocalStack",
 	)
-	require.NoError(t, err, "lstk az cloud show failed: %s", stderr2)
-	assert.Contains(t, stdout, "azure.localhost.localstack.cloud:4566",
+	must.NoError(t, err, "lstk az cloud show failed: %s", stderr2)
+	must.Contains(t, stdout, "azure.localhost.localstack.cloud:4566",
 		"registered cloud should expose the LocalStack Azure endpoint")
 
 	// Setup must also work without a terminal (CI use case): runLstk uses
@@ -222,6 +221,6 @@ func TestSetupAzureAndAzCommandSucceed(t *testing.T) {
 		baseEnv.With(env.APIEndpoint, mockServer.URL),
 		"setup", "azure",
 	)
-	require.NoError(t, err, "non-interactive setup azure failed: stdout=%s stderr=%s", stdoutNI, stderrNI)
-	assert.Contains(t, stdoutNI, "Azure CLI integration ready")
+	must.NoError(t, err, "non-interactive setup azure failed: stdout=%s stderr=%s", stdoutNI, stderrNI)
+	must.Contains(t, stdoutNI, "Azure CLI integration ready")
 }
diff --git a/test/integration/signal_forwarding_test.go b/test/integration/signal_forwarding_test.go
index c641024d..b91d2c1e 100644
--- a/test/integration/signal_forwarding_test.go
+++ b/test/integration/signal_forwarding_test.go
@@ -13,7 +13,7 @@ import (
 	"time"
 
 	"github.com/creack/pty"
-	"github.com/stretchr/testify/require"
+	"github.com/localstack/lstk/internal/must"
 )
 
 // These tests cover proc.Run's signal handling for wrapped tools end to end,
@@ -30,7 +30,7 @@ func startSignalWait(t *testing.T, wire func(*exec.Cmd)) *exec.Cmd {
 	installExtension(t, extDir, "sig")
 
 	binPath, err := filepath.Abs(binaryPath())
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	cmd := exec.CommandContext(testContext(t), binPath, "sig", "signal-wait")
 	cmd.Dir = t.TempDir()
@@ -87,10 +87,10 @@ func TestWrappedToolReceivesForwardedSignalNonInteractive(t *testing.T) {
 				c.Stdout = out
 				c.Stderr = out
 			})
-			require.NoError(t, cmd.Start())
+			must.NoError(t, cmd.Start())
 
 			waitForMarker(t, out)
-			require.NoError(t, cmd.Process.Signal(tc.sig))
+			must.NoError(t, cmd.Process.Signal(tc.sig))
 
 			err := cmd.Wait()
 			requireExitCode(t, 41, err)
@@ -107,12 +107,12 @@ func TestWrappedToolReceivesForwardedSIGTERMInTerminal(t *testing.T) {
 	var ptmx *os.File
 	cmd := startSignalWait(t, func(c *exec.Cmd) {})
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err)
+	must.NoError(t, err)
 	defer func() { _ = ptmx.Close() }()
 
 	out, copied := drainPTY(ptmx)
 	waitForMarker(t, out)
-	require.NoError(t, cmd.Process.Signal(syscall.SIGTERM))
+	must.NoError(t, cmd.Process.Signal(syscall.SIGTERM))
 
 	err = cmd.Wait()
 	<-copied
@@ -127,13 +127,13 @@ func TestWrappedToolSingleSIGINTOnCtrlCInTerminal(t *testing.T) {
 	t.Parallel()
 	cmd := startSignalWait(t, func(c *exec.Cmd) {})
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err)
+	must.NoError(t, err)
 	defer func() { _ = ptmx.Close() }()
 
 	out, copied := drainPTY(ptmx)
 	waitForMarker(t, out)
 	_, err = ptmx.Write([]byte{0x03}) // Ctrl-C → SIGINT to the foreground process group
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	err = cmd.Wait()
 	<-copied
@@ -148,11 +148,11 @@ func TestWrappedToolSingleSIGINTOnCtrlCInTerminal(t *testing.T) {
 func TestWrappedToolSingleSIGINTOnCtrlCWithRedirectedStdin(t *testing.T) {
 	t.Parallel()
 	ptmx, tty, err := pty.Open()
-	require.NoError(t, err)
+	must.NoError(t, err)
 	defer func() { _ = ptmx.Close() }()
 
 	devNull, err := os.Open(os.DevNull)
-	require.NoError(t, err)
+	must.NoError(t, err)
 	defer func() { _ = devNull.Close() }()
 
 	cmd := startSignalWait(t, func(c *exec.Cmd) {
@@ -163,13 +163,13 @@ func TestWrappedToolSingleSIGINTOnCtrlCWithRedirectedStdin(t *testing.T) {
 		// foreground process group, exactly like a real interactive session.
 		c.SysProcAttr = &syscall.SysProcAttr{Setsid: true, Setctty: true, Ctty: 1}
 	})
-	require.NoError(t, cmd.Start())
+	must.NoError(t, cmd.Start())
 	_ = tty.Close() // child holds its own copy of the slave side
 
 	out, copied := drainPTY(ptmx)
 	waitForMarker(t, out)
 	_, err = ptmx.Write([]byte{0x03}) // Ctrl-C → SIGINT to the foreground process group
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	err = cmd.Wait()
 	<-copied
diff --git a/test/integration/snap_sanitize_test.go b/test/integration/snap_sanitize_test.go
new file mode 100644
index 00000000..3d7d6378
--- /dev/null
+++ b/test/integration/snap_sanitize_test.go
@@ -0,0 +1,59 @@
+package integration_test
+
+import (
+	"regexp"
+	"strings"
+)
+
+// snap.Match has no masking hook (snap.MatchJSON's dotted paths are JSON
+// only), so CLI output is passed through sanitizeOutput before snapshotting.
+// Patterns are anchored on stable context (label, host, filename prefix)
+// rather than value-shaped: Go's RE2 has no lookahead, and a bare
+// number/semver pattern would corrupt neighbouring text such as IPv4
+// addresses. Add a rule here when a new volatile value shows up in
+// snapshot output.
+var (
+	// httptest servers listen on a random localhost port.
+	sanitizePortRe = regexp.MustCompile(`(https?://127\.0\.0\.1):\d+`)
+	// Release asset names embed the host platform (lstk_0.0.2_darwin_arm64.tar.gz).
+	sanitizeAssetRe = regexp.MustCompile(`\blstk_([^_\s]+)_[a-z0-9]+_[a-z0-9]+(\.tar\.gz|\.zip)`)
+	// Rendered instance info lines with per-run values.
+	sanitizeVersionRe = regexp.MustCompile(`(Version: )\S+`)
+	sanitizeUptimeRe  = regexp.MustCompile(`(?m)(Uptime: ).+$`)
+	// The emulator endpoint host depends on whether localhost.localstack.cloud
+	// resolves in the environment; scheme and port stay pinned.
+	sanitizeEndpointHostRe = regexp.MustCompile(`(ENV_AWS_ENDPOINT_URL(?:_S3)?=https?://)[^:\s]+`)
+	// Any URL pointing at the default gateway port (terraform override
+	// endpoints, rendered endpoint lines) — anchored on :4566 so it can't
+	// touch unrelated URLs.
+	sanitizeGatewayHostRe = regexp.MustCompile(`(https?://)[^:"\s]+(:4566)`)
+	// Rendered snapshot metadata: timestamps ("2026-04-15 14:32 UTC"),
+	// human-readable sizes ("47.3 MB"), and LocalStack calendar versions
+	// ("2026.03"). Fixture-driven today, but masked so fixture tweaks don't
+	// churn snapshots.
+	sanitizeDateRe   = regexp.MustCompile(`\d{4}-\d{2}-\d{2} \d{2}:\d{2} UTC`)
+	sanitizeSizeRe   = regexp.MustCompile(`\b\d+(?:\.\d+)? (?:B|KB|MB|GB)\b`)
+	sanitizeCalverRe = regexp.MustCompile(`\b20\d{2}\.\d{2}\b`)
+	// Reference-extension echo lines carrying temp paths or random ids.
+	sanitizeExtPathRe = regexp.MustCompile(`(?m)^(SELF=|CONFIG_DIR=).*$`)
+	sanitizeExtIDRe   = regexp.MustCompile(`(?m)^(SESSION_ID=).*$`)
+)
+
+func sanitizeOutput(s string) string {
+	s = strings.ReplaceAll(s, "\r\n", "\n")
+	s = sanitizePortRe.ReplaceAllString(s, "${1}:<port>")
+	s = sanitizeAssetRe.ReplaceAllString(s, "lstk_${1}_<platform>${2}")
+	s = sanitizeVersionRe.ReplaceAllString(s, "${1}<version>")
+	s = sanitizeUptimeRe.ReplaceAllString(s, "${1}<time>")
+	s = sanitizeEndpointHostRe.ReplaceAllString(s, "${1}<host>")
+	s = sanitizeGatewayHostRe.ReplaceAllString(s, "${1}<endpoint-host>${2}")
+	s = sanitizeExtPathRe.ReplaceAllString(s, "${1}<path>")
+	s = sanitizeExtIDRe.ReplaceAllString(s, "${1}<id>")
+	s = sanitizeDateRe.ReplaceAllString(s, "<date>")
+	s = sanitizeSizeRe.ReplaceAllString(s, "<size>")
+	s = sanitizeCalverRe.ReplaceAllString(s, "<calver>")
+	// Wrapped-tool env dumps echo GOOS-dependent endpoint hosts.
+	s = strings.ReplaceAll(s, "host.docker.internal", "<endpoint-host>")
+	s = strings.ReplaceAll(s, "localhost.localstack.cloud", "<endpoint-host>")
+	return s
+}
diff --git a/test/integration/snapshot_experimental_test.go b/test/integration/snapshot_experimental_test.go
index 45b1db5f..57e4f415 100644
--- a/test/integration/snapshot_experimental_test.go
+++ b/test/integration/snapshot_experimental_test.go
@@ -5,9 +5,8 @@ import (
 	"net/http/httptest"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // save/load work for Snowflake and Azure but emit an experimental warning.
@@ -112,10 +111,10 @@ func TestSnapshotNonAWSShowsExperimentalWarning(t *testing.T) {
 
 				args := append([]string{"--config", em.writeConfig(t, "4566"), "--non-interactive"}, subArgs...)
 				stdout, stderr, err := runLstk(t, ctx, dir, environ, args...)
-				require.NoError(t, err, "lstk snapshot %s failed: %s", op.name, stderr)
-				assert.Contains(t, stdout, op.successText)
-				assert.Contains(t, stdout, experimentalWarningFragment)
-				assert.Contains(t, stdout, em.name)
+				must.NoError(t, err, "lstk snapshot %s failed: %s", op.name, stderr)
+				must.Contains(t, stdout, op.successText)
+				must.Contains(t, stdout, experimentalWarningFragment)
+				must.Contains(t, stdout, em.name)
 			})
 		}
 	}
@@ -137,7 +136,7 @@ func TestSnapshotSaveAWSNoExperimentalWarning(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "save",
 	)
-	require.NoError(t, err, "lstk snapshot save failed: %s", stderr)
-	assert.Contains(t, stdout, "Snapshot saved")
-	assert.NotContains(t, stdout, experimentalWarningFragment)
+	must.NoError(t, err, "lstk snapshot save failed: %s", stderr)
+	must.Contains(t, stdout, "Snapshot saved")
+	must.NotContains(t, stdout, experimentalWarningFragment)
 }
diff --git a/test/integration/snapshot_list_test.go b/test/integration/snapshot_list_test.go
index b618248e..34f07f52 100644
--- a/test/integration/snapshot_list_test.go
+++ b/test/integration/snapshot_list_test.go
@@ -9,9 +9,9 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // listCapture records what the platform list endpoint received. It is written from the
@@ -40,7 +40,7 @@ func (c *listCapture) get() (called bool, creator, auth string) {
 func mockCloudPodsServer(t *testing.T, pods []map[string]any, cap *listCapture) *httptest.Server {
 	t.Helper()
 	body, err := json.Marshal(pods)
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/v1/cloudpods" && r.Method == http.MethodGet {
@@ -78,18 +78,11 @@ func TestSnapshotListSuccessWithoutDocker(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "list",
 	)
-	require.NoError(t, err, "lstk snapshot list failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot list failed: %s", stderr)
 	called, creator, _ := cap.get()
-	require.True(t, called, "the platform list endpoint should have been called")
-	assert.Equal(t, "me", creator, "default list should send ?creator=me")
-	assert.Contains(t, stdout, "~ 2 snapshots")
-	assert.Contains(t, stdout, "~ 2 snapshots\n\n  NAME")
-	assert.Contains(t, stdout, "NAME")
-	assert.Contains(t, stdout, "VERSION")
-	assert.Contains(t, stdout, "LAST CHANGED")
-	assert.Contains(t, stdout, "baseline-q2")
-	assert.Contains(t, stdout, "infra-2026-04")
-	assert.Contains(t, stdout, "3")
+	must.True(t, called, "the platform list endpoint should have been called")
+	must.Eq(t, "me", creator, "default list should send ?creator=me")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotListAllFlag(t *testing.T) {
@@ -104,12 +97,12 @@ func TestSnapshotListAllFlag(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "list", "--all",
 	)
-	require.NoError(t, err, "lstk snapshot list --all failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot list --all failed: %s", stderr)
 	called, creator, _ := cap.get()
-	require.True(t, called, "the platform list endpoint should have been called")
-	assert.Equal(t, "", creator, "--all should omit the ?creator param")
-	assert.Contains(t, stdout, "~ 1 snapshot")
-	assert.Contains(t, stdout, "org-pod")
+	must.True(t, called, "the platform list endpoint should have been called")
+	must.Eq(t, "", creator, "--all should omit the ?creator param")
+	must.Contains(t, stdout, "~ 1 snapshot")
+	must.Contains(t, stdout, "org-pod")
 }
 
 func TestSnapshotListEmpty(t *testing.T) {
@@ -121,8 +114,8 @@ func TestSnapshotListEmpty(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "list",
 	)
-	require.NoError(t, err, "lstk snapshot list failed: %s", stderr)
-	assert.Contains(t, stdout, "No snapshots found")
+	must.NoError(t, err, "lstk snapshot list failed: %s", stderr)
+	must.Contains(t, stdout, "No snapshots found")
 }
 
 func TestSnapshotListSendsBasicAuthHeader(t *testing.T) {
@@ -135,10 +128,10 @@ func TestSnapshotListSendsBasicAuthHeader(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "list",
 	)
-	require.NoError(t, err, "lstk snapshot list failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot list failed: %s", stderr)
 	_, _, auth := cap.get()
 	expected := "Basic " + base64.StdEncoding.EncodeToString([]byte(":test-token"))
-	assert.Equal(t, expected, auth, "list should authenticate to the platform with Basic base64(\":\"+token)")
+	must.Eq(t, expected, auth, "list should authenticate to the platform with Basic base64(\":\"+token)")
 }
 
 func TestSnapshotListRequiresAuthToken(t *testing.T) {
@@ -159,8 +152,8 @@ func TestSnapshotListRequiresAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "list",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Authentication required")
-	assert.Contains(t, stdout, "lstk login")
+	must.Contains(t, stdout, "Authentication required")
+	must.Contains(t, stdout, "lstk login")
 }
 
 func TestSnapshotListServerError(t *testing.T) {
@@ -179,7 +172,7 @@ func TestSnapshotListServerError(t *testing.T) {
 		"--non-interactive", "snapshot", "list",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, strings.ToLower(stderr), "error")
+	must.Contains(t, strings.ToLower(stderr), "error")
 }
 
 func TestSnapshotListInteractive(t *testing.T) {
@@ -193,6 +186,6 @@ func TestSnapshotListInteractive(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"snapshot", "list",
 	)
-	require.NoError(t, err, "interactive lstk snapshot list failed")
-	assert.Contains(t, out, "my-pod")
+	must.NoError(t, err, "interactive lstk snapshot list failed")
+	must.Contains(t, out, "my-pod")
 }
diff --git a/test/integration/snapshot_load_test.go b/test/integration/snapshot_load_test.go
index c954fb28..3e8767b2 100644
--- a/test/integration/snapshot_load_test.go
+++ b/test/integration/snapshot_load_test.go
@@ -9,9 +9,8 @@ import (
 	"sync/atomic"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // mockPodDiffServer returns a test server that handles GET /_localstack/pods/{name}/diff.
@@ -140,7 +139,7 @@ func mockPodDiffNotFoundServer(t *testing.T) *httptest.Server {
 func writeTestSnapFile(t *testing.T, dir, name string) string {
 	t.Helper()
 	path := filepath.Join(dir, name)
-	require.NoError(t, os.WriteFile(path, []byte("SNAP"), 0600))
+	must.NoError(t, os.WriteFile(path, []byte("SNAP"), 0600))
 	return path
 }
 
@@ -157,7 +156,7 @@ func TestSnapshotLoadRemoteRejected(t *testing.T) {
 				"--non-interactive", "snapshot", "load", ref,
 			)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "not yet supported")
+			must.Contains(t, stderr, "not yet supported")
 		})
 	}
 }
@@ -172,7 +171,7 @@ func TestSnapshotLoadS3RequiresPodName(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "s3://bucket/key",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "pod name is required")
+	must.Contains(t, stderr, "pod name is required")
 }
 
 func TestSnapshotLoadPodNoAuthToken(t *testing.T) {
@@ -184,7 +183,7 @@ func TestSnapshotLoadPodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "authentication")
+	must.Contains(t, stderr, "authentication")
 }
 
 func TestSnapshotLoadPodInvalidName(t *testing.T) {
@@ -198,7 +197,7 @@ func TestSnapshotLoadPodInvalidName(t *testing.T) {
 				"--non-interactive", "snapshot", "load", ref,
 			)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "invalid pod name")
+			must.Contains(t, stderr, "invalid pod name")
 		})
 	}
 }
@@ -212,7 +211,7 @@ func TestSnapshotLoadFileNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "/no/such/snapshot.snapshot",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "snapshot file not found")
+	must.Contains(t, stderr, "snapshot file not found")
 }
 
 // TestSnapshotLoadPathIsDirectory ensures passing a directory instead of a
@@ -224,14 +223,14 @@ func TestSnapshotLoadPathIsDirectory(t *testing.T) {
 
 	dir := t.TempDir()
 	target := filepath.Join(dir, "some-directory")
-	require.NoError(t, os.Mkdir(target, 0o755))
+	must.NoError(t, os.Mkdir(target, 0o755))
 
 	_, stderr, err := runLstk(t, ctx, t.TempDir(),
 		testEnvWithHome(t.TempDir(), ""),
 		"--non-interactive", "snapshot", "load", target,
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "is a directory")
+	must.Contains(t, stderr, "is a directory")
 }
 
 // --- Docker required ---
@@ -252,8 +251,8 @@ func TestSnapshotLoadLocalSuccess(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "load", snapPath,
 	)
-	require.NoError(t, err, "lstk snapshot load failed: %s", stderr)
-	assert.Contains(t, stdout, "Snapshot loaded")
+	must.NoError(t, err, "lstk snapshot load failed: %s", stderr)
+	must.Contains(t, stdout, "Snapshot loaded")
 }
 
 func TestSnapshotLoadLocalBareNameFallback(t *testing.T) {
@@ -273,8 +272,8 @@ func TestSnapshotLoadLocalBareNameFallback(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "load", filepath.Join(dir, "snap"),
 	)
-	require.NoError(t, err, "bare name fallback failed: %s", stderr)
-	assert.Contains(t, stdout, "Snapshot loaded")
+	must.NoError(t, err, "bare name fallback failed: %s", stderr)
+	must.Contains(t, stdout, "Snapshot loaded")
 }
 
 // TestSnapshotLoadLocalLegacyZipFallback verifies that snapshots saved as .zip by
@@ -296,8 +295,8 @@ func TestSnapshotLoadLocalLegacyZipFallback(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "load", filepath.Join(dir, "snap"),
 	)
-	require.NoError(t, err, "legacy .zip fallback failed: %s", stderr)
-	assert.Contains(t, stdout, "Snapshot loaded")
+	must.NoError(t, err, "legacy .zip fallback failed: %s", stderr)
+	must.Contains(t, stdout, "Snapshot loaded")
 }
 
 func TestSnapshotLoadLocalInvalidFile(t *testing.T) {
@@ -319,8 +318,8 @@ func TestSnapshotLoadLocalInvalidFile(t *testing.T) {
 	requireExitCode(t, 1, err)
 	// The user-facing error is emitted through the sink (stdout); the underlying
 	// "zip archive" detail must not leak to the user.
-	assert.Contains(t, stdout, "not a valid snapshot")
-	assert.NotContains(t, strings.ToLower(stdout+stderr), "zip")
+	must.Contains(t, stdout, "not a valid snapshot")
+	must.NotContains(t, strings.ToLower(stdout+stderr), "zip")
 }
 
 func TestSnapshotLoadLocalOverwriteStrategy(t *testing.T) {
@@ -339,8 +338,8 @@ func TestSnapshotLoadLocalOverwriteStrategy(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "load", "--merge=overwrite", snapPath,
 	)
-	require.NoError(t, err, "lstk snapshot load --merge=overwrite failed: %s", stderr)
-	assert.True(t, wasReset(), "/_localstack/state/reset should have been called for overwrite strategy")
+	must.NoError(t, err, "lstk snapshot load --merge=overwrite failed: %s", stderr)
+	must.True(t, wasReset(), "/_localstack/state/reset should have been called for overwrite strategy")
 }
 
 func TestSnapshotLoadPodSuccess(t *testing.T) {
@@ -358,11 +357,11 @@ func TestSnapshotLoadPodSuccess(t *testing.T) {
 			With(env.AuthToken, "test-token"),
 		"--non-interactive", "snapshot", "load", "pod:my-baseline",
 	)
-	require.NoError(t, err, "lstk snapshot load pod:my-baseline failed: %s", stderr)
-	assert.Contains(t, stdout, "Snapshot loaded")
-	assert.Contains(t, stdout, "my-baseline")
-	assert.Contains(t, stdout, "s3")
-	assert.Contains(t, stdout, "dynamodb")
+	must.NoError(t, err, "lstk snapshot load pod:my-baseline failed: %s", stderr)
+	must.Contains(t, stdout, "Snapshot loaded")
+	must.Contains(t, stdout, "my-baseline")
+	must.Contains(t, stdout, "s3")
+	must.Contains(t, stdout, "dynamodb")
 }
 
 func TestSnapshotLoadPodServerError(t *testing.T) {
@@ -381,7 +380,7 @@ func TestSnapshotLoadPodServerError(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "platform unavailable")
+	must.Contains(t, stderr, "platform unavailable")
 }
 
 // TestSnapshotLoadPodNotFound covers a non-existent cloud snapshot. The emulator
@@ -406,8 +405,8 @@ func TestSnapshotLoadPodNotFound(t *testing.T) {
 	requireExitCode(t, 1, err)
 	// The user-facing error is emitted through the sink (stdout); the raw
 	// platform diagnostic must not leak to the user.
-	assert.Contains(t, stdout, "not found on the LocalStack platform")
-	assert.NotContains(t, strings.ToLower(stdout+stderr), "version information")
+	must.Contains(t, stdout, "not found on the LocalStack platform")
+	must.NotContains(t, strings.ToLower(stdout+stderr), "version information")
 }
 
 func TestSnapshotLoadTelemetryEmitted(t *testing.T) {
@@ -429,7 +428,7 @@ func TestSnapshotLoadTelemetryEmitted(t *testing.T) {
 			With(env.AnalyticsEndpoint, analyticsSrv.URL),
 		"--non-interactive", "snapshot", "load", snapPath,
 	)
-	require.NoError(t, err, "lstk snapshot load failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot load failed: %s", stderr)
 	assertCommandTelemetry(t, events, "snapshot load", 0)
 }
 
@@ -449,8 +448,8 @@ func TestSnapshotLoadInteractive(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"snapshot", "load", snapPath,
 	)
-	require.NoError(t, err, "interactive lstk snapshot load failed")
-	assert.Contains(t, out, "Snapshot loaded")
+	must.NoError(t, err, "interactive lstk snapshot load failed")
+	must.Contains(t, out, "Snapshot loaded")
 }
 
 func TestLoadAliasMatchesSnapshotLoad(t *testing.T) {
@@ -472,8 +471,8 @@ func TestLoadAliasMatchesSnapshotLoad(t *testing.T) {
 			With(env.AnalyticsEndpoint, analyticsSrv.URL),
 		"--non-interactive", "load", snapPath,
 	)
-	require.NoError(t, err, "lstk load failed: %s", stderr)
-	assert.Contains(t, stdout, "Snapshot loaded")
+	must.NoError(t, err, "lstk load failed: %s", stderr)
+	must.Contains(t, stdout, "Snapshot loaded")
 
 	// Alias must emit telemetry under the canonical name so usage isn't
 	// split across "load" and "snapshot load" labels.
@@ -493,7 +492,7 @@ func TestSnapshotLoadDryRunOnLocalRef(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "--dry-run", snapPath,
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "pod refs")
+	must.Contains(t, stderr, "pod refs")
 }
 
 func TestSnapshotLoadDryRunPodNoAuthToken(t *testing.T) {
@@ -505,7 +504,7 @@ func TestSnapshotLoadDryRunPodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "--dry-run", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "authentication")
+	must.Contains(t, stderr, "authentication")
 }
 
 func TestSnapshotLoadDryRunPodSuccess(t *testing.T) {
@@ -523,10 +522,10 @@ func TestSnapshotLoadDryRunPodSuccess(t *testing.T) {
 			With(env.AuthToken, "test-token"),
 		"--non-interactive", "snapshot", "load", "--dry-run", "pod:my-baseline",
 	)
-	require.NoError(t, err, "lstk snapshot load --dry-run failed: %s", stderr)
-	assert.Contains(t, stdout, "Dry-run results")
-	assert.Contains(t, stdout, "my-baseline")
-	assert.Contains(t, stdout, "No state was modified.")
+	must.NoError(t, err, "lstk snapshot load --dry-run failed: %s", stderr)
+	must.Contains(t, stdout, "Dry-run results")
+	must.Contains(t, stdout, "my-baseline")
+	must.Contains(t, stdout, "No state was modified.")
 }
 
 // TestSnapshotLoadDryRunPodNotFound covers a non-existent cloud snapshot, mirroring
@@ -550,8 +549,8 @@ func TestSnapshotLoadDryRunPodNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "--dry-run", "pod:does-not-exist",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "not found on the LocalStack platform")
-	assert.NotContains(t, strings.ToLower(stdout+stderr), "version information")
+	must.Contains(t, stdout, "not found on the LocalStack platform")
+	must.NotContains(t, strings.ToLower(stdout+stderr), "version information")
 }
 
 // mockUnlicensedPodsServer mimics an emulator whose license does not include
@@ -588,9 +587,9 @@ func TestSnapshotLoadFeatureUnavailable(t *testing.T) {
 	)
 	requireExitCode(t, 1, err)
 	// The user-facing error is emitted through the sink (stdout).
-	assert.Contains(t, stdout, "Snapshots require a paid LocalStack plan")
-	assert.Contains(t, stdout, "https://www.localstack.cloud/pricing")
-	assert.NotContains(t, stdout+stderr, "status 404", "the raw HTTP status must not leak to the user")
+	must.Contains(t, stdout, "Snapshots require a paid LocalStack plan")
+	must.Contains(t, stdout, "https://www.localstack.cloud/pricing")
+	must.NotContains(t, stdout+stderr, "status 404", "the raw HTTP status must not leak to the user")
 }
 
 // The save path funnels through a different shared helper than load, so it needs
@@ -611,7 +610,7 @@ func TestSnapshotSaveFeatureUnavailable(t *testing.T) {
 		"--non-interactive", "snapshot", "save", filepath.Join(dir, "out.snapshot"),
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Snapshots require a paid LocalStack plan")
-	assert.Contains(t, stdout, "https://www.localstack.cloud/pricing")
-	assert.NotContains(t, stdout+stderr, "status 404")
+	must.Contains(t, stdout, "Snapshots require a paid LocalStack plan")
+	must.Contains(t, stdout, "https://www.localstack.cloud/pricing")
+	must.NotContains(t, stdout+stderr, "status 404")
 }
diff --git a/test/integration/snapshot_load_version_test.go b/test/integration/snapshot_load_version_test.go
index a6d77b58..85e12515 100644
--- a/test/integration/snapshot_load_version_test.go
+++ b/test/integration/snapshot_load_version_test.go
@@ -7,9 +7,8 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // queryCapture records the query string of the pod load/diff request the emulator
@@ -92,15 +91,15 @@ func TestSnapshotLoadPodVersionReachesWire(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), versionedLoadEnv(t),
 		"--non-interactive", "--endpoint-url", srv.URL, "snapshot", "load", "pod:my-baseline:3",
 	)
-	require.NoError(t, err, "lstk snapshot load failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot load failed: %s", stderr)
 
 	called, path, query := cap.get()
-	require.True(t, called, "the pod load endpoint should have been called")
-	assert.Equal(t, "/_localstack/pods/my-baseline", path)
-	assert.Equal(t, "3", query.Get("version"))
-	assert.Equal(t, "account-region-merge", query.Get("merge"), "the default merge strategy still applies")
+	must.True(t, called, "the pod load endpoint should have been called")
+	must.Eq(t, "/_localstack/pods/my-baseline", path)
+	must.Eq(t, "3", query.Get("version"))
+	must.Eq(t, "account-region-merge", query.Get("merge"), "the default merge strategy still applies")
 
-	assert.Contains(t, stdout, "pod:my-baseline:3", "the loaded source should name the pinned version")
+	must.Contains(t, stdout, "pod:my-baseline:3", "the loaded source should name the pinned version")
 }
 
 // TestSnapshotLoadPodWithoutVersionOmitsParam: an unpinned ref must not send
@@ -114,14 +113,14 @@ func TestSnapshotLoadPodWithoutVersionOmitsParam(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), versionedLoadEnv(t),
 		"--non-interactive", "--endpoint-url", srv.URL, "snapshot", "load", "pod:my-baseline",
 	)
-	require.NoError(t, err, "lstk snapshot load failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot load failed: %s", stderr)
 
 	called, _, query := cap.get()
-	require.True(t, called, "the pod load endpoint should have been called")
-	assert.False(t, query.Has("version"), "an unpinned load must not send a version parameter")
+	must.True(t, called, "the pod load endpoint should have been called")
+	must.False(t, query.Has("version"), "an unpinned load must not send a version parameter")
 
-	assert.Contains(t, stdout, "pod:my-baseline")
-	assert.NotContains(t, stdout, "pod:my-baseline:")
+	must.Contains(t, stdout, "pod:my-baseline")
+	must.NotContains(t, stdout, "pod:my-baseline:")
 }
 
 // TestLoadAliasAcceptsPodVersion: the root `lstk load` alias shares the REF
@@ -135,11 +134,11 @@ func TestLoadAliasAcceptsPodVersion(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), versionedLoadEnv(t),
 		"--non-interactive", "--endpoint-url", srv.URL, "load", "pod:my-baseline:2",
 	)
-	require.NoError(t, err, "lstk load failed: %s", stderr)
+	must.NoError(t, err, "lstk load failed: %s", stderr)
 
 	called, _, query := cap.get()
-	require.True(t, called, "the pod load endpoint should have been called")
-	assert.Equal(t, "2", query.Get("version"))
+	must.True(t, called, "the pod load endpoint should have been called")
+	must.Eq(t, "2", query.Get("version"))
 }
 
 // TestSnapshotLoadPodVersionDryRun: --dry-run previews the same version the load
@@ -153,15 +152,15 @@ func TestSnapshotLoadPodVersionDryRun(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), versionedLoadEnv(t),
 		"--non-interactive", "--endpoint-url", srv.URL, "snapshot", "load", "pod:my-baseline:3", "--dry-run",
 	)
-	require.NoError(t, err, "lstk snapshot load --dry-run failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot load --dry-run failed: %s", stderr)
 
 	called, path, query := cap.get()
-	require.True(t, called, "the diff endpoint should have been called")
-	assert.Equal(t, "/_localstack/pods/my-baseline/diff", path)
-	assert.Equal(t, "3", query.Get("version"))
+	must.True(t, called, "the diff endpoint should have been called")
+	must.Eq(t, "/_localstack/pods/my-baseline/diff", path)
+	must.Eq(t, "3", query.Get("version"))
 
-	assert.Contains(t, stdout, "Dry-run results for pod:my-baseline:3")
-	assert.Contains(t, stdout, "No state was modified")
+	must.Contains(t, stdout, "Dry-run results for pod:my-baseline:3")
+	must.Contains(t, stdout, "No state was modified")
 }
 
 // TestSnapshotLoadPodVersionNotFound: the emulator's own message already names
@@ -180,10 +179,10 @@ func TestSnapshotLoadPodVersionNotFound(t *testing.T) {
 	requireExitCode(t, 1, err)
 
 	_, _, query := cap.get()
-	assert.Equal(t, "99", query.Get("version"))
+	must.Eq(t, "99", query.Get("version"))
 
-	assert.Contains(t, stdout, "maximum version available in the remote storage is 3")
-	assert.Contains(t, stdout, "lstk snapshot versions pod:my-baseline")
+	must.Contains(t, stdout, "maximum version available in the remote storage is 3")
+	must.Contains(t, stdout, "lstk snapshot versions pod:my-baseline")
 }
 
 // TestSnapshotLoadRejectsMalformedVersion: a colon in a ref is unambiguously a
@@ -205,8 +204,8 @@ func TestSnapshotLoadRejectsMalformedVersion(t *testing.T) {
 				"--non-interactive", "--endpoint-url", srv.URL, "snapshot", "load", ref,
 			)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "invalid version")
-			assert.NotContains(t, stderr, "invalid pod name")
+			must.Contains(t, stderr, "invalid version")
+			must.NotContains(t, stderr, "invalid pod name")
 		})
 	}
 }
@@ -221,7 +220,7 @@ func TestSnapshotLoadS3RejectsPodVersion(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "my-pod:3", "s3://bucket/prefix",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "S3 remotes do not support snapshot versions")
+	must.Contains(t, stderr, "S3 remotes do not support snapshot versions")
 }
 
 // TestSnapshotSaveRejectsPodVersion: the platform assigns a version on every
@@ -235,8 +234,8 @@ func TestSnapshotSaveRejectsPodVersion(t *testing.T) {
 			"--non-interactive", "snapshot", "save", "pod:my-baseline:3",
 		)
 		requireExitCode(t, 1, err)
-		assert.Contains(t, stderr, "the platform assigns the version on each save")
-		assert.NotContains(t, stderr, "invalid pod name")
+		must.Contains(t, stderr, "the platform assigns the version on each save")
+		must.NotContains(t, stderr, "invalid pod name")
 	})
 
 	t.Run("s3 remote", func(t *testing.T) {
@@ -245,7 +244,7 @@ func TestSnapshotSaveRejectsPodVersion(t *testing.T) {
 			"--non-interactive", "snapshot", "save", "my-pod:3", "s3://bucket/prefix",
 		)
 		requireExitCode(t, 1, err)
-		assert.Contains(t, stderr, "S3 remotes do not support snapshot versions")
+		must.Contains(t, stderr, "S3 remotes do not support snapshot versions")
 	})
 }
 
@@ -259,7 +258,7 @@ func TestSnapshotRemoveRejectsPodVersion(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline:3", "--force",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "drop the ':3'")
+	must.Contains(t, stderr, "drop the ':3'")
 }
 
 // TestStartSnapshotFlagAcceptsPodVersion: --snapshot goes through the same REF
@@ -272,5 +271,5 @@ func TestStartSnapshotFlagAcceptsPodVersion(t *testing.T) {
 		"--non-interactive", "start", "--snapshot", "pod:my-baseline:abc",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "invalid version")
+	must.Contains(t, stderr, "invalid version")
 }
diff --git a/test/integration/snapshot_merge_e2e_test.go b/test/integration/snapshot_merge_e2e_test.go
index 11d5cc33..94fe2fe5 100644
--- a/test/integration/snapshot_merge_e2e_test.go
+++ b/test/integration/snapshot_merge_e2e_test.go
@@ -9,10 +9,9 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // End-to-end tests for `lstk snapshot load --merge` that exercise the real
@@ -41,7 +40,7 @@ func requireAWSCLI(t *testing.T) {
 func createSNSTopic(t *testing.T, ctx context.Context, e env.Environ, region, name string) {
 	t.Helper()
 	_, stderr, err := runLstk(t, ctx, "", e, "aws", "sns", "create-topic", "--name", name, "--region", region)
-	require.NoError(t, err, "create-topic %s/%s failed: %s", region, name, stderr)
+	must.NoError(t, err, "create-topic %s/%s failed: %s", region, name, stderr)
 }
 
 // createSQSQueue creates an SQS queue named name in region via `lstk aws`,
@@ -60,14 +59,14 @@ func createSQSQueue(t *testing.T, ctx context.Context, e env.Environ, region, na
 		args = append(args, "--attributes", shorthand)
 	}
 	_, stderr, err := runLstk(t, ctx, "", e, args...)
-	require.NoError(t, err, "create-queue %s/%s failed: %s", region, name, stderr)
+	must.NoError(t, err, "create-queue %s/%s failed: %s", region, name, stderr)
 }
 
 // createS3Bucket creates an S3 bucket named name in region via `lstk aws`.
 func createS3Bucket(t *testing.T, ctx context.Context, e env.Environ, region, name string) {
 	t.Helper()
 	_, stderr, err := runLstk(t, ctx, "", e, "aws", "s3", "mb", "s3://"+name, "--region", region)
-	require.NoError(t, err, "s3 mb %s/%s failed: %s", region, name, stderr)
+	must.NoError(t, err, "s3 mb %s/%s failed: %s", region, name, stderr)
 }
 
 // snsTopicNames lists the SNS topics in region and returns their names (the
@@ -75,14 +74,14 @@ func createS3Bucket(t *testing.T, ctx context.Context, e env.Environ, region, na
 func snsTopicNames(t *testing.T, ctx context.Context, e env.Environ, region string) []string {
 	t.Helper()
 	stdout, stderr, err := runLstk(t, ctx, "", e, "aws", "sns", "list-topics", "--region", region, "--output", "json")
-	require.NoError(t, err, "list-topics %s failed: %s", region, stderr)
+	must.NoError(t, err, "list-topics %s failed: %s", region, stderr)
 
 	var resp struct {
 		Topics []struct {
 			TopicArn string `json:"TopicArn"`
 		} `json:"Topics"`
 	}
-	require.NoError(t, json.Unmarshal([]byte(stdout), &resp), "parsing list-topics output: %s", stdout)
+	must.NoError(t, json.Unmarshal([]byte(stdout), &resp), "parsing list-topics output: %s", stdout)
 
 	names := make([]string, 0, len(resp.Topics))
 	for _, topic := range resp.Topics {
@@ -112,13 +111,13 @@ func topicNameFromARN(arn string) string {
 func sqsQueueURLsByName(t *testing.T, ctx context.Context, e env.Environ, region string) map[string]string {
 	t.Helper()
 	stdout, stderr, err := runLstk(t, ctx, "", e, "aws", "sqs", "list-queues", "--region", region, "--output", "json")
-	require.NoError(t, err, "list-queues %s failed: %s", region, stderr)
+	must.NoError(t, err, "list-queues %s failed: %s", region, stderr)
 
 	var resp struct {
 		QueueUrls []string `json:"QueueUrls"`
 	}
 	if stdout != "" {
-		require.NoError(t, json.Unmarshal([]byte(stdout), &resp), "parsing list-queues output: %s", stdout)
+		must.NoError(t, json.Unmarshal([]byte(stdout), &resp), "parsing list-queues output: %s", stdout)
 	}
 
 	byName := make(map[string]string, len(resp.QueueUrls))
@@ -134,14 +133,14 @@ func sqsQueueVisibilityTimeout(t *testing.T, ctx context.Context, e env.Environ,
 	t.Helper()
 	stdout, stderr, err := runLstk(t, ctx, "", e, "aws", "sqs", "get-queue-attributes",
 		"--queue-url", queueURL, "--attribute-names", "VisibilityTimeout", "--region", region, "--output", "json")
-	require.NoError(t, err, "get-queue-attributes %s failed: %s", queueURL, stderr)
+	must.NoError(t, err, "get-queue-attributes %s failed: %s", queueURL, stderr)
 
 	var resp struct {
 		Attributes struct {
 			VisibilityTimeout string `json:"VisibilityTimeout"`
 		} `json:"Attributes"`
 	}
-	require.NoError(t, json.Unmarshal([]byte(stdout), &resp), "parsing get-queue-attributes output: %s", stdout)
+	must.NoError(t, json.Unmarshal([]byte(stdout), &resp), "parsing get-queue-attributes output: %s", stdout)
 	return resp.Attributes.VisibilityTimeout
 }
 
@@ -149,14 +148,14 @@ func sqsQueueVisibilityTimeout(t *testing.T, ctx context.Context, e env.Environ,
 func s3BucketNames(t *testing.T, ctx context.Context, e env.Environ) []string {
 	t.Helper()
 	stdout, stderr, err := runLstk(t, ctx, "", e, "aws", "s3api", "list-buckets", "--output", "json")
-	require.NoError(t, err, "list-buckets failed: %s", stderr)
+	must.NoError(t, err, "list-buckets failed: %s", stderr)
 
 	var resp struct {
 		Buckets []struct {
 			Name string `json:"Name"`
 		} `json:"Buckets"`
 	}
-	require.NoError(t, json.Unmarshal([]byte(stdout), &resp), "parsing list-buckets output: %s", stdout)
+	must.NoError(t, json.Unmarshal([]byte(stdout), &resp), "parsing list-buckets output: %s", stdout)
 
 	names := make([]string, len(resp.Buckets))
 	for i, b := range resp.Buckets {
@@ -180,10 +179,10 @@ func buildMergeTestSnapshots(t *testing.T, ctx context.Context, e env.Environ, d
 
 	snap1 = filepath.Join(dir, "snapshot1.snapshot")
 	_, stderr, err := runLstk(t, ctx, "", e, "snapshot", "save", snap1)
-	require.NoError(t, err, "snapshot save (1) failed: %s", stderr)
+	must.NoError(t, err, "snapshot save (1) failed: %s", stderr)
 
 	_, stderr, err = runLstk(t, ctx, "", e, "reset", "--force")
-	require.NoError(t, err, "reset before snapshot 2 failed: %s", stderr)
+	must.NoError(t, err, "reset before snapshot 2 failed: %s", stderr)
 
 	createSNSTopic(t, ctx, e, "us-east-1", "topic3")
 	createSQSQueue(t, ctx, e, "us-east-1", "queue3", nil)
@@ -191,7 +190,7 @@ func buildMergeTestSnapshots(t *testing.T, ctx context.Context, e env.Environ, d
 
 	snap2 = filepath.Join(dir, "snapshot2.snapshot")
 	_, stderr, err = runLstk(t, ctx, "", e, "snapshot", "save", snap2)
-	require.NoError(t, err, "snapshot save (2) failed: %s", stderr)
+	must.NoError(t, err, "snapshot save (2) failed: %s", stderr)
 
 	return snap1, snap2
 }
@@ -216,7 +215,7 @@ func TestSnapshotLoadMergeStrategies(t *testing.T) {
 	// Pinned to the "dev" image tag rather than the default "latest" so we can
 	// catch problems with the merge logic in a known-good image before they hit users.
 	configPath := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configPath, []byte("[[containers]]\ntype = \"aws\"\ntag = \""+mergeTestAWSTag+"\"\nport = \"4566\"\n"), 0644))
+	must.NoError(t, os.WriteFile(configPath, []byte("[[containers]]\ntype = \"aws\"\ntag = \""+mergeTestAWSTag+"\"\nport = \"4566\"\n"), 0644))
 	startRealLocalStackWithConfig(t, ctx, token, configPath)
 
 	e := env.With(env.DisableEvents, "1").With(env.Home, t.TempDir())
@@ -226,7 +225,7 @@ func TestSnapshotLoadMergeStrategies(t *testing.T) {
 	// first (runLstk has no TTY, so this is non-interactive) so every later
 	// `aws` call's stdout is clean JSON.
 	_, stderr, err := runLstk(t, ctx, "", e, "setup", "aws")
-	require.NoError(t, err, "lstk setup aws failed: %s", stderr)
+	must.NoError(t, err, "lstk setup aws failed: %s", stderr)
 
 	snap1, snap2 := buildMergeTestSnapshots(t, ctx, e, t.TempDir())
 
@@ -267,35 +266,35 @@ func TestSnapshotLoadMergeStrategies(t *testing.T) {
 	for _, tc := range tests {
 		t.Run(tc.strategy, func(t *testing.T) {
 			_, stderr, err := runLstk(t, ctx, "", e, "reset", "--force")
-			require.NoError(t, err, "reset failed: %s", stderr)
+			must.NoError(t, err, "reset failed: %s", stderr)
 
 			_, stderr, err = runLstk(t, ctx, "", e, "snapshot", "load", snap1)
-			require.NoError(t, err, "loading snapshot1 failed: %s", stderr)
+			must.NoError(t, err, "loading snapshot1 failed: %s", stderr)
 
 			_, stderr, err = runLstk(t, ctx, "", e, "snapshot", "load", snap2, "--merge="+tc.strategy)
-			require.NoError(t, err, "loading snapshot2 (merge=%s) failed: %s", tc.strategy, stderr)
+			must.NoError(t, err, "loading snapshot2 (merge=%s) failed: %s", tc.strategy, stderr)
 
-			assert.ElementsMatch(t, tc.wantUSEastSNS, snsTopicNames(t, ctx, e, "us-east-1"), "us-east-1 SNS topics")
-			assert.ElementsMatch(t, tc.wantUSEastS3, s3BucketNames(t, ctx, e), "S3 buckets")
-			assert.ElementsMatch(t, tc.wantAPSoutheast2["sns"], snsTopicNames(t, ctx, e, "ap-southeast-2"), "ap-southeast-2 SNS topics")
+			must.ElementsMatch(t, tc.wantUSEastSNS, snsTopicNames(t, ctx, e, "us-east-1"), "us-east-1 SNS topics")
+			must.ElementsMatch(t, tc.wantUSEastS3, s3BucketNames(t, ctx, e), "S3 buckets")
+			must.ElementsMatch(t, tc.wantAPSoutheast2["sns"], snsTopicNames(t, ctx, e, "ap-southeast-2"), "ap-southeast-2 SNS topics")
 
 			usEastQueues := sqsQueueURLsByName(t, ctx, e, "us-east-1")
 			gotUSEastSQS := make([]string, 0, len(usEastQueues))
 			for name := range usEastQueues {
 				gotUSEastSQS = append(gotUSEastSQS, name)
 			}
-			assert.ElementsMatch(t, tc.wantUSEastSQS, gotUSEastSQS, "us-east-1 SQS queues")
+			must.ElementsMatch(t, tc.wantUSEastSQS, gotUSEastSQS, "us-east-1 SQS queues")
 
 			apSoutheastQueues := sqsQueueURLsByName(t, ctx, e, "ap-southeast-2")
 			gotAPSoutheastSQS := make([]string, 0, len(apSoutheastQueues))
 			for name := range apSoutheastQueues {
 				gotAPSoutheastSQS = append(gotAPSoutheastSQS, name)
 			}
-			assert.ElementsMatch(t, tc.wantAPSoutheast2["sqs"], gotAPSoutheastSQS, "ap-southeast-2 SQS queues")
+			must.ElementsMatch(t, tc.wantAPSoutheast2["sqs"], gotAPSoutheastSQS, "ap-southeast-2 SQS queues")
 
 			queueToReplaceURL, ok := usEastQueues["queue-to-replace"]
-			require.True(t, ok, "queue-to-replace should exist in us-east-1 after merge=%s", tc.strategy)
-			assert.Equal(t, tc.wantVisibility, sqsQueueVisibilityTimeout(t, ctx, e, "us-east-1", queueToReplaceURL),
+			must.True(t, ok, "queue-to-replace should exist in us-east-1 after merge=%s", tc.strategy)
+			must.Eq(t, tc.wantVisibility, sqsQueueVisibilityTimeout(t, ctx, e, "us-east-1", queueToReplaceURL),
 				"queue-to-replace VisibilityTimeout after merge=%s", tc.strategy)
 		})
 	}
diff --git a/test/integration/snapshot_remove_test.go b/test/integration/snapshot_remove_test.go
index 0b720074..9ec819da 100644
--- a/test/integration/snapshot_remove_test.go
+++ b/test/integration/snapshot_remove_test.go
@@ -14,9 +14,8 @@ import (
 	"time"
 
 	"github.com/creack/pty"
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // mockPodRemoveServer returns a test server that handles DELETE /_localstack/pods/{name}.
@@ -48,8 +47,8 @@ func TestSnapshotRemoveLocalRefRejected(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "./my-baseline.zip",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "resolves to a local file")
-	assert.Contains(t, stderr, "CLI cannot delete local files")
+	must.Contains(t, stderr, "resolves to a local file")
+	must.Contains(t, stderr, "CLI cannot delete local files")
 }
 
 func TestSnapshotRemoveLocalBareNameRejected(t *testing.T) {
@@ -61,8 +60,8 @@ func TestSnapshotRemoveLocalBareNameRejected(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "resolves to a local file")
-	assert.Contains(t, stderr, "CLI cannot delete local files")
+	must.Contains(t, stderr, "resolves to a local file")
+	must.Contains(t, stderr, "CLI cannot delete local files")
 }
 
 func TestSnapshotRemovePodNoAuthToken(t *testing.T) {
@@ -74,7 +73,7 @@ func TestSnapshotRemovePodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline", "--force",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "authentication")
+	must.Contains(t, stderr, "authentication")
 }
 
 func TestSnapshotRemovePodInvalidName(t *testing.T) {
@@ -89,7 +88,7 @@ func TestSnapshotRemovePodInvalidName(t *testing.T) {
 				"--non-interactive", "snapshot", "remove", ref,
 			)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "invalid pod name")
+			must.Contains(t, stderr, "invalid pod name")
 		})
 	}
 }
@@ -103,7 +102,7 @@ func TestSnapshotRemoveNonInteractiveRequiresForce(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "--force")
+	must.Contains(t, stderr, "--force")
 }
 
 func TestSnapshotRemoteSchemeRejected(t *testing.T) {
@@ -118,7 +117,7 @@ func TestSnapshotRemoteSchemeRejected(t *testing.T) {
 				"--non-interactive", "snapshot", "remove", ref,
 			)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "not yet supported")
+			must.Contains(t, stderr, "not yet supported")
 		})
 	}
 }
@@ -140,10 +139,10 @@ func TestSnapshotRemovePodSuccess(t *testing.T) {
 			With(env.AuthToken, "test-token"),
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline", "--force",
 	)
-	require.NoError(t, err, "lstk snapshot remove pod:my-baseline failed: %s", stderr)
-	assert.Contains(t, stdout, "my-baseline")
-	assert.Contains(t, stdout, "deleted")
-	assert.Equal(t, int32(1), calls(), "DELETE endpoint should be called exactly once")
+	must.NoError(t, err, "lstk snapshot remove pod:my-baseline failed: %s", stderr)
+	must.Contains(t, stdout, "my-baseline")
+	must.Contains(t, stdout, "deleted")
+	must.Eq(t, int32(1), calls(), "DELETE endpoint should be called exactly once")
 }
 
 func TestSnapshotRemovePodServerError(t *testing.T) {
@@ -162,8 +161,8 @@ func TestSnapshotRemovePodServerError(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline", "--force",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "pod remove failed")
-	assert.Equal(t, int32(1), calls(), "DELETE endpoint should be called even when server errors")
+	must.Contains(t, stderr, "pod remove failed")
+	must.Eq(t, int32(1), calls(), "DELETE endpoint should be called even when server errors")
 }
 
 func TestSnapshotRemovePodNotFound(t *testing.T) {
@@ -191,10 +190,10 @@ func TestSnapshotRemovePodNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-snapshot", "--force",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, `"my-snapshot"`)
-	assert.Contains(t, stderr, "not found")
-	assert.NotContains(t, stderr, "HTTP 500")
-	assert.NotContains(t, stderr, "pod remove failed")
+	must.Contains(t, stderr, `"my-snapshot"`)
+	must.Contains(t, stderr, "not found")
+	must.NotContains(t, stderr, "HTTP 500")
+	must.NotContains(t, stderr, "pod remove failed")
 }
 
 func TestSnapshotRemoveInteractive(t *testing.T) {
@@ -210,14 +209,14 @@ func TestSnapshotRemoveInteractive(t *testing.T) {
 	startRemove := func(t *testing.T, srv *httptest.Server) (*os.File, *syncBuffer, chan struct{}, *exec.Cmd) {
 		t.Helper()
 		binPath, err := filepath.Abs(binaryPath())
-		require.NoError(t, err)
+		must.NoError(t, err)
 
 		cmd := exec.CommandContext(testContext(t), binPath, "snapshot", "remove", "pod:my-baseline")
 		cmd.Env = env.Environ(testEnvWithHome(t.TempDir(), "")).
 			With(env.LocalStackHost, lsHost(srv)).
 			With(env.AuthToken, "test-token")
 		ptmx, err := pty.Start(cmd)
-		require.NoError(t, err, "failed to start command in PTY")
+		must.NoError(t, err, "failed to start command in PTY")
 		t.Cleanup(func() { _ = ptmx.Close() })
 
 		out := &syncBuffer{}
@@ -226,7 +225,7 @@ func TestSnapshotRemoveInteractive(t *testing.T) {
 			_, _ = io.Copy(out, ptmx)
 			close(outputCh)
 		}()
-		require.Eventually(t, func() bool {
+		must.Eventually(t, func() bool {
 			return bytes.Contains(out.Bytes(), []byte("Delete cloud snapshot"))
 		}, 10*time.Second, 100*time.Millisecond, "confirmation prompt should appear")
 		return ptmx, out, outputCh, cmd
@@ -236,37 +235,37 @@ func TestSnapshotRemoveInteractive(t *testing.T) {
 		srv, calls := mockPodRemoveServer(t, http.StatusOK)
 		ptmx, out, outputCh, cmd := startRemove(t, srv)
 		_, err := ptmx.Write([]byte("y"))
-		require.NoError(t, err)
-		require.NoError(t, cmd.Wait())
+		must.NoError(t, err)
+		must.NoError(t, cmd.Wait())
 		<-outputCh
 
-		assert.Contains(t, out.String(), "deleted")
-		assert.Equal(t, int32(1), calls(), "DELETE endpoint should be called after confirmation")
+		must.Contains(t, out.String(), "deleted")
+		must.Eq(t, int32(1), calls(), "DELETE endpoint should be called after confirmation")
 	})
 
 	t.Run("cancels with n", func(t *testing.T) {
 		srv, calls := mockPodRemoveServer(t, http.StatusOK)
 		ptmx, out, outputCh, cmd := startRemove(t, srv)
 		_, err := ptmx.Write([]byte("n"))
-		require.NoError(t, err)
-		require.NoError(t, cmd.Wait())
+		must.NoError(t, err)
+		must.NoError(t, cmd.Wait())
 		<-outputCh
 
-		assert.Contains(t, out.String(), "Cancelled")
-		assert.Equal(t, int32(0), calls(), "DELETE endpoint must not be called when user cancels")
+		must.Contains(t, out.String(), "Cancelled")
+		must.Eq(t, int32(0), calls(), "DELETE endpoint must not be called when user cancels")
 	})
 
 	t.Run("force skips confirmation prompt", func(t *testing.T) {
 		srv, calls := mockPodRemoveServer(t, http.StatusOK)
 
 		binPath, err := filepath.Abs(binaryPath())
-		require.NoError(t, err)
+		must.NoError(t, err)
 		cmd := exec.CommandContext(testContext(t), binPath, "snapshot", "remove", "pod:my-baseline", "--force")
 		cmd.Env = env.Environ(testEnvWithHome(t.TempDir(), "")).
 			With(env.LocalStackHost, lsHost(srv)).
 			With(env.AuthToken, "test-token")
 		ptmx, err := pty.Start(cmd)
-		require.NoError(t, err, "failed to start command in PTY")
+		must.NoError(t, err, "failed to start command in PTY")
 		t.Cleanup(func() { _ = ptmx.Close() })
 
 		out := &syncBuffer{}
@@ -276,11 +275,11 @@ func TestSnapshotRemoveInteractive(t *testing.T) {
 			close(outputCh)
 		}()
 
-		require.NoError(t, cmd.Wait())
+		must.NoError(t, cmd.Wait())
 		<-outputCh
 
-		assert.NotContains(t, out.String(), "Delete cloud snapshot", "confirmation prompt must not appear with --force")
-		assert.Contains(t, out.String(), "deleted")
-		assert.Equal(t, int32(1), calls(), "DELETE endpoint should be called without confirmation")
+		must.NotContains(t, out.String(), "Delete cloud snapshot", "confirmation prompt must not appear with --force")
+		must.Contains(t, out.String(), "deleted")
+		must.Eq(t, int32(1), calls(), "DELETE endpoint should be called without confirmation")
 	})
 }
diff --git a/test/integration/snapshot_save_test.go b/test/integration/snapshot_save_test.go
index 77975785..5dd06f34 100644
--- a/test/integration/snapshot_save_test.go
+++ b/test/integration/snapshot_save_test.go
@@ -14,9 +14,8 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // mockStateServer returns a test server that serves a minimal ZIP at /_localstack/pods/state.
@@ -25,10 +24,10 @@ func mockStateServer(t *testing.T) *httptest.Server {
 	var zipBuf bytes.Buffer
 	zw := zip.NewWriter(&zipBuf)
 	f, err := zw.Create("state.json")
-	require.NoError(t, err)
+	must.NoError(t, err)
 	_, err = f.Write([]byte(`{"services":{}}`))
-	require.NoError(t, err)
-	require.NoError(t, zw.Close())
+	must.NoError(t, err)
+	must.NoError(t, zw.Close())
 	zipData := zipBuf.Bytes()
 
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -59,10 +58,10 @@ func mockStateServerCapturing(t *testing.T) (*httptest.Server, func() string) {
 	var zipBuf bytes.Buffer
 	zw := zip.NewWriter(&zipBuf)
 	f, err := zw.Create("state.json")
-	require.NoError(t, err)
+	must.NoError(t, err)
 	_, err = f.Write([]byte(`{"services":{}}`))
-	require.NoError(t, err)
-	require.NoError(t, zw.Close())
+	must.NoError(t, err)
+	must.NoError(t, zw.Close())
 	zipData := zipBuf.Bytes()
 
 	var (
@@ -109,11 +108,11 @@ func TestSnapshotSaveDefaultDestination(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "save",
 	)
-	require.NoError(t, err, "lstk snapshot save failed: %s", stderr)
-	assert.Contains(t, stdout, "Snapshot saved")
+	must.NoError(t, err, "lstk snapshot save failed: %s", stderr)
+	must.Contains(t, stdout, "Snapshot saved")
 
 	entries, readErr := os.ReadDir(dir)
-	require.NoError(t, readErr)
+	must.NoError(t, readErr)
 	var found bool
 	for _, e := range entries {
 		if strings.HasPrefix(e.Name(), "snapshot-") && strings.HasSuffix(e.Name(), ".snapshot") {
@@ -121,7 +120,7 @@ func TestSnapshotSaveDefaultDestination(t *testing.T) {
 			break
 		}
 	}
-	assert.True(t, found, "default snapshot file (snapshot-*.snapshot) should exist in %s", dir)
+	must.True(t, found, "default snapshot file (snapshot-*.snapshot) should exist in %s", dir)
 }
 
 func TestSnapshotSaveCustomPath(t *testing.T) {
@@ -139,17 +138,17 @@ func TestSnapshotSaveCustomPath(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "save", outPath,
 	)
-	require.NoError(t, err, "lstk snapshot save failed: %s", stderr)
-	assert.Contains(t, stdout, "Snapshot saved")
-	assert.Contains(t, stdout, "./my-snap.snapshot")
+	must.NoError(t, err, "lstk snapshot save failed: %s", stderr)
+	must.Contains(t, stdout, "Snapshot saved")
+	must.Contains(t, stdout, "./my-snap.snapshot")
 
 	data, err := os.ReadFile(outPath)
-	require.NoError(t, err, "output file should exist")
-	assert.True(t, len(data) > 0, "output file should be non-empty")
+	must.NoError(t, err, "output file should exist")
+	must.True(t, len(data) > 0, "output file should be non-empty")
 
 	r, err := zip.NewReader(bytes.NewReader(data), int64(len(data)))
-	require.NoError(t, err, "output file should be a valid ZIP")
-	assert.NotEmpty(t, r.File)
+	must.NoError(t, err, "output file should be a valid ZIP")
+	must.NotEmpty(t, r.File)
 }
 
 func TestSnapshotSaveRelativePath(t *testing.T) {
@@ -166,11 +165,11 @@ func TestSnapshotSaveRelativePath(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "save", "./my-state",
 	)
-	require.NoError(t, err, "lstk snapshot save failed: %s", stderr)
-	assert.Contains(t, stdout, "Snapshot saved")
+	must.NoError(t, err, "lstk snapshot save failed: %s", stderr)
+	must.Contains(t, stdout, "Snapshot saved")
 
 	_, statErr := os.Stat(filepath.Join(dir, "my-state.snapshot"))
-	assert.NoError(t, statErr, "relative output file should exist")
+	must.NoError(t, statErr, "relative output file should exist")
 }
 
 // TestSnapshotSaveForcesSnapshotExtension verifies that a user-supplied extension
@@ -189,13 +188,13 @@ func TestSnapshotSaveForcesSnapshotExtension(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "save", "./x.zip",
 	)
-	require.NoError(t, err, "lstk snapshot save failed: %s", stderr)
-	assert.Contains(t, stdout, "./x.snapshot")
+	must.NoError(t, err, "lstk snapshot save failed: %s", stderr)
+	must.Contains(t, stdout, "./x.snapshot")
 
 	_, statErr := os.Stat(filepath.Join(dir, "x.snapshot"))
-	assert.NoError(t, statErr, "extension should be forced to .snapshot")
+	must.NoError(t, statErr, "extension should be forced to .snapshot")
 	_, zipErr := os.Stat(filepath.Join(dir, "x.zip"))
-	assert.True(t, os.IsNotExist(zipErr), "the user-supplied .zip path should not be created")
+	must.True(t, os.IsNotExist(zipErr), "the user-supplied .zip path should not be created")
 }
 
 func TestSnapshotSaveOverwritesExistingFile(t *testing.T) {
@@ -208,17 +207,17 @@ func TestSnapshotSaveOverwritesExistingFile(t *testing.T) {
 	srv := mockStateServer(t)
 	dir := t.TempDir()
 	outPath := filepath.Join(dir, "snap.snapshot")
-	require.NoError(t, os.WriteFile(outPath, []byte("OLD"), 0600))
+	must.NoError(t, os.WriteFile(outPath, []byte("OLD"), 0600))
 
 	_, stderr, err := runLstk(t, ctx, dir,
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "save", outPath,
 	)
-	require.NoError(t, err, "lstk snapshot save should overwrite: %s", stderr)
+	must.NoError(t, err, "lstk snapshot save should overwrite: %s", stderr)
 
 	data, err := os.ReadFile(outPath)
-	require.NoError(t, err)
-	assert.NotEqual(t, "OLD", string(data), "file should have been overwritten")
+	must.NoError(t, err)
+	must.NotEq(t, "OLD", string(data), "file should have been overwritten")
 }
 
 func TestSnapshotSaveRemoteRejected(t *testing.T) {
@@ -232,7 +231,7 @@ func TestSnapshotSaveRemoteRejected(t *testing.T) {
 
 			_, stderr, err := runLstk(t, ctx, t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--non-interactive", "snapshot", "save", dest)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "not yet supported")
+			must.Contains(t, stderr, "not yet supported")
 		})
 	}
 }
@@ -248,7 +247,7 @@ func TestSnapshotSaveS3MissingCredentials(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "my-pod", "s3://my-bucket/prefix",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "AWS credentials required")
+	must.Contains(t, stderr, "AWS credentials required")
 }
 
 func TestSnapshotSaveS3CredentialsInURLRejected(t *testing.T) {
@@ -262,7 +261,7 @@ func TestSnapshotSaveS3CredentialsInURLRejected(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "my-pod", "s3://my-bucket/prefix?access_key_id=AKIA&secret_access_key=secret",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "do not put credentials")
+	must.Contains(t, stderr, "do not put credentials")
 }
 
 // mockPodS3Server handles the remote registration plus pod save against an S3
@@ -327,18 +326,18 @@ func TestSnapshotSaveS3Success(t *testing.T) {
 			With(env.AWSSecretAccessKey, "topsecret"),
 		"--non-interactive", "snapshot", "save", "my-pod", s3URL,
 	)
-	require.NoError(t, err, "lstk snapshot save to s3 failed: %s", stderr)
-	assert.Contains(t, stdout, "Snapshot saved to "+s3URL)
-	assert.Contains(t, stdout, "my-pod")
+	must.NoError(t, err, "lstk snapshot save to s3 failed: %s", stderr)
+	must.Contains(t, stdout, "Snapshot saved to "+s3URL)
+	must.Contains(t, stdout, "my-pod")
 
 	remoteURL, saveBody := captured()
 	// The registered URL carries placeholders, never the secret values.
-	assert.Contains(t, remoteURL, "{access_key_id}")
-	assert.NotContains(t, remoteURL, "topsecret")
-	assert.NotContains(t, remoteURL, "AKIAEXAMPLE")
+	must.Contains(t, remoteURL, "{access_key_id}")
+	must.NotContains(t, remoteURL, "topsecret")
+	must.NotContains(t, remoteURL, "AKIAEXAMPLE")
 	// The secrets travel only in the ephemeral save params.
-	assert.Contains(t, string(saveBody), "topsecret")
-	assert.Contains(t, string(saveBody), "remote_params")
+	must.Contains(t, string(saveBody), "topsecret")
+	must.Contains(t, string(saveBody), "remote_params")
 }
 
 // mockPodSaveServer returns a test server that handles POST /_localstack/pods/{name}
@@ -378,11 +377,11 @@ func TestSnapshotSavePodSuccess(t *testing.T) {
 			With(env.AuthToken, "test-token"),
 		"--non-interactive", "snapshot", "save", "pod:my-baseline",
 	)
-	require.NoError(t, err, "lstk snapshot save pod:my-baseline failed: %s", stderr)
-	assert.Contains(t, stdout, "Snapshot saved")
-	assert.Contains(t, stdout, "my-baseline")
-	assert.Contains(t, stdout, "Version: 1")
-	assert.Contains(t, stdout, "dynamodb, s3")
+	must.NoError(t, err, "lstk snapshot save pod:my-baseline failed: %s", stderr)
+	must.Contains(t, stdout, "Snapshot saved")
+	must.Contains(t, stdout, "my-baseline")
+	must.Contains(t, stdout, "Version: 1")
+	must.Contains(t, stdout, "dynamodb, s3")
 }
 
 func TestSnapshotSavePodServerError(t *testing.T) {
@@ -401,7 +400,7 @@ func TestSnapshotSavePodServerError(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "platform error")
+	must.Contains(t, stderr, "platform error")
 }
 
 func TestSnapshotSavePodNoAuthToken(t *testing.T) {
@@ -413,7 +412,7 @@ func TestSnapshotSavePodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "authentication")
+	must.Contains(t, stderr, "authentication")
 }
 
 func TestSnapshotSavePodInvalidName(t *testing.T) {
@@ -429,7 +428,7 @@ func TestSnapshotSavePodInvalidName(t *testing.T) {
 
 			_, stderr, err := runLstk(t, ctx, t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--non-interactive", "snapshot", "save", dest)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "invalid pod name")
+			must.Contains(t, stderr, "invalid pod name")
 		})
 	}
 }
@@ -502,18 +501,18 @@ func TestSnapshotSavePodWithServices(t *testing.T) {
 			With(env.AuthToken, "test-token"),
 		"--non-interactive", "snapshot", "save", "pod:my-baseline", "--services", "s3,dynamodb",
 	)
-	require.NoError(t, err, "lstk snapshot save pod:my-baseline --services failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot save pod:my-baseline --services failed: %s", stderr)
 
 	var parsed struct {
 		Attributes struct {
 			Services []string `json:"services"`
 		} `json:"attributes"`
 	}
-	require.NoError(t, json.Unmarshal(capturedBody(), &parsed))
-	assert.Equal(t, []string{"s3", "dynamodb"}, parsed.Attributes.Services, "request body must carry exactly the requested services")
+	must.NoError(t, json.Unmarshal(capturedBody(), &parsed))
+	must.Eq(t, []string{"s3", "dynamodb"}, parsed.Attributes.Services, "request body must carry exactly the requested services")
 
-	assert.Contains(t, stdout, "Snapshot saved")
-	assert.Contains(t, stdout, "Services: s3, dynamodb")
+	must.Contains(t, stdout, "Snapshot saved")
+	must.Contains(t, stdout, "Services: s3, dynamodb")
 }
 
 func TestSnapshotSavePodServicesSingleValue(t *testing.T) {
@@ -531,15 +530,15 @@ func TestSnapshotSavePodServicesSingleValue(t *testing.T) {
 			With(env.AuthToken, "test-token"),
 		"--non-interactive", "snapshot", "save", "pod:my-baseline", "-s", "s3",
 	)
-	require.NoError(t, err, "lstk snapshot save pod:my-baseline -s s3 failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot save pod:my-baseline -s s3 failed: %s", stderr)
 
 	var parsed struct {
 		Attributes struct {
 			Services []string `json:"services"`
 		} `json:"attributes"`
 	}
-	require.NoError(t, json.Unmarshal(capturedBody(), &parsed))
-	assert.Equal(t, []string{"s3"}, parsed.Attributes.Services)
+	must.NoError(t, json.Unmarshal(capturedBody(), &parsed))
+	must.Eq(t, []string{"s3"}, parsed.Attributes.Services)
 }
 
 func TestSnapshotSavePodServicesInvalidFormat(t *testing.T) {
@@ -559,7 +558,7 @@ func TestSnapshotSavePodServicesInvalidFormat(t *testing.T) {
 				"--non-interactive", "snapshot", "save", "pod:my-baseline", "--services", value,
 			)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "comma-separated list of service names")
+			must.Contains(t, stderr, "comma-separated list of service names")
 		})
 	}
 }
@@ -579,14 +578,14 @@ func TestSnapshotSaveLocalWithServices(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "save", dest, "--services", "s3,dynamodb",
 	)
-	require.NoError(t, err, "lstk snapshot save --services failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot save --services failed: %s", stderr)
 
-	assert.Equal(t, "services=s3,dynamodb", capturedQuery(), "request must carry exactly the requested services")
-	assert.Contains(t, stdout, "Snapshot saved")
-	assert.Contains(t, stdout, "Services: s3, dynamodb")
+	must.Eq(t, "services=s3,dynamodb", capturedQuery(), "request must carry exactly the requested services")
+	must.Contains(t, stdout, "Snapshot saved")
+	must.Contains(t, stdout, "Services: s3, dynamodb")
 
 	_, statErr := os.Stat(dest)
-	require.NoError(t, statErr, "snapshot file should have been created")
+	must.NoError(t, statErr, "snapshot file should have been created")
 }
 
 func TestSnapshotSaveS3WithServices(t *testing.T) {
@@ -606,7 +605,7 @@ func TestSnapshotSaveS3WithServices(t *testing.T) {
 			With(env.AWSSecretAccessKey, "topsecret"),
 		"--non-interactive", "snapshot", "save", "my-pod", s3URL, "--services", "s3,lambda",
 	)
-	require.NoError(t, err, "lstk snapshot save to s3 with --services failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot save to s3 with --services failed: %s", stderr)
 
 	_, saveBody := captured()
 	var parsed struct {
@@ -614,8 +613,8 @@ func TestSnapshotSaveS3WithServices(t *testing.T) {
 			Services []string `json:"services"`
 		} `json:"attributes"`
 	}
-	require.NoError(t, json.Unmarshal(saveBody, &parsed))
-	assert.Equal(t, []string{"s3", "lambda"}, parsed.Attributes.Services)
+	must.NoError(t, json.Unmarshal(saveBody, &parsed))
+	must.Eq(t, []string{"s3", "lambda"}, parsed.Attributes.Services)
 }
 
 func TestSnapshotSaveEmulatorNotRunning(t *testing.T) {
@@ -649,7 +648,7 @@ func TestSnapshotSaveEmulatorNotRunning(t *testing.T) {
 			}
 			stdout, _, err := runLstk(t, ctx, t.TempDir(), e, tc.args...)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stdout, "not running")
+			must.Contains(t, stdout, "not running")
 		})
 	}
 }
@@ -668,7 +667,7 @@ func TestSnapshotSaveInvalidParentDir(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "/no/such/dir/state",
 	)
 	requireExitCode(t, 1, err)
-	assert.NotEmpty(t, stderr)
+	must.NotEmpty(t, stderr)
 }
 
 func TestSnapshotSaveTelemetryEmitted(t *testing.T) {
@@ -685,7 +684,7 @@ func TestSnapshotSaveTelemetryEmitted(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)).With(env.AnalyticsEndpoint, analyticsSrv.URL),
 		"--non-interactive", "snapshot", "save",
 	)
-	require.NoError(t, err, "lstk snapshot save failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot save failed: %s", stderr)
 	assertCommandTelemetry(t, events, "snapshot save", 0)
 }
 
@@ -722,16 +721,16 @@ func TestSaveAliasMatchesSnapshotSave(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)).With(env.AnalyticsEndpoint, analyticsSrv.URL),
 		"--non-interactive", "save", outPath,
 	)
-	require.NoError(t, err, "lstk save failed: %s", stderr)
-	assert.Contains(t, stdout, "Snapshot saved")
+	must.NoError(t, err, "lstk save failed: %s", stderr)
+	must.Contains(t, stdout, "Snapshot saved")
 
 	data, err := os.ReadFile(outPath)
-	require.NoError(t, err, "output file should exist")
-	assert.True(t, len(data) > 0, "output file should be non-empty")
+	must.NoError(t, err, "output file should exist")
+	must.True(t, len(data) > 0, "output file should be non-empty")
 
 	r, err := zip.NewReader(bytes.NewReader(data), int64(len(data)))
-	require.NoError(t, err, "output file should be a valid ZIP")
-	assert.NotEmpty(t, r.File)
+	must.NoError(t, err, "output file should be a valid ZIP")
+	must.NotEmpty(t, r.File)
 
 	// Alias must emit telemetry under the canonical name so usage isn't
 	// split across "save" and "snapshot save" labels.
@@ -752,6 +751,6 @@ func TestSnapshotSaveInteractive(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"snapshot", "save", filepath.Join(dir, "snap"),
 	)
-	require.NoError(t, err, "interactive lstk snapshot save failed")
-	assert.Contains(t, out, "Snapshot saved")
+	must.NoError(t, err, "interactive lstk snapshot save failed")
+	must.Contains(t, out, "Snapshot saved")
 }
diff --git a/test/integration/snapshot_show_test.go b/test/integration/snapshot_show_test.go
index d51e04e5..7febd53c 100644
--- a/test/integration/snapshot_show_test.go
+++ b/test/integration/snapshot_show_test.go
@@ -8,9 +8,9 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // showCapture records what the single-pod platform endpoint received.
@@ -77,21 +77,13 @@ func TestSnapshotShowSuccessWithoutDocker(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "show", "pod:my-baseline",
 	)
-	require.NoError(t, err, "lstk snapshot show failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot show failed: %s", stderr)
 
 	called, path, _ := cap.get()
-	require.True(t, called, "the single-pod endpoint should have been called")
-	assert.Equal(t, "/v1/cloudpods/my-baseline", path)
-
-	assert.Contains(t, stdout, "my-baseline")
-	assert.Contains(t, stdout, "2026-04-15 14:32 UTC")
-	assert.Contains(t, stdout, "47.3 MB")
-	assert.Contains(t, stdout, "2026.03")
-	assert.Contains(t, stdout, "Pre-refactor baseline")
-	assert.Contains(t, stdout, "s3, lambda, dynamodb, sqs")
-	assert.Contains(t, stdout, "Resources")
-	assert.Contains(t, stdout, "3 buckets")
-	assert.Contains(t, stdout, "1 function\n", "count of one should use the singular noun")
+	must.True(t, called, "the single-pod endpoint should have been called")
+	must.Eq(t, "/v1/cloudpods/my-baseline", path)
+
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotShowWithoutResources(t *testing.T) {
@@ -105,9 +97,9 @@ func TestSnapshotShowWithoutResources(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "show", "pod:bare",
 	)
-	require.NoError(t, err, "lstk snapshot show failed: %s", stderr)
-	assert.Contains(t, stdout, "s3, sqs")
-	assert.NotContains(t, stdout, "Resources", "Resources section must be omitted when no counts are available")
+	must.NoError(t, err, "lstk snapshot show failed: %s", stderr)
+	must.Contains(t, stdout, "s3, sqs")
+	must.NotContains(t, stdout, "Resources", "Resources section must be omitted when no counts are available")
 }
 
 // TestSnapshotShowPodNameLeadingUnderscore covers a name the platform's
@@ -125,11 +117,11 @@ func TestSnapshotShowPodNameLeadingUnderscore(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "show", "pod:"+name,
 	)
-	require.NoError(t, err, "lstk snapshot show failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot show failed: %s", stderr)
 
 	called, path, _ := cap.get()
-	require.True(t, called, "the single-pod endpoint should have been called")
-	assert.Equal(t, "/v1/cloudpods/"+name, path)
+	must.True(t, called, "the single-pod endpoint should have been called")
+	must.Eq(t, "/v1/cloudpods/"+name, path)
 }
 
 // TestSnapshotShowRejectsPodNameWithPeriod: dots are outside the platform's
@@ -145,11 +137,11 @@ func TestSnapshotShowRejectsPodNameWithPeriod(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "show", "pod:release.v1",
 	)
-	require.Error(t, err, "a dotted pod name must be rejected client-side")
-	assert.Contains(t, stderr, "invalid pod name")
+	must.Error(t, err, "a dotted pod name must be rejected client-side")
+	must.Contains(t, stderr, "invalid pod name")
 
 	called, _, _ := cap.get()
-	assert.False(t, called, "the platform endpoint must not be called for an invalid name")
+	must.False(t, called, "the platform endpoint must not be called for an invalid name")
 }
 
 func TestSnapshotShowSendsBasicAuthHeader(t *testing.T) {
@@ -163,10 +155,10 @@ func TestSnapshotShowSendsBasicAuthHeader(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "show", "pod:p",
 	)
-	require.NoError(t, err, "lstk snapshot show failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot show failed: %s", stderr)
 	_, _, auth := cap.get()
 	expected := "Basic " + base64.StdEncoding.EncodeToString([]byte(":test-token"))
-	assert.Equal(t, expected, auth)
+	must.Eq(t, expected, auth)
 }
 
 func TestSnapshotShowRejectsLocalPath(t *testing.T) {
@@ -183,7 +175,7 @@ func TestSnapshotShowRejectsLocalPath(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "./my-snapshot",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, strings.ToLower(stderr), "local")
+	must.Contains(t, strings.ToLower(stderr), "local")
 }
 
 func TestSnapshotShowNotFound(t *testing.T) {
@@ -199,8 +191,8 @@ func TestSnapshotShowNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "pod:missing",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "not found")
-	assert.Contains(t, stdout, "lstk snapshot list")
+	must.Contains(t, stdout, "not found")
+	must.Contains(t, stdout, "lstk snapshot list")
 }
 
 func TestSnapshotShowRequiresAuthToken(t *testing.T) {
@@ -221,6 +213,6 @@ func TestSnapshotShowRequiresAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Authentication required")
-	assert.Contains(t, stdout, "lstk login")
+	must.Contains(t, stdout, "Authentication required")
+	must.Contains(t, stdout, "lstk login")
 }
diff --git a/test/integration/snapshot_versions_test.go b/test/integration/snapshot_versions_test.go
index b3f8a9f9..70589113 100644
--- a/test/integration/snapshot_versions_test.go
+++ b/test/integration/snapshot_versions_test.go
@@ -6,9 +6,9 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // threeVersionPod is a platform payload with a deliberately out-of-order
@@ -47,26 +47,15 @@ func TestSnapshotVersionsSuccessWithoutDocker(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "versions", "pod:my-baseline",
 	)
-	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
 
 	called, path, _ := cap.get()
-	require.True(t, called, "the single-pod endpoint should have been called")
-	assert.Equal(t, "/v1/cloudpods/my-baseline", path)
-
-	assert.Contains(t, stdout, "~ 3 versions")
-	for _, header := range []string{"VERSION", "CREATED", "LOCALSTACK", "SERVICES"} {
-		assert.Contains(t, stdout, header)
-	}
-	assert.NotContains(t, stdout, "DESCRIPTION", "the description column was dropped in favour of more service names")
-	assert.Contains(t, stdout, "2026-04-15 14:32 UTC")
-	assert.Contains(t, stdout, "s3, lambda")
-	assert.NotContains(t, stdout, "nightly baseline", "the description is no longer rendered")
-
-	// Newest first: version 3's row must precede version 1's.
-	assert.Less(t, strings.Index(stdout, "2026.06"), strings.Index(stdout, "2026.05"),
-		"versions should be listed newest first")
-	assert.Less(t, strings.Index(stdout, "2026.05"), strings.Index(stdout, "2026.04"),
-		"versions should be listed newest first")
+	must.True(t, called, "the single-pod endpoint should have been called")
+	must.Eq(t, "/v1/cloudpods/my-baseline", path)
+
+	// The snapshot pins column set (no DESCRIPTION), newest-first ordering,
+	// and that descriptions are no longer rendered.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestSnapshotVersionsFiltersDeletedVersions: the platform marks removed versions
@@ -86,12 +75,9 @@ func TestSnapshotVersionsFiltersDeletedVersions(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "versions", "pod:p",
 	)
-	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
 
-	assert.Contains(t, stdout, "~ 2 versions", "the deleted version must not be counted")
-	assert.Contains(t, stdout, "keep-one")
-	assert.Contains(t, stdout, "keep-three")
-	assert.NotContains(t, stdout, "gone-two")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotVersionsSingleVersionUsesSingularNoun(t *testing.T) {
@@ -104,8 +90,8 @@ func TestSnapshotVersionsSingleVersionUsesSingularNoun(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "versions", "pod:solo",
 	)
-	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
-	assert.Contains(t, stdout, "~ 1 version\n")
+	must.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
+	must.Contains(t, stdout, "~ 1 version\n")
 }
 
 func TestSnapshotVersionsEmptyHistory(t *testing.T) {
@@ -117,9 +103,9 @@ func TestSnapshotVersionsEmptyHistory(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "versions", "pod:blank",
 	)
-	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
-	assert.Contains(t, stdout, "No versions found for 'pod:blank'")
-	assert.NotContains(t, stdout, "VERSION", "no table should be rendered")
+	must.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
+	must.Contains(t, stdout, "No versions found for 'pod:blank'")
+	must.NotContains(t, stdout, "VERSION", "no table should be rendered")
 }
 
 // TestSnapshotVersionsNoDockerRequired proves the command reads the platform API
@@ -134,8 +120,8 @@ func TestSnapshotVersionsNoDockerRequired(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--non-interactive", "snapshot", "versions", "pod:my-baseline",
 	)
-	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
-	assert.Contains(t, stdout, "~ 3 versions")
+	must.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
+	must.Contains(t, stdout, "~ 3 versions")
 }
 
 func TestSnapshotVersionsRejectsLocalPath(t *testing.T) {
@@ -148,8 +134,8 @@ func TestSnapshotVersionsRejectsLocalPath(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "./my-snapshot",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, strings.ToLower(stderr), "local")
-	assert.Contains(t, stderr, "list versions of local snapshots")
+	must.Contains(t, strings.ToLower(stderr), "local")
+	must.Contains(t, stderr, "list versions of local snapshots")
 }
 
 // TestSnapshotVersionsRejectsS3Ref: S3 remotes are fully supported by
@@ -166,9 +152,9 @@ func TestSnapshotVersionsRejectsS3Ref(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "s3://bucket/prefix",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "only supported for Cloud Pods")
-	assert.Contains(t, stderr, "S3 remotes")
-	assert.NotContains(t, stderr, "coming soon")
+	must.Contains(t, stderr, "only supported for Cloud Pods")
+	must.Contains(t, stderr, "S3 remotes")
+	must.NotContains(t, stderr, "coming soon")
 }
 
 // TestSnapshotVersionsOrasKeepsComingSoon: oras:// is unimplemented for every
@@ -184,7 +170,7 @@ func TestSnapshotVersionsOrasKeepsComingSoon(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "oras://registry/image",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "coming soon")
+	must.Contains(t, stderr, "coming soon")
 }
 
 // TestSnapshotShowPinnedVersion: show is read-only and the platform returns every
@@ -209,13 +195,11 @@ func TestSnapshotShowPinnedVersion(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "show", "pod:my-baseline:1",
 	)
-	require.NoError(t, err, "lstk snapshot show failed: %s", stderr)
+	must.NoError(t, err, "lstk snapshot show failed: %s", stderr)
 
-	assert.Contains(t, stdout, "the first one")
-	assert.Contains(t, stdout, "2026.04")
-	assert.Contains(t, stdout, "1.0 KB")
-	assert.NotContains(t, stdout, "the latest one", "the pinned version's metadata must win")
-	assert.NotContains(t, stdout, "2026.06")
+	// Snapshot of version 1's card: the pinned version's metadata must win
+	// over the latest version's.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotShowVersionNotFound(t *testing.T) {
@@ -229,9 +213,9 @@ func TestSnapshotShowVersionNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "pod:my-baseline:99",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Version 99 of 'pod:my-baseline' not found")
-	assert.Contains(t, stdout, "The highest available version is 3.")
-	assert.Contains(t, stdout, "lstk snapshot versions pod:my-baseline")
+	must.Contains(t, stdout, "Version 99 of 'pod:my-baseline' not found")
+	must.Contains(t, stdout, "The highest available version is 3.")
+	must.Contains(t, stdout, "lstk snapshot versions pod:my-baseline")
 }
 
 // TestSnapshotVersionsRejectsVersionSuffix: this command lists every version, so
@@ -246,7 +230,7 @@ func TestSnapshotVersionsRejectsVersionSuffix(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:my-baseline:3",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "drop the ':3'")
+	must.Contains(t, stderr, "drop the ':3'")
 }
 
 func TestSnapshotVersionsRejectsInvalidPodName(t *testing.T) {
@@ -259,7 +243,7 @@ func TestSnapshotVersionsRejectsInvalidPodName(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:release.v1",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "invalid pod name")
+	must.Contains(t, stderr, "invalid pod name")
 }
 
 func TestSnapshotVersionsNotFound(t *testing.T) {
@@ -275,8 +259,8 @@ func TestSnapshotVersionsNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:missing",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "not found")
-	assert.Contains(t, stdout, "lstk snapshot list")
+	must.Contains(t, stdout, "not found")
+	must.Contains(t, stdout, "lstk snapshot list")
 }
 
 func TestSnapshotVersionsRequiresAuthToken(t *testing.T) {
@@ -291,6 +275,6 @@ func TestSnapshotVersionsRequiresAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Authentication required")
-	assert.Contains(t, stdout, "lstk login")
+	must.Contains(t, stdout, "Authentication required")
+	must.Contains(t, stdout, "lstk login")
 }
diff --git a/test/integration/start_snapshot_test.go b/test/integration/start_snapshot_test.go
index 26bc6986..3b941178 100644
--- a/test/integration/start_snapshot_test.go
+++ b/test/integration/start_snapshot_test.go
@@ -5,9 +5,8 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // --- no Docker required (parallel) ---
@@ -21,7 +20,7 @@ func TestStartSnapshotConflictingFlags(t *testing.T) {
 		"--non-interactive", "start", "--snapshot", "pod:my-baseline", "--no-snapshot",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "cannot be used together")
+	must.Contains(t, stderr, "cannot be used together")
 }
 
 func TestStartSnapshotInvalidPodName(t *testing.T) {
@@ -33,7 +32,7 @@ func TestStartSnapshotInvalidPodName(t *testing.T) {
 		"--non-interactive", "start", "--snapshot", "pod:bad.name",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "invalid pod name")
+	must.Contains(t, stderr, "invalid pod name")
 }
 
 func TestStartSnapshotLocalFileNotFound(t *testing.T) {
@@ -45,7 +44,7 @@ func TestStartSnapshotLocalFileNotFound(t *testing.T) {
 		"--non-interactive", "start", "--snapshot", "/no/such/snapshot.snapshot",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "snapshot file not found")
+	must.Contains(t, stderr, "snapshot file not found")
 }
 
 // --- Docker required ---
@@ -73,17 +72,17 @@ port = "4566"
 snapshot = "pod:my-baseline"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "",
 		env.With(env.APIEndpoint, licenseServer.URL).With(env.LocalStackHost, lsHost(podServer)),
 		"--config", configFile, "start",
 	)
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "Snapshot loaded", "configured snapshot should auto-load after start")
-	assert.Contains(t, stdout, "my-baseline")
+	must.Contains(t, stdout, "Snapshot loaded", "configured snapshot should auto-load after start")
+	must.Contains(t, stdout, "my-baseline")
 }
 
 // TestStartNoSnapshotSkipsAutoLoad verifies that --no-snapshot skips auto-loading
@@ -106,14 +105,14 @@ port = "4566"
 snapshot = "pod:my-baseline"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "",
 		env.With(env.APIEndpoint, licenseServer.URL),
 		"--config", configFile, "start", "--no-snapshot",
 	)
-	require.NoError(t, err, "lstk start --no-snapshot failed: %s", stderr)
+	must.NoError(t, err, "lstk start --no-snapshot failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.NotContains(t, stdout, "Snapshot loaded", "--no-snapshot should skip auto-loading")
+	must.NotContains(t, stdout, "Snapshot loaded", "--no-snapshot should skip auto-loading")
 }
diff --git a/test/integration/start_test.go b/test/integration/start_test.go
index 18d9e4b1..44fd0545 100644
--- a/test/integration/start_test.go
+++ b/test/integration/start_test.go
@@ -20,11 +20,10 @@ import (
 	"time"
 
 	"github.com/creack/pty"
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/api/types/network"
 	"github.com/moby/moby/client"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 const snowflakeContainerName = "localstack-snowflake"
@@ -41,14 +40,14 @@ func TestStartCommandSucceedsWithValidToken(t *testing.T) {
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
-	assert.True(t, inspect.Container.State.Running, "container should be running")
+	must.NoError(t, err, "failed to inspect container")
+	must.True(t, inspect.Container.State.Running, "container should be running")
 
-	assert.NotContains(t, stdout, "• Persistence:",
+	must.NotContains(t, stdout, "• Persistence:",
 		"persistence bullet must be omitted when --persist is not set")
 }
 
@@ -69,18 +68,18 @@ func TestStartCommandReusesLocalImageWhenPresent(t *testing.T) {
 	const pinnedTag = "reuse-local-test"
 	const pinnedImage = "localstack/localstack-pro:" + pinnedTag
 	reader, err := dockerClient.ImagePull(ctx, testImage, client.ImagePullOptions{})
-	require.NoError(t, err, "failed to pull test image")
+	must.NoError(t, err, "failed to pull test image")
 	_, _ = io.Copy(io.Discard, reader)
 	_ = reader.Close()
 	_, err = dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: pinnedImage})
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), pinnedImage, client.ImageRemoveOptions{})
 	})
 
 	home := t.TempDir()
 	configFile := filepath.Join(home, "config.toml")
-	require.NoError(t, os.WriteFile(configFile,
+	must.NoError(t, os.WriteFile(configFile,
 		[]byte(fmt.Sprintf("[[containers]]\ntype = \"aws\"\ntag = %q\nport = \"4599\"\n", pinnedTag)), 0644))
 
 	mockServer := createMockLicenseServer(true)
@@ -91,8 +90,8 @@ func TestStartCommandReusesLocalImageWhenPresent(t *testing.T) {
 		string(env.AuthToken)+"=fake-token")
 	stdout, _, _ := runLstk(t, ctx, "", e, "--config", configFile, "start")
 
-	assert.Contains(t, stdout, "Using local image "+pinnedImage, "a pinned image present locally should be reused")
-	assert.NotContains(t, stdout, "Pulling", "lstk must not re-pull an image that is already present")
+	must.Contains(t, stdout, "Using local image "+pinnedImage, "a pinned image present locally should be reused")
+	must.NotContains(t, stdout, "Pulling", "lstk must not re-pull an image that is already present")
 }
 
 // A container that exits during startup must fail with a styled
@@ -109,11 +108,11 @@ func TestStartFailsWhenContainerExitsDuringStartup(t *testing.T) {
 	const pinnedTag = "exit-during-startup-test"
 	const pinnedImage = "localstack/localstack-pro:" + pinnedTag
 	reader, err := dockerClient.ImagePull(ctx, testImage, client.ImagePullOptions{})
-	require.NoError(t, err, "failed to pull test image")
+	must.NoError(t, err, "failed to pull test image")
 	_, _ = io.Copy(io.Discard, reader)
 	_ = reader.Close()
 	_, err = dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: pinnedImage})
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), pinnedImage, client.ImageRemoveOptions{})
 	})
@@ -126,7 +125,7 @@ func TestStartFailsWhenContainerExitsDuringStartup(t *testing.T) {
 
 	home := t.TempDir()
 	configFile := filepath.Join(home, "config.toml")
-	require.NoError(t, os.WriteFile(configFile,
+	must.NoError(t, os.WriteFile(configFile,
 		[]byte(fmt.Sprintf("[[containers]]\ntype = \"aws\"\ntag = %q\nport = \"4599\"\n", pinnedTag)), 0644))
 
 	mockServer := createMockLicenseServer(true)
@@ -137,11 +136,11 @@ func TestStartFailsWhenContainerExitsDuringStartup(t *testing.T) {
 		string(env.AuthToken)+"=fake-token")
 	stdout, stderr, err := runLstk(t, ctx, "", e, "--config", configFile, "--non-interactive", "start")
 
-	require.Error(t, err, "expected start to fail when the container exits during startup")
+	must.Error(t, err, "expected start to fail when the container exits during startup")
 	requireExitCode(t, 1, err)
 	combined := stdout + stderr
-	assert.Contains(t, combined, "exited unexpectedly", "the failure must be surfaced as a styled error")
-	assert.Contains(t, combined, "exit code 0", "the captured exit code must be reported")
+	must.Contains(t, combined, "exited unexpectedly", "the failure must be surfaced as a styled error")
+	must.Contains(t, combined, "exit code 0", "the captured exit code must be reported")
 }
 
 // A container that stays running but never serves /_localstack/health must not wait forever.
@@ -160,11 +159,11 @@ func TestStartFailsWhenContainerNeverBecomesHealthy(t *testing.T) {
 	const pinnedTag = "never-healthy-test"
 	const pinnedImage = "localstack/localstack-pro:" + pinnedTag
 	reader, err := dockerClient.ImagePull(ctx, standInImage, client.ImagePullOptions{})
-	require.NoError(t, err, "failed to pull nginx test image")
+	must.NoError(t, err, "failed to pull nginx test image")
 	_, _ = io.Copy(io.Discard, reader)
 	_ = reader.Close()
 	_, err = dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: standInImage, Target: pinnedImage})
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), pinnedImage, client.ImageRemoveOptions{})
 	})
@@ -178,7 +177,7 @@ func TestStartFailsWhenContainerNeverBecomesHealthy(t *testing.T) {
 
 	home := t.TempDir()
 	configFile := filepath.Join(home, "config.toml")
-	require.NoError(t, os.WriteFile(configFile,
+	must.NoError(t, os.WriteFile(configFile,
 		[]byte(fmt.Sprintf("[[containers]]\ntype = \"aws\"\ntag = %q\nport = \"4599\"\n", pinnedTag)), 0644))
 
 	mockServer := createMockLicenseServer(true)
@@ -190,12 +189,12 @@ func TestStartFailsWhenContainerNeverBecomesHealthy(t *testing.T) {
 		string(env.StartupTimeout)+"=5s")
 	stdout, stderr, err := runLstk(t, ctx, "", e, "--config", configFile, "--non-interactive", "start")
 
-	require.Error(t, err, "expected start to fail when the container never becomes healthy")
+	must.Error(t, err, "expected start to fail when the container never becomes healthy")
 	requireExitCode(t, 1, err)
 	combined := stdout + stderr
-	assert.Contains(t, combined, "did not become ready within 5s", "the bounded timeout must be surfaced")
-	assert.Contains(t, combined, "lstk logs", "the guidance must point at lstk logs")
-	assert.Contains(t, combined, "lstk stop", "the guidance must point at lstk stop")
+	must.Contains(t, combined, "did not become ready within 5s", "the bounded timeout must be surfaced")
+	must.Contains(t, combined, "lstk logs", "the guidance must point at lstk logs")
+	must.Contains(t, combined, "lstk stop", "the guidance must point at lstk stop")
 }
 
 // Interrupting a start while it awaits readiness (Ctrl+C / SIGINT) renders no
@@ -219,11 +218,11 @@ func TestStartEmitsTelemetryWhenInterruptedDuringStartup(t *testing.T) {
 	const pinnedTag = "interrupted-startup-test"
 	const pinnedImage = "localstack/localstack-pro:" + pinnedTag
 	reader, err := dockerClient.ImagePull(ctx, standInImage, client.ImagePullOptions{})
-	require.NoError(t, err, "failed to pull nginx test image")
+	must.NoError(t, err, "failed to pull nginx test image")
 	_, _ = io.Copy(io.Discard, reader)
 	_ = reader.Close()
 	_, err = dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: standInImage, Target: pinnedImage})
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), pinnedImage, client.ImageRemoveOptions{})
 	})
@@ -237,7 +236,7 @@ func TestStartEmitsTelemetryWhenInterruptedDuringStartup(t *testing.T) {
 
 	home := t.TempDir()
 	configFile := filepath.Join(home, "config.toml")
-	require.NoError(t, os.WriteFile(configFile,
+	must.NoError(t, os.WriteFile(configFile,
 		[]byte(fmt.Sprintf("[[containers]]\ntype = \"aws\"\ntag = %q\nport = \"4599\"\n", pinnedTag)), 0644))
 
 	mockServer := createMockLicenseServer(true)
@@ -245,7 +244,7 @@ func TestStartEmitsTelemetryWhenInterruptedDuringStartup(t *testing.T) {
 	analyticsSrv, events := mockAnalyticsServer(t)
 
 	binPath, err := filepath.Abs(binaryPath())
-	require.NoError(t, err)
+	must.NoError(t, err)
 	cmd := exec.CommandContext(ctx, binPath, "--config", configFile, "--non-interactive", "start")
 	cmd.Env = append(testEnvWithHome(home, ""),
 		string(env.APIEndpoint)+"="+mockServer.URL,
@@ -254,25 +253,25 @@ func TestStartEmitsTelemetryWhenInterruptedDuringStartup(t *testing.T) {
 	out := &syncBuffer{}
 	cmd.Stdout = out
 	cmd.Stderr = out
-	require.NoError(t, cmd.Start())
+	must.NoError(t, cmd.Start())
 
 	// Interrupt only once the container is running, so the SIGINT lands in the
 	// readiness wait rather than during container creation.
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		inspect, ierr := dockerClient.ContainerInspect(ctx, wantContainer, client.ContainerInspectOptions{})
 		return ierr == nil && inspect.Container.State.Running
 	}, 60*time.Second, 100*time.Millisecond, "container never started; output:\n%s", out.String())
-	require.NoError(t, cmd.Process.Signal(os.Interrupt))
+	must.NoError(t, cmd.Process.Signal(os.Interrupt))
 	_ = cmd.Wait()
 
 	byName := collectTelemetryByName(t, events, 2)
 	lifecycle, ok := byName["lstk_lifecycle"]
-	require.True(t, ok, "an interrupted start must still emit a lifecycle telemetry event")
+	must.True(t, ok, "an interrupted start must still emit a lifecycle telemetry event")
 	lifePayload, _ := lifecycle["payload"].(map[string]any)
-	assert.Equal(t, "start_error", lifePayload["event_type"])
-	assert.Equal(t, "start_failed", lifePayload["error_code"])
-	assert.Contains(t, lifePayload["error_msg"], "context canceled")
-	assert.Contains(t, byName, "lstk_command")
+	must.Eq(t, "start_error", lifePayload["event_type"])
+	must.Eq(t, "start_failed", lifePayload["error_code"])
+	must.Contains(t, lifePayload["error_msg"], "context canceled")
+	must.Contains(t, byName, "lstk_command")
 }
 
 func TestStartCommandSucceedsWithKeyringToken(t *testing.T) {
@@ -283,7 +282,7 @@ func TestStartCommandSucceedsWithKeyringToken(t *testing.T) {
 	// Store token in keyring before running command
 	authToken := env.Require(t, env.AuthToken)
 	err := SetAuthTokenInKeyring(authToken)
-	require.NoError(t, err, "failed to store token in keyring")
+	must.NoError(t, err, "failed to store token in keyring")
 
 	mockServer := createMockLicenseServer(true)
 	defer mockServer.Close()
@@ -291,12 +290,12 @@ func TestStartCommandSucceedsWithKeyringToken(t *testing.T) {
 	ctx := testContext(t)
 	// Run without LOCALSTACK_AUTH_TOKEN should use keyring
 	_, stderr, err := runLstk(t, ctx, "", env.Without(env.AuthToken).With(env.APIEndpoint, mockServer.URL), "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
-	assert.True(t, inspect.Container.State.Running, "container should be running")
+	must.NoError(t, err, "failed to inspect container")
+	must.True(t, inspect.Container.State.Running, "container should be running")
 }
 
 func TestStartCommandFailsWithInvalidToken(t *testing.T) {
@@ -308,9 +307,9 @@ func TestStartCommandFailsWithInvalidToken(t *testing.T) {
 	defer mockServer.Close()
 
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AuthToken, "invalid-token").With(env.APIEndpoint, mockServer.URL), "start")
-	require.Error(t, err, "expected lstk start to fail with invalid token")
+	must.Error(t, err, "expected lstk start to fail with invalid token")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "License validation failed")
+	must.Contains(t, stdout, "License validation failed")
 }
 
 func TestStartCommandDoesNothingWhenAlreadyRunning(t *testing.T) {
@@ -323,9 +322,9 @@ func TestStartCommandDoesNothingWhenAlreadyRunning(t *testing.T) {
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.AuthToken, "fake-token").With(env.AnalyticsEndpoint, analyticsSrv.URL), "start")
-	require.NoError(t, err, "lstk start should succeed when container is already running: %s", stderr)
+	must.NoError(t, err, "lstk start should succeed when container is already running: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "already running")
+	must.Contains(t, stdout, "already running")
 	assertCommandTelemetry(t, events, "start", 0)
 }
 
@@ -336,21 +335,21 @@ func TestStartCommandFailsWhenPortInUse(t *testing.T) {
 
 	// Simulates port in use by non-LocalStack process (/_localstack/info will fail)
 	ln, err := net.Listen("tcp", ":4566")
-	require.NoError(t, err, "failed to bind port 4566 for test")
+	must.NoError(t, err, "failed to bind port 4566 for test")
 	defer func() { _ = ln.Close() }()
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AuthToken, "fake-token").With(env.AnalyticsEndpoint, analyticsSrv.URL), "start")
-	require.Error(t, err, "expected lstk start to fail when port is in use")
+	must.Error(t, err, "expected lstk start to fail when port is in use")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Port 4566 already in use")
-	assert.Contains(t, stdout, "Free the port or configure a different one.")
-	assert.Contains(t, stdout, "Use another port in the configuration:")
+	must.Contains(t, stdout, "Port 4566 already in use")
+	must.Contains(t, stdout, "Free the port or configure a different one.")
+	must.Contains(t, stdout, "Use another port in the configuration:")
 
 	// Both lstk_lifecycle (start_error) and lstk_command events should be emitted.
 	byName := collectTelemetryByName(t, events, 2)
-	assert.Contains(t, byName, "lstk_lifecycle")
-	assert.Contains(t, byName, "lstk_command")
+	must.Contains(t, byName, "lstk_lifecycle")
+	must.Contains(t, byName, "lstk_command")
 }
 
 func TestStartDoesNotHangWithExternalContainerAndNoCachedLabel(t *testing.T) {
@@ -365,7 +364,7 @@ func TestStartDoesNotHangWithExternalContainerAndNoCachedLabel(t *testing.T) {
 
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -376,14 +375,14 @@ func TestStartDoesNotHangWithExternalContainerAndNoCachedLabel(t *testing.T) {
 	// trigger emulator selection and block on keyboard input.
 	home := t.TempDir()
 	configFile := filepath.Join(home, "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte("[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte("[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
 
 	stdout, err := runLstkInPTY(t, ctx,
 		env.With(env.AuthToken, "fake-token").With(env.Home, home),
 		"start", "--config", configFile,
 	)
-	require.NoError(t, err, "lstk start hung: TUI did not exit when external container was running and no plan label was cached")
-	assert.Contains(t, stdout, "already running")
+	must.NoError(t, err, "lstk start hung: TUI did not exit when external container was running and no plan label was cached")
+	must.Contains(t, stdout, "already running")
 }
 
 func TestStartCommandAttachesToExternalContainer(t *testing.T) {
@@ -395,7 +394,7 @@ func TestStartCommandAttachesToExternalContainer(t *testing.T) {
 
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -405,9 +404,9 @@ func TestStartCommandAttachesToExternalContainer(t *testing.T) {
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.AuthToken, "fake-token").With(env.AnalyticsEndpoint, analyticsSrv.URL), "start")
-	require.NoError(t, err, "lstk start should succeed when external container is running: %s", stderr)
+	must.NoError(t, err, "lstk start should succeed when external container is running: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "already running")
+	must.Contains(t, stdout, "already running")
 	assertCommandTelemetry(t, events, "start", 0)
 }
 
@@ -418,7 +417,7 @@ func TestStartCommandAttachesWhenLocalStackRespondingOnPort(t *testing.T) {
 
 	// Serve a mock /_localstack/info on port 4566 so lstk can identify the running version.
 	ln, err := net.Listen("tcp", ":4566")
-	require.NoError(t, err, "failed to bind port 4566 for test")
+	must.NoError(t, err, "failed to bind port 4566 for test")
 	srv := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/_localstack/info" {
 			w.Header().Set("Content-Type", "application/json")
@@ -432,10 +431,10 @@ func TestStartCommandAttachesWhenLocalStackRespondingOnPort(t *testing.T) {
 	defer srv.Close()
 
 	stdout, stderr, err := runLstk(t, testContext(t), "", env.With(env.AuthToken, "fake-token"), "start")
-	require.NoError(t, err, "lstk start should succeed when LocalStack is already running: %s", stderr)
+	must.NoError(t, err, "lstk start should succeed when LocalStack is already running: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "3.4.0")
-	assert.Contains(t, stdout, "already running")
+	must.Contains(t, stdout, "3.4.0")
+	must.Contains(t, stdout, "already running")
 }
 
 func TestStartCommandFailsWhenLocalStackRunningOnDifferentPort(t *testing.T) {
@@ -448,7 +447,7 @@ func TestStartCommandFailsWhenLocalStackRunningOnDifferentPort(t *testing.T) {
 	// Tag the test image as a LocalStack pro image to simulate an instance running.
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -462,13 +461,13 @@ type = "aws"
 port = "4567"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, _, err := runLstk(t, ctx, "", env.With(env.AuthToken, "fake-token").With(env.AnalyticsEndpoint, analyticsSrv.URL), "--config", configFile, "start")
-	require.Error(t, err, "expected lstk start to fail when LS is already running on a different port")
+	must.Error(t, err, "expected lstk start to fail when LS is already running on a different port")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "already running")
+	must.Contains(t, stdout, "already running")
 	assertCommandTelemetry(t, events, "start", 1)
 }
 
@@ -484,7 +483,7 @@ func TestStartCommandFailsOnEmulatorTypeMismatch(t *testing.T) {
 	// Tag the test image as a LocalStack pro image to simulate AWS LocalStack running.
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -496,26 +495,26 @@ func TestStartCommandFailsOnEmulatorTypeMismatch(t *testing.T) {
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, _, err := runLstk(t, ctx, "", env.With(env.AuthToken, "fake-token").With(env.AnalyticsEndpoint, analyticsSrv.URL), "--config", configFile, "start")
-	require.Error(t, err, "lstk start should fail on emulator type mismatch")
+	must.Error(t, err, "lstk start should fail on emulator type mismatch")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "LocalStack AWS Emulator is running on port 4566")
-	assert.Contains(t, stdout, "Your config specifies the LocalStack Snowflake Emulator")
-	assert.Contains(t, stdout, "docker stop localstack-external-aws")
+	must.Contains(t, stdout, "LocalStack AWS Emulator is running on port 4566")
+	must.Contains(t, stdout, "Your config specifies the LocalStack Snowflake Emulator")
+	must.Contains(t, stdout, "docker stop localstack-external-aws")
 
 	byName := collectTelemetryByName(t, events, 2)
 	cmdPayload, _ := byName["lstk_command"]["payload"].(map[string]any)
 	cmdParams, _ := cmdPayload["parameters"].(map[string]any)
 	cmdResult, _ := cmdPayload["result"].(map[string]any)
-	assert.Equal(t, "start", cmdParams["command"])
-	assert.InDelta(t, 1, cmdResult["exit_code"], 0)
+	must.Eq(t, "start", cmdParams["command"])
+	must.InDelta(t, 1, cmdResult["exit_code"], 0)
 
 	lifecycle, ok := byName["lstk_lifecycle"]
-	require.True(t, ok, "expected lstk_lifecycle telemetry event")
+	must.True(t, ok, "expected lstk_lifecycle telemetry event")
 	lifePayload, _ := lifecycle["payload"].(map[string]any)
-	assert.Equal(t, "start_error", lifePayload["event_type"])
-	assert.Equal(t, "emulator_mismatch", lifePayload["error_code"])
-	assert.Equal(t, "snowflake", lifePayload["emulator"])
-	assert.Contains(t, lifePayload["error_msg"], "running aws on port 4566, configured snowflake")
+	must.Eq(t, "start_error", lifePayload["event_type"])
+	must.Eq(t, "emulator_mismatch", lifePayload["error_code"])
+	must.Eq(t, "snowflake", lifePayload["emulator"])
+	must.Contains(t, lifePayload["error_msg"], "running aws on port 4566, configured snowflake")
 }
 
 func TestStartCommandSucceedsWithNonDefaultPort(t *testing.T) {
@@ -535,16 +534,16 @@ tag = "latest"
 port = "4567"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
+	must.NoError(t, err, "failed to inspect container")
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	assert.Equal(t, "localhost.localstack.cloud:4567", envVars["LOCALSTACK_HOST"],
+	must.Eq(t, "localhost.localstack.cloud:4567", envVars["LOCALSTACK_HOST"],
 		"LOCALSTACK_HOST must reflect configured host port so LocalStack accepts requests on it")
 }
 
@@ -572,25 +571,24 @@ env = ["expose"]
 GATEWAY_LISTEN = "0.0.0.0:4566,0.0.0.0:443,0.0.0.0:8443"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
+	must.NoError(t, err, "failed to inspect container")
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	assert.Equal(t, "0.0.0.0:4566,0.0.0.0:443,0.0.0.0:8443", envVars["GATEWAY_LISTEN"],
+	must.Eq(t, "0.0.0.0:4566,0.0.0.0:443,0.0.0.0:8443", envVars["GATEWAY_LISTEN"],
 		"configured GATEWAY_LISTEN must be passed to the container")
 
 	for _, p := range []string{"4566/tcp", "443/tcp", "8443/tcp", "4510/tcp"} {
 		bindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort(p)]
-		if assert.NotEmpty(t, bindings, "port %s should be bound", p) {
-			assert.Equal(t, "0.0.0.0", bindings[0].HostIP.String(),
-				"port %s should bind to the host IP from GATEWAY_LISTEN", p)
-		}
+		must.NotEmpty(t, bindings, "port %s should be bound", p)
+		must.Eq(t, "0.0.0.0", bindings[0].HostIP.String(),
+			"port %s should bind to the host IP from GATEWAY_LISTEN", p)
 	}
 }
 
@@ -616,14 +614,14 @@ port = "4566"
 expose_ports = [15353, "15354:15355/udp"]
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
+	must.NoError(t, err, "failed to inspect container")
 
 	// A bare port is published on the same host port for both protocols (DNS needs
 	// both); an entry with an explicit host port and protocol is published as written.
@@ -634,12 +632,11 @@ expose_ports = [15353, "15354:15355/udp"]
 	}
 	for port, hostPort := range expected {
 		bindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort(port)]
-		if assert.NotEmpty(t, bindings, "port %s should be bound", port) {
-			assert.Equal(t, hostPort, bindings[0].HostPort)
-			assert.Equal(t, "127.0.0.1", bindings[0].HostIP.String())
-		}
+		must.NotEmpty(t, bindings, "port %s should be bound", port)
+		must.Eq(t, hostPort, bindings[0].HostPort)
+		must.Eq(t, "127.0.0.1", bindings[0].HostIP.String())
 	}
-	assert.Empty(t, inspect.Container.HostConfig.PortBindings[network.MustParsePort("15355/tcp")],
+	must.Empty(t, inspect.Container.HostConfig.PortBindings[network.MustParsePort("15355/tcp")],
 		"an entry that names udp must not also publish tcp")
 }
 
@@ -666,22 +663,22 @@ port = "4566"
 expose_ports = ["8080:4566"]
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
-	assert.Contains(t, stdout+stderr, "Ignoring expose_ports entry 8080:4566/tcp",
+	must.NoError(t, err, "lstk start failed: %s", stderr)
+	must.Contains(t, stdout+stderr, "Ignoring expose_ports entry 8080:4566/tcp",
 		"expected a warning explaining why the entry was dropped")
-	assert.Contains(t, stdout+stderr, "already publishes container port 4566/tcp on host port 4566")
+	must.Contains(t, stdout+stderr, "already publishes container port 4566/tcp on host port 4566")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
+	must.NoError(t, err, "failed to inspect container")
 
 	edgeBindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort("4566/tcp")]
-	require.NotEmpty(t, edgeBindings, "the edge port must still be published")
-	assert.Equal(t, "4566", edgeBindings[0].HostPort, "the edge port's host binding must be unchanged")
-	assert.Empty(t, inspect.Container.HostConfig.PortBindings[network.MustParsePort("8080/tcp")],
+	must.NotEmpty(t, edgeBindings, "the edge port must still be published")
+	must.Eq(t, "4566", edgeBindings[0].HostPort, "the edge port's host binding must be unchanged")
+	must.Empty(t, inspect.Container.HostConfig.PortBindings[network.MustParsePort("8080/tcp")],
 		"the conflicting host port must not be published")
 }
 
@@ -707,24 +704,23 @@ port = "4566"
 expose_ports = ["4566/udp"]
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
-	assert.NotContains(t, stdout+stderr, "Ignoring expose_ports entry",
+	must.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NotContains(t, stdout+stderr, "Ignoring expose_ports entry",
 		"a new protocol on the edge port does not collide with anything and needs no warning")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
+	must.NoError(t, err, "failed to inspect container")
 
 	udpBindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort("4566/udp")]
-	if assert.NotEmpty(t, udpBindings, "4566/udp should now be published") {
-		assert.Equal(t, "4566", udpBindings[0].HostPort)
-	}
+	must.NotEmpty(t, udpBindings, "4566/udp should now be published")
+	must.Eq(t, "4566", udpBindings[0].HostPort)
 	tcpBindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort("4566/tcp")]
-	require.NotEmpty(t, tcpBindings, "4566/tcp must remain published")
-	assert.Equal(t, "4566", tcpBindings[0].HostPort)
+	must.NotEmpty(t, tcpBindings, "4566/tcp must remain published")
+	must.Eq(t, "4566", tcpBindings[0].HostPort)
 }
 
 // TestStartCommandFailsWhenExposedPortIsTaken covers a busy host port requested via
@@ -737,7 +733,7 @@ func TestStartCommandFailsWhenExposedPortIsTaken(t *testing.T) {
 	t.Cleanup(cleanup)
 
 	ln, err := net.Listen("tcp", ":15360")
-	require.NoError(t, err, "failed to bind port 15360 for test")
+	must.NoError(t, err, "failed to bind port 15360 for test")
 	defer func() { _ = ln.Close() }()
 
 	configContent := `
@@ -748,13 +744,13 @@ port = "4566"
 expose_ports = [15360]
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AuthToken, "fake-token"), "--config", configFile, "start")
-	require.Error(t, err, "expected lstk start to fail when a requested expose_ports port is in use")
+	must.Error(t, err, "expected lstk start to fail when a requested expose_ports port is in use")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Port 15360 is already in use")
-	assert.Contains(t, stdout, "LocalStack requires this port. Free it before starting.")
+	must.Contains(t, stdout, "Port 15360 is already in use")
+	must.Contains(t, stdout, "LocalStack requires this port. Free it before starting.")
 }
 
 // TestStartCommandPublishesOnlyDefaultPortsWhenExposePortsUnset pins the no-op case:
@@ -772,10 +768,10 @@ func TestStartCommandPublishesOnlyDefaultPortsWhenExposePortsUnset(t *testing.T)
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
+	must.NoError(t, err, "failed to inspect container")
 
 	wantPublished := map[string]bool{"4566/tcp": true, "443/tcp": true}
 	for p := 4510; p <= 4559; p++ {
@@ -788,7 +784,7 @@ func TestStartCommandPublishesOnlyDefaultPortsWhenExposePortsUnset(t *testing.T)
 			gotPublished[port.String()] = true
 		}
 	}
-	assert.Equal(t, wantPublished, gotPublished, "no expose_ports configured should publish exactly the default port set")
+	must.Eq(t, wantPublished, gotPublished, "no expose_ports configured should publish exactly the default port set")
 }
 
 // TestStartCommandRejectsInvalidExposePorts checks the config surface fails at load
@@ -804,11 +800,11 @@ port = "4566"
 expose_ports = ["53/sctp"]
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	_, stderr, err := runLstk(t, testContext(t), "", testEnvWithHome(t.TempDir(), ""), "--config", configFile, "status")
-	require.Error(t, err)
-	assert.Contains(t, stderr, `protocol must be "tcp" or "udp"`)
+	must.Error(t, err)
+	must.Contains(t, stderr, `protocol must be "tcp" or "udp"`)
 }
 
 func TestStartCommandSetsUpContainerCorrectly(t *testing.T) {
@@ -823,18 +819,18 @@ func TestStartCommandSetsUpContainerCorrectly(t *testing.T) {
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
-	require.True(t, inspect.Container.State.Running)
+	must.NoError(t, err, "failed to inspect container")
+	must.True(t, inspect.Container.State.Running)
 
 	t.Run("environment variables", func(t *testing.T) {
 		envVars := containerEnvToMap(inspect.Container.Config.Env)
-		assert.Equal(t, ":4566,:443", envVars["GATEWAY_LISTEN"])
-		assert.Equal(t, containerName, envVars["MAIN_CONTAINER_NAME"])
-		assert.Equal(t, "localhost.localstack.cloud:4566", envVars["LOCALSTACK_HOST"])
-		assert.NotEmpty(t, envVars["LOCALSTACK_AUTH_TOKEN"])
+		must.Eq(t, ":4566,:443", envVars["GATEWAY_LISTEN"])
+		must.Eq(t, containerName, envVars["MAIN_CONTAINER_NAME"])
+		must.Eq(t, "localhost.localstack.cloud:4566", envVars["LOCALSTACK_HOST"])
+		must.NotEmpty(t, envVars["LOCALSTACK_AUTH_TOKEN"])
 	})
 
 	t.Run("docker socket mount", func(t *testing.T) {
@@ -842,52 +838,51 @@ func TestStartCommandSetsUpContainerCorrectly(t *testing.T) {
 			t.Skip("Docker daemon is not reachable via unix socket")
 		}
 
-		assert.True(t, hasBindTarget(inspect.Container.HostConfig.Binds, "/var/run/docker.sock"),
+		must.True(t, hasBindTarget(inspect.Container.HostConfig.Binds, "/var/run/docker.sock"),
 			"expected Docker socket bind mount to /var/run/docker.sock, got: %v", inspect.Container.HostConfig.Binds)
-		assert.True(t, hasBindSource(inspect.Container.HostConfig.Binds, "/var/run/docker.sock"),
+		must.True(t, hasBindSource(inspect.Container.HostConfig.Binds, "/var/run/docker.sock"),
 			"expected Docker socket bind mount from /var/run/docker.sock, got: %v", inspect.Container.HostConfig.Binds)
 
 		envVars := containerEnvToMap(inspect.Container.Config.Env)
-		assert.Equal(t, "unix:///var/run/docker.sock", envVars["DOCKER_HOST"])
+		must.Eq(t, "unix:///var/run/docker.sock", envVars["DOCKER_HOST"])
 	})
 
 	t.Run("service port range", func(t *testing.T) {
 		for p := 4510; p <= 4559; p++ {
 			port := network.MustParsePort(fmt.Sprintf("%d/tcp", p))
 			bindings := inspect.Container.HostConfig.PortBindings[port]
-			if assert.NotEmpty(t, bindings, "port %d/tcp should be bound", p) {
-				assert.Equal(t, strconv.Itoa(p), bindings[0].HostPort)
-			}
+			must.NotEmpty(t, bindings, "port %d/tcp should be bound", p)
+			must.Eq(t, strconv.Itoa(p), bindings[0].HostPort)
 		}
 	})
 
 	t.Run("main port", func(t *testing.T) {
 		mainBindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort("4566/tcp")]
-		require.NotEmpty(t, mainBindings, "port 4566/tcp should be bound")
-		assert.Equal(t, "4566", mainBindings[0].HostPort)
+		must.NotEmpty(t, mainBindings, "port 4566/tcp should be bound")
+		must.Eq(t, "4566", mainBindings[0].HostPort)
 	})
 
 	t.Run("https port", func(t *testing.T) {
 		httpsBindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort("443/tcp")]
-		require.NotEmpty(t, httpsBindings, "port 443/tcp should be bound")
-		assert.Equal(t, "443", httpsBindings[0].HostPort)
+		must.NotEmpty(t, httpsBindings, "port 443/tcp should be bound")
+		must.Eq(t, "443", httpsBindings[0].HostPort)
 	})
 
 	t.Run("volume mount", func(t *testing.T) {
-		assert.True(t, hasBindTarget(inspect.Container.HostConfig.Binds, "/var/lib/localstack"),
+		must.True(t, hasBindTarget(inspect.Container.HostConfig.Binds, "/var/lib/localstack"),
 			"expected volume bind mount to /var/lib/localstack, got: %v", inspect.Container.HostConfig.Binds)
 	})
 
 	t.Run("auto remove", func(t *testing.T) {
-		assert.True(t, inspect.Container.HostConfig.AutoRemove,
+		must.True(t, inspect.Container.HostConfig.AutoRemove,
 			"expected container to be created with AutoRemove (--rm) so it does not linger after exit")
 	})
 
 	t.Run("http health endpoint", func(t *testing.T) {
 		resp, err := http.Get("http://localhost.localstack.cloud:4566/_localstack/health")
-		require.NoError(t, err)
+		must.NoError(t, err)
 		t.Cleanup(func() { _ = resp.Body.Close() })
-		assert.Equal(t, http.StatusOK, resp.StatusCode)
+		must.Eq(t, http.StatusOK, resp.StatusCode)
 	})
 
 	t.Run("https health endpoint", func(t *testing.T) {
@@ -899,9 +894,9 @@ func TestStartCommandSetsUpContainerCorrectly(t *testing.T) {
 			},
 		}
 		resp, err := client.Get("https://localhost.localstack.cloud/_localstack/health")
-		require.NoError(t, err)
+		must.NoError(t, err)
 		t.Cleanup(func() { _ = resp.Body.Close() })
-		assert.Equal(t, http.StatusOK, resp.StatusCode)
+		must.Eq(t, http.StatusOK, resp.StatusCode)
 	})
 }
 
@@ -929,43 +924,43 @@ port = "4566"
 container_name = %q
 `, customName)
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	testEnv := env.With(env.APIEndpoint, mockServer.URL)
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnv, "--config", configFile, "start")
-	require.NoError(t, err, "lstk start failed: %s%s", stdout, stderr)
+	must.NoError(t, err, "lstk start failed: %s%s", stdout, stderr)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, customName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "expected a container named %q", customName)
-	require.True(t, inspect.Container.State.Running)
+	must.NoError(t, err, "expected a container named %q", customName)
+	must.True(t, inspect.Container.State.Running)
 
 	// The name Docker gave the container and the name the emulator reports for itself
 	// (used to introspect itself and to name the containers it spawns) must agree.
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	assert.Equal(t, customName, envVars["MAIN_CONTAINER_NAME"])
+	must.Eq(t, customName, envVars["MAIN_CONTAINER_NAME"])
 
 	_, err = dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	assert.Error(t, err, "the derived name %q must not be used when 'name' is set", containerName)
+	must.Error(t, err, "the derived name %q must not be used when 'name' is set", containerName)
 
 	// The default persistence directory stays keyed to the derived name, so setting or
 	// changing 'name' never silently orphans existing state.
 	volumePath, stderr, err := runLstk(t, ctx, "", testEnv, "--config", configFile, "volume", "path")
-	require.NoError(t, err, "lstk volume path failed: %s", stderr)
-	assert.Contains(t, volumePath, filepath.Join("lstk", "volume", containerName))
+	must.NoError(t, err, "lstk volume path failed: %s", stderr)
+	must.Contains(t, volumePath, filepath.Join("lstk", "volume", containerName))
 
 	// Discovery resolves the custom name for the downstream commands.
 	statusOut, stderr, err := runLstk(t, ctx, "", testEnv, "--config", configFile, "status")
-	require.NoError(t, err, "lstk status failed: %s", stderr)
-	assert.Contains(t, statusOut, "Container: "+customName)
+	must.NoError(t, err, "lstk status failed: %s", stderr)
+	must.Contains(t, statusOut, "Container: "+customName)
 
 	_, stderr, err = runLstk(t, ctx, "", testEnv, "--config", configFile, "stop")
-	require.NoError(t, err, "lstk stop failed: %s", stderr)
+	must.NoError(t, err, "lstk stop failed: %s", stderr)
 
 	// Removal is asynchronous — the container is created with AutoRemove, so an inspect
 	// immediately after `stop` can still catch it mid-removal. Poll rather than assert once.
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		_, err := dockerClient.ContainerInspect(ctx, customName, client.ContainerInspectOptions{})
 		return err != nil
 	}, 30*time.Second, 200*time.Millisecond, "lstk stop should have removed %q", customName)
@@ -984,7 +979,7 @@ func TestStartCommandMountsExtraVolumes(t *testing.T) {
 	// A real init-hook script that lstk mounts as a file (it must already exist).
 	scriptDir := t.TempDir()
 	scriptPath := filepath.Join(scriptDir, "init.sf.sql")
-	require.NoError(t, os.WriteFile(scriptPath, []byte("SHOW DATABASES;\n"), 0644))
+	must.NoError(t, os.WriteFile(scriptPath, []byte("SHOW DATABASES;\n"), 0644))
 
 	configContent := `
 [[containers]]
@@ -994,22 +989,22 @@ port = "4566"
 volumes = ["` + escapeTomlPath(scriptPath) + `:/etc/localstack/init/ready.d/init.sf.sql:ro"]
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
-	require.True(t, inspect.Container.State.Running)
+	must.NoError(t, err, "failed to inspect container")
+	must.True(t, inspect.Container.State.Running)
 
 	binds := inspect.Container.HostConfig.Binds
-	assert.True(t, hasBindTarget(binds, "/var/lib/localstack"),
+	must.True(t, hasBindTarget(binds, "/var/lib/localstack"),
 		"persistence mount must still be present, got: %v", binds)
-	assert.True(t, hasBindTarget(binds, "/etc/localstack/init/ready.d/init.sf.sql"),
+	must.True(t, hasBindTarget(binds, "/etc/localstack/init/ready.d/init.sf.sql"),
 		"expected init-hook mount target, got: %v", binds)
-	assert.True(t, hasBindSource(binds, scriptPath),
+	must.True(t, hasBindSource(binds, scriptPath),
 		"expected init-hook mount source %s, got: %v", scriptPath, binds)
 }
 
@@ -1027,7 +1022,7 @@ func TestStartCommandMountsMultipleVolumes(t *testing.T) {
 	// as files (they must already exist).
 	persistBase := t.TempDir()
 	persistDir := filepath.Join(persistBase, "persist")
-	require.NoError(t, os.MkdirAll(persistDir, 0755))
+	must.NoError(t, os.MkdirAll(persistDir, 0755))
 
 	// LocalStack runs as root inside the container and writes root-owned files
 	// (certs, state) into the persistence mount. On Linux CI (non-root user),
@@ -1042,9 +1037,9 @@ func TestStartCommandMountsMultipleVolumes(t *testing.T) {
 
 	scriptDir := t.TempDir()
 	bootScript := filepath.Join(scriptDir, "boot.sh")
-	require.NoError(t, os.WriteFile(bootScript, []byte("#!/bin/sh\necho boot\n"), 0644))
+	must.NoError(t, os.WriteFile(bootScript, []byte("#!/bin/sh\necho boot\n"), 0644))
 	readyScript := filepath.Join(scriptDir, "init.sf.sql")
-	require.NoError(t, os.WriteFile(readyScript, []byte("SHOW DATABASES;\n"), 0644))
+	must.NoError(t, os.WriteFile(readyScript, []byte("SHOW DATABASES;\n"), 0644))
 
 	configContent := `
 [[containers]]
@@ -1058,31 +1053,31 @@ volumes = [
 ]
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
-	require.True(t, inspect.Container.State.Running)
+	must.NoError(t, err, "failed to inspect container")
+	must.True(t, inspect.Container.State.Running)
 
 	binds := inspect.Container.HostConfig.Binds
 
-	assert.True(t, hasBindTarget(binds, "/var/lib/localstack"),
+	must.True(t, hasBindTarget(binds, "/var/lib/localstack"),
 		"expected persistence mount target, got: %v", binds)
-	assert.True(t, hasBindSource(binds, persistDir),
+	must.True(t, hasBindSource(binds, persistDir),
 		"expected persistence mount source %s, got: %v", persistDir, binds)
 
-	assert.True(t, hasBindTarget(binds, "/etc/localstack/init/boot.d/boot.sh"),
+	must.True(t, hasBindTarget(binds, "/etc/localstack/init/boot.d/boot.sh"),
 		"expected boot init-hook mount target, got: %v", binds)
-	assert.True(t, hasBindSource(binds, bootScript),
+	must.True(t, hasBindSource(binds, bootScript),
 		"expected boot init-hook mount source %s, got: %v", bootScript, binds)
 
-	assert.True(t, hasBindTarget(binds, "/etc/localstack/init/ready.d/init.sf.sql"),
+	must.True(t, hasBindTarget(binds, "/etc/localstack/init/ready.d/init.sf.sql"),
 		"expected ready init-hook mount target, got: %v", binds)
-	assert.True(t, hasBindSource(binds, readyScript),
+	must.True(t, hasBindSource(binds, readyScript),
 		"expected ready init-hook mount source %s, got: %v", readyScript, binds)
 }
 
@@ -1105,12 +1100,12 @@ port = "4566"
 volumes = ["` + escapeTomlPath(missing) + `:/etc/localstack/init/ready.d/x.sf.sql"]
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	_, stderr, err := runLstk(t, testContext(t), "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	require.Error(t, err)
+	must.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "does not exist")
+	must.Contains(t, stderr, "does not exist")
 }
 
 func TestStartCommandPassesCIAndLocalStackEnvVars(t *testing.T) {
@@ -1133,20 +1128,20 @@ func TestStartCommandPassesCIAndLocalStackEnvVars(t *testing.T) {
 		With(env.DisableEvents, "1").
 		With("LOCALSTACK_PATH", "/home/user/repos/localstack"),
 		"start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout+stderr, "Not forwarding LOCALSTACK_PATH",
+	must.Contains(t, stdout+stderr, "Not forwarding LOCALSTACK_PATH",
 		"dropping a critical-collision variable must be surfaced to the user")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
-	require.True(t, inspect.Container.State.Running)
+	must.NoError(t, err, "failed to inspect container")
+	must.True(t, inspect.Container.State.Running)
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	assert.Equal(t, "true", envVars["CI"])
-	assert.Equal(t, "1", envVars["LOCALSTACK_DISABLE_EVENTS"])
-	assert.NotEmpty(t, envVars["LOCALSTACK_AUTH_TOKEN"])
-	assert.NotContains(t, envVars, "LOCALSTACK_PATH")
+	must.Eq(t, "true", envVars["CI"])
+	must.Eq(t, "1", envVars["LOCALSTACK_DISABLE_EVENTS"])
+	must.NotEmpty(t, envVars["LOCALSTACK_AUTH_TOKEN"])
+	must.NotContains(t, envVars, "LOCALSTACK_PATH")
 }
 
 func TestStartCommandPersistFlagSetsPersistenceEnv(t *testing.T) {
@@ -1161,22 +1156,22 @@ func TestStartCommandPersistFlagSetsPersistenceEnv(t *testing.T) {
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start", "--persist")
-	require.NoError(t, err, "lstk start --persist failed: %s", stderr)
+	must.NoError(t, err, "lstk start --persist failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
-	require.True(t, inspect.Container.State.Running)
+	must.NoError(t, err, "failed to inspect container")
+	must.True(t, inspect.Container.State.Running)
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	assert.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
+	must.Eq(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
 
-	assert.Contains(t, stdout, "• Persistence: Enabled",
+	must.Contains(t, stdout, "• Persistence: Enabled",
 		"lstk start --persist should surface persistence state in the header")
 
 	statusStdout, statusStderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "status")
-	require.NoError(t, err, "lstk status failed: %s", statusStderr)
-	assert.Contains(t, statusStdout, "• Persistence: Enabled",
+	must.NoError(t, err, "lstk status failed: %s", statusStderr)
+	must.Contains(t, statusStdout, "• Persistence: Enabled",
 		"lstk status should surface persistence state when the running container has it enabled")
 }
 
@@ -1194,17 +1189,17 @@ func TestStartCommandForwardsPersistenceEnvFromHost(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL).
 		With(env.Persistence, "1"),
 		"start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
-	require.True(t, inspect.Container.State.Running)
+	must.NoError(t, err, "failed to inspect container")
+	must.True(t, inspect.Container.State.Running)
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	assert.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
+	must.Eq(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
 
-	assert.Contains(t, stdout, "• Persistence: Enabled",
+	must.Contains(t, stdout, "• Persistence: Enabled",
 		"lstk start should surface persistence state when LOCALSTACK_PERSISTENCE=1 is set in the shell")
 }
 
@@ -1229,21 +1224,21 @@ port = "4566"
 env = ["persistence"]
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
-	require.True(t, inspect.Container.State.Running)
+	must.NoError(t, err, "failed to inspect container")
+	must.True(t, inspect.Container.State.Running)
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	assert.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
+	must.Eq(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
 
-	assert.Contains(t, stdout, "• Persistence: Enabled",
+	must.Contains(t, stdout, "• Persistence: Enabled",
 		"lstk start should surface persistence state when LOCALSTACK_PERSISTENCE=1 is set in the config profile")
 }
 
@@ -1297,7 +1292,7 @@ func TestStartHidesHeaderUntilAuthComplete(t *testing.T) {
 	cmd.Env = env.Without(env.AuthToken).With(env.APIEndpoint, mockServer.URL)
 
 	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start command in PTY")
+	must.NoError(t, err, "failed to start command in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	output := &syncBuffer{}
@@ -1306,20 +1301,20 @@ func TestStartHidesHeaderUntilAuthComplete(t *testing.T) {
 	}()
 
 	// Wait for the login prompt — header must not be visible yet.
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(output.Bytes(), []byte("Press any key when complete"))
 	}, 10*time.Second, 100*time.Millisecond, "auth prompt should appear")
 
-	assert.NotContains(t, output.String(), "lstk ", "header must be hidden while auth is pending")
+	must.NotContains(t, output.String(), "lstk ", "header must be hidden while auth is pending")
 
 	// Complete auth by pressing ENTER.
 	_, err = ptmx.Write([]byte("\r"))
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	// After auth completes, the header must appear. Look for the header's
 	// "lstk " prefix — the version that follows is wrapped in ANSI styling
 	// so a contiguous "lstk (" match would fail under terminal rendering.
-	require.Eventually(t, func() bool {
+	must.Eventually(t, func() bool {
 		return bytes.Contains(output.Bytes(), []byte("lstk "))
 	}, 10*time.Second, 100*time.Millisecond, "header should appear after auth completes")
 
@@ -1345,17 +1340,17 @@ port = "4566"
 image = "lstk-nonexistent-custom-image"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	// A dummy token satisfies the up-front auth check (it is not validated here);
 	// the flow fails when the custom image cannot be pulled or found locally.
 	e := env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.AuthToken, "dummy-token")
 	stdout, stderr, err := runLstk(t, testContext(t), "", e, "--config", configFile, "--non-interactive", "start")
 
-	require.Error(t, err, "expected start to fail when the custom image is unavailable")
+	must.Error(t, err, "expected start to fail when the custom image is unavailable")
 	requireExitCode(t, 1, err)
 	combined := stdout + stderr
-	assert.Contains(t, combined, "Failed to pull lstk-nonexistent-custom-image:latest")
+	must.Contains(t, combined, "Failed to pull lstk-nonexistent-custom-image:latest")
 }
 
 // TestStartTimesOutWhenEmulatorNeverBecomesHealthy verifies that --timeout bounds
@@ -1370,7 +1365,7 @@ func TestStartTimesOutWhenEmulatorNeverBecomesHealthy(t *testing.T) {
 	ctx := testContext(t)
 	imageRef := commitNeverHealthyImage(t, ctx)
 	imageName, imageTag, ok := strings.Cut(imageRef, ":")
-	require.True(t, ok, "never-healthy image reference must carry a pinned tag")
+	must.True(t, ok, "never-healthy image reference must carry a pinned tag")
 
 	// A non-interactive startup timeout deliberately leaves the container running
 	// for inspection, and the pinned tag names it "localstack-aws-<tag>" — a name
@@ -1384,7 +1379,7 @@ func TestStartTimesOutWhenEmulatorNeverBecomesHealthy(t *testing.T) {
 
 	home := t.TempDir()
 	configFile := filepath.Join(home, "config.toml")
-	require.NoError(t, os.WriteFile(configFile,
+	must.NoError(t, os.WriteFile(configFile,
 		[]byte(fmt.Sprintf("[[containers]]\ntype = \"aws\"\nport = \"4566\"\nimage = %q\ntag = %q\n", imageName, imageTag)), 0644))
 
 	// A pinned tag already present locally skips both the pull and the license
@@ -1393,9 +1388,9 @@ func TestStartTimesOutWhenEmulatorNeverBecomesHealthy(t *testing.T) {
 	e := append(testEnvWithHome(home, ""), string(env.AuthToken)+"=fake-token")
 	stdout, stderr, err := runLstk(t, ctx, "", e, "--config", configFile, "--non-interactive", "start", "--timeout", "3s")
 
-	require.Error(t, err, "expected start to fail when the emulator never becomes healthy")
+	must.Error(t, err, "expected start to fail when the emulator never becomes healthy")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout+stderr, "LocalStack did not become ready within 3s")
+	must.Contains(t, stdout+stderr, "LocalStack did not become ready within 3s")
 }
 
 // TestStartFallsBackToLocalImageWhenPullFails verifies the offline degradation
@@ -1419,12 +1414,12 @@ func TestStartFallsBackToLocalImageWhenPullFails(t *testing.T) {
 	const sourceImage = "localstack/localstack-pro:latest"
 	const localImage = "lstk-offline-fallback-test"
 	reader, err := dockerClient.ImagePull(ctx, sourceImage, client.ImagePullOptions{})
-	require.NoError(t, err, "failed to pull source image")
+	must.NoError(t, err, "failed to pull source image")
 	_, _ = io.Copy(io.Discard, reader)
 	_ = reader.Close()
 
 	_, err = dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: sourceImage, Target: localImage + ":latest"})
-	require.NoError(t, err, "failed to tag local image")
+	must.NoError(t, err, "failed to tag local image")
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), localImage+":latest", client.ImageRemoveOptions{Force: true})
 	})
@@ -1433,7 +1428,7 @@ func TestStartFallsBackToLocalImageWhenPullFails(t *testing.T) {
 	// dir outside t.TempDir (whose cleanup runs as the unprivileged test user and
 	// would fail on root-owned files) so HOME can stay fully isolated below.
 	volumeDir, err := os.MkdirTemp("", "lstk-volume")
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() { _ = os.RemoveAll(volumeDir) }) // best-effort; root-owned files may remain
 
 	home := t.TempDir()
@@ -1446,7 +1441,7 @@ image = %q
 volume = %q
 `, localImage, volumeDir)
 	configFile := filepath.Join(home, "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	mockServer := createMockLicenseServer(true)
 	defer mockServer.Close()
@@ -1455,14 +1450,14 @@ volume = %q
 		With(env.APIEndpoint, mockServer.URL).
 		With(env.AuthToken, authToken)
 	stdout, stderr, err := runLstk(t, ctx, "", e, "--config", configFile, "--non-interactive", "start")
-	require.NoError(t, err, "lstk start should fall back to the local image: %s", stderr)
+	must.NoError(t, err, "lstk start should fall back to the local image: %s", stderr)
 	requireExitCode(t, 0, err)
 
-	assert.Contains(t, stdout+stderr, "using the local image", "expected the local-image fallback warning")
+	must.Contains(t, stdout+stderr, "using the local image", "expected the local-image fallback warning")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
-	assert.True(t, inspect.Container.State.Running, "container should be running from the local image")
+	must.NoError(t, err, "failed to inspect container")
+	must.True(t, inspect.Container.State.Running, "container should be running from the local image")
 }
 
 // TestStartContinuesWhenLicenseServerUnreachable verifies the offline degradation
@@ -1492,7 +1487,7 @@ func TestStartContinuesWhenLicenseServerUnreachable(t *testing.T) {
 	// dir outside t.TempDir (whose cleanup runs as the unprivileged test user and
 	// would fail on root-owned files) so HOME can stay fully isolated below.
 	volumeDir, err := os.MkdirTemp("", "lstk-volume")
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() { _ = os.RemoveAll(volumeDir) }) // best-effort; root-owned files may remain
 
 	home := t.TempDir()
@@ -1504,20 +1499,20 @@ port = "4566"
 volume = %q
 `, volumeDir)
 	configFile := filepath.Join(home, "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	e := env.Environ(testEnvWithHome(home, "")).
 		With(env.APIEndpoint, unreachableURL).
 		With(env.AuthToken, authToken)
 	stdout, stderr, err := runLstk(t, ctx, "", e, "--config", configFile, "--non-interactive", "start")
-	require.NoError(t, err, "lstk start should continue when the license server is unreachable: %s", stderr)
+	must.NoError(t, err, "lstk start should continue when the license server is unreachable: %s", stderr)
 	requireExitCode(t, 0, err)
 
-	assert.Contains(t, stdout+stderr, "Could not reach the license server", "expected the license-unreachable warning")
+	must.Contains(t, stdout+stderr, "Could not reach the license server", "expected the license-unreachable warning")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect container")
-	assert.True(t, inspect.Container.State.Running, "container should be running")
+	must.NoError(t, err, "failed to inspect container")
+	must.True(t, inspect.Container.State.Running, "container should be running")
 }
 
 // TestStartUsesLocalCustomImageWithoutPullOrLicenseCheck verifies the offline
@@ -1549,11 +1544,11 @@ func TestStartUsesLocalCustomImageWithoutPullOrLicenseCheck(t *testing.T) {
 	// Make the custom image present locally without a registry by tagging the
 	// lightweight test image under it.
 	reader, err := dockerClient.ImagePull(ctx, testImage, client.ImagePullOptions{})
-	require.NoError(t, err, "failed to pull test image")
+	must.NoError(t, err, "failed to pull test image")
 	_, _ = io.Copy(io.Discard, reader)
 	_ = reader.Close()
 	_, err = dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fullRef})
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fullRef, client.ImageRemoveOptions{Force: true})
 	})
@@ -1584,7 +1579,7 @@ tag = %q
 port = "4566"
 image = %q
 `, pinnedTag, customImage)
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	// A dummy token satisfies the up-front auth check; it is never validated
 	// because the license pre-flight is skipped for a local image.
@@ -1595,15 +1590,15 @@ image = %q
 	combined := stdout + stderr
 
 	// Found locally and used — nothing is pulled.
-	assert.Contains(t, combined, "Using local image "+fullRef,
+	must.Contains(t, combined, "Using local image "+fullRef,
 		"the configured custom image, present locally, should be reused: %s", combined)
-	assert.NotContains(t, combined, "Pulling",
+	must.NotContains(t, combined, "Pulling",
 		"lstk must not pull when the configured custom image is already present locally")
 
 	// No license check from the CLI for a local image.
-	assert.Equal(t, int32(0), atomic.LoadInt32(&licenseHits),
+	must.Eq(t, int32(0), atomic.LoadInt32(&licenseHits),
 		"the CLI must not contact the license server for a local image")
-	assert.NotContains(t, combined, "Checking license",
+	must.NotContains(t, combined, "Checking license",
 		"lstk must not run a pre-flight license check for a local image")
 
 	// Started from the configured local image: lstk created the container using it.
@@ -1612,7 +1607,7 @@ image = %q
 	// authoritative signal. When the container is still present, additionally
 	// confirm it was created from the configured image.
 	if inspect, err := dockerClient.ContainerInspect(ctx, wantContainer, client.ContainerInspectOptions{}); err == nil {
-		assert.Equal(t, fullRef, inspect.Container.Config.Image,
+		must.Eq(t, fullRef, inspect.Container.Config.Image,
 			"the container should be created from the configured custom image")
 	}
 }
@@ -1639,7 +1634,7 @@ tag  = "latest"
 port = %q
 `, hostPort)
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(content), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(content), 0644))
 	return configFile
 }
 
@@ -1658,7 +1653,7 @@ func TestStartCommandForSnowflakeSkipsLicenseValidation(t *testing.T) {
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", writeSnowflakeConfig(t, "4566"), "start")
-	require.NoError(t, err, "lstk start should succeed for snowflake even when the license server rejects the request: %s", stderr)
+	must.NoError(t, err, "lstk start should succeed for snowflake even when the license server rejects the request: %s", stderr)
 	requireExitCode(t, 0, err)
 }
 
@@ -1679,25 +1674,25 @@ func TestStartCommandSucceedsForSnowflake(t *testing.T) {
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, snowflakeContainerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect snowflake container")
-	require.True(t, inspect.Container.State.Running, "snowflake container should be running")
-	assert.Contains(t, inspect.Container.Config.Image, "localstack/snowflake",
+	must.NoError(t, err, "failed to inspect snowflake container")
+	must.True(t, inspect.Container.State.Running, "snowflake container should be running")
+	must.Contains(t, inspect.Container.Config.Image, "localstack/snowflake",
 		"expected localstack/snowflake image, got %s", inspect.Container.Config.Image)
 
 	resp, err := http.Get(fmt.Sprintf("http://localhost:%s/_localstack/health", hostPort))
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() { _ = resp.Body.Close() })
-	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	must.Eq(t, http.StatusOK, resp.StatusCode)
 
-	assert.Contains(t, stdout, "• Snowflake endpoint: http://snowflake.",
+	must.Contains(t, stdout, "• Snowflake endpoint: http://snowflake.",
 		"snowflake start should print the snowflake-prefixed endpoint hint")
-	assert.NotContains(t, stdout, "• Endpoint: localhost.localstack.cloud",
+	must.NotContains(t, stdout, "• Endpoint: localhost.localstack.cloud",
 		"snowflake start should not print the bare AWS-style endpoint line")
-	assert.Contains(t, stdout, "> Tip:",
+	must.Contains(t, stdout, "> Tip:",
 		"snowflake start should print a tip line like AWS does")
 }
 
@@ -1718,13 +1713,13 @@ func TestStartCommandSetsSnowflakeS3EndpointFromPort(t *testing.T) {
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, snowflakeContainerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect snowflake container")
+	must.NoError(t, err, "failed to inspect snowflake container")
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	assert.Equal(t, "s3.localhost.localstack.cloud:"+hostPort, envVars["SF_S3_ENDPOINT"],
+	must.Eq(t, "s3.localhost.localstack.cloud:"+hostPort, envVars["SF_S3_ENDPOINT"],
 		"SF_S3_ENDPOINT should match the configured Snowflake port")
 }
 
@@ -1744,7 +1739,7 @@ tag  = "latest"
 port = %q
 `, hostPort)
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(content), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(content), 0644))
 	return configFile
 }
 
@@ -1765,21 +1760,21 @@ func TestStartCommandSucceedsForAzure(t *testing.T) {
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, azureContainerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "failed to inspect azure container")
-	require.True(t, inspect.Container.State.Running, "azure container should be running")
-	assert.Contains(t, inspect.Container.Config.Image, "localstack/localstack-azure",
+	must.NoError(t, err, "failed to inspect azure container")
+	must.True(t, inspect.Container.State.Running, "azure container should be running")
+	must.Contains(t, inspect.Container.Config.Image, "localstack/localstack-azure",
 		"expected localstack/localstack-azure image, got %s", inspect.Container.Config.Image)
 
 	resp, err := http.Get(fmt.Sprintf("http://localhost:%s/_localstack/health", hostPort))
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() { _ = resp.Body.Close() })
-	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	must.Eq(t, http.StatusOK, resp.StatusCode)
 
-	assert.Contains(t, stdout, "> Tip:",
+	must.Contains(t, stdout, "> Tip:",
 		"azure start should print a tip line like AWS does")
 }
 
@@ -1799,7 +1794,7 @@ func TestStartCommandForAzureShowsPlanFromActivatedLicense(t *testing.T) {
 	// the license the container activated into its volume — not the license API.
 	const fakeImage = "localstack/localstack-azure:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -1807,8 +1802,8 @@ func TestStartCommandForAzureShowsPlanFromActivatedLicense(t *testing.T) {
 
 	home := t.TempDir()
 	volumeDir := filepath.Join(home, "volume")
-	require.NoError(t, os.MkdirAll(filepath.Join(volumeDir, "cache"), 0755))
-	require.NoError(t, os.WriteFile(filepath.Join(volumeDir, "cache", "license.json"),
+	must.NoError(t, os.MkdirAll(filepath.Join(volumeDir, "cache"), 0755))
+	must.NoError(t, os.WriteFile(filepath.Join(volumeDir, "cache", "license.json"),
 		[]byte(`{"license_type":"enterprise"}`), 0600))
 
 	configContent := fmt.Sprintf(`
@@ -1819,16 +1814,16 @@ port = "4566"
 volume = %q
 `, volumeDir)
 	configFile := filepath.Join(home, "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	// Fresh HOME = no cached plan_label, so the label must come from the volume license.
 	stdout, err := runLstkInPTY(t, ctx,
 		env.Environ(testEnvWithHome(home, "")).Without(env.AuthToken).With(env.AuthToken, "fake-token"),
 		"start", "--config", configFile,
 	)
-	require.NoError(t, err, "lstk start failed: %s", stdout)
-	assert.Contains(t, stdout, "already running")
-	assert.Contains(t, stdout, "LocalStack Enterprise",
+	must.NoError(t, err, "lstk start failed: %s", stdout)
+	must.Contains(t, stdout, "already running")
+	must.Contains(t, stdout, "LocalStack Enterprise",
 		"azure header should show the plan from the license the emulator activated into its volume")
 }
 
@@ -1848,6 +1843,6 @@ func TestStartCommandForAzureSkipsLicenseValidation(t *testing.T) {
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", writeAzureConfig(t, "4566"), "start")
-	require.NoError(t, err, "lstk start should succeed for azure even when the license server rejects the request: %s", stderr)
+	must.NoError(t, err, "lstk start should succeed for azure even when the license server rejects the request: %s", stderr)
 	requireExitCode(t, 0, err)
 }
diff --git a/test/integration/status_test.go b/test/integration/status_test.go
index cf7002ce..dac0df23 100644
--- a/test/integration/status_test.go
+++ b/test/integration/status_test.go
@@ -17,10 +17,9 @@ import (
 	"github.com/aws/aws-sdk-go-v2/credentials"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/aws/aws-sdk-go-v2/service/sqs"
-	"github.com/moby/moby/client"
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"github.com/moby/moby/client"
 )
 
 func TestStatusCommandFailsWhenNotRunning(t *testing.T) {
@@ -30,11 +29,11 @@ func TestStatusCommandFailsWhenNotRunning(t *testing.T) {
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "status")
-	require.Error(t, err, "expected lstk status to fail when emulator not running")
+	must.Error(t, err, "expected lstk status to fail when emulator not running")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "is not running")
-	assert.Contains(t, stdout, "Start LocalStack:")
-	assert.Contains(t, stdout, "See help:")
+	must.Contains(t, stdout, "is not running")
+	must.Contains(t, stdout, "Start LocalStack:")
+	must.Contains(t, stdout, "See help:")
 	assertCommandTelemetry(t, events, "status", 1)
 }
 
@@ -50,34 +49,37 @@ func TestStatusCommandShowsResourcesWhenRunning(t *testing.T) {
 	defer mockServer.Close()
 
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 
 	awsCfg, err := awsconfig.LoadDefaultConfig(ctx,
 		awsconfig.WithRegion("us-east-1"),
 		awsconfig.WithCredentialsProvider(credentials.NewStaticCredentialsProvider("test", "test", "")),
 		awsconfig.WithBaseEndpoint("http://localhost:4566"),
 	)
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	s3Client := s3.NewFromConfig(awsCfg, func(o *s3.Options) { o.UsePathStyle = true })
 	_, err = s3Client.CreateBucket(ctx, &s3.CreateBucketInput{Bucket: aws.String("my-test-bucket")})
-	require.NoError(t, err, "failed to create S3 bucket")
+	must.NoError(t, err, "failed to create S3 bucket")
 
 	sqsClient := sqs.NewFromConfig(awsCfg)
 	_, err = sqsClient.CreateQueue(ctx, &sqs.CreateQueueInput{QueueName: aws.String("my-test-queue")})
-	require.NoError(t, err, "failed to create SQS queue")
+	must.NoError(t, err, "failed to create SQS queue")
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "status")
-	require.NoError(t, err, "lstk status failed: %s", stderr)
+	must.NoError(t, err, "lstk status failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "running")
-	assert.Contains(t, stdout, "SERVICE")
-	assert.Contains(t, stdout, "RESOURCE")
-	assert.Contains(t, stdout, "S3")
-	assert.Contains(t, stdout, "my-test-bucket")
-	assert.Contains(t, stdout, "SQS")
-	assert.Contains(t, stdout, "my-test-queue")
+	// Not a snapshot: this test needs a real auth token and a live emulator,
+	// so a committed snapshot could not be regenerated by most contributors
+	// (and the resources table layout varies with the emulator image).
+	must.Contains(t, stdout, "running")
+	must.Contains(t, stdout, "SERVICE")
+	must.Contains(t, stdout, "RESOURCE")
+	must.Contains(t, stdout, "S3")
+	must.Contains(t, stdout, "my-test-bucket")
+	must.Contains(t, stdout, "SQS")
+	must.Contains(t, stdout, "my-test-queue")
 	assertCommandTelemetry(t, events, "status", 0)
 }
 
@@ -104,7 +106,7 @@ func TestStatusCommandWorksWithNonDefaultPort(t *testing.T) {
 
 	// Extract the port so we can bind it to the container.
 	_, mockPort, err := net.SplitHostPort(server.Listener.Addr().String())
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	// Simulates starting LocalStack on a non-default host port.
 	startTestContainer(t, ctx, mockPort)
@@ -113,11 +115,11 @@ func TestStatusCommandWorksWithNonDefaultPort(t *testing.T) {
 	// Simulates the user changing the config port after starting the container
 	configContent := "[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "--config", configFile, "status")
-	require.NoError(t, err, "lstk status failed: %s", stderr)
-	assert.Contains(t, stdout, "4.14.1")
+	must.NoError(t, err, "lstk status failed: %s", stderr)
+	must.Contains(t, stdout, "4.14.1")
 }
 
 func TestStatusCommandWorksWithExternalContainer(t *testing.T) {
@@ -129,7 +131,7 @@ func TestStatusCommandWorksWithExternalContainer(t *testing.T) {
 
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -150,9 +152,9 @@ func TestStatusCommandWorksWithExternalContainer(t *testing.T) {
 	defer server.Close()
 
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.LocalStackHost, lsHost(server)), "status")
-	require.NoError(t, err, "lstk status should work with external container: %s", stderr)
+	must.NoError(t, err, "lstk status should work with external container: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "3.5.0")
+	must.Contains(t, stdout, "3.5.0")
 }
 
 func TestStatusCommandForSnowflakeShowsNoResources(t *testing.T) {
@@ -164,16 +166,16 @@ func TestStatusCommandForSnowflakeShowsNoResources(t *testing.T) {
 	startTestSnowflakeContainer(t, ctx)
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "--config", writeSnowflakeConfig(t, "4566"), "status")
-	require.NoError(t, err, "lstk status failed for snowflake: %s", stderr)
+	must.NoError(t, err, "lstk status failed for snowflake: %s", stderr)
 	requireExitCode(t, 0, err)
 
-	assert.Contains(t, stdout, "Snowflake")
-	assert.Contains(t, stdout, "running")
-	assert.Contains(t, stdout, "snowflake.localhost.localstack.cloud:4566",
+	must.Contains(t, stdout, "Snowflake")
+	must.Contains(t, stdout, "running")
+	must.Contains(t, stdout, "snowflake.localhost.localstack.cloud:4566",
 		"snowflake status should display the snowflake-routed host clients use to connect")
 	// Snowflake does not expose AWS resources — no resource table or empty-state message.
-	assert.NotContains(t, stdout, "SERVICE")
-	assert.NotContains(t, stdout, "No resources deployed")
+	must.NotContains(t, stdout, "SERVICE")
+	must.NotContains(t, stdout, "No resources deployed")
 }
 
 func TestStatusCommandForSnowflakeShowsVersion(t *testing.T) {
@@ -193,16 +195,16 @@ func TestStatusCommandForSnowflakeShowsVersion(t *testing.T) {
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	require.NoError(t, err, "lstk start failed: %s", stderr)
+	must.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	expectedVersion := fetchSnowflakeVersion(t, hostPort)
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "--config", configFile, "status")
-	require.NoError(t, err, "lstk status failed: %s", stderr)
+	must.NoError(t, err, "lstk status failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
-	assert.Contains(t, stdout, "• Version: "+expectedVersion,
+	must.Contains(t, stdout, "• Version: "+expectedVersion,
 		"snowflake status should display the version reported by /_localstack/health")
 }
 
@@ -228,22 +230,22 @@ func TestStatusCommandShowsNoResourcesWhenEmpty(t *testing.T) {
 	defer server.Close()
 
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.LocalStackHost, lsHost(server)), "status")
-	require.NoError(t, err, "lstk status failed: %s", stderr)
+	must.NoError(t, err, "lstk status failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "No resources deployed")
+	must.Contains(t, stdout, "No resources deployed")
 }
 
 func fetchSnowflakeVersion(t *testing.T, hostPort string) string {
 	t.Helper()
 	resp, err := http.Get(fmt.Sprintf("http://localhost:%s/_localstack/health", hostPort))
-	require.NoError(t, err, "failed to fetch snowflake health")
+	must.NoError(t, err, "failed to fetch snowflake health")
 	t.Cleanup(func() { _ = resp.Body.Close() })
 	body, err := io.ReadAll(resp.Body)
-	require.NoError(t, err, "failed to read snowflake health body")
+	must.NoError(t, err, "failed to read snowflake health body")
 	var h struct {
 		Version string `json:"version"`
 	}
-	require.NoError(t, json.Unmarshal(body, &h), "failed to decode snowflake health: %s", body)
-	require.NotEmpty(t, h.Version, "snowflake health response missing version field")
+	must.NoError(t, json.Unmarshal(body, &h), "failed to decode snowflake health: %s", body)
+	must.NotEmpty(t, h.Version, "snowflake health response missing version field")
 	return h.Version
 }
diff --git a/test/integration/stop_test.go b/test/integration/stop_test.go
index 2a927881..2165a020 100644
--- a/test/integration/stop_test.go
+++ b/test/integration/stop_test.go
@@ -5,10 +5,9 @@ import (
 	"encoding/json"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestStopCommandSucceeds(t *testing.T) {
@@ -21,18 +20,18 @@ func TestStopCommandSucceeds(t *testing.T) {
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "stop")
-	require.NoError(t, err, "lstk stop failed: %s", stderr)
+	must.NoError(t, err, "lstk stop failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "Stopping", "should show stopping message")
-	assert.Contains(t, stdout, "stopped", "should show stopped message")
+	must.Contains(t, stdout, "Stopping", "should show stopping message")
+	must.Contains(t, stdout, "stopped", "should show stopped message")
 
 	_, err = dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	assert.Error(t, err, "container should not exist after stop")
+	must.Error(t, err, "container should not exist after stop")
 
 	// Both lstk_lifecycle (stop) and lstk_command events should be emitted.
 	byName := collectTelemetryByName(t, events, 2)
-	assert.Contains(t, byName, "lstk_lifecycle")
-	assert.Contains(t, byName, "lstk_command")
+	must.Contains(t, byName, "lstk_lifecycle")
+	must.Contains(t, byName, "lstk_command")
 }
 
 // TestStopCommandRejectsAmbientEndpointURLEvenWithLocalContainerRunning
@@ -50,13 +49,13 @@ func TestStopCommandRejectsAmbientEndpointURLEvenWithLocalContainerRunning(t *te
 	startTestContainer(t, ctx)
 
 	stdout, _, err := runLstk(t, ctx, "", env.With(env.DisableEvents, "1").With("LSTK_ENDPOINT_URL", "http://127.0.0.1:1"), "stop")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
-	assert.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
+	must.Error(t, err)
+	must.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	must.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.NoError(t, err, "container should still exist — stop must reject before ever touching it")
-	assert.True(t, inspect.Container.State.Running, "container should still be running")
+	must.NoError(t, err, "container should still exist — stop must reject before ever touching it")
+	must.True(t, inspect.Container.State.Running, "container should still be running")
 }
 
 func TestStopCommandFailsWhenNotRunning(t *testing.T) {
@@ -66,9 +65,9 @@ func TestStopCommandFailsWhenNotRunning(t *testing.T) {
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "stop")
-	require.Error(t, err, "expected lstk stop to fail when container not running")
+	must.Error(t, err, "expected lstk stop to fail when container not running")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "LocalStack AWS Emulator is not running")
+	must.Contains(t, stdout, "LocalStack AWS Emulator is not running")
 	assertCommandTelemetry(t, events, "stop", 1)
 }
 
@@ -82,9 +81,9 @@ func TestStopCommandReportsEmulatorSpecificNotRunningMessage(t *testing.T) {
 	analyticsSrv, events := mockAnalyticsServer(t)
 	e := env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.AnalyticsEndpoint, analyticsSrv.URL)
 	stdout, _, err := runLstk(t, testContext(t), "", e, "--config", configFile, "stop")
-	require.Error(t, err, "expected lstk stop to fail when snowflake container not running")
+	must.Error(t, err, "expected lstk stop to fail when snowflake container not running")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "LocalStack Snowflake Emulator is not running",
+	must.Contains(t, stdout, "LocalStack Snowflake Emulator is not running",
 		"stop should match status's emulator-specific message")
 	assertCommandTelemetry(t, events, "stop", 1)
 }
@@ -101,7 +100,7 @@ func TestStopCommandIgnoresForeignEmulatorOnPort(t *testing.T) {
 	// AWS image running on 4566 while config targets snowflake.
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -110,13 +109,13 @@ func TestStopCommandIgnoresForeignEmulatorOnPort(t *testing.T) {
 	configFile := writeSnowflakeConfig(t, "4566")
 
 	stdout, _, err := runLstk(t, testContext(t), "", testEnvWithHome(t.TempDir(), ""), "--config", configFile, "stop")
-	require.Error(t, err, "lstk stop should not match foreign emulator on configured port")
+	must.Error(t, err, "lstk stop should not match foreign emulator on configured port")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "LocalStack Snowflake Emulator is not running")
-	assert.NotContains(t, stdout, "stopped", "should not have stopped the AWS container")
+	must.Contains(t, stdout, "LocalStack Snowflake Emulator is not running")
+	must.NotContains(t, stdout, "stopped", "should not have stopped the AWS container")
 
 	_, inspectErr := dockerClient.ContainerInspect(ctx, "localstack-external-aws", client.ContainerInspectOptions{})
-	assert.NoError(t, inspectErr, "AWS container should still exist after snowflake-targeted stop")
+	must.NoError(t, inspectErr, "AWS container should still exist after snowflake-targeted stop")
 }
 
 func TestStopCommandStopsExternalContainer(t *testing.T) {
@@ -128,7 +127,7 @@ func TestStopCommandStopsExternalContainer(t *testing.T) {
 
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	require.NoError(t, err)
+	must.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -136,12 +135,12 @@ func TestStopCommandStopsExternalContainer(t *testing.T) {
 	startExternalContainer(t, ctx, fakeImage, "localstack-external", "4566")
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "stop")
-	require.NoError(t, err, "lstk stop should stop external container: %s", stderr)
+	must.NoError(t, err, "lstk stop should stop external container: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "stopped")
+	must.Contains(t, stdout, "stopped")
 
 	_, err = dockerClient.ContainerInspect(ctx, "localstack-external", client.ContainerInspectOptions{})
-	assert.Error(t, err, "external container should be gone after lstk stop")
+	must.Error(t, err, "external container should be gone after lstk stop")
 }
 
 func TestStopCommandIsIdempotent(t *testing.T) {
@@ -154,14 +153,14 @@ func TestStopCommandIsIdempotent(t *testing.T) {
 
 	e := testEnvWithHome(t.TempDir(), "")
 	_, stderr, err := runLstk(t, ctx, "", e, "stop")
-	require.NoError(t, err, "first lstk stop failed: %s", stderr)
+	must.NoError(t, err, "first lstk stop failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	_, err = dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.Error(t, err, "container should not exist after first stop")
+	must.Error(t, err, "container should not exist after first stop")
 
 	_, _, err = runLstk(t, ctx, "", e, "stop")
-	assert.Error(t, err, "second lstk stop should fail since container already removed")
+	must.Error(t, err, "second lstk stop should fail since container already removed")
 	requireExitCode(t, 1, err)
 }
 
@@ -174,13 +173,13 @@ func TestStopCommandJSON(t *testing.T) {
 	startTestContainer(t, ctx)
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "stop", "--json")
-	require.NoError(t, err, "lstk stop --json failed: %s", stderr)
+	must.NoError(t, err, "lstk stop --json failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "ok", envelope.Status)
-	assert.Equal(t, "stop", envelope.Command)
-	assert.Nil(t, envelope.Error)
+	must.Eq(t, "ok", envelope.Status)
+	must.Eq(t, "stop", envelope.Command)
+	must.Nil(t, envelope.Error)
 
 	var data struct {
 		Emulators []struct {
@@ -189,11 +188,11 @@ func TestStopCommandJSON(t *testing.T) {
 			WasRunning bool   `json:"wasRunning"`
 		} `json:"emulators"`
 	}
-	require.NoError(t, json.Unmarshal(envelope.Data, &data))
-	require.Len(t, data.Emulators, 1)
-	assert.Equal(t, "aws", data.Emulators[0].Type)
-	assert.Equal(t, "localstack-aws", data.Emulators[0].Name)
-	assert.True(t, data.Emulators[0].WasRunning)
+	must.NoError(t, json.Unmarshal(envelope.Data, &data))
+	must.Len(t, data.Emulators, 1)
+	must.Eq(t, "aws", data.Emulators[0].Type)
+	must.Eq(t, "localstack-aws", data.Emulators[0].Name)
+	must.True(t, data.Emulators[0].WasRunning)
 }
 
 func TestStopCommandJSONNotRunning(t *testing.T) {
@@ -205,8 +204,8 @@ func TestStopCommandJSONNotRunning(t *testing.T) {
 	requireExitCode(t, 1, err)
 
 	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "error", envelope.Status)
-	require.NotNil(t, envelope.Error)
-	assert.Equal(t, "EMULATOR_NOT_RUNNING", envelope.Error.Code)
-	assert.Equal(t, "EMULATOR", envelope.Error.Category)
+	must.Eq(t, "error", envelope.Status)
+	must.NotNil(t, envelope.Error)
+	must.Eq(t, "EMULATOR_NOT_RUNNING", envelope.Error.Code)
+	must.Eq(t, "EMULATOR", envelope.Error.Category)
 }
diff --git a/test/integration/telemetry_test.go b/test/integration/telemetry_test.go
index e983f2df..f2f2e4e1 100644
--- a/test/integration/telemetry_test.go
+++ b/test/integration/telemetry_test.go
@@ -18,9 +18,8 @@ import (
 	"time"
 
 	"github.com/google/uuid"
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // mockAnalyticsServer returns a test server that records received analytics events.
@@ -70,7 +69,7 @@ func TestStartCommandSendsTelemetryEvent(t *testing.T) {
 			With(env.AuthToken, "fake-token").
 			With(env.AnalyticsEndpoint, analyticsSrv.URL)
 		out, err := cmd.CombinedOutput()
-		require.NoError(t, err, "lstk %v failed: %s", args, out)
+		must.NoError(t, err, "lstk %v failed: %s", args, out)
 	}
 
 	t.Run("lstk start emits command=start", func(t *testing.T) {
@@ -78,33 +77,33 @@ func TestStartCommandSendsTelemetryEvent(t *testing.T) {
 
 		select {
 		case event := <-events:
-			assert.Equal(t, "lstk_command", event["name"])
+			must.Eq(t, "lstk_command", event["name"])
 
 			metadata, ok := event["metadata"].(map[string]any)
-			require.True(t, ok)
+			must.True(t, ok)
 			_, err := uuid.Parse(metadata["session_id"].(string))
-			assert.NoError(t, err, "session_id should be a valid UUID")
+			must.NoError(t, err, "session_id should be a valid UUID")
 			_, err = time.Parse("2006-01-02 15:04:05.000000", metadata["client_time"].(string))
-			assert.NoError(t, err, "client_time should match expected format")
+			must.NoError(t, err, "client_time should match expected format")
 
 			payload, ok := event["payload"].(map[string]any)
-			require.True(t, ok)
-			assert.NotEmpty(t, payload["machine_id"], "machine_id should be present")
-			assert.Equal(t, os.Getenv("CI") != "", payload["is_ci"])
+			must.True(t, ok)
+			must.NotEmpty(t, payload["machine_id"], "machine_id should be present")
+			must.Eq(t, os.Getenv("CI") != "", payload["is_ci"])
 
 			environment, ok := payload["environment"].(map[string]any)
-			require.True(t, ok)
-			assert.NotEmpty(t, environment["lstk_version"])
-			assert.Equal(t, runtime.GOOS, environment["os"])
-			assert.Equal(t, runtime.GOARCH, environment["arch"])
+			must.True(t, ok)
+			must.NotEmpty(t, environment["lstk_version"])
+			must.Eq[any](t, runtime.GOOS, environment["os"])
+			must.Eq[any](t, runtime.GOARCH, environment["arch"])
 
 			params, ok := payload["parameters"].(map[string]any)
-			require.True(t, ok)
-			assert.Equal(t, "start", params["command"])
+			must.True(t, ok)
+			must.Eq(t, "start", params["command"])
 
 			result, ok := payload["result"].(map[string]any)
-			require.True(t, ok)
-			assert.InDelta(t, 0, result["exit_code"], 0)
+			must.True(t, ok)
+			must.InDelta(t, 0, result["exit_code"], 0)
 		case <-time.After(3 * time.Second):
 			t.Fatal("timed out waiting for telemetry event")
 		}
@@ -129,7 +128,7 @@ func TestStopCommandSendsTelemetryEvents(t *testing.T) {
 	_, stderr, err := runLstk(t, ctx, "", env.Environ(testEnvWithHome(t.TempDir(), "")).
 		With(env.AuthToken, "fake-token").
 		With(env.AnalyticsEndpoint, analyticsSrv.URL), "stop")
-	require.NoError(t, err, "lstk stop failed: %s", stderr)
+	must.NoError(t, err, "lstk stop failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	// Collect both the lstk_lifecycle and lstk_command events (order not guaranteed).
@@ -146,20 +145,20 @@ func TestStopCommandSendsTelemetryEvents(t *testing.T) {
 	}
 
 	lifecycle, ok := byName["lstk_lifecycle"]
-	require.True(t, ok, "expected lstk_lifecycle event")
+	must.True(t, ok, "expected lstk_lifecycle event")
 	lp := lifecycle["payload"].(map[string]any)
-	assert.Equal(t, "stop", lp["event_type"])
-	assert.Equal(t, "aws", lp["emulator"])
+	must.Eq(t, "stop", lp["event_type"])
+	must.Eq(t, "aws", lp["emulator"])
 
 	command, ok := byName["lstk_command"]
-	require.True(t, ok, "expected lstk_command event")
+	must.True(t, ok, "expected lstk_command event")
 	cp := command["payload"].(map[string]any)
 	params, ok := cp["parameters"].(map[string]any)
-	require.True(t, ok)
-	assert.Equal(t, "stop", params["command"])
+	must.True(t, ok)
+	must.Eq(t, "stop", params["command"])
 	result, ok := cp["result"].(map[string]any)
-	require.True(t, ok)
-	assert.InDelta(t, 0, result["exit_code"], 0)
+	must.True(t, ok)
+	must.InDelta(t, 0, result["exit_code"], 0)
 }
 
 func TestStartCommandSucceedsWhenAnalyticsEndpointUnreachable(t *testing.T) {
@@ -178,7 +177,7 @@ func TestStartCommandSucceedsWhenAnalyticsEndpointUnreachable(t *testing.T) {
 		With(env.AnalyticsEndpoint, "http://127.0.0.1:1")
 	out, err := cmd.CombinedOutput()
 
-	require.NoError(t, err, "lstk start should succeed even when analytics endpoint is unreachable: %s", out)
+	must.NoError(t, err, "lstk start should succeed even when analytics endpoint is unreachable: %s", out)
 	requireExitCode(t, 0, err)
 }
 
@@ -200,7 +199,7 @@ func TestStartCommandDoesNotSendTelemetryWhenDisabled(t *testing.T) {
 		With(env.AnalyticsEndpoint, analyticsSrv.URL).
 		With(env.DisableEvents, "1")
 	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, "lstk start failed: %s", out)
+	must.NoError(t, err, "lstk start failed: %s", out)
 	requireExitCode(t, 0, err)
 
 	// Wait long enough that a goroutine would have fired if enabled.
@@ -229,7 +228,7 @@ func TestAWSProxyTelemetryRecordsExitCodeAndSubcommand(t *testing.T) {
 	// Fake aws on PATH exiting like the real CLI does on a usage error, so the
 	// test needs neither the AWS CLI installed nor a real malformed request.
 	fakeBinDir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(fakeBinDir, "aws"), []byte("#!/bin/sh\nexit 252\n"), 0o755))
+	must.NoError(t, os.WriteFile(filepath.Join(fakeBinDir, "aws"), []byte("#!/bin/sh\nexit 252\n"), 0o755))
 
 	environ := env.Environ(testEnvWithHome(t.TempDir(), "")).
 		With(env.AnalyticsEndpoint, analyticsSrv.URL).
@@ -238,19 +237,19 @@ func TestAWSProxyTelemetryRecordsExitCodeAndSubcommand(t *testing.T) {
 
 	_, _, err := runLstk(t, testContext(t), "", environ,
 		"--endpoint-url", emulatorSrv.URL, "aws", "s3", "lss")
-	require.Error(t, err)
+	must.Error(t, err)
 	requireExitCode(t, 252, err)
 
 	event := receiveEventByName(t, events, "lstk_command")
 	payload, ok := event["payload"].(map[string]any)
-	require.True(t, ok)
+	must.True(t, ok)
 	params, ok := payload["parameters"].(map[string]any)
-	require.True(t, ok)
-	assert.Equal(t, "aws", params["command"])
-	assert.Equal(t, "s3 lss", params["subcommand"])
+	must.True(t, ok)
+	must.Eq(t, "aws", params["command"])
+	must.Eq(t, "s3 lss", params["subcommand"])
 	result, ok := payload["result"].(map[string]any)
-	require.True(t, ok)
-	assert.InDelta(t, 252, result["exit_code"], 0)
+	must.True(t, ok)
+	must.InDelta(t, 252, result["exit_code"], 0)
 }
 
 // receiveEventByName waits up to 3s for an event with the given name.
@@ -277,9 +276,9 @@ func assertCommandTelemetry(t *testing.T, events <-chan map[string]any, command
 	event := receiveEventByName(t, events, "lstk_command")
 	payload, _ := event["payload"].(map[string]any)
 	params, _ := payload["parameters"].(map[string]any)
-	assert.Equal(t, command, params["command"])
+	must.Eq[any](t, command, params["command"])
 	result, _ := payload["result"].(map[string]any)
-	assert.InDelta(t, exitCode, result["exit_code"], 0)
+	must.InDelta(t, exitCode, result["exit_code"], 0)
 }
 
 // Regression test for FLC-648: a slow analytics endpoint must not add to
@@ -322,8 +321,8 @@ func TestStartCommand_DoesNotBlockOnSlowAnalyticsEndpoint(t *testing.T) {
 	out, err := cmd.CombinedOutput()
 	parentDuration := time.Since(start)
 
-	require.NoError(t, err, "lstk start failed: %s", out)
-	require.Less(t, parentDuration, maxParentDuration,
+	must.NoError(t, err, "lstk start failed: %s", out)
+	must.Less(t, parentDuration, maxParentDuration,
 		"parent process took %v, expected <%v — subprocess flush should not block parent", parentDuration, maxParentDuration)
 
 	// The detached subprocess should still deliver the event.
@@ -347,7 +346,7 @@ func TestCommandTelemetryIsDeliveredByDetachedFlusher(t *testing.T) {
 		With(env.AuthToken, "fake-token").
 		With(env.AnalyticsEndpoint, analyticsSrv.URL).
 		With(env.Key("DOCKER_HOST"), "tcp://127.0.0.1:1"), "start")
-	require.Error(t, err)
+	must.Error(t, err)
 	requireExitCode(t, 1, err)
 
 	assertCommandTelemetry(t, events, "start", 1)
@@ -371,7 +370,7 @@ func TestFlushTelemetrySubcommandDoesNotSpawnRecursively(t *testing.T) {
 		With(env.AnalyticsEndpoint, analyticsSrv.URL)
 	cmd.Stdin = strings.NewReader(input)
 	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, "__flush-telemetry failed: %s", out)
+	must.NoError(t, err, "__flush-telemetry failed: %s", out)
 
 	got := map[string]bool{}
 	for i := 0; i < 2; i++ {
@@ -382,7 +381,7 @@ func TestFlushTelemetrySubcommandDoesNotSpawnRecursively(t *testing.T) {
 			t.Fatalf("expected 2 flushed events, got %d: %v", i, got)
 		}
 	}
-	assert.True(t, got["first_event"] && got["second_event"], "expected both piped events, got: %v", got)
+	must.True(t, got["first_event"] && got["second_event"], "expected both piped events, got: %v", got)
 
 	// No further events may arrive: that would mean the flusher emitted telemetry about itself.
 	select {
@@ -408,7 +407,7 @@ func TestOtelFlushSpansJoinCommandTrace(t *testing.T) {
 		With(env.Otel, "1").
 		With(env.OtelEndpoint, otlpSrv.URL).
 		With(env.Key("DOCKER_HOST"), "tcp://127.0.0.1:1"), "start")
-	require.Error(t, err)
+	must.Error(t, err)
 	requireExitCode(t, 1, err)
 
 	// The flusher subprocess exports after the parent exits; allow for its
diff --git a/test/integration/terraform_cmd_test.go b/test/integration/terraform_cmd_test.go
index 9f1ea076..e52eb151 100644
--- a/test/integration/terraform_cmd_test.go
+++ b/test/integration/terraform_cmd_test.go
@@ -8,9 +8,9 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 const tfOverrideFile = "localstack_providers_override.tf"
@@ -40,7 +40,7 @@ if [ -f localstack_providers_override.tf ]; then
   while IFS= read -r line; do echo "TF> $line"; done < localstack_providers_override.tf
 fi
 `, awsSchemaJSON)
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "terraform"), []byte(script), 0755))
+	must.NoError(t, os.WriteFile(filepath.Join(dir, "terraform"), []byte(script), 0755))
 	return dir
 }
 
@@ -59,7 +59,7 @@ if [ "$1" = "providers" ] && [ "$2" = "schema" ]; then
 fi
 echo "ARGS:$*"
 `
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "terraform"), []byte(script), 0755))
+	must.NoError(t, os.WriteFile(filepath.Join(dir, "terraform"), []byte(script), 0755))
 	return dir
 }
 
@@ -74,7 +74,7 @@ func writeFakeTerraformExit(t *testing.T, code int) string {
 echo "terraform: simulated failure" >&2
 exit %d
 `, code)
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "terraform"), []byte(script), 0755))
+	must.NoError(t, os.WriteFile(filepath.Join(dir, "terraform"), []byte(script), 0755))
 	return dir
 }
 
@@ -86,8 +86,8 @@ func TestTerraformForwardsArgs(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "version")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:version")
+	must.NoError(t, err, "stderr: %s", stderr)
+	must.Contains(t, stdout, "ARGS:version")
 }
 
 func TestTerraformAliasTF(t *testing.T) {
@@ -96,8 +96,8 @@ func TestTerraformAliasTF(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "tf", "version")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:version")
+	must.NoError(t, err, "stderr: %s", stderr)
+	must.Contains(t, stdout, "ARGS:version")
 }
 
 // LSTK_TF_CMD selects the binary to invoke (e.g. OpenTofu). A stub named `tofu`
@@ -108,14 +108,14 @@ func TestTerraformHonorsLstkTfCmd(t *testing.T) {
 		t.Skip("fake tofu script not supported on Windows")
 	}
 	dir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "tofu"),
+	must.NoError(t, os.WriteFile(filepath.Join(dir, "tofu"),
 		[]byte("#!/bin/sh\necho \"TOFU:$*\"\n"), 0755))
 	e := env.With(env.DisableEvents, "1").With("PATH", dir).With(env.Home, t.TempDir()).
 		With(env.Key("LSTK_TF_CMD"), "tofu")
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "version")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "TOFU:version")
+	must.NoError(t, err, "stderr: %s", stderr)
+	must.Contains(t, stdout, "TOFU:version")
 }
 
 func TestTerraformPropagatesExitCode(t *testing.T) {
@@ -124,8 +124,8 @@ func TestTerraformPropagatesExitCode(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "validate")
-	require.Error(t, err)
-	assert.Contains(t, stderr, "simulated failure")
+	must.Error(t, err)
+	must.Contains(t, stderr, "simulated failure")
 	requireExitCode(t, 5, err)
 }
 
@@ -135,11 +135,11 @@ func TestTerraformMissingBinary(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "version")
-	require.Error(t, err)
+	must.Error(t, err)
 	combined := stderr + stdout
-	assert.Contains(t, combined, "not found in PATH")
-	assert.Contains(t, combined, "Install Terraform CLI:")
-	assert.Contains(t, combined, "https://developer.hashicorp.com/terraform/cli")
+	must.Contains(t, combined, "not found in PATH")
+	must.Contains(t, combined, "Install Terraform CLI:")
+	must.Contains(t, combined, "https://developer.hashicorp.com/terraform/cli")
 }
 
 // 7.3 — fmt/validate/version/init run without generating an override and without
@@ -156,14 +156,14 @@ func TestTerraformUnproxiedSkipsOverride(t *testing.T) {
 
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, e,
 				"terraform", "--region", "us-west-2", "--account", "111111111111", sub)
-			require.NoError(t, err, "stderr: %s", stderr)
+			must.NoError(t, err, "stderr: %s", stderr)
 
-			assert.Contains(t, stdout, "ARGS:"+sub)
+			must.Contains(t, stdout, "ARGS:"+sub)
 			// lstk-specific flags must not be forwarded to terraform.
-			assert.NotContains(t, stdout, "--region")
-			assert.NotContains(t, stdout, "--account")
+			must.NotContains(t, stdout, "--region")
+			must.NotContains(t, stdout, "--account")
 			// No override file generated.
-			assert.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
+			must.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 		})
 	}
 }
@@ -183,10 +183,10 @@ func TestTerraformHelpSkipsOverride(t *testing.T) {
 
 			cmdArgs := append([]string{"terraform"}, args...)
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, e, cmdArgs...)
-			require.NoError(t, err, "stderr: %s", stderr)
+			must.NoError(t, err, "stderr: %s", stderr)
 
-			assert.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
-			assert.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
+			must.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
+			must.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 		})
 	}
 }
@@ -200,8 +200,8 @@ func TestTerraformInvalidAccountRejected(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"terraform", "--account", "12345", "plan")
-	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "12-digit")
+	must.Error(t, err)
+	must.Contains(t, stderr+stdout, "12-digit")
 }
 
 func TestTerraformMissingFlagValue(t *testing.T) {
@@ -210,8 +210,8 @@ func TestTerraformMissingFlagValue(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "--region")
-	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "--region requires a value")
+	must.Error(t, err)
+	must.Contains(t, stderr+stdout, "--region requires a value")
 }
 
 // 7.7 — positional rules. Flags after the action are forwarded verbatim (use an
@@ -224,8 +224,8 @@ func TestTerraformFlagsAfterActionAreForwarded(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"terraform", "version", "--region", "us-west-2")
-	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:version --region us-west-2")
+	must.NoError(t, err, "stderr: %s", stderr)
+	must.Contains(t, stdout, "ARGS:version --region us-west-2")
 }
 
 func TestTerraformFlagBeforeSubcommandRejected(t *testing.T) {
@@ -235,8 +235,8 @@ func TestTerraformFlagBeforeSubcommandRejected(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--account", "111111111111", "terraform", "version")
-	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "must appear after the terraform subcommand")
+	must.Error(t, err)
+	must.Contains(t, stderr+stdout, "must appear after the terraform subcommand")
 }
 
 // 7.2 — proxied command with no running emulator fails with "not running" and
@@ -250,10 +250,10 @@ func TestTerraformFailsWhenEmulatorNotRunning(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "plan")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "is not running")
-	assert.Contains(t, stdout, "Start LocalStack:")
-	assert.NotContains(t, stdout, "ARGS:plan")
+	must.Error(t, err)
+	must.Contains(t, stdout, "is not running")
+	must.Contains(t, stdout, "Start LocalStack:")
+	must.NotContains(t, stdout, "ARGS:plan")
 }
 
 // 10.4 — lstk terraform only works with the AWS emulator. When a non-AWS
@@ -273,10 +273,10 @@ func TestTerraformRequiresAWSEmulator(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), e, "terraform", "plan")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "requires the")
-	assert.Contains(t, stdout, "Snowflake")
-	assert.NotContains(t, stdout, "ARGS:plan")
+	must.Error(t, err)
+	must.Contains(t, stdout, "requires the")
+	must.Contains(t, stdout, "Snowflake")
+	must.NotContains(t, stdout, "ARGS:plan")
 }
 
 // 7.4 + 7.6 (encoding) — LSTK_TF_DRY_RUN generates the override (with resolved
@@ -295,19 +295,18 @@ func TestTerraformDryRunGeneratesOverride(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, ctx, workDir, e,
 		"terraform", "--region", "us-west-2", "--account", "111111111111", "plan")
-	require.NoError(t, err, "stderr: %s", stderr)
+	must.NoError(t, err, "stderr: %s", stderr)
 
 	// terraform plan must NOT have run.
-	assert.NotContains(t, stdout, "ARGS:plan")
+	must.NotContains(t, stdout, "ARGS:plan")
 
 	overridePath := filepath.Join(workDir, tfOverrideFile)
-	require.FileExists(t, overridePath)
+	must.FileExists(t, overridePath)
 	content, err := os.ReadFile(overridePath)
-	require.NoError(t, err)
-	assert.Contains(t, string(content), `region = "us-west-2"`)
-	assert.Contains(t, string(content), `access_key = "111111111111"`)
-	assert.Contains(t, string(content), "endpoints {")
-	assert.Contains(t, string(content), "s3 =")
+	must.NoError(t, err)
+	// The snapshot pins the full generated override: resolved region and
+	// account encoded, plus the complete endpoints block (host masked).
+	snap.Match(t, sanitizeOutput(string(content)))
 }
 
 // 7.5 — a pre-existing override file (not created by lstk) causes a clear
@@ -322,17 +321,17 @@ func TestTerraformRefusesPreexistingOverride(t *testing.T) {
 	fakeDir := writeFakeTerraform(t)
 	workDir := t.TempDir()
 	overridePath := filepath.Join(workDir, tfOverrideFile)
-	require.NoError(t, os.WriteFile(overridePath, []byte("# my own override\n"), 0644))
+	must.NoError(t, os.WriteFile(overridePath, []byte("# my own override\n"), 0644))
 
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, ctx, workDir, e, "terraform", "plan")
-	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "refusing to overwrite")
+	must.Error(t, err)
+	must.Contains(t, stderr+stdout, "refusing to overwrite")
 
 	content, err := os.ReadFile(overridePath)
-	require.NoError(t, err)
-	assert.Equal(t, "# my own override\n", string(content), "user's file must be untouched")
+	must.NoError(t, err)
+	must.Eq(t, "# my own override\n", string(content), "user's file must be untouched")
 }
 
 // 7.8 — a proxied `plan` generates the override (with endpoint keys sourced from
@@ -352,14 +351,14 @@ func TestTerraformGeneratesAndRemovesOverride(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, ctx, workDir, e, "terraform", "plan")
-	require.NoError(t, err, "stderr: %s", stderr)
+	must.NoError(t, err, "stderr: %s", stderr)
 
 	// terraform ran and saw an override carrying the schema-derived s3 endpoint key.
-	assert.Contains(t, stdout, "ARGS:plan")
-	assert.Contains(t, stdout, "TF>")
-	assert.Contains(t, stdout, "s3 =")
+	must.Contains(t, stdout, "ARGS:plan")
+	must.Contains(t, stdout, "TF>")
+	must.Contains(t, stdout, "s3 =")
 	// The override is removed once the run completes.
-	assert.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
+	must.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 }
 
 // 11.4 — a proxied command run with `-chdir=DIR` anchors lstk's work to DIR.
@@ -379,35 +378,35 @@ func TestTerraformChdirAnchorsOverrideToDir(t *testing.T) {
 	t.Run("override generated inside chdir dir", func(t *testing.T) {
 		workDir := t.TempDir()
 		infra := filepath.Join(workDir, "infra")
-		require.NoError(t, os.Mkdir(infra, 0755))
+		must.NoError(t, os.Mkdir(infra, 0755))
 		e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir()).
 			With(env.Key("LSTK_TF_DRY_RUN"), "1")
 
 		_, stderr, err := runLstk(t, ctx, workDir, e, "terraform", "-chdir=infra", "plan")
-		require.NoError(t, err, "stderr: %s", stderr)
+		must.NoError(t, err, "stderr: %s", stderr)
 
 		overridePath := filepath.Join(infra, tfOverrideFile)
-		require.FileExists(t, overridePath)
+		must.FileExists(t, overridePath)
 		content, err := os.ReadFile(overridePath)
-		require.NoError(t, err)
-		assert.Contains(t, string(content), "s3 =") // schema-derived endpoint key
+		must.NoError(t, err)
+		must.Contains(t, string(content), "s3 =") // schema-derived endpoint key
 		// Nothing was written at the top level.
-		assert.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
+		must.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 	})
 
 	// A live run forwards -chdir to terraform and removes the override after.
 	t.Run("chdir forwarded and override cleaned up", func(t *testing.T) {
 		workDir := t.TempDir()
 		infra := filepath.Join(workDir, "infra")
-		require.NoError(t, os.Mkdir(infra, 0755))
+		must.NoError(t, os.Mkdir(infra, 0755))
 		e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 		stdout, stderr, err := runLstk(t, ctx, workDir, e, "terraform", "-chdir=infra", "plan")
-		require.NoError(t, err, "stderr: %s", stderr)
+		must.NoError(t, err, "stderr: %s", stderr)
 
-		assert.Contains(t, stdout, "ARGS:-chdir=infra plan")
-		assert.NoFileExists(t, filepath.Join(infra, tfOverrideFile))
-		assert.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
+		must.Contains(t, stdout, "ARGS:-chdir=infra plan")
+		must.NoFileExists(t, filepath.Join(infra, tfOverrideFile))
+		must.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 	})
 }
 
@@ -425,10 +424,10 @@ func TestTerraformChdirMissingDirFails(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, _, err := runLstk(t, ctx, workDir, e, "terraform", "-chdir=does-not-exist", "plan")
-	require.Error(t, err)
-	assert.Contains(t, stdout, "does not exist")
-	assert.NotContains(t, stdout, "ARGS:")
-	assert.NoFileExists(t, filepath.Join(workDir, "does-not-exist", tfOverrideFile))
+	must.Error(t, err)
+	must.Contains(t, stdout, "does not exist")
+	must.NotContains(t, stdout, "ARGS:")
+	must.NoFileExists(t, filepath.Join(workDir, "does-not-exist", tfOverrideFile))
 }
 
 // 7.9 — provider schema unavailable (before init) fails with the init-required
@@ -445,8 +444,8 @@ func TestTerraformSchemaUnavailableRequiresInit(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).With(env.Home, t.TempDir())
 
 	stdout, stderr, err := runLstk(t, ctx, workDir, e, "terraform", "plan")
-	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "terraform init")
-	assert.NotContains(t, stdout, "ARGS:plan")
-	assert.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
+	must.Error(t, err)
+	must.Contains(t, stderr+stdout, "terraform init")
+	must.NotContains(t, stdout, "ARGS:plan")
+	must.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 }
diff --git a/test/integration/terraform_e2e_test.go b/test/integration/terraform_e2e_test.go
index 67d4e587..fabd4982 100644
--- a/test/integration/terraform_e2e_test.go
+++ b/test/integration/terraform_e2e_test.go
@@ -9,9 +9,8 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // End-to-end tests for `lstk terraform` that exercise the real terraform/tofu
@@ -57,7 +56,7 @@ func tfPluginCacheDir(t *testing.T) string {
 	t.Helper()
 	tfCacheOnce.Do(func() {
 		d, err := os.MkdirTemp("", "lstk-tf-plugin-cache")
-		require.NoError(t, err)
+		must.NoError(t, err)
 		tfCacheDir = d
 	})
 	return tfCacheDir
@@ -80,7 +79,7 @@ func copySample(t *testing.T, name string) string {
 	t.Helper()
 	work := t.TempDir()
 	src := filepath.Join("test-samples", "iac", "terraform", name)
-	require.NoError(t, os.CopyFS(work, os.DirFS(src)))
+	must.NoError(t, os.CopyFS(work, os.DirFS(src)))
 	return work
 }
 
@@ -98,7 +97,7 @@ func runTerraform(t *testing.T, ctx context.Context, work string, e env.Environ,
 func tfInit(t *testing.T, ctx context.Context, work string, e env.Environ) {
 	t.Helper()
 	_, stderr, err := runTerraform(t, ctx, work, e, "init", "-no-color")
-	require.NoError(t, err, "terraform init failed: %s", stderr)
+	must.NoError(t, err, "terraform init failed: %s", stderr)
 }
 
 // 8.1 + 8.2 — top-level project: real init + apply against a real LocalStack,
@@ -119,10 +118,10 @@ func TestTerraformE2ETopLevelProject(t *testing.T) {
 	tfInit(t, ctx, work, e)
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
-	require.NoError(t, err, "apply stderr: %s", stderr)
+	must.NoError(t, err, "apply stderr: %s", stderr)
 
 	// The generated override is cleaned up after the run completes.
-	assert.NoFileExists(t, filepath.Join(work, tfOverrideFile))
+	must.NoFileExists(t, filepath.Join(work, tfOverrideFile))
 }
 
 // 8.4 — single aws provider block (no alias): exactly one override block. We
@@ -142,10 +141,10 @@ func TestTerraformE2ESingleProvider(t *testing.T) {
 	tfInit(t, ctx, work, e)
 
 	override := captureOverride(t, ctx, work, e)
-	assert.Equal(t, 1, countString(override, `provider "aws" {`), "exactly one provider block")
+	must.Eq(t, 1, countString(override, `provider "aws" {`), "exactly one provider block")
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
-	require.NoError(t, err, "apply stderr: %s", stderr)
+	must.NoError(t, err, "apply stderr: %s", stderr)
 }
 
 // 8.5 — multiple aliased providers plus the default: one override block per
@@ -164,11 +163,11 @@ func TestTerraformE2EMultipleAliases(t *testing.T) {
 	tfInit(t, ctx, work, e)
 
 	override := captureOverride(t, ctx, work, e)
-	assert.Equal(t, 2, countString(override, `provider "aws" {`), "default + aliased provider blocks")
-	assert.Contains(t, override, `alias = "west"`)
+	must.Eq(t, 2, countString(override, `provider "aws" {`), "default + aliased provider blocks")
+	must.Contains(t, override, `alias = "west"`)
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
-	require.NoError(t, err, "apply stderr: %s", stderr)
+	must.NoError(t, err, "apply stderr: %s", stderr)
 }
 
 // 8.3 — recursive discovery: a provider block in a sub-directory is represented
@@ -189,15 +188,15 @@ func TestTerraformE2ESubdirectoryDiscovery(t *testing.T) {
 	// ignored by discovery. It's created at runtime rather than committed,
 	// since a fake .terraform dir in the repo would be confusing.
 	cacheDir := filepath.Join(work, ".terraform", "extra")
-	require.NoError(t, os.MkdirAll(cacheDir, 0755))
-	require.NoError(t, os.WriteFile(filepath.Join(cacheDir, "cached.tf"),
+	must.NoError(t, os.MkdirAll(cacheDir, 0755))
+	must.NoError(t, os.WriteFile(filepath.Join(cacheDir, "cached.tf"),
 		[]byte("provider \"aws\" {\n  alias = \"should_be_ignored\"\n}\n"), 0644))
 	e := e2eEnv(t)
 	tfInit(t, ctx, work, e)
 
 	override := captureOverride(t, ctx, work, e)
-	assert.Contains(t, override, `alias = "replica"`, "sub-directory provider discovered")
-	assert.NotContains(t, override, "should_be_ignored", ".terraform provider ignored")
+	must.Contains(t, override, `alias = "replica"`, "sub-directory provider discovered")
+	must.NotContains(t, override, "should_be_ignored", ".terraform provider ignored")
 }
 
 // 8.6 — a provider block that explicitly sets an endpoint (e.g. FIPS) is
@@ -217,11 +216,11 @@ func TestTerraformE2EExplicitEndpointOverridden(t *testing.T) {
 	tfInit(t, ctx, work, e)
 
 	override := captureOverride(t, ctx, work, e)
-	assert.NotContains(t, override, "s3-fips.us-east-1.amazonaws.com", "user FIPS endpoint must not survive")
-	assert.Contains(t, override, "localstack", "override S3 endpoint targets LocalStack")
+	must.NotContains(t, override, "s3-fips.us-east-1.amazonaws.com", "user FIPS endpoint must not survive")
+	must.Contains(t, override, "localstack", "override S3 endpoint targets LocalStack")
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
-	require.NoError(t, err, "apply must route to LocalStack, not FIPS; stderr: %s", stderr)
+	must.NoError(t, err, "apply must route to LocalStack, not FIPS; stderr: %s", stderr)
 }
 
 // 8.7 — provider version coverage: schema-based endpoint discovery works for
@@ -252,7 +251,7 @@ func TestTerraformE2EProviderVersions(t *testing.T) {
 			// A successful apply requires schema discovery (endpoint keys) to
 			// have worked for this provider version.
 			_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
-			require.NoError(t, err, "apply stderr: %s", stderr)
+			must.NoError(t, err, "apply stderr: %s", stderr)
 		})
 	}
 }
@@ -272,12 +271,12 @@ func TestTerraformE2ETofu(t *testing.T) {
 	e := e2eEnv(t).With(env.Key("LSTK_TF_CMD"), "tofu")
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "init", "-no-color")
-	require.NoError(t, err, "tofu init stderr: %s", stderr)
+	must.NoError(t, err, "tofu init stderr: %s", stderr)
 
 	_, stderr, err = runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
-	require.NoError(t, err, "tofu apply stderr: %s", stderr)
+	must.NoError(t, err, "tofu apply stderr: %s", stderr)
 
-	assert.NoFileExists(t, filepath.Join(work, tfOverrideFile))
+	must.NoFileExists(t, filepath.Join(work, tfOverrideFile))
 }
 
 // captureOverride runs the command with LSTK_TF_DRY_RUN=1 so the generated
@@ -286,10 +285,10 @@ func captureOverride(t *testing.T, ctx context.Context, work string, e env.Envir
 	t.Helper()
 	_, stderr, err := runTerraform(t, ctx, work, e.With(env.Key("LSTK_TF_DRY_RUN"), "1"),
 		"plan", "-no-color")
-	require.NoError(t, err, "dry-run stderr: %s", stderr)
+	must.NoError(t, err, "dry-run stderr: %s", stderr)
 	content, err := os.ReadFile(filepath.Join(work, tfOverrideFile))
-	require.NoError(t, err, "override file should exist after dry run")
+	must.NoError(t, err, "override file should exist after dry run")
 	// Remove it so a subsequent real run doesn't trip the pre-existing-file guard.
-	require.NoError(t, os.Remove(filepath.Join(work, tfOverrideFile)))
+	must.NoError(t, os.Remove(filepath.Join(work, tfOverrideFile)))
 	return string(content)
 }
diff --git a/test/integration/terraform_s3backend_e2e_test.go b/test/integration/terraform_s3backend_e2e_test.go
index 0c0efce0..d66c5078 100644
--- a/test/integration/terraform_s3backend_e2e_test.go
+++ b/test/integration/terraform_s3backend_e2e_test.go
@@ -5,9 +5,8 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // End-to-end tests for the S3 state backend and terraform_remote_state support.
@@ -21,7 +20,7 @@ import (
 func tfStateList(t *testing.T, ctx context.Context, work string, e env.Environ) string {
 	t.Helper()
 	stdout, stderr, err := runTerraform(t, ctx, work, e, "state", "list")
-	require.NoError(t, err, "state list failed: %s", stderr)
+	must.NoError(t, err, "state list failed: %s", stderr)
 	return stdout
 }
 
@@ -45,12 +44,12 @@ func TestTerraformE2ES3Backend(t *testing.T) {
 	tfInit(t, ctx, work, e)
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
-	require.NoError(t, err, "apply stderr: %s", stderr)
+	must.NoError(t, err, "apply stderr: %s", stderr)
 
 	// State written to and read back from the LocalStack bucket.
-	assert.Contains(t, tfStateList(t, ctx, work, e), "aws_s3_bucket.b")
+	must.Contains(t, tfStateList(t, ctx, work, e), "aws_s3_bucket.b")
 
-	assert.NoFileExists(t, filepath.Join(work, tfOverrideFile))
+	must.NoFileExists(t, filepath.Join(work, tfOverrideFile))
 }
 
 // 10.2 — an S3 backend with DynamoDB locking: lstk creates the lock table, and
@@ -71,9 +70,9 @@ func TestTerraformE2ES3BackendLocking(t *testing.T) {
 	tfInit(t, ctx, work, e)
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
-	require.NoError(t, err, "apply with DynamoDB locking stderr: %s", stderr)
+	must.NoError(t, err, "apply with DynamoDB locking stderr: %s", stderr)
 
-	assert.Contains(t, tfStateList(t, ctx, work, e), "aws_s3_bucket.b")
+	must.Contains(t, tfStateList(t, ctx, work, e), "aws_s3_bucket.b")
 }
 
 // 10.3 — terraform_remote_state: a producer stack writes state (with an output)
@@ -93,17 +92,17 @@ func TestTerraformE2ERemoteState(t *testing.T) {
 	e := e2eEnv(t)
 	tfInit(t, ctx, producer, e)
 	_, stderr, err := runTerraform(t, ctx, producer, e, "apply", "-auto-approve", "-no-color")
-	require.NoError(t, err, "producer apply stderr: %s", stderr)
+	must.NoError(t, err, "producer apply stderr: %s", stderr)
 
 	// Consumer: reads the producer's remote state from LocalStack.
 	consumer := copySample(t, "remote-state/consumer")
 	tfInit(t, ctx, consumer, e)
 	_, stderr, err = runTerraform(t, ctx, consumer, e, "apply", "-auto-approve", "-no-color")
-	require.NoError(t, err, "consumer apply stderr: %s", stderr)
+	must.NoError(t, err, "consumer apply stderr: %s", stderr)
 
 	stdout, stderr, err := runTerraform(t, ctx, consumer, e, "output", "-raw", "producer_bucket")
-	require.NoError(t, err, "consumer output stderr: %s", stderr)
-	assert.Contains(t, stdout, "lstk-e2e-remote-producer", "consumer read the producer's output from LocalStack remote state")
+	must.NoError(t, err, "consumer output stderr: %s", stderr)
+	must.Contains(t, stdout, "lstk-e2e-remote-producer", "consumer read the producer's output from LocalStack remote state")
 }
 
 // 10.4 — the S3 backend flow under OpenTofu (LSTK_TF_CMD=tofu), covering the
@@ -123,9 +122,9 @@ func TestTerraformE2ES3BackendTofu(t *testing.T) {
 	tfInit(t, ctx, work, e)
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
-	require.NoError(t, err, "tofu apply stderr: %s", stderr)
+	must.NoError(t, err, "tofu apply stderr: %s", stderr)
 
-	assert.Contains(t, tfStateList(t, ctx, work, e), "aws_s3_bucket.b")
+	must.Contains(t, tfStateList(t, ctx, work, e), "aws_s3_bucket.b")
 }
 
 // State-bucket provisioning must address the same LocalStack account as the
@@ -149,19 +148,19 @@ func TestTerraformE2ES3BackendProvisionsInSelectedAccount(t *testing.T) {
 	e := e2eEnv(t)
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "--account", account, "init", "-no-color")
-	require.NoError(t, err, "init with --account failed: %s", stderr)
+	must.NoError(t, err, "init with --account failed: %s", stderr)
 
 	_, stderr, err = runTerraform(t, ctx, work, e, "--account", account, "apply", "-auto-approve", "-no-color")
-	require.NoError(t, err, "apply stderr: %s", stderr)
+	must.NoError(t, err, "apply stderr: %s", stderr)
 
 	selected, stderr, err := runLstk(t, ctx, work, e, "aws", "--account", account, "s3", "ls")
-	require.NoError(t, err, "listing buckets in the selected account failed: %s", stderr)
-	assert.Contains(t, selected, "lstk-tf-state", "the state bucket must exist in the selected account")
+	must.NoError(t, err, "listing buckets in the selected account failed: %s", stderr)
+	must.Contains(t, selected, "lstk-tf-state", "the state bucket must exist in the selected account")
 
 	// And not in the default account, which is where it landed before the fix.
 	deflt, stderr, err := runLstk(t, ctx, work, e, "aws", "s3", "ls")
-	require.NoError(t, err, "listing buckets in the default account failed: %s", stderr)
-	assert.NotContains(t, deflt, "lstk-tf-state", "the state bucket must not be in the default account")
+	must.NoError(t, err, "listing buckets in the default account failed: %s", stderr)
+	must.NotContains(t, deflt, "lstk-tf-state", "the state bucket must not be in the default account")
 }
 
 // 10.5 — a configuration with no S3 backend still behaves as before: `init`
@@ -175,8 +174,8 @@ func TestTerraformE2EInitNoBackendNoEmulator(t *testing.T) {
 	e := e2eEnv(t)
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "init", "-no-color")
-	require.NoError(t, err, "backend-less init must not require an emulator; stderr: %s", stderr)
+	must.NoError(t, err, "backend-less init must not require an emulator; stderr: %s", stderr)
 
 	// No override is generated for a backend-less init.
-	assert.NoFileExists(t, filepath.Join(work, tfOverrideFile))
+	must.NoFileExists(t, filepath.Join(work, tfOverrideFile))
 }
diff --git a/test/integration/update_test.go b/test/integration/update_test.go
index b2d1c337..fd44adad 100644
--- a/test/integration/update_test.go
+++ b/test/integration/update_test.go
@@ -23,9 +23,9 @@ import (
 	"time"
 
 	"github.com/creack/pty"
+	"github.com/localstack/lstk/internal/must"
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestUpdateCheckCommand(t *testing.T) {
@@ -34,11 +34,11 @@ func TestUpdateCheckCommand(t *testing.T) {
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "update", "--check")
-	require.NoError(t, err, "lstk update --check failed: %s", stderr)
+	must.NoError(t, err, "lstk update --check failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	// Dev builds report a note about skipping update check
-	assert.Contains(t, stdout, "Note:", "should show a note (dev build or up-to-date)")
+	must.Contains(t, stdout, "Note:", "should show a note (dev build or up-to-date)")
 	assertCommandTelemetry(t, events, "update", 0)
 }
 
@@ -47,9 +47,9 @@ func TestUpdateCheckCommandNonInteractive(t *testing.T) {
 	ctx := testContext(t)
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "update", "--check", "--non-interactive")
-	require.NoError(t, err, "lstk update --check --non-interactive failed: %s", stderr)
+	must.NoError(t, err, "lstk update --check --non-interactive failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "Note:", "should show a note in non-interactive mode")
+	must.Contains(t, stdout, "Note:", "should show a note in non-interactive mode")
 }
 
 func TestUpdateCheckCommandJSON(t *testing.T) {
@@ -57,24 +57,24 @@ func TestUpdateCheckCommandJSON(t *testing.T) {
 	ctx := testContext(t)
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "update", "--check", "--json")
-	require.NoError(t, err, "lstk update --check --json failed: %s", stderr)
+	must.NoError(t, err, "lstk update --check --json failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "ok", envelope.Status)
-	assert.Equal(t, "update", envelope.Command)
+	must.Eq(t, "ok", envelope.Status)
+	must.Eq(t, "update", envelope.Command)
 
 	var data struct {
 		CurrentVersion  string `json:"currentVersion"`
 		LatestVersion   string `json:"latestVersion"`
 		UpdateAvailable bool   `json:"updateAvailable"`
 	}
-	require.NoError(t, json.Unmarshal(envelope.Data, &data))
+	must.NoError(t, json.Unmarshal(envelope.Data, &data))
 	// The integration test binary is a dev build, so Check short-circuits
 	// before any network call — this exercises the "checked, none applied"
 	// UpdateCheckedEvent shape without depending on network access.
-	assert.Equal(t, "dev", data.CurrentVersion)
-	assert.False(t, data.UpdateAvailable)
+	must.Eq(t, "dev", data.CurrentVersion)
+	must.False(t, data.UpdateAvailable)
 }
 
 func requireNPM(t *testing.T) {
@@ -101,8 +101,8 @@ func TestUpdateNPMInstall(t *testing.T) {
 	// On Windows, t.TempDir() may return a short 8.3 path (e.g. RUNNER~1)
 	// while the program resolves the long path. EvalSymlinks normalizes both.
 	projectDir, err := filepath.EvalSymlinks(t.TempDir())
-	require.NoError(t, err)
-	require.NoError(t, os.WriteFile(
+	must.NoError(t, err)
+	must.NoError(t, os.WriteFile(
 		filepath.Join(projectDir, "package.json"),
 		[]byte(`{"name":"test-project","version":"1.0.0","dependencies":{"@localstack/lstk":"*"}}`),
 		0o644,
@@ -112,7 +112,7 @@ func TestUpdateNPMInstall(t *testing.T) {
 	npmInstall := exec.CommandContext(ctx, "npm", "install", "@localstack/lstk")
 	npmInstall.Dir = projectDir
 	out, err := npmInstall.CombinedOutput()
-	require.NoError(t, err, "npm install failed: %s", string(out))
+	must.NoError(t, err, "npm install failed: %s", string(out))
 
 	// Build a fake old version binary and replace the one in node_modules
 	platformPkg := npmPlatformPackage()
@@ -124,11 +124,11 @@ func TestUpdateNPMInstall(t *testing.T) {
 
 	// Verify the binary exists from npm install
 	_, err = os.Stat(nmBinaryPath)
-	require.NoError(t, err, "expected binary at %s after npm install", nmBinaryPath)
+	must.NoError(t, err, "expected binary at %s after npm install", nmBinaryPath)
 
 	// Build our dev binary with a fake old version into that location
 	repoRoot, err := filepath.Abs("../..")
-	require.NoError(t, err)
+	must.NoError(t, err)
 	buildCmd := exec.CommandContext(ctx, "go", "build",
 		"-ldflags", "-X github.com/localstack/lstk/internal/version.version=0.0.1",
 		"-o", nmBinaryPath,
@@ -136,7 +136,7 @@ func TestUpdateNPMInstall(t *testing.T) {
 	)
 	buildCmd.Dir = repoRoot
 	out, err = buildCmd.CombinedOutput()
-	require.NoError(t, err, "go build failed: %s", string(out))
+	must.NoError(t, err, "go build failed: %s", string(out))
 
 	// Run the binary directly (not through npx) so os.Executable() resolves to the node_modules path.
 	// The update should always use `npm install -g` regardless of local/global context.
@@ -145,10 +145,10 @@ func TestUpdateNPMInstall(t *testing.T) {
 	stdout, err := cmd.CombinedOutput()
 	stdoutStr := string(stdout)
 
-	require.NoError(t, err, "lstk update failed: %s", stdoutStr)
+	must.NoError(t, err, "lstk update failed: %s", stdoutStr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdoutStr, "npm install -g", "should always use global install")
-	assert.Contains(t, stdoutStr, "Updated to", "should complete the update")
+	must.Contains(t, stdoutStr, "npm install -g", "should always use global install")
+	must.Contains(t, stdoutStr, "Updated to", "should complete the update")
 }
 
 func TestUpdateBinaryInPlace(t *testing.T) {
@@ -162,7 +162,7 @@ func TestUpdateBinaryInPlace(t *testing.T) {
 	}
 	tmpBinary := filepath.Join(t.TempDir(), binaryName)
 	repoRoot, err := filepath.Abs("../..")
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	buildCmd := exec.CommandContext(ctx, "go", "build",
 		"-ldflags", "-X github.com/localstack/lstk/internal/version.version=0.0.1",
@@ -171,13 +171,13 @@ func TestUpdateBinaryInPlace(t *testing.T) {
 	)
 	buildCmd.Dir = repoRoot
 	out, err := buildCmd.CombinedOutput()
-	require.NoError(t, err, "go build failed: %s", string(out))
+	must.NoError(t, err, "go build failed: %s", string(out))
 
 	// Verify it reports the fake version
 	verCmd := exec.CommandContext(ctx, tmpBinary, "--version")
 	verOut, err := verCmd.CombinedOutput()
-	require.NoError(t, err)
-	assert.Contains(t, string(verOut), "0.0.1")
+	must.NoError(t, err)
+	must.Contains(t, string(verOut), "0.0.1")
 
 	// Run update — should download the real latest release from GitHub and
 	// replace itself. HOME is a temp dir so config/log side effects stay
@@ -186,21 +186,21 @@ func TestUpdateBinaryInPlace(t *testing.T) {
 	updateCmd.Env = testEnvWithHome(t.TempDir(), "")
 	updateOut, err := updateCmd.CombinedOutput()
 	updateStr := string(updateOut)
-	require.NoError(t, err, "lstk update failed: %s", updateStr)
+	must.NoError(t, err, "lstk update failed: %s", updateStr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, updateStr, "Update available: 0.0.1", "should detect update")
-	assert.Contains(t, updateStr, "Downloading and verifying update", "should download and verify binary")
-	assert.Contains(t, updateStr, "Updated to", "should complete the update")
+	must.Contains(t, updateStr, "Update available: 0.0.1", "should detect update")
+	must.Contains(t, updateStr, "Downloading and verifying update", "should download and verify binary")
+	must.Contains(t, updateStr, "Updated to", "should complete the update")
 
 	// Verify the binary was replaced with the release version the update
 	// reported, not just "anything other than 0.0.1".
 	m := regexp.MustCompile(`Updated to v?([0-9]+\.[0-9]+\.[0-9]+\S*)`).FindStringSubmatch(updateStr)
-	require.Len(t, m, 2, "update output should report the installed version: %s", updateStr)
+	must.Len(t, m, 2, "update output should report the installed version: %s", updateStr)
 	verCmd2 := exec.CommandContext(ctx, tmpBinary, "--version")
 	verOut2, err := verCmd2.CombinedOutput()
-	require.NoError(t, err)
-	assert.Contains(t, string(verOut2), m[1], "replaced binary should print the downloaded release version")
-	assert.NotContains(t, string(verOut2), "0.0.1", "binary should no longer be the old version")
+	must.NoError(t, err)
+	must.Contains(t, string(verOut2), m[1], "replaced binary should print the downloaded release version")
+	must.NotContains(t, string(verOut2), "0.0.1", "binary should no longer be the old version")
 }
 
 // TestUpdateBinaryInPlaceJSON exercises an actual applied update (not just
@@ -218,7 +218,7 @@ func TestUpdateBinaryInPlaceJSON(t *testing.T) {
 	}
 	tmpBinary := filepath.Join(t.TempDir(), binaryName)
 	repoRoot, err := filepath.Abs("../..")
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	buildCmd := exec.CommandContext(ctx, "go", "build",
 		"-ldflags", "-X github.com/localstack/lstk/internal/version.version=0.0.1",
@@ -227,28 +227,28 @@ func TestUpdateBinaryInPlaceJSON(t *testing.T) {
 	)
 	buildCmd.Dir = repoRoot
 	out, err := buildCmd.CombinedOutput()
-	require.NoError(t, err, "go build failed: %s", string(out))
+	must.NoError(t, err, "go build failed: %s", string(out))
 
 	updateCmd := exec.CommandContext(ctx, tmpBinary, "update", "--non-interactive", "--json")
 	updateCmd.Env = testEnvWithHome(t.TempDir(), "")
 	updateOut, err := updateCmd.CombinedOutput()
 	updateStr := string(updateOut)
-	require.NoError(t, err, "lstk update --json failed: %s", updateStr)
+	must.NoError(t, err, "lstk update --json failed: %s", updateStr)
 	requireExitCode(t, 0, err)
 
 	envelope := decodeEnvelope(t, strings.TrimSpace(updateStr))
-	assert.Equal(t, "ok", envelope.Status)
+	must.Eq(t, "ok", envelope.Status)
 
 	var data map[string]any
-	require.NoError(t, json.Unmarshal(envelope.Data, &data))
-	assert.Equal(t, "0.0.1", data["currentVersion"])
-	assert.Equal(t, true, data["updated"])
-	assert.Equal(t, "binary", data["method"])
-	assert.NotEmpty(t, data["updatedVersion"])
+	must.NoError(t, json.Unmarshal(envelope.Data, &data))
+	must.Eq(t, "0.0.1", data["currentVersion"])
+	must.Eq(t, true, data["updated"])
+	must.Eq(t, "binary", data["method"])
+	must.NotEmpty(t, data["updatedVersion"])
 	_, hasLatestVersion := data["latestVersion"]
 	_, hasUpdateAvailable := data["updateAvailable"]
-	assert.False(t, hasLatestVersion, "applied-update data should not carry a stale latestVersion key from the preceding check")
-	assert.False(t, hasUpdateAvailable, "applied-update data should not carry a stale updateAvailable key from the preceding check")
+	must.False(t, hasLatestVersion, "applied-update data should not carry a stale latestVersion key from the preceding check")
+	must.False(t, hasUpdateAvailable, "applied-update data should not carry a stale updateAvailable key from the preceding check")
 }
 
 func requireHomebrew(t *testing.T) {
@@ -263,7 +263,7 @@ func homebrewLstkBinaryPath(t *testing.T) string {
 
 	// Find the Caskroom binary by resolving the brew symlink
 	brewBin, err := exec.Command("brew", "--prefix").Output()
-	require.NoError(t, err)
+	must.NoError(t, err)
 	prefix := strings.TrimSpace(string(brewBin))
 
 	// Look for lstk in the Caskroom
@@ -283,7 +283,7 @@ func TestUpdateHomebrew(t *testing.T) {
 
 	ctx := testContext(t)
 	repoRoot, err := filepath.Abs("../..")
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	// Build a fake old version into the Caskroom location
 	buildCmd := exec.CommandContext(ctx, "go", "build",
@@ -293,13 +293,13 @@ func TestUpdateHomebrew(t *testing.T) {
 	)
 	buildCmd.Dir = repoRoot
 	out, err := buildCmd.CombinedOutput()
-	require.NoError(t, err, "go build failed: %s", string(out))
+	must.NoError(t, err, "go build failed: %s", string(out))
 
 	// Verify it reports the fake version
 	verCmd := exec.CommandContext(ctx, caskBinary, "--version")
 	verOut, err := verCmd.CombinedOutput()
-	require.NoError(t, err)
-	assert.Contains(t, string(verOut), "0.0.1")
+	must.NoError(t, err)
+	must.Contains(t, string(verOut), "0.0.1")
 
 	// Run update — should detect Homebrew and run brew upgrade
 	// Note: brew may consider lstk already up-to-date (its metadata tracks the
@@ -308,10 +308,10 @@ func TestUpdateHomebrew(t *testing.T) {
 	updateCmd := exec.CommandContext(ctx, caskBinary, "update", "--non-interactive")
 	updateOut, err := updateCmd.CombinedOutput()
 	updateStr := string(updateOut)
-	require.NoError(t, err, "lstk update failed: %s", updateStr)
+	must.NoError(t, err, "lstk update failed: %s", updateStr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, updateStr, "Homebrew", "should detect Homebrew install")
-	assert.Contains(t, updateStr, "brew upgrade", "should mention brew upgrade")
+	must.Contains(t, updateStr, "Homebrew", "should detect Homebrew install")
+	must.Contains(t, updateStr, "brew upgrade", "should mention brew upgrade")
 }
 
 func TestUpdateNotification(t *testing.T) {
@@ -325,7 +325,7 @@ func TestUpdateNotification(t *testing.T) {
 	// Build a fake old version to a temp location
 	tmpBinary := filepath.Join(t.TempDir(), "lstk")
 	repoRoot, err := filepath.Abs("../..")
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	buildCmd := exec.CommandContext(ctx, "go", "build",
 		"-ldflags", "-X github.com/localstack/lstk/internal/version.version=0.0.1",
@@ -334,7 +334,7 @@ func TestUpdateNotification(t *testing.T) {
 	)
 	buildCmd.Dir = repoRoot
 	out, err := buildCmd.CombinedOutput()
-	require.NoError(t, err, "go build failed: %s", string(out))
+	must.NoError(t, err, "go build failed: %s", string(out))
 
 	// Mock API server so license validation fails fast after the notification
 	mockServer := createMockLicenseServer(false)
@@ -349,7 +349,7 @@ type = "aws"     # Emulator type
 tag  = "latest"  # Docker image tag
 port = "4566"    # Host port
 `
-		require.NoError(t, os.WriteFile(configFile, []byte(originalConfig), 0o644))
+		must.NoError(t, os.WriteFile(configFile, []byte(originalConfig), 0o644))
 
 		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 		defer cancel()
@@ -358,7 +358,7 @@ port = "4566"    # Host port
 		cmd.Env = env.Without(env.AuthToken).With(env.AuthToken, "fake-token").With(env.APIEndpoint, mockServer.URL)
 
 		ptmx, err := pty.Start(cmd)
-		require.NoError(t, err, "failed to start command in PTY")
+		must.NoError(t, err, "failed to start command in PTY")
 		defer func() { _ = ptmx.Close() }()
 
 		output := &syncBuffer{}
@@ -368,25 +368,25 @@ port = "4566"    # Host port
 			close(outputCh)
 		}()
 
-		require.Eventually(t, func() bool {
+		must.Eventually(t, func() bool {
 			return bytes.Contains(output.Bytes(), []byte("New lstk version available"))
 		}, 10*time.Second, 100*time.Millisecond, "update notification prompt should appear")
 
 		_, err = ptmx.Write([]byte("s"))
-		require.NoError(t, err)
+		must.NoError(t, err)
 
 		_ = cmd.Wait()
 		<-outputCh
 
-		assert.Contains(t, output.String(), "New lstk version available")
+		must.Contains(t, output.String(), "New lstk version available")
 
 		configData, err := os.ReadFile(configFile)
-		require.NoError(t, err)
+		must.NoError(t, err)
 		configStr := string(configData)
-		assert.Contains(t, configStr, "update_skipped_version", "skipped version should be persisted")
-		assert.Contains(t, configStr, "# User-maintained lstk config", "file header comment should be preserved")
-		assert.Contains(t, configStr, "# Emulator type", "inline comments should be preserved")
-		assert.Contains(t, configStr, `port = "4566"`, "existing config values should be preserved")
+		must.Contains(t, configStr, "update_skipped_version", "skipped version should be persisted")
+		must.Contains(t, configStr, "# User-maintained lstk config", "file header comment should be preserved")
+		must.Contains(t, configStr, "# Emulator type", "inline comments should be preserved")
+		must.Contains(t, configStr, `port = "4566"`, "existing config values should be preserved")
 	})
 
 	t.Run("update", func(t *testing.T) {
@@ -394,11 +394,11 @@ port = "4566"    # Host port
 		// Copy binary since it will be replaced during the update
 		updateBinary := filepath.Join(t.TempDir(), "lstk")
 		data, err := os.ReadFile(tmpBinary)
-		require.NoError(t, err)
-		require.NoError(t, os.WriteFile(updateBinary, data, 0o755))
+		must.NoError(t, err)
+		must.NoError(t, os.WriteFile(updateBinary, data, 0o755))
 
 		configFile := filepath.Join(t.TempDir(), "config.toml")
-		require.NoError(t, os.WriteFile(configFile, []byte(""), 0o644))
+		must.NoError(t, os.WriteFile(configFile, []byte(""), 0o644))
 
 		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
 		defer cancel()
@@ -407,7 +407,7 @@ port = "4566"    # Host port
 		cmd.Env = env.Without(env.AuthToken).With(env.AuthToken, "fake-token").With(env.APIEndpoint, mockServer.URL)
 
 		ptmx, err := pty.Start(cmd)
-		require.NoError(t, err, "failed to start command in PTY")
+		must.NoError(t, err, "failed to start command in PTY")
 		defer func() { _ = ptmx.Close() }()
 
 		output := &syncBuffer{}
@@ -417,26 +417,26 @@ port = "4566"    # Host port
 			close(outputCh)
 		}()
 
-		require.Eventually(t, func() bool {
+		must.Eventually(t, func() bool {
 			return bytes.Contains(output.Bytes(), []byte("New lstk version available"))
 		}, 10*time.Second, 100*time.Millisecond, "update notification prompt should appear")
 
 		_, err = ptmx.Write([]byte("u"))
-		require.NoError(t, err)
+		must.NoError(t, err)
 
 		err = cmd.Wait()
 		<-outputCh
 
 		out := output.String()
-		require.NoError(t, err, "update should succeed: %s", out)
-		assert.Contains(t, out, "New lstk version available")
-		assert.Contains(t, out, "Updated to")
+		must.NoError(t, err, "update should succeed: %s", out)
+		must.Contains(t, out, "New lstk version available")
+		must.Contains(t, out, "Updated to")
 
 		// Verify the binary was actually replaced
 		verCmd := exec.CommandContext(ctx, updateBinary, "--version")
 		verOut, err := verCmd.CombinedOutput()
-		require.NoError(t, err)
-		assert.NotContains(t, string(verOut), "0.0.1", "binary should no longer be the old version")
+		must.NoError(t, err)
+		must.NotContains(t, string(verOut), "0.0.1", "binary should no longer be the old version")
 	})
 }
 
@@ -449,7 +449,7 @@ func npmPlatformPackage() string {
 func buildLstkWithVersion(t *testing.T, ctx context.Context, version, outPath string) {
 	t.Helper()
 	repoRoot, err := filepath.Abs("../..")
-	require.NoError(t, err)
+	must.NoError(t, err)
 	buildCmd := exec.CommandContext(ctx, "go", "build",
 		"-ldflags", "-X github.com/localstack/lstk/internal/version.version="+version,
 		"-o", outPath,
@@ -457,7 +457,7 @@ func buildLstkWithVersion(t *testing.T, ctx context.Context, version, outPath st
 	)
 	buildCmd.Dir = repoRoot
 	out, err := buildCmd.CombinedOutput()
-	require.NoError(t, err, "go build failed: %s", string(out))
+	must.NoError(t, err, "go build failed: %s", string(out))
 }
 
 // releaseAssetName mirrors the goreleaser asset naming the updater expects:
@@ -480,24 +480,24 @@ func packageReleaseArchive(t *testing.T, binaryName string, binary []byte) []byt
 		hdr := &zip.FileHeader{Name: binaryName, Method: zip.Deflate}
 		hdr.SetMode(0o755)
 		w, err := zw.CreateHeader(hdr)
-		require.NoError(t, err)
+		must.NoError(t, err)
 		_, err = w.Write(binary)
-		require.NoError(t, err)
-		require.NoError(t, zw.Close())
+		must.NoError(t, err)
+		must.NoError(t, zw.Close())
 		return buf.Bytes()
 	}
 	gw := gzip.NewWriter(&buf)
 	tw := tar.NewWriter(gw)
-	require.NoError(t, tw.WriteHeader(&tar.Header{
+	must.NoError(t, tw.WriteHeader(&tar.Header{
 		Name:     binaryName,
 		Mode:     0o755,
 		Size:     int64(len(binary)),
 		Typeflag: tar.TypeReg,
 	}))
 	_, err := tw.Write(binary)
-	require.NoError(t, err)
-	require.NoError(t, tw.Close())
-	require.NoError(t, gw.Close())
+	must.NoError(t, err)
+	must.NoError(t, tw.Close())
+	must.NoError(t, gw.Close())
 	return buf.Bytes()
 }
 
@@ -557,7 +557,7 @@ func TestUpdateBinaryMockGitHubHappyPath(t *testing.T) {
 	newBinary := filepath.Join(t.TempDir(), binaryName)
 	buildLstkWithVersion(t, ctx, "0.0.2", newBinary)
 	newBytes, err := os.ReadFile(newBinary)
-	require.NoError(t, err)
+	must.NoError(t, err)
 
 	archive := packageReleaseArchive(t, binaryName, newBytes)
 	sum := sha256.Sum256(archive)
@@ -570,22 +570,24 @@ func TestUpdateBinaryMockGitHubHappyPath(t *testing.T) {
 	})
 
 	updateCmd := exec.CommandContext(ctx, oldBinary, "update", "--non-interactive")
-	updateCmd.Env = mockGitHubEnv(t, srv)
+	// Pin PATH to an empty dir so the multiple-installs warning (which scans
+	// PATH for other lstk binaries) can never inject host-dependent lines
+	// into the snapshotted output.
+	updateCmd.Env = append(mockGitHubEnv(t, srv), string(env.Path)+"="+t.TempDir())
 	out, err := updateCmd.CombinedOutput()
 	outStr := string(out)
-	require.NoError(t, err, "lstk update failed: %s", outStr)
+	must.NoError(t, err, "lstk update failed: %s", outStr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, outStr, "Update available: 0.0.1 → v0.0.2", "should detect the mock release")
-	assert.Contains(t, outStr, "Downloading and verifying update", "should take the binary download path")
-	assert.Contains(t, outStr, "Updated to v0.0.2", "should complete the update")
+	// The snapshot pins the full check → download/verify → updated sequence.
+	snap.Match(t, sanitizeOutput(outStr))
 
 	verOut, err := exec.CommandContext(ctx, oldBinary, "--version").CombinedOutput()
-	require.NoError(t, err)
-	assert.Contains(t, string(verOut), "0.0.2", "binary should be replaced with the mock release")
+	must.NoError(t, err)
+	must.Contains(t, string(verOut), "0.0.2", "binary should be replaced with the mock release")
 
 	leftovers, err := filepath.Glob(filepath.Join(filepath.Dir(oldBinary), "lstk-update-*"))
-	require.NoError(t, err)
-	assert.Empty(t, leftovers, "download temp files should be cleaned up")
+	must.NoError(t, err)
+	must.Empty(t, leftovers, "download temp files should be cleaned up")
 }
 
 // TestUpdateBinaryMockGitHubChecksumMismatch proves the checksum gate: when
@@ -625,7 +627,7 @@ func TestUpdateBinaryMockGitHubChecksumMismatch(t *testing.T) {
 	updateCmd.Stdout = &stdout
 	updateCmd.Stderr = &stderr
 	err := updateCmd.Run()
-	require.Error(t, err, "update must fail on checksum mismatch, output: %s%s", stdout.String(), stderr.String())
+	must.Error(t, err, "update must fail on checksum mismatch, output: %s%s", stdout.String(), stderr.String())
 	requireExitCode(t, 1, err)
 
 	wantStdout := "Checking for updates...\n" +
@@ -633,16 +635,16 @@ func TestUpdateBinaryMockGitHubChecksumMismatch(t *testing.T) {
 		"Downloading and verifying update...\n" +
 		fmt.Sprintf("Error: update failed: checksum mismatch for %s: expected %s, got %s — the downloaded archive may be corrupted or tampered with; update aborted\n",
 			assetName, hex.EncodeToString(wrongSum[:]), hex.EncodeToString(archiveSum[:]))
-	assert.Equal(t, wantStdout, stdout.String(), "full stdout should be exactly the check/download/error sequence")
-	assert.Empty(t, stderr.String(), "silent-error handling must not print anything to stderr")
+	must.Eq(t, wantStdout, stdout.String(), "full stdout should be exactly the check/download/error sequence")
+	must.Empty(t, stderr.String(), "silent-error handling must not print anything to stderr")
 
 	verOut, err := exec.CommandContext(ctx, oldBinary, "--version").CombinedOutput()
-	require.NoError(t, err, "original binary should still run")
-	assert.Contains(t, string(verOut), "0.0.1", "binary must not be replaced on checksum mismatch")
+	must.NoError(t, err, "original binary should still run")
+	must.Contains(t, string(verOut), "0.0.1", "binary must not be replaced on checksum mismatch")
 
 	leftovers, err := filepath.Glob(filepath.Join(filepath.Dir(oldBinary), "lstk-update-*"))
-	require.NoError(t, err)
-	assert.Empty(t, leftovers, "rejected download must not leave temp files behind")
+	must.NoError(t, err)
+	must.Empty(t, leftovers, "rejected download must not leave temp files behind")
 }
 
 // TestUpdateBinaryMockGitHubMissingChecksums proves the fail-closed contract:
@@ -669,16 +671,16 @@ func TestUpdateBinaryMockGitHubMissingChecksums(t *testing.T) {
 	updateCmd.Env = mockGitHubEnv(t, srv)
 	out, err := updateCmd.CombinedOutput()
 	outStr := string(out)
-	require.Error(t, err, "update must fail when checksums.txt is missing, output: %s", outStr)
+	must.Error(t, err, "update must fail when checksums.txt is missing, output: %s", outStr)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, outStr, "no checksums.txt asset", "should name the missing manifest")
-	assert.Contains(t, outStr, "refusing to install an unverifiable binary", "should state the fail-closed policy")
+	must.Contains(t, outStr, "no checksums.txt asset", "should name the missing manifest")
+	must.Contains(t, outStr, "refusing to install an unverifiable binary", "should state the fail-closed policy")
 
 	verOut, err := exec.CommandContext(ctx, oldBinary, "--version").CombinedOutput()
-	require.NoError(t, err, "original binary should still run")
-	assert.Contains(t, string(verOut), "0.0.1", "binary must not be replaced without a verifiable manifest")
+	must.NoError(t, err, "original binary should still run")
+	must.Contains(t, string(verOut), "0.0.1", "binary must not be replaced without a verifiable manifest")
 
 	leftovers, err := filepath.Glob(filepath.Join(filepath.Dir(oldBinary), "lstk-update-*"))
-	require.NoError(t, err)
-	assert.Empty(t, leftovers, "aborted update must not leave temp files behind")
+	must.NoError(t, err)
+	must.Empty(t, leftovers, "aborted update must not leave temp files behind")
 }
diff --git a/test/integration/version_resolution_test.go b/test/integration/version_resolution_test.go
index cdb60d41..52357b3b 100644
--- a/test/integration/version_resolution_test.go
+++ b/test/integration/version_resolution_test.go
@@ -10,9 +10,8 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // returns a mock license server that answers license requests with the given
@@ -57,14 +56,14 @@ func TestVersionResolvedViaImageInspection(t *testing.T) {
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start")
-	require.NoError(t, err, "lstk start failed:\nstdout: %s\nstderr: %s", stdout, stderr)
+	must.NoError(t, err, "lstk start failed:\nstdout: %s\nstderr: %s", stdout, stderr)
 
-	assert.NotEmpty(t, *capturedVersion, "license request should carry a version resolved from image inspection")
-	assert.NotEqual(t, "latest", *capturedVersion, "resolved version should not be the unresolved 'latest' tag")
-	assert.Contains(t, stdout, "Checking license")
+	must.NotEmpty(t, *capturedVersion, "license request should carry a version resolved from image inspection")
+	must.NotEq(t, "latest", *capturedVersion, "resolved version should not be the unresolved 'latest' tag")
+	must.Contains(t, stdout, "Checking license")
 
 	semverLike := strings.Contains(*capturedVersion, ".") || strings.Contains(*capturedVersion, "-")
-	assert.True(t, semverLike, "resolved version %q should look like a real version", *capturedVersion)
+	must.True(t, semverLike, "resolved version %q should look like a real version", *capturedVersion)
 }
 
 // Verifies that when the license check fails after image inspection, the command
@@ -81,8 +80,8 @@ func TestCommandFailsNicelyWhenLicenseCheckFails(t *testing.T) {
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "",
 		env.With(env.APIEndpoint, mockServer.URL), "start")
-	require.Error(t, err, "expected lstk start to fail when license check fails")
-	assert.Contains(t, stdout, "License validation failed",
+	must.Error(t, err, "expected lstk start to fail when license check fails")
+	must.Contains(t, stdout, "License validation failed",
 		"stderr: %s", stderr)
 }
 
@@ -102,7 +101,7 @@ func TestUnsupportedTagSkipsPreflightValidation(t *testing.T) {
 	// multi-GB download). The pull failure is this test's expected exit path — the
 	// behavior under test is that the run gets *past* license validation.
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(`
+	must.NoError(t, os.WriteFile(configFile, []byte(`
 [[containers]]
 type  = "aws"
 tag   = "dev"
@@ -117,14 +116,14 @@ image = "127.0.0.1:1/localstack-pro"
 	stdout, stderr, err := runLstk(t, ctx, "", environ, "--config", configFile, "start")
 
 	out := stdout + "\n" + stderr
-	assert.Equal(t, "dev", *capturedVersion, "the configured tag should be sent to the license API")
-	assert.NotContains(t, out, "license validation failed",
+	must.Eq(t, "dev", *capturedVersion, "the configured tag should be sent to the license API")
+	must.NotContains(t, out, "license validation failed",
 		"an unparseable tag must not be treated as a license rejection")
-	assert.Contains(t, out, `does not support tag "dev"`,
+	must.Contains(t, out, `does not support tag "dev"`,
 		"the skipped pre-flight should be surfaced as a warning")
-	require.Error(t, err, "the start should proceed to the pull and fail on the unreachable registry")
+	must.Error(t, err, "the start should proceed to the pull and fail on the unreachable registry")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, out, "Failed to pull")
+	must.Contains(t, out, "Failed to pull")
 }
 
 // Verifies that pinned tags are validated before pulling (fail-fast path).
@@ -139,7 +138,7 @@ func TestPinnedTagValidatedPrePull(t *testing.T) {
 	mockServer, capturedVersion := createLicenseMockServer(t, http.StatusForbidden, "")
 
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	require.NoError(t, os.WriteFile(configFile, []byte(`
+	must.NoError(t, os.WriteFile(configFile, []byte(`
 [[containers]]
 type = "aws"
 tag  = "4.0.0"
@@ -149,8 +148,8 @@ port = "4566"
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "",
 		env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	require.Error(t, err, "expected lstk start to fail when license check fails")
-	assert.Contains(t, stdout, "License validation failed",
+	must.Error(t, err, "expected lstk start to fail when license check fails")
+	must.Contains(t, stdout, "License validation failed",
 		"stderr: %s", stderr)
-	assert.Equal(t, "4.0.0", *capturedVersion, "pinned tag should be sent directly to the license API without image inspection")
+	must.Eq(t, "4.0.0", *capturedVersion, "pinned tag should be sent directly to the license API without image inspection")
 }
diff --git a/test/integration/volume_test.go b/test/integration/volume_test.go
index 9edf247b..b6e7e283 100644
--- a/test/integration/volume_test.go
+++ b/test/integration/volume_test.go
@@ -12,9 +12,8 @@ import (
 	"time"
 
 	"github.com/creack/pty"
+	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestVolumePathCommand(t *testing.T) {
@@ -28,10 +27,10 @@ func TestVolumePathCommand(t *testing.T) {
 
 		e := testEnvWithHome(tmpHome, xdgOverride)
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "volume", "path")
-		require.NoError(t, err, stderr)
+		must.NoError(t, err, stderr)
 		requireExitCode(t, 0, err)
 
-		assert.Contains(t, stdout, filepath.Join("lstk", "volume", "localstack-aws"))
+		must.Contains(t, stdout, filepath.Join("lstk", "volume", "localstack-aws"))
 	})
 
 	t.Run("prints custom volume path from config", func(t *testing.T) {
@@ -45,10 +44,10 @@ port = "4566"
 volume = "` + escapeTomlPath(customVolume) + `"
 `
 		configFile := filepath.Join(t.TempDir(), "config.toml")
-		require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+		must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "volume", "path")
-		require.NoError(t, err, stderr)
+		must.NoError(t, err, stderr)
 		requireExitCode(t, 0, err)
 
 		assertSamePath(t, customVolume, stdout)
@@ -65,10 +64,10 @@ port = "4566"
 volumes = ["` + escapeTomlPath(persistDir) + `:/var/lib/localstack", "/abs/init.sf.sql:/etc/localstack/init/ready.d/init.sf.sql"]
 `
 		configFile := filepath.Join(t.TempDir(), "config.toml")
-		require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+		must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "volume", "path")
-		require.NoError(t, err, stderr)
+		must.NoError(t, err, stderr)
 		requireExitCode(t, 0, err)
 
 		assertSamePath(t, persistDir, stdout)
@@ -85,10 +84,10 @@ port = "4566"
 volumes = ["./persist:/var/lib/localstack"]
 `
 		configFile := filepath.Join(configDir, "config.toml")
-		require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+		must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "volume", "path")
-		require.NoError(t, err, stderr)
+		must.NoError(t, err, stderr)
 		requireExitCode(t, 0, err)
 
 		assertSamePath(t, filepath.Join(configDir, "persist"), stdout)
@@ -104,7 +103,7 @@ volumes = ["./persist:/var/lib/localstack"]
 		analyticsSrv, events := mockAnalyticsServer(t)
 		e := env.Environ(testEnvWithHome(tmpHome, xdgOverride)).With(env.AnalyticsEndpoint, analyticsSrv.URL)
 		_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "volume", "path")
-		require.NoError(t, err, stderr)
+		must.NoError(t, err, stderr)
 		requireExitCode(t, 0, err)
 
 		assertCommandTelemetry(t, events, "volume path", 0)
@@ -116,9 +115,9 @@ func TestVolumeClearCommand(t *testing.T) {
 	t.Run("clears volume with force flag", func(t *testing.T) {
 		t.Parallel()
 		volumeDir := t.TempDir()
-		require.NoError(t, os.MkdirAll(filepath.Join(volumeDir, "cache", "certs"), 0755))
-		require.NoError(t, os.WriteFile(filepath.Join(volumeDir, "cache", "certs", "cert.pem"), []byte("fake cert"), 0644))
-		require.NoError(t, os.WriteFile(filepath.Join(volumeDir, "cache", "machine.json"), []byte("{}"), 0644))
+		must.NoError(t, os.MkdirAll(filepath.Join(volumeDir, "cache", "certs"), 0755))
+		must.NoError(t, os.WriteFile(filepath.Join(volumeDir, "cache", "certs", "cert.pem"), []byte("fake cert"), 0644))
+		must.NoError(t, os.WriteFile(filepath.Join(volumeDir, "cache", "machine.json"), []byte("{}"), 0644))
 
 		configContent := `
 [[containers]]
@@ -128,22 +127,22 @@ port = "4566"
 volume = "` + escapeTomlPath(volumeDir) + `"
 `
 		configFile := filepath.Join(t.TempDir(), "config.toml")
-		require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+		must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "--non-interactive", "volume", "clear", "--force")
-		require.NoError(t, err, "lstk volume clear failed: %s\nstdout: %s", stderr, stdout)
+		must.NoError(t, err, "lstk volume clear failed: %s\nstdout: %s", stderr, stdout)
 		requireExitCode(t, 0, err)
 
-		assert.Contains(t, stdout, "Volume data cleared")
+		must.Contains(t, stdout, "Volume data cleared")
 
 		// Directory itself should still exist
 		_, err = os.Stat(volumeDir)
-		require.NoError(t, err, "volume directory should still exist")
+		must.NoError(t, err, "volume directory should still exist")
 
 		// But contents should be gone
 		entries, err := os.ReadDir(volumeDir)
-		require.NoError(t, err)
-		assert.Empty(t, entries, "volume directory should be empty")
+		must.NoError(t, err)
+		must.Empty(t, entries, "volume directory should be empty")
 	})
 
 	t.Run("fails without force in non-interactive mode", func(t *testing.T) {
@@ -155,10 +154,10 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 
 		e := testEnvWithHome(tmpHome, xdgOverride)
 		_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--non-interactive", "volume", "clear")
-		require.Error(t, err)
+		must.Error(t, err)
 		requireExitCode(t, 1, err)
 
-		assert.Contains(t, stderr, "--force")
+		must.Contains(t, stderr, "--force")
 	})
 
 	t.Run("handles nonexistent volume directory", func(t *testing.T) {
@@ -173,19 +172,19 @@ port = "4566"
 volume = "` + escapeTomlPath(volumeDir) + `"
 `
 		configFile := filepath.Join(t.TempDir(), "config.toml")
-		require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+		must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "--non-interactive", "volume", "clear", "--force")
-		require.NoError(t, err, "lstk volume clear failed: %s\nstdout: %s", stderr, stdout)
+		must.NoError(t, err, "lstk volume clear failed: %s\nstdout: %s", stderr, stdout)
 		requireExitCode(t, 0, err)
 
-		assert.Contains(t, stdout, "Volume data cleared")
+		must.Contains(t, stdout, "Volume data cleared")
 	})
 
 	t.Run("filters by emulator type", func(t *testing.T) {
 		t.Parallel()
 		volumeDir := t.TempDir()
-		require.NoError(t, os.WriteFile(filepath.Join(volumeDir, "data.json"), []byte("{}"), 0644))
+		must.NoError(t, os.WriteFile(filepath.Join(volumeDir, "data.json"), []byte("{}"), 0644))
 
 		configContent := `
 [[containers]]
@@ -195,22 +194,22 @@ port = "4566"
 volume = "` + escapeTomlPath(volumeDir) + `"
 `
 		configFile := filepath.Join(t.TempDir(), "config.toml")
-		require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+		must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 		// Wrong type should fail
 		_, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "--non-interactive", "volume", "clear", "--force", "--type", "snowflake")
-		require.Error(t, err)
+		must.Error(t, err)
 		requireExitCode(t, 1, err)
-		assert.Contains(t, stderr, "not found")
+		must.Contains(t, stderr, "not found")
 
 		// Correct type should succeed
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "--non-interactive", "volume", "clear", "--force", "--type", "aws")
-		require.NoError(t, err, "lstk volume clear failed: %s\nstdout: %s", stderr, stdout)
+		must.NoError(t, err, "lstk volume clear failed: %s\nstdout: %s", stderr, stdout)
 		requireExitCode(t, 0, err)
 
 		entries, err := os.ReadDir(volumeDir)
-		require.NoError(t, err)
-		assert.Empty(t, entries)
+		must.NoError(t, err)
+		must.Empty(t, entries)
 	})
 
 	t.Run("emits telemetry", func(t *testing.T) {
@@ -223,7 +222,7 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 		analyticsSrv, events := mockAnalyticsServer(t)
 		e := env.Environ(testEnvWithHome(tmpHome, xdgOverride)).With(env.AnalyticsEndpoint, analyticsSrv.URL)
 		_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--non-interactive", "volume", "clear", "--force")
-		require.NoError(t, err, stderr)
+		must.NoError(t, err, stderr)
 		requireExitCode(t, 0, err)
 
 		assertCommandTelemetry(t, events, "volume clear", 0)
@@ -245,7 +244,7 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 			"-v", volumeDir+":/vol",
 			"alpine", "sh", "-c", "mkdir /vol/cache && touch /vol/cache/cert.pem",
 		).CombinedOutput()
-		require.NoError(t, err, "docker setup failed: %s", out)
+		must.NoError(t, err, "docker setup failed: %s", out)
 		t.Cleanup(func() {
 			_ = exec.Command("docker", "run", "--rm",
 				"-v", volumeDir+":/vol",
@@ -261,7 +260,7 @@ port = "4566"
 volume = "` + escapeTomlPath(volumeDir) + `"
 `
 		configFile := filepath.Join(t.TempDir(), "config.toml")
-		require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+		must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 		_, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "--non-interactive", "volume", "clear", "--force")
 		if err == nil {
@@ -269,7 +268,7 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 		}
 
 		requireExitCode(t, 1, err)
-		assert.Contains(t, stderr, "sudo")
+		must.Contains(t, stderr, "sudo")
 	})
 }
 
@@ -289,7 +288,7 @@ port = "4566"
 volume = "` + escapeTomlPath(volumeDir) + `"
 `
 		configFile := filepath.Join(t.TempDir(), "config.toml")
-		require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+		must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 		return configFile
 	}
 
@@ -300,7 +299,7 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 		cmd := exec.CommandContext(testContext(t), binaryPath(), "--config", configFile, "volume", "clear")
 		cmd.Env = testEnvWithHome(t.TempDir(), "")
 		ptmx, err := pty.Start(cmd)
-		require.NoError(t, err, "failed to start command in PTY")
+		must.NoError(t, err, "failed to start command in PTY")
 		t.Cleanup(func() { _ = ptmx.Close() })
 		out := &syncBuffer{}
 		outputCh := make(chan struct{})
@@ -308,7 +307,7 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 			_, _ = io.Copy(out, ptmx)
 			close(outputCh)
 		}()
-		require.Eventually(t, func() bool {
+		must.Eventually(t, func() bool {
 			return bytes.Contains(out.Bytes(), []byte("Clear volume data?"))
 		}, 10*time.Second, 100*time.Millisecond, "confirmation prompt should appear")
 		return ptmx, out, outputCh, cmd
@@ -317,39 +316,39 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 	t.Run("clears volume when user confirms with y", func(t *testing.T) {
 		t.Parallel()
 		volumeDir := t.TempDir()
-		require.NoError(t, os.WriteFile(filepath.Join(volumeDir, "data.json"), []byte("{}"), 0644))
+		must.NoError(t, os.WriteFile(filepath.Join(volumeDir, "data.json"), []byte("{}"), 0644))
 
 		ptmx, out, outputCh, cmd := startVolumeClear(t, makeConfig(t, volumeDir))
 		_, err := ptmx.Write([]byte("y"))
-		require.NoError(t, err)
-		require.NoError(t, cmd.Wait())
+		must.NoError(t, err)
+		must.NoError(t, cmd.Wait())
 		<-outputCh
 
-		assert.Contains(t, out.String(), "Volume data cleared")
+		must.Contains(t, out.String(), "Volume data cleared")
 		entries, err := os.ReadDir(volumeDir)
-		require.NoError(t, err)
-		assert.Empty(t, entries, "volume directory should be empty after confirm")
+		must.NoError(t, err)
+		must.Empty(t, entries, "volume directory should be empty after confirm")
 	})
 
 	t.Run("cancels when user presses n", func(t *testing.T) {
 		t.Parallel()
 		volumeDir := t.TempDir()
-		require.NoError(t, os.WriteFile(filepath.Join(volumeDir, "data.json"), []byte("{}"), 0644))
+		must.NoError(t, os.WriteFile(filepath.Join(volumeDir, "data.json"), []byte("{}"), 0644))
 
 		ptmx, out, outputCh, cmd := startVolumeClear(t, makeConfig(t, volumeDir))
 		_, err := ptmx.Write([]byte("n"))
-		require.NoError(t, err)
-		require.NoError(t, cmd.Wait())
+		must.NoError(t, err)
+		must.NoError(t, cmd.Wait())
 		<-outputCh
 
-		assert.Contains(t, out.String(), "Cancelled")
+		must.Contains(t, out.String(), "Cancelled")
 		entries, err := os.ReadDir(volumeDir)
-		require.NoError(t, err)
-		assert.Len(t, entries, 1, "volume directory should be untouched after cancel")
+		must.NoError(t, err)
+		must.Len(t, entries, 1, "volume directory should be untouched after cancel")
 	})
 }
 
 // escapeTomlPath escapes backslashes for Windows paths in TOML quoted strings.
 func escapeTomlPath(path string) string {
 	return strings.ReplaceAll(path, `\`, `\\`)
-}
\ No newline at end of file
+}

From f92e94e29de26e49e99a21f05d44a38d57bb9ca4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Wed, 12 Aug 2026 11:24:37 +0200
Subject: [PATCH 06/21] Pad snapshot mask placeholders to original value width

Co-Authored-By: Claude <noreply@anthropic.com>
---
 ...estSnapshotListSuccessWithoutDocker_1.snap |  2 +-
 .../TestSnapshotShowPinnedVersion_1.snap      |  4 ++--
 ...estSnapshotShowSuccessWithoutDocker_1.snap |  6 +++---
 ...napshotVersionsSuccessWithoutDocker_1.snap |  6 +++---
 test/integration/snap_sanitize_test.go        | 21 ++++++++++++++++---
 5 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/test/integration/__snapshots__/TestSnapshotListSuccessWithoutDocker_1.snap b/test/integration/__snapshots__/TestSnapshotListSuccessWithoutDocker_1.snap
index 41f587dd..b024ec10 100644
--- a/test/integration/__snapshots__/TestSnapshotListSuccessWithoutDocker_1.snap
+++ b/test/integration/__snapshots__/TestSnapshotListSuccessWithoutDocker_1.snap
@@ -2,5 +2,5 @@ Fetching snapshots...
 ~ 2 snapshots
 
   NAME           VERSION  LAST CHANGED
-  baseline-q2    3        <date>
+  baseline-q2    3        <date>              
   infra-2026-04  1        -
\ No newline at end of file
diff --git a/test/integration/__snapshots__/TestSnapshotShowPinnedVersion_1.snap b/test/integration/__snapshots__/TestSnapshotShowPinnedVersion_1.snap
index d9561f9d..9d5f3f1e 100644
--- a/test/integration/__snapshots__/TestSnapshotShowPinnedVersion_1.snap
+++ b/test/integration/__snapshots__/TestSnapshotShowPinnedVersion_1.snap
@@ -1,9 +1,9 @@
 Fetching snapshot version 1...
 Name            my-baseline
 Version         1
-Created         <date>
+Created         <date>              
 Size            <size>
-LocalStack      <calver>
+LocalStack      <calv> 
 Message         the first one
 
 Services        s3
\ No newline at end of file
diff --git a/test/integration/__snapshots__/TestSnapshotShowSuccessWithoutDocker_1.snap b/test/integration/__snapshots__/TestSnapshotShowSuccessWithoutDocker_1.snap
index 643bcd22..f5c0087a 100644
--- a/test/integration/__snapshots__/TestSnapshotShowSuccessWithoutDocker_1.snap
+++ b/test/integration/__snapshots__/TestSnapshotShowSuccessWithoutDocker_1.snap
@@ -1,9 +1,9 @@
 Fetching snapshot...
 Name            my-baseline
 Version         1
-Created         <date>
-Size            <size>
-LocalStack      <calver>
+Created         <date>              
+Size            <size> 
+LocalStack      <calv> 
 Message         Pre-refactor baseline
 
 Services        s3, lambda, dynamodb, sqs
diff --git a/test/integration/__snapshots__/TestSnapshotVersionsSuccessWithoutDocker_1.snap b/test/integration/__snapshots__/TestSnapshotVersionsSuccessWithoutDocker_1.snap
index b6dc6777..d4db542d 100644
--- a/test/integration/__snapshots__/TestSnapshotVersionsSuccessWithoutDocker_1.snap
+++ b/test/integration/__snapshots__/TestSnapshotVersionsSuccessWithoutDocker_1.snap
@@ -2,6 +2,6 @@ Fetching versions...
 ~ 3 versions
 
   VERSION  CREATED               LOCALSTACK  SERVICES
-  3        <date>  <calver>     s3, lambda
-  2        <date>  <calver>     s3
-  1        <date>  <calver>     -
\ No newline at end of file
+  3        <date>                <calv>      s3, lambda
+  2        <date>                <calv>      s3
+  1        <date>                <calv>      -
\ No newline at end of file
diff --git a/test/integration/snap_sanitize_test.go b/test/integration/snap_sanitize_test.go
index 3d7d6378..2452a2be 100644
--- a/test/integration/snap_sanitize_test.go
+++ b/test/integration/snap_sanitize_test.go
@@ -39,6 +39,18 @@ var (
 	sanitizeExtIDRe   = regexp.MustCompile(`(?m)^(SESSION_ID=).*$`)
 )
 
+// maskKeepWidth replaces every match with placeholder, right-padded with
+// spaces to the match's width so table column alignment survives. The
+// placeholder must not be wider than the shortest possible match.
+func maskKeepWidth(re *regexp.Regexp, s, placeholder string) string {
+	return re.ReplaceAllStringFunc(s, func(m string) string {
+		if pad := len(m) - len(placeholder); pad > 0 {
+			return placeholder + strings.Repeat(" ", pad)
+		}
+		return placeholder
+	})
+}
+
 func sanitizeOutput(s string) string {
 	s = strings.ReplaceAll(s, "\r\n", "\n")
 	s = sanitizePortRe.ReplaceAllString(s, "${1}:<port>")
@@ -49,9 +61,12 @@ func sanitizeOutput(s string) string {
 	s = sanitizeGatewayHostRe.ReplaceAllString(s, "${1}<endpoint-host>${2}")
 	s = sanitizeExtPathRe.ReplaceAllString(s, "${1}<path>")
 	s = sanitizeExtIDRe.ReplaceAllString(s, "${1}<id>")
-	s = sanitizeDateRe.ReplaceAllString(s, "<date>")
-	s = sanitizeSizeRe.ReplaceAllString(s, "<size>")
-	s = sanitizeCalverRe.ReplaceAllString(s, "<calver>")
+	// Width-preserving masks: these values appear in aligned tables, so the
+	// placeholder is padded to the original value's width to keep the
+	// snapshot's columns readable.
+	s = maskKeepWidth(sanitizeDateRe, s, "<date>")
+	s = maskKeepWidth(sanitizeSizeRe, s, "<size>")
+	s = maskKeepWidth(sanitizeCalverRe, s, "<calv>")
 	// Wrapped-tool env dumps echo GOOS-dependent endpoint hosts.
 	s = strings.ReplaceAll(s, "host.docker.internal", "<endpoint-host>")
 	s = strings.ReplaceAll(s, "localhost.localstack.cloud", "<endpoint-host>")

From 6471f670e4959ca9e4d011609eef59f399588ef3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Wed, 12 Aug 2026 11:59:01 +0200
Subject: [PATCH 07/21] Fix snapshot token leak and Windows phantom extension
 listing

Co-Authored-By: Claude <noreply@anthropic.com>
---
 internal/extension/resolve.go          | 11 ++++++++++-
 test/integration/json_flag_test.go     |  9 ++++++++-
 test/integration/snap_sanitize_test.go |  6 +++++-
 3 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/internal/extension/resolve.go b/internal/extension/resolve.go
index 98d34dc6..f6d9b8c9 100644
--- a/internal/extension/resolve.go
+++ b/internal/extension/resolve.go
@@ -6,6 +6,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	goruntime "runtime"
+	"slices"
 	"sort"
 	"strings"
 
@@ -128,7 +129,15 @@ func scanDir(dir string) []string {
 		}
 		name := strings.TrimPrefix(fileName, NamePrefix)
 		if goruntime.GOOS == "windows" {
-			name = strings.TrimSuffix(name, filepath.Ext(name))
+			// isExecutableFile accepts any regular file on Windows, so
+			// executability must be decided here by PATHEXT — otherwise a
+			// data file like lstk-extensions.toml lists as a phantom
+			// "extensions" extension.
+			ext := strings.ToLower(filepath.Ext(name))
+			if !slices.Contains(windowsExts(), ext) {
+				continue
+			}
+			name = strings.TrimSuffix(name, ext)
 		}
 		if name == "" {
 			continue
diff --git a/test/integration/json_flag_test.go b/test/integration/json_flag_test.go
index 2f7ac31c..120abc02 100644
--- a/test/integration/json_flag_test.go
+++ b/test/integration/json_flag_test.go
@@ -1,6 +1,8 @@
 package integration_test
 
 import (
+	"slices"
+	"strings"
 	"testing"
 
 	"github.com/localstack/lstk/internal/must"
@@ -189,7 +191,12 @@ func TestExtensionReceivesJSONFlagInContext(t *testing.T) {
 	extDir := t.TempDir()
 	installExtension(t, extDir, "hello")
 	tmpHome := t.TempDir()
-	environ := envWithPath(tmpHome, extDir)
+	// Strip any ambient auth token: it would add an environment-dependent
+	// AUTH_TOKEN line to the snapshotted context echo (and put a real secret
+	// in the failure diff).
+	environ := slices.DeleteFunc(envWithPath(tmpHome, extDir), func(kv string) bool {
+		return strings.HasPrefix(kv, string(env.AuthToken)+"=")
+	})
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "--json", "hello", "--foo")
 	must.NoError(t, err, stderr)
diff --git a/test/integration/snap_sanitize_test.go b/test/integration/snap_sanitize_test.go
index 2452a2be..96c1aff7 100644
--- a/test/integration/snap_sanitize_test.go
+++ b/test/integration/snap_sanitize_test.go
@@ -36,7 +36,10 @@ var (
 	sanitizeCalverRe = regexp.MustCompile(`\b20\d{2}\.\d{2}\b`)
 	// Reference-extension echo lines carrying temp paths or random ids.
 	sanitizeExtPathRe = regexp.MustCompile(`(?m)^(SELF=|CONFIG_DIR=).*$`)
-	sanitizeExtIDRe   = regexp.MustCompile(`(?m)^(SESSION_ID=).*$`)
+	sanitizeExtIDRe = regexp.MustCompile(`(?m)^(SESSION_ID=).*$`)
+	// Defense in depth: a real auth token must never land in a committed
+	// snapshot or a failure diff, even if a test forgets to strip it.
+	sanitizeExtTokenRe = regexp.MustCompile(`(?m)^(AUTH_TOKEN=).*$`)
 )
 
 // maskKeepWidth replaces every match with placeholder, right-padded with
@@ -61,6 +64,7 @@ func sanitizeOutput(s string) string {
 	s = sanitizeGatewayHostRe.ReplaceAllString(s, "${1}<endpoint-host>${2}")
 	s = sanitizeExtPathRe.ReplaceAllString(s, "${1}<path>")
 	s = sanitizeExtIDRe.ReplaceAllString(s, "${1}<id>")
+	s = sanitizeExtTokenRe.ReplaceAllString(s, "${1}<redacted>")
 	// Width-preserving masks: these values appear in aligned tables, so the
 	// placeholder is padded to the original value's width to keep the
 	// snapshot's columns readable.

From d9e5aa2234d214600c523462e9083b3e4d812bab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Wed, 12 Aug 2026 12:23:36 +0200
Subject: [PATCH 08/21] Guarantee snapshot files end with exactly one trailing
 newline

Co-Authored-By: Claude <noreply@anthropic.com>
---
 internal/snap/snap.go                         | 14 ++++++-
 internal/snap/snap_test.go                    | 41 +++++++++++++++----
 .../TestCDKInjectsCleanAWSEnv_1.snap          |  2 +-
 ...ndledWithDescriptionAndPathNameOnly_1.snap |  2 +-
 ...tExtensionReceivesJSONFlagInContext_1.snap |  2 +-
 .../TestSAMInjectsCleanAWSEnv_1.snap          |  2 +-
 ...estSnapshotListSuccessWithoutDocker_1.snap |  2 +-
 .../TestSnapshotShowPinnedVersion_1.snap      |  2 +-
 ...estSnapshotShowSuccessWithoutDocker_1.snap |  2 +-
 ...pshotVersionsFiltersDeletedVersions_1.snap |  2 +-
 ...napshotVersionsSuccessWithoutDocker_1.snap |  2 +-
 ...ndpointURLHTTPSRendersReducedOutput_1.snap |  2 +-
 ...atusEndpointURLRendersReducedOutput_1.snap |  2 +-
 13 files changed, 57 insertions(+), 20 deletions(-)

diff --git a/internal/snap/snap.go b/internal/snap/snap.go
index fdee4d14..91771114 100644
--- a/internal/snap/snap.go
+++ b/internal/snap/snap.go
@@ -130,7 +130,14 @@ func match(t testing.TB, got, dir string) {
 	mu.Unlock()
 
 	path := filepath.Join(dir, name)
-	want, err := os.ReadFile(path)
+	raw, err := os.ReadFile(path)
+	// Snapshot files always end with exactly one newline (see write) so text
+	// tooling (git diffs, cat, EOF-fixing hooks) treats them as regular text
+	// files. Both sides are compared with that trailing newline stripped; the
+	// cost is that a snapshot cannot distinguish output ending with a newline
+	// from output that doesn't.
+	want := strings.TrimSuffix(string(raw), "\n")
+	got = strings.TrimSuffix(got, "\n")
 	update := os.Getenv("UPDATE_SNAPS") == "true"
 	switch {
 	case errors.Is(err, os.ErrNotExist):
@@ -142,7 +149,7 @@ func match(t testing.TB, got, dir string) {
 		t.Logf("snap: created %s", path)
 	case err != nil:
 		t.Fatalf("snap: reading %s: %v", path, err)
-	case string(want) != got:
+	case want != got:
 		if update {
 			write(t, path, got)
 			t.Logf("snap: updated %s", path)
@@ -214,11 +221,14 @@ func reportObsolete(dir string, seen map[string]bool, update bool) (int, error)
 	return obsolete, nil
 }
 
+// write stores content with exactly one trailing newline, the invariant
+// match relies on when it strips it back off before comparing.
 func write(t testing.TB, path, content string) {
 	t.Helper()
 	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 		t.Fatalf("snap: %v", err)
 	}
+	content = strings.TrimSuffix(content, "\n") + "\n"
 	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
 		t.Fatalf("snap: %v", err)
 	}
diff --git a/internal/snap/snap_test.go b/internal/snap/snap_test.go
index 0f6e9c6b..9de1bca7 100644
--- a/internal/snap/snap_test.go
+++ b/internal/snap/snap_test.go
@@ -11,11 +11,11 @@ import (
 // Match uses are implemented; anything else nil-panics loudly.
 type fakeT struct {
 	testing.TB
-	name    string
-	failed  bool
-	fatal   bool
-	msg     string
-	logs    []string
+	name   string
+	failed bool
+	fatal  bool
+	msg    string
+	logs   []string
 }
 
 func (f *fakeT) Helper()      {}
@@ -134,7 +134,7 @@ func TestMatchUpdatesOnEnv(t *testing.T) {
 		t.Fatalf("update mode should rewrite, not fail: %q", ft.msg)
 	}
 	content, _ := os.ReadFile(path)
-	if string(content) != "new" {
+	if string(content) != "new\n" {
 		t.Fatalf("snapshot not updated: %q", content)
 	}
 }
@@ -166,7 +166,7 @@ func TestMatchCountsCallsWithinOneTest(t *testing.T) {
 	if ft.failed {
 		t.Fatalf("unexpected failure: %q", ft.msg)
 	}
-	for path, want := range map[string]string{path1: "first", path2: "second"} {
+	for path, want := range map[string]string{path1: "first\n", path2: "second\n"} {
 		content, err := os.ReadFile(path)
 		if err != nil || string(content) != want {
 			t.Fatalf("%s: content=%q err=%v", path, content, err)
@@ -267,3 +267,30 @@ func TestMatchJSONFatalPathsWriteNoSnapshot(t *testing.T) {
 		}
 	}
 }
+
+// TestMatchTrailingNewlineInvariant pins the EOF contract: stored files end
+// with exactly one newline regardless of whether the value had one, and a
+// value matches its stored snapshot with or without a trailing newline.
+func TestMatchTrailingNewlineInvariant(t *testing.T) {
+	t.Setenv("CI", "")
+	t.Setenv("UPDATE_SNAPS", "")
+	path := snapPath(t, "TestFakeEOF", "1")
+
+	ft := &fakeT{name: "TestFakeEOF"}
+	Match(ft, "line\n")
+	content, err := os.ReadFile(path)
+	if err != nil || string(content) != "line\n" {
+		t.Fatalf("stored snapshot should end with exactly one newline: %q err=%v", content, err)
+	}
+
+	for _, got := range []string{"line", "line\n"} {
+		mu.Lock()
+		delete(calls, filepath.Dir(path)+"|TestFakeEOF")
+		mu.Unlock()
+		ft := &fakeT{name: "TestFakeEOF"}
+		Match(ft, got)
+		if ft.failed {
+			t.Fatalf("Match(%q) should match the stored snapshot: %q", got, ft.msg)
+		}
+	}
+}
diff --git a/test/integration/__snapshots__/TestCDKInjectsCleanAWSEnv_1.snap b/test/integration/__snapshots__/TestCDKInjectsCleanAWSEnv_1.snap
index 842e6097..1038a720 100644
--- a/test/integration/__snapshots__/TestCDKInjectsCleanAWSEnv_1.snap
+++ b/test/integration/__snapshots__/TestCDKInjectsCleanAWSEnv_1.snap
@@ -6,4 +6,4 @@ ENV_AWS_ACCESS_KEY_ID=test
 ENV_AWS_SECRET_ACCESS_KEY=test
 ENV_AWS_PROFILE=<unset>
 ENV_AWS_DEFAULT_PROFILE=<unset>
-ENV_AWS_SESSION_TOKEN=<unset>
\ No newline at end of file
+ENV_AWS_SESSION_TOKEN=<unset>
diff --git a/test/integration/__snapshots__/TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly_1.snap b/test/integration/__snapshots__/TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly_1.snap
index 7309ab31..34c7c020 100644
--- a/test/integration/__snapshots__/TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly_1.snap
+++ b/test/integration/__snapshots__/TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly_1.snap
@@ -43,4 +43,4 @@ Options:
       --snapshot string       Snapshot REF to load after start (overrides config for this run)
       --timeout duration      Maximum time to wait for the emulator to become ready (overrides LSTK_STARTUP_TIMEOUT; 0 uses the default)
   -t, --type string           Emulator type to start (aws, snowflake, azure)
-  -v, --version               Show version
\ No newline at end of file
+  -v, --version               Show version
diff --git a/test/integration/__snapshots__/TestExtensionReceivesJSONFlagInContext_1.snap b/test/integration/__snapshots__/TestExtensionReceivesJSONFlagInContext_1.snap
index 97c0187e..02ba42a1 100644
--- a/test/integration/__snapshots__/TestExtensionReceivesJSONFlagInContext_1.snap
+++ b/test/integration/__snapshots__/TestExtensionReceivesJSONFlagInContext_1.snap
@@ -5,4 +5,4 @@ CONFIG_DIR=<path>
 NON_INTERACTIVE=true
 JSON=true
 SESSION_ID=<id>
-EMULATOR_COUNT=0
\ No newline at end of file
+EMULATOR_COUNT=0
diff --git a/test/integration/__snapshots__/TestSAMInjectsCleanAWSEnv_1.snap b/test/integration/__snapshots__/TestSAMInjectsCleanAWSEnv_1.snap
index e10a4bd3..2e1ab842 100644
--- a/test/integration/__snapshots__/TestSAMInjectsCleanAWSEnv_1.snap
+++ b/test/integration/__snapshots__/TestSAMInjectsCleanAWSEnv_1.snap
@@ -7,4 +7,4 @@ ENV_AWS_ACCESS_KEY_ID=111111111111
 ENV_AWS_SECRET_ACCESS_KEY=test
 ENV_AWS_PROFILE=<unset>
 ENV_AWS_DEFAULT_PROFILE=<unset>
-ENV_AWS_SESSION_TOKEN=<unset>
\ No newline at end of file
+ENV_AWS_SESSION_TOKEN=<unset>
diff --git a/test/integration/__snapshots__/TestSnapshotListSuccessWithoutDocker_1.snap b/test/integration/__snapshots__/TestSnapshotListSuccessWithoutDocker_1.snap
index b024ec10..17d4389b 100644
--- a/test/integration/__snapshots__/TestSnapshotListSuccessWithoutDocker_1.snap
+++ b/test/integration/__snapshots__/TestSnapshotListSuccessWithoutDocker_1.snap
@@ -3,4 +3,4 @@ Fetching snapshots...
 
   NAME           VERSION  LAST CHANGED
   baseline-q2    3        <date>              
-  infra-2026-04  1        -
\ No newline at end of file
+  infra-2026-04  1        -
diff --git a/test/integration/__snapshots__/TestSnapshotShowPinnedVersion_1.snap b/test/integration/__snapshots__/TestSnapshotShowPinnedVersion_1.snap
index 9d5f3f1e..9e801ef1 100644
--- a/test/integration/__snapshots__/TestSnapshotShowPinnedVersion_1.snap
+++ b/test/integration/__snapshots__/TestSnapshotShowPinnedVersion_1.snap
@@ -6,4 +6,4 @@ Size            <size>
 LocalStack      <calv> 
 Message         the first one
 
-Services        s3
\ No newline at end of file
+Services        s3
diff --git a/test/integration/__snapshots__/TestSnapshotShowSuccessWithoutDocker_1.snap b/test/integration/__snapshots__/TestSnapshotShowSuccessWithoutDocker_1.snap
index f5c0087a..b68bb074 100644
--- a/test/integration/__snapshots__/TestSnapshotShowSuccessWithoutDocker_1.snap
+++ b/test/integration/__snapshots__/TestSnapshotShowSuccessWithoutDocker_1.snap
@@ -10,4 +10,4 @@ Services        s3, lambda, dynamodb, sqs
 
 Resources
   lambda        1 function
-  s3            3 buckets
\ No newline at end of file
+  s3            3 buckets
diff --git a/test/integration/__snapshots__/TestSnapshotVersionsFiltersDeletedVersions_1.snap b/test/integration/__snapshots__/TestSnapshotVersionsFiltersDeletedVersions_1.snap
index 6ecde50f..8816fe6c 100644
--- a/test/integration/__snapshots__/TestSnapshotVersionsFiltersDeletedVersions_1.snap
+++ b/test/integration/__snapshots__/TestSnapshotVersionsFiltersDeletedVersions_1.snap
@@ -3,4 +3,4 @@ Fetching versions...
 
   VERSION  CREATED  LOCALSTACK  SERVICES
   3        -        keep-three  -
-  1        -        keep-one    -
\ No newline at end of file
+  1        -        keep-one    -
diff --git a/test/integration/__snapshots__/TestSnapshotVersionsSuccessWithoutDocker_1.snap b/test/integration/__snapshots__/TestSnapshotVersionsSuccessWithoutDocker_1.snap
index d4db542d..3dc60c25 100644
--- a/test/integration/__snapshots__/TestSnapshotVersionsSuccessWithoutDocker_1.snap
+++ b/test/integration/__snapshots__/TestSnapshotVersionsSuccessWithoutDocker_1.snap
@@ -4,4 +4,4 @@ Fetching versions...
   VERSION  CREATED               LOCALSTACK  SERVICES
   3        <date>                <calv>      s3, lambda
   2        <date>                <calv>      s3
-  1        <date>                <calv>      -
\ No newline at end of file
+  1        <date>                <calv>      -
diff --git a/test/integration/__snapshots__/TestStatusEndpointURLHTTPSRendersReducedOutput_1.snap b/test/integration/__snapshots__/TestStatusEndpointURLHTTPSRendersReducedOutput_1.snap
index 8678671c..a9cb1138 100644
--- a/test/integration/__snapshots__/TestStatusEndpointURLHTTPSRendersReducedOutput_1.snap
+++ b/test/integration/__snapshots__/TestStatusEndpointURLHTTPSRendersReducedOutput_1.snap
@@ -2,4 +2,4 @@ Fetching LocalStack status...
 ✔︎ LocalStack AWS Emulator is running
 • Endpoint: https://127.0.0.1:<port>
 • Version: <version>
-> Note: No resources deployed
\ No newline at end of file
+> Note: No resources deployed
diff --git a/test/integration/__snapshots__/TestStatusEndpointURLRendersReducedOutput_1.snap b/test/integration/__snapshots__/TestStatusEndpointURLRendersReducedOutput_1.snap
index d75ab62c..9eca9e62 100644
--- a/test/integration/__snapshots__/TestStatusEndpointURLRendersReducedOutput_1.snap
+++ b/test/integration/__snapshots__/TestStatusEndpointURLRendersReducedOutput_1.snap
@@ -2,4 +2,4 @@ Fetching LocalStack status...
 ✔︎ LocalStack AWS Emulator is running
 • Endpoint: http://127.0.0.1:<port>
 • Version: <version>
-> Note: No resources deployed
\ No newline at end of file
+> Note: No resources deployed

From a74d9689147ceb12faf3ef370612fb1fb9e747f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Wed, 12 Aug 2026 12:31:57 +0200
Subject: [PATCH 09/21] Convert remaining deterministic Contains clusters to
 snapshots

Co-Authored-By: Claude <noreply@anthropic.com>
---
 ...tensionEndpointOmittedWhenNoRuntime_1.snap |  8 ++++++
 ...ssionIDOmittedWhenTelemetryDisabled_1.snap |  7 +++++
 ...stExtensionUnknownCommandDispatches_1.snap |  8 ++++++
 ...before_the_command_name_is_rejected_1.snap | 13 +++++++++
 ...before_the_command_name_is_rejected_1.snap | 13 +++++++++
 ...after_the_wrapped_tool_s_own_action_1.snap |  2 ++
 ...json_immediately_after_command_name_1.snap |  2 ++
 ...after_the_wrapped_tool_s_own_action_1.snap |  2 ++
 ...json_immediately_after_command_name_1.snap |  2 ++
 ...after_the_wrapped_tool_s_own_action_1.snap |  2 ++
 ...json_immediately_after_command_name_1.snap |  2 ++
 ...after_the_wrapped_tool_s_own_action_1.snap |  2 ++
 ...json_immediately_after_command_name_1.snap |  2 ++
 ...after_the_wrapped_tool_s_own_action_1.snap |  2 ++
 ...json_immediately_after_command_name_1.snap |  2 ++
 ...CommandsRejectBeforeCommandName_aws_1.snap | 13 +++++++++
 ...yCommandsRejectBeforeCommandName_az_1.snap | 13 +++++++++
 ...CommandsRejectBeforeCommandName_cdk_1.snap | 13 +++++++++
 ...CommandsRejectBeforeCommandName_sam_1.snap | 13 +++++++++
 ...dsRejectBeforeCommandName_terraform_1.snap | 13 +++++++++
 .../TestSnapshotShowVersionNotFound_1.snap    |  4 +++
 .../TestSnapshotVersionsRejectsS3Ref_1.snap   |  1 +
 ...estStatusCommandFailsWhenNotRunning_1.snap |  3 ++
 .../TestTerraformMissingBinary_1.snap         |  3 ++
 test/integration/extension_test.go            | 26 ++++++++---------
 test/integration/json_flag_test.go            | 28 +++++++------------
 test/integration/license_test.go              |  2 ++
 test/integration/snap_sanitize_test.go        |  2 +-
 test/integration/snapshot_versions_test.go    |  8 ++----
 test/integration/status_test.go               |  5 ++--
 test/integration/terraform_cmd_test.go        |  7 ++---
 31 files changed, 177 insertions(+), 46 deletions(-)
 create mode 100644 test/integration/__snapshots__/TestExtensionEndpointOmittedWhenNoRuntime_1.snap
 create mode 100644 test/integration/__snapshots__/TestExtensionSessionIDOmittedWhenTelemetryDisabled_1.snap
 create mode 100644 test/integration/__snapshots__/TestExtensionUnknownCommandDispatches_1.snap
 create mode 100644 test/integration/__snapshots__/TestJSONFlagBeforeCommandNameBooleanValues_--json_true_before_the_command_name_is_rejected_1.snap
 create mode 100644 test/integration/__snapshots__/TestJSONFlagBeforeCommandNameBooleanValues_a_malformed_value_before_the_command_name_is_rejected_1.snap
 create mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_aws_json_after_the_wrapped_tool_s_own_action_1.snap
 create mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_aws_json_immediately_after_command_name_1.snap
 create mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_az_json_after_the_wrapped_tool_s_own_action_1.snap
 create mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_az_json_immediately_after_command_name_1.snap
 create mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_cdk_json_after_the_wrapped_tool_s_own_action_1.snap
 create mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_cdk_json_immediately_after_command_name_1.snap
 create mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_sam_json_after_the_wrapped_tool_s_own_action_1.snap
 create mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_sam_json_immediately_after_command_name_1.snap
 create mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_terraform_json_after_the_wrapped_tool_s_own_action_1.snap
 create mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_terraform_json_immediately_after_command_name_1.snap
 create mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_aws_1.snap
 create mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_az_1.snap
 create mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_cdk_1.snap
 create mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_sam_1.snap
 create mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_terraform_1.snap
 create mode 100644 test/integration/__snapshots__/TestSnapshotShowVersionNotFound_1.snap
 create mode 100644 test/integration/__snapshots__/TestSnapshotVersionsRejectsS3Ref_1.snap
 create mode 100644 test/integration/__snapshots__/TestStatusCommandFailsWhenNotRunning_1.snap
 create mode 100644 test/integration/__snapshots__/TestTerraformMissingBinary_1.snap

diff --git a/test/integration/__snapshots__/TestExtensionEndpointOmittedWhenNoRuntime_1.snap b/test/integration/__snapshots__/TestExtensionEndpointOmittedWhenNoRuntime_1.snap
new file mode 100644
index 00000000..0d3e2957
--- /dev/null
+++ b/test/integration/__snapshots__/TestExtensionEndpointOmittedWhenNoRuntime_1.snap
@@ -0,0 +1,8 @@
+ARGS=[]
+SELF=<path>
+API_VERSION=1
+CONFIG_DIR=<path>
+NON_INTERACTIVE=true
+JSON=false
+SESSION_ID=<id>
+EMULATOR_COUNT=0
diff --git a/test/integration/__snapshots__/TestExtensionSessionIDOmittedWhenTelemetryDisabled_1.snap b/test/integration/__snapshots__/TestExtensionSessionIDOmittedWhenTelemetryDisabled_1.snap
new file mode 100644
index 00000000..5f1207f1
--- /dev/null
+++ b/test/integration/__snapshots__/TestExtensionSessionIDOmittedWhenTelemetryDisabled_1.snap
@@ -0,0 +1,7 @@
+ARGS=[exit 7]
+SELF=<path>
+API_VERSION=1
+CONFIG_DIR=<path>
+NON_INTERACTIVE=true
+JSON=false
+EMULATOR_COUNT=0
diff --git a/test/integration/__snapshots__/TestExtensionUnknownCommandDispatches_1.snap b/test/integration/__snapshots__/TestExtensionUnknownCommandDispatches_1.snap
new file mode 100644
index 00000000..f15ac550
--- /dev/null
+++ b/test/integration/__snapshots__/TestExtensionUnknownCommandDispatches_1.snap
@@ -0,0 +1,8 @@
+ARGS=[world]
+SELF=<path>
+API_VERSION=1
+CONFIG_DIR=<path>
+NON_INTERACTIVE=true
+JSON=false
+SESSION_ID=<id>
+EMULATOR_COUNT=0
diff --git a/test/integration/__snapshots__/TestJSONFlagBeforeCommandNameBooleanValues_--json_true_before_the_command_name_is_rejected_1.snap b/test/integration/__snapshots__/TestJSONFlagBeforeCommandNameBooleanValues_--json_true_before_the_command_name_is_rejected_1.snap
new file mode 100644
index 00000000..31aee90d
--- /dev/null
+++ b/test/integration/__snapshots__/TestJSONFlagBeforeCommandNameBooleanValues_--json_true_before_the_command_name_is_rejected_1.snap
@@ -0,0 +1,13 @@
+{
+  "command": "aws",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"aws\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
diff --git a/test/integration/__snapshots__/TestJSONFlagBeforeCommandNameBooleanValues_a_malformed_value_before_the_command_name_is_rejected_1.snap b/test/integration/__snapshots__/TestJSONFlagBeforeCommandNameBooleanValues_a_malformed_value_before_the_command_name_is_rejected_1.snap
new file mode 100644
index 00000000..31aee90d
--- /dev/null
+++ b/test/integration/__snapshots__/TestJSONFlagBeforeCommandNameBooleanValues_a_malformed_value_before_the_command_name_is_rejected_1.snap
@@ -0,0 +1,13 @@
+{
+  "command": "aws",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"aws\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_aws_json_after_the_wrapped_tool_s_own_action_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_aws_json_after_the_wrapped_tool_s_own_action_1.snap
new file mode 100644
index 00000000..07c27422
--- /dev/null
+++ b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_aws_json_after_the_wrapped_tool_s_own_action_1.snap
@@ -0,0 +1,2 @@
+Error: aws CLI not found in PATH
+  ==> Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_aws_json_immediately_after_command_name_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_aws_json_immediately_after_command_name_1.snap
new file mode 100644
index 00000000..07c27422
--- /dev/null
+++ b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_aws_json_immediately_after_command_name_1.snap
@@ -0,0 +1,2 @@
+Error: aws CLI not found in PATH
+  ==> Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_az_json_after_the_wrapped_tool_s_own_action_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_az_json_after_the_wrapped_tool_s_own_action_1.snap
new file mode 100644
index 00000000..65851aeb
--- /dev/null
+++ b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_az_json_after_the_wrapped_tool_s_own_action_1.snap
@@ -0,0 +1,2 @@
+Error: az CLI not found in PATH
+  ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_az_json_immediately_after_command_name_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_az_json_immediately_after_command_name_1.snap
new file mode 100644
index 00000000..65851aeb
--- /dev/null
+++ b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_az_json_immediately_after_command_name_1.snap
@@ -0,0 +1,2 @@
+Error: az CLI not found in PATH
+  ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_cdk_json_after_the_wrapped_tool_s_own_action_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_cdk_json_after_the_wrapped_tool_s_own_action_1.snap
new file mode 100644
index 00000000..f809a508
--- /dev/null
+++ b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_cdk_json_after_the_wrapped_tool_s_own_action_1.snap
@@ -0,0 +1,2 @@
+Error: cdk not found in PATH
+  ==> Install CDK CLI: npm install -g aws-cdk
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_cdk_json_immediately_after_command_name_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_cdk_json_immediately_after_command_name_1.snap
new file mode 100644
index 00000000..f809a508
--- /dev/null
+++ b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_cdk_json_immediately_after_command_name_1.snap
@@ -0,0 +1,2 @@
+Error: cdk not found in PATH
+  ==> Install CDK CLI: npm install -g aws-cdk
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_sam_json_after_the_wrapped_tool_s_own_action_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_sam_json_after_the_wrapped_tool_s_own_action_1.snap
new file mode 100644
index 00000000..0ae1a435
--- /dev/null
+++ b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_sam_json_after_the_wrapped_tool_s_own_action_1.snap
@@ -0,0 +1,2 @@
+Error: sam not found in PATH
+  ==> Install AWS SAM CLI: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_sam_json_immediately_after_command_name_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_sam_json_immediately_after_command_name_1.snap
new file mode 100644
index 00000000..0ae1a435
--- /dev/null
+++ b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_sam_json_immediately_after_command_name_1.snap
@@ -0,0 +1,2 @@
+Error: sam not found in PATH
+  ==> Install AWS SAM CLI: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_terraform_json_after_the_wrapped_tool_s_own_action_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_terraform_json_after_the_wrapped_tool_s_own_action_1.snap
new file mode 100644
index 00000000..6f8ddc16
--- /dev/null
+++ b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_terraform_json_after_the_wrapped_tool_s_own_action_1.snap
@@ -0,0 +1,2 @@
+Error: terraform not found in PATH
+  ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_terraform_json_immediately_after_command_name_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_terraform_json_immediately_after_command_name_1.snap
new file mode 100644
index 00000000..6f8ddc16
--- /dev/null
+++ b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_terraform_json_immediately_after_command_name_1.snap
@@ -0,0 +1,2 @@
+Error: terraform not found in PATH
+  ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_aws_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_aws_1.snap
new file mode 100644
index 00000000..31aee90d
--- /dev/null
+++ b/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_aws_1.snap
@@ -0,0 +1,13 @@
+{
+  "command": "aws",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"aws\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_az_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_az_1.snap
new file mode 100644
index 00000000..919d6aba
--- /dev/null
+++ b/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_az_1.snap
@@ -0,0 +1,13 @@
+{
+  "command": "az",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"az\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_cdk_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_cdk_1.snap
new file mode 100644
index 00000000..dcd98f24
--- /dev/null
+++ b/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_cdk_1.snap
@@ -0,0 +1,13 @@
+{
+  "command": "cdk",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"cdk\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_sam_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_sam_1.snap
new file mode 100644
index 00000000..9a89fa28
--- /dev/null
+++ b/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_sam_1.snap
@@ -0,0 +1,13 @@
+{
+  "command": "sam",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"sam\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_terraform_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_terraform_1.snap
new file mode 100644
index 00000000..980add94
--- /dev/null
+++ b/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_terraform_1.snap
@@ -0,0 +1,13 @@
+{
+  "command": "terraform",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"terraform\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
diff --git a/test/integration/__snapshots__/TestSnapshotShowVersionNotFound_1.snap b/test/integration/__snapshots__/TestSnapshotShowVersionNotFound_1.snap
new file mode 100644
index 00000000..eaad06de
--- /dev/null
+++ b/test/integration/__snapshots__/TestSnapshotShowVersionNotFound_1.snap
@@ -0,0 +1,4 @@
+Fetching snapshot version 99...
+Error: Version 99 of 'pod:my-baseline' not found
+  The highest available version is 3.
+  ==> List available versions: lstk snapshot versions pod:my-baseline
diff --git a/test/integration/__snapshots__/TestSnapshotVersionsRejectsS3Ref_1.snap b/test/integration/__snapshots__/TestSnapshotVersionsRejectsS3Ref_1.snap
new file mode 100644
index 00000000..8a4c22bd
--- /dev/null
+++ b/test/integration/__snapshots__/TestSnapshotVersionsRejectsS3Ref_1.snap
@@ -0,0 +1 @@
+Error: snapshot versions is only supported for Cloud Pods (pod: refs), not S3 remotes
diff --git a/test/integration/__snapshots__/TestStatusCommandFailsWhenNotRunning_1.snap b/test/integration/__snapshots__/TestStatusCommandFailsWhenNotRunning_1.snap
new file mode 100644
index 00000000..d64cbd44
--- /dev/null
+++ b/test/integration/__snapshots__/TestStatusCommandFailsWhenNotRunning_1.snap
@@ -0,0 +1,3 @@
+Error: LocalStack AWS Emulator is not running
+  ==> Start LocalStack: lstk
+  ==> See help: lstk -h
diff --git a/test/integration/__snapshots__/TestTerraformMissingBinary_1.snap b/test/integration/__snapshots__/TestTerraformMissingBinary_1.snap
new file mode 100644
index 00000000..b3093cdc
--- /dev/null
+++ b/test/integration/__snapshots__/TestTerraformMissingBinary_1.snap
@@ -0,0 +1,3 @@
+
+Error: terraform not found in PATH
+  ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
diff --git a/test/integration/extension_test.go b/test/integration/extension_test.go
index 55ad6b30..2d30e11f 100644
--- a/test/integration/extension_test.go
+++ b/test/integration/extension_test.go
@@ -142,11 +142,12 @@ func TestExtensionUnknownCommandDispatches(t *testing.T) {
 	installExtension(t, extDir, "hello")
 
 	tmpHome := t.TempDir()
-	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), envWithPath(tmpHome, extDir), "hello", "world")
+	// DOCKER_HOST points at a closed port so the emulator context (and with it
+	// the EMULATOR_COUNT/EMULATOR lines) can't vary with the host's Docker state.
+	environ := append(envWithPath(tmpHome, extDir), "DOCKER_HOST=tcp://127.0.0.1:1")
+	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "hello", "world")
 	must.NoError(t, err, stderr)
-	must.Contains(t, stdout, "ARGS=[world]")
-	must.Contains(t, stdout, "API_VERSION=1")
-	must.Contains(t, stdout, "CONFIG_DIR=")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestExtensionUnknownCommandNoExtensionErrors(t *testing.T) {
@@ -207,10 +208,9 @@ func TestExtensionEndpointOmittedWhenNoRuntime(t *testing.T) {
 	environ = append(environ, "DOCKER_HOST=tcp://127.0.0.1:1")
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "ref")
 	must.NoError(t, err, stderr)
-	must.Contains(t, stdout, "EMULATOR_COUNT=0")
-	must.NotContains(t, stdout, "EMULATOR=")
-	// The extension still runs and still receives the always-present variables.
-	must.Contains(t, stdout, "API_VERSION=1")
+	// The snapshot pins EMULATOR_COUNT=0 with no EMULATOR= lines, while the
+	// always-present variables are still conveyed.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestExtensionSelfAuthorizationRefusesWithoutToken(t *testing.T) {
@@ -293,12 +293,10 @@ func TestExtensionSessionIDOmittedWhenTelemetryDisabled(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), environ, "ref", "exit", "7")
 	requireExitCode(t, 7, err)
 
-	// No session exists, so the field is omitted rather than conveyed empty (the
-	// JSON-level omission is asserted in internal/extension).
-	must.NotContains(t, stdout, "SESSION_ID=",
-		"no sessionId may be conveyed when telemetry is disabled")
-	must.Contains(t, stdout, "API_VERSION=1")
-	must.Contains(t, stdout, "ARGS=[exit 7]")
+	// No session exists, so the snapshot carries no SESSION_ID line at all —
+	// omitted rather than conveyed empty (the JSON-level omission is asserted
+	// in internal/extension).
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // echoedValue returns the value of a `KEY=value` line the reference extension
diff --git a/test/integration/json_flag_test.go b/test/integration/json_flag_test.go
index 120abc02..d43acec5 100644
--- a/test/integration/json_flag_test.go
+++ b/test/integration/json_flag_test.go
@@ -104,9 +104,9 @@ func TestJSONFlagProxyCommandsForwardJSON(t *testing.T) {
 			args := append([]string{tc.name, "--json"}, tc.args...)
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, environ, args...)
 			must.Error(t, err)
-			combined := stdout + stderr
-			must.Contains(t, combined, "not found in PATH", "--json should have been forwarded to the wrapped tool, not rejected by lstk")
-			must.NotContains(t, combined, "is not able to provide output in JSON format")
+			// The snapshot pins the wrapped tool's missing-binary error —
+			// proof --json was forwarded, not rejected by lstk.
+			snap.Match(t, sanitizeOutput(stdout+"\n"+stderr))
 		})
 
 		t.Run(tc.name+"/json after the wrapped tool's own action", func(t *testing.T) {
@@ -115,9 +115,7 @@ func TestJSONFlagProxyCommandsForwardJSON(t *testing.T) {
 			args := append(append([]string{tc.name}, tc.args...), "--json")
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, environ, args...)
 			must.Error(t, err)
-			combined := stdout + stderr
-			must.Contains(t, combined, "not found in PATH", "--json should have been forwarded to the wrapped tool, not rejected by lstk")
-			must.NotContains(t, combined, "is not able to provide output in JSON format")
+			snap.Match(t, sanitizeOutput(stdout+"\n"+stderr))
 		})
 	}
 }
@@ -139,10 +137,8 @@ func TestJSONFlagProxyCommandsRejectBeforeCommandName(t *testing.T) {
 			args := append([]string{"--json", tc.name}, tc.args...)
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, environ, args...)
 			requireExitCode(t, 1, err)
-			envelope := decodeEnvelope(t, stdout)
-			must.Eq(t, tc.name, envelope.Command)
-			must.NotNil(t, envelope.Error)
-			must.Eq(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
+			decodeEnvelope(t, stdout)
+			snap.MatchJSON(t, []byte(stdout))
 			must.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
 		})
 	}
@@ -160,10 +156,8 @@ func TestJSONFlagBeforeCommandNameBooleanValues(t *testing.T) {
 		t.Parallel()
 		stdout, _, err := runLstk(t, testContext(t), t.TempDir(), env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).WithHome(t.TempDir()), "--json=true", "aws", "s3", "ls")
 		requireExitCode(t, 1, err)
-		envelope := decodeEnvelope(t, stdout)
-		must.Eq(t, "aws", envelope.Command)
-		must.NotNil(t, envelope.Error)
-		must.Eq(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
+		decodeEnvelope(t, stdout)
+		snap.MatchJSON(t, []byte(stdout))
 	})
 
 	t.Run("--json=false before the command name is not rejected", func(t *testing.T) {
@@ -179,10 +173,8 @@ func TestJSONFlagBeforeCommandNameBooleanValues(t *testing.T) {
 		t.Parallel()
 		stdout, _, err := runLstk(t, testContext(t), t.TempDir(), env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).WithHome(t.TempDir()), "--json=notabool", "aws", "s3", "ls")
 		requireExitCode(t, 1, err)
-		envelope := decodeEnvelope(t, stdout)
-		must.Eq(t, "aws", envelope.Command)
-		must.NotNil(t, envelope.Error)
-		must.Eq(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
+		decodeEnvelope(t, stdout)
+		snap.MatchJSON(t, []byte(stdout))
 	})
 }
 
diff --git a/test/integration/license_test.go b/test/integration/license_test.go
index 4b568ebc..8cbfa357 100644
--- a/test/integration/license_test.go
+++ b/test/integration/license_test.go
@@ -95,6 +95,8 @@ func TestLicenseValidationFailure(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL).With(env.AuthToken, "test-token-for-license-validation"), "start")
 	must.Error(t, err, "expected lstk start to fail with forbidden license")
 	requireExitCode(t, 1, err)
+	// Not a snapshot: the output embeds pull-progress lines that depend on
+	// the runner's image cache and the live emulator image version.
 	must.Contains(t, stdout, "License validation failed")
 	must.Contains(t, stdout, "invalid, inactive, or expired")
 	must.Contains(t, stdout, "lstk logout", "the error should point at re-authentication")
diff --git a/test/integration/snap_sanitize_test.go b/test/integration/snap_sanitize_test.go
index 96c1aff7..70e8845e 100644
--- a/test/integration/snap_sanitize_test.go
+++ b/test/integration/snap_sanitize_test.go
@@ -36,7 +36,7 @@ var (
 	sanitizeCalverRe = regexp.MustCompile(`\b20\d{2}\.\d{2}\b`)
 	// Reference-extension echo lines carrying temp paths or random ids.
 	sanitizeExtPathRe = regexp.MustCompile(`(?m)^(SELF=|CONFIG_DIR=).*$`)
-	sanitizeExtIDRe = regexp.MustCompile(`(?m)^(SESSION_ID=).*$`)
+	sanitizeExtIDRe   = regexp.MustCompile(`(?m)^(SESSION_ID=).*$`)
 	// Defense in depth: a real auth token must never land in a committed
 	// snapshot or a failure diff, even if a test forgets to strip it.
 	sanitizeExtTokenRe = regexp.MustCompile(`(?m)^(AUTH_TOKEN=).*$`)
diff --git a/test/integration/snapshot_versions_test.go b/test/integration/snapshot_versions_test.go
index 70589113..f066d65a 100644
--- a/test/integration/snapshot_versions_test.go
+++ b/test/integration/snapshot_versions_test.go
@@ -152,9 +152,7 @@ func TestSnapshotVersionsRejectsS3Ref(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "s3://bucket/prefix",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "only supported for Cloud Pods")
-	must.Contains(t, stderr, "S3 remotes")
-	must.NotContains(t, stderr, "coming soon")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // TestSnapshotVersionsOrasKeepsComingSoon: oras:// is unimplemented for every
@@ -213,9 +211,7 @@ func TestSnapshotShowVersionNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "pod:my-baseline:99",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "Version 99 of 'pod:my-baseline' not found")
-	must.Contains(t, stdout, "The highest available version is 3.")
-	must.Contains(t, stdout, "lstk snapshot versions pod:my-baseline")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestSnapshotVersionsRejectsVersionSuffix: this command lists every version, so
diff --git a/test/integration/status_test.go b/test/integration/status_test.go
index dac0df23..d4ce641c 100644
--- a/test/integration/status_test.go
+++ b/test/integration/status_test.go
@@ -18,6 +18,7 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/aws/aws-sdk-go-v2/service/sqs"
 	"github.com/localstack/lstk/internal/must"
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
 )
@@ -31,9 +32,7 @@ func TestStatusCommandFailsWhenNotRunning(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "status")
 	must.Error(t, err, "expected lstk status to fail when emulator not running")
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "is not running")
-	must.Contains(t, stdout, "Start LocalStack:")
-	must.Contains(t, stdout, "See help:")
+	snap.Match(t, sanitizeOutput(stdout))
 	assertCommandTelemetry(t, events, "status", 1)
 }
 
diff --git a/test/integration/terraform_cmd_test.go b/test/integration/terraform_cmd_test.go
index 6c990fe5..578ed9a0 100644
--- a/test/integration/terraform_cmd_test.go
+++ b/test/integration/terraform_cmd_test.go
@@ -107,10 +107,9 @@ func TestTerraformMissingBinary(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "version")
 	must.Error(t, err)
-	combined := stderr + stdout
-	must.Contains(t, combined, "not found in PATH")
-	must.Contains(t, combined, "Install Terraform CLI:")
-	must.Contains(t, combined, "https://developer.hashicorp.com/terraform/cli")
+	// The snapshot pins the full missing-binary error card, install hint
+	// included.
+	snap.Match(t, sanitizeOutput(stderr+"\n"+stdout))
 }
 
 // 7.3 — fmt/validate/version/init run without generating an override and without

From d9702b2869a1e299a4c2ed6f0716fea65fbac179 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Wed, 12 Aug 2026 12:37:24 +0200
Subject: [PATCH 10/21] Strip ambient auth token in envWithPath for
 deterministic extension output

Co-Authored-By: Claude <noreply@anthropic.com>
---
 test/integration/extension_test.go | 6 ++++++
 test/integration/json_flag_test.go | 9 +--------
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/test/integration/extension_test.go b/test/integration/extension_test.go
index 2d30e11f..22ba9c02 100644
--- a/test/integration/extension_test.go
+++ b/test/integration/extension_test.go
@@ -7,6 +7,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"runtime"
+	"slices"
 	"strings"
 	"sync"
 	"testing"
@@ -104,6 +105,11 @@ func installLstkBundle(t *testing.T, dir string) string {
 // is touched. Extra DOCKER_HOST etc. can be appended by the caller.
 func envWithPath(tmpHome, extDir string) []string {
 	e := testEnvWithHome(tmpHome, "")
+	// Strip any ambient auth token (set in CI) so extension-context output is
+	// deterministic; a test that wants one appends it explicitly, which wins.
+	e = slices.DeleteFunc(e, func(kv string) bool {
+		return strings.HasPrefix(kv, string(env.AuthToken)+"=")
+	})
 	e = append(e, "PATH="+extDir+string(os.PathListSeparator)+os.Getenv("PATH"))
 	return e
 }
diff --git a/test/integration/json_flag_test.go b/test/integration/json_flag_test.go
index d43acec5..b9b0280a 100644
--- a/test/integration/json_flag_test.go
+++ b/test/integration/json_flag_test.go
@@ -1,8 +1,6 @@
 package integration_test
 
 import (
-	"slices"
-	"strings"
 	"testing"
 
 	"github.com/localstack/lstk/internal/must"
@@ -183,12 +181,7 @@ func TestExtensionReceivesJSONFlagInContext(t *testing.T) {
 	extDir := t.TempDir()
 	installExtension(t, extDir, "hello")
 	tmpHome := t.TempDir()
-	// Strip any ambient auth token: it would add an environment-dependent
-	// AUTH_TOKEN line to the snapshotted context echo (and put a real secret
-	// in the failure diff).
-	environ := slices.DeleteFunc(envWithPath(tmpHome, extDir), func(kv string) bool {
-		return strings.HasPrefix(kv, string(env.AuthToken)+"=")
-	})
+	environ := envWithPath(tmpHome, extDir)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "--json", "hello", "--foo")
 	must.NoError(t, err, stderr)

From 09b48702910db5b5f6b1ff4d0efd30081eb02a05 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Wed, 12 Aug 2026 12:59:56 +0200
Subject: [PATCH 11/21] Restore testify assertions and delete internal/must

Co-Authored-By: Claude <noreply@anthropic.com>
---
 CLAUDE.md                                     |   2 +-
 internal/must/must.go                         | 374 ------------
 internal/must/must_test.go                    | 249 --------
 internal/output/envelope_sink_test.go         |  18 +-
 internal/output/snapshot_sanitize_test.go     |  14 +-
 .../integration/auth_token_precedence_test.go |  22 +-
 test/integration/aws_cmd_test.go              | 216 +++----
 test/integration/aws_completion_test.go       |  38 +-
 test/integration/aws_e2e_test.go              |  10 +-
 .../aws_profile_precedence_test.go            |  20 +-
 test/integration/awsconfig_test.go            | 128 ++---
 test/integration/az_cmd_test.go               |  50 +-
 test/integration/az_e2e_test.go               |  24 +-
 test/integration/az_interception_test.go      |  62 +-
 test/integration/az_pty_test.go               |  18 +-
 test/integration/cdk_cmd_test.go              |  66 +--
 test/integration/cdk_e2e_test.go              |  26 +-
 test/integration/completion_test.go           |  38 +-
 test/integration/config_test.go               |  66 +--
 test/integration/docker_unhealthy_test.go     |  34 +-
 test/integration/docker_windows_test.go       |  12 +-
 test/integration/docs_test.go                 |  24 +-
 test/integration/emulator_select_test.go      |  98 ++--
 test/integration/emulator_type_test.go        | 112 ++--
 test/integration/endpoint_url_https_test.go   |  46 +-
 test/integration/endpoint_url_test.go         | 118 ++--
 test/integration/exit_code_test.go            |  10 +-
 test/integration/extension_test.go            |  92 +--
 test/integration/faketool_test.go             |   8 +-
 test/integration/go.mod                       |   8 +-
 test/integration/go.sum                       |   9 +
 test/integration/json_envelope_test.go        |  28 +-
 test/integration/json_flag_test.go            |  46 +-
 test/integration/license_test.go              |  66 +--
 test/integration/localstack_test.go           |   6 +-
 test/integration/logging_test.go              |  22 +-
 test/integration/login_test.go                |  78 +--
 test/integration/logout_test.go               |  44 +-
 test/integration/logs_test.go                 |  60 +-
 test/integration/main_test.go                 |  32 +-
 test/integration/multiple_installs_test.go    |  30 +-
 test/integration/non_interactive_test.go      |  14 +-
 test/integration/pty_helpers_test.go          |  12 +-
 test/integration/reset_test.go                |  62 +-
 test/integration/restart_test.go              |  56 +-
 test/integration/sam_cmd_test.go              | 104 ++--
 test/integration/sam_e2e_test.go              |  18 +-
 test/integration/setup_azure_test.go          |  60 +-
 test/integration/signal_forwarding_test.go    |  24 +-
 .../integration/snapshot_experimental_test.go |  16 +-
 test/integration/snapshot_list_test.go        |  38 +-
 test/integration/snapshot_load_test.go        |  92 +--
 .../integration/snapshot_load_version_test.go |  64 +--
 test/integration/snapshot_merge_e2e_test.go   |  54 +-
 test/integration/snapshot_remove_test.go      |  58 +-
 test/integration/snapshot_save_test.go        | 152 ++---
 test/integration/snapshot_show_test.go        |  40 +-
 test/integration/snapshot_versions_test.go    |  44 +-
 test/integration/start_snapshot_test.go       |  22 +-
 test/integration/start_test.go                | 530 +++++++++---------
 test/integration/status_test.go               |  72 +--
 test/integration/stop_test.go                 |  82 +--
 test/integration/telemetry_test.go            |  86 +--
 test/integration/terraform_cmd_test.go        | 134 ++---
 test/integration/terraform_e2e_test.go        |  50 +-
 .../terraform_s3backend_e2e_test.go           |  42 +-
 test/integration/update_test.go               | 194 +++----
 test/integration/version_resolution_test.go   |  36 +-
 test/integration/volume_test.go               |  92 +--
 69 files changed, 2032 insertions(+), 2640 deletions(-)
 delete mode 100644 internal/must/must.go
 delete mode 100644 internal/must/must_test.go

diff --git a/CLAUDE.md b/CLAUDE.md
index 2be22c37..f2316ef9 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -233,7 +233,7 @@ When drafting Slack messages, PR descriptions, review replies, release notes, or
 # Testing
 
 - Prefer integration tests to cover most cases. Use unit tests when integration tests are not practical.
-- In-house test helpers (no external assertion/snapshot deps): `internal/must` for fatal generic assertions (`must.Eq` renders go-cmp diffs; `must.Nil`/`NotNil` handle typed nils), and `internal/snap` for file-snapshot tests. `snap.Match(t, s)` stores one file per snapshot under `__snapshots__/` next to the test; missing snapshots are created locally but fail in CI; `UPDATE_SNAPS=true go test ./...` rewrites them. `snap.MatchJSON(t, raw, "data.currentVersion", ...)` snapshots a JSON document in canonical pretty-printed form, masking the values at the given dotted paths with `<any>` (a path that doesn't resolve fails the test; objects only, no array indexing). A package using snapshots must wire `func TestMain(m *testing.M) { os.Exit(snap.Clean(m)) }` — obsolete snapshots then fail the run (or are deleted under `UPDATE_SNAPS=true`); cleanup is skipped on filtered (`-run`/`-skip`) or failed runs. Sanitize volatile values before matching with label-anchored regexes, not value-shaped ones (see `sanitizeSnapshot` in `internal/output`; RE2 has no lookahead, so a bare semver pattern corrupts IPv4 strings).
+- Assertions use `github.com/stretchr/testify` (`require` for fatal checks). Snapshots use the in-house `internal/snap` helper. `snap.Match(t, s)` stores one file per snapshot under `__snapshots__/` next to the test; missing snapshots are created locally but fail in CI; `UPDATE_SNAPS=true go test ./...` rewrites them. `snap.MatchJSON(t, raw, "data.currentVersion", ...)` snapshots a JSON document in canonical pretty-printed form, masking the values at the given dotted paths with `<any>` (a path that doesn't resolve fails the test; objects only, no array indexing). A package using snapshots must wire `func TestMain(m *testing.M) { os.Exit(snap.Clean(m)) }` — obsolete snapshots then fail the run (or are deleted under `UPDATE_SNAPS=true`); cleanup is skipped on filtered (`-run`/`-skip`) or failed runs. Sanitize volatile values before matching with label-anchored regexes, not value-shaped ones (see `sanitizeSnapshot` in `internal/output`; RE2 has no lookahead, so a bare semver pattern corrupts IPv4 strings).
 - **When fixing a bug, always add an integration test** that fails before the fix and passes after. This prevents regressions and documents the exact scenario that was broken.
 - Integration tests that run the CLI binary with Bubble Tea must use a PTY since Bubble Tea requires a terminal. Use the cross-platform helpers in `test/integration/pty_helpers_test.go` — `runLstkInPTY` for run-to-completion, or `startLstkInPTY`/`startCmdInPTY` returning a `ptyProc` with `waitForOutput`/`write`/`wait`/`kill` for interactive prompts — never `creack/pty` directly. The helpers wrap `charmbracelet/x/xpty` (Unix PTY on macOS/Linux, ConPTY on Windows), so PTY tests run on Windows too; output from `wait()`/`output()` is ANSI-stripped because ConPTY injects its own repaint sequences. `creack/pty` remains only in `signal_forwarding_test.go` (build-tagged `!windows`; POSIX signal semantics don't port).
 - Never fake an external CLI (`aws`, `az`, `terraform`, `cdk`, `sam`, `aws_completer`, browser openers) with a shell script — scripts don't run on Windows. Use `writeFakeTool`/`installFakeTool` (`test/integration/faketool_test.go`), which copy a compiled Go stand-in (`test-samples/faketool`) onto PATH configured via a JSON sidecar (echo lines with `{argN}`/`{args}`/`{env:NAME}` placeholders, arg-prefix cases like `--version`, sleep, exit codes, record-to-file).
diff --git a/internal/must/must.go b/internal/must/must.go
deleted file mode 100644
index 5f707a60..00000000
--- a/internal/must/must.go
+++ /dev/null
@@ -1,374 +0,0 @@
-// Package must provides minimal generic test assertions that fail the test
-// immediately (t.Fatal semantics). In-house replacement for the subset of
-// testify that lstk uses; diffing is delegated to go-cmp, which renders
-// readable struct/slice mismatches.
-//
-// Argument order and trailing msgAndArgs follow testify's conventions
-// (want/expected before got/actual; an optional format string plus args at
-// the end) so call sites migrate mechanically.
-package must
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"reflect"
-	"regexp"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/google/go-cmp/cmp"
-)
-
-// message renders testify-style trailing msgAndArgs: a lone value is printed
-// as-is, a leading string with further args is a Printf format.
-func message(msgAndArgs []any) string {
-	switch len(msgAndArgs) {
-	case 0:
-		return ""
-	case 1:
-		return fmt.Sprintf("%v", msgAndArgs[0])
-	default:
-		if format, ok := msgAndArgs[0].(string); ok {
-			return fmt.Sprintf(format, msgAndArgs[1:]...)
-		}
-		return fmt.Sprint(msgAndArgs...)
-	}
-}
-
-func fatalf(t testing.TB, msgAndArgs []any, format string, args ...any) {
-	t.Helper()
-	s := fmt.Sprintf(format, args...)
-	if m := message(msgAndArgs); m != "" {
-		s = m + "\n" + s
-	}
-	t.Fatalf("%s", s)
-}
-
-// Eq fails the test if want and got are not deeply equal (go-cmp semantics).
-func Eq[A any](t testing.TB, want, got A, msgAndArgs ...any) {
-	t.Helper()
-	if diff := cmp.Diff(want, got); diff != "" {
-		fatalf(t, msgAndArgs, "mismatch (-want +got):\n%s", diff)
-	}
-}
-
-// NotEq fails the test if want and got are deeply equal (go-cmp semantics).
-func NotEq[A any](t testing.TB, want, got A, msgAndArgs ...any) {
-	t.Helper()
-	if cmp.Diff(want, got) == "" {
-		fatalf(t, msgAndArgs, "expected values to differ, both were %#v", got)
-	}
-}
-
-// True fails the test if ok is false.
-func True(t testing.TB, ok bool, msgAndArgs ...any) {
-	t.Helper()
-	if !ok {
-		fatalf(t, msgAndArgs, "expected condition to be true")
-	}
-}
-
-// False fails the test if ok is true.
-func False(t testing.TB, ok bool, msgAndArgs ...any) {
-	t.Helper()
-	if ok {
-		fatalf(t, msgAndArgs, "expected condition to be false")
-	}
-}
-
-// NoError fails the test if err is non-nil.
-func NoError(t testing.TB, err error, msgAndArgs ...any) {
-	t.Helper()
-	if err != nil {
-		fatalf(t, msgAndArgs, "unexpected error: %v", err)
-	}
-}
-
-// Error fails the test if err is nil.
-func Error(t testing.TB, err error, msgAndArgs ...any) {
-	t.Helper()
-	if err == nil {
-		fatalf(t, msgAndArgs, "expected an error, got nil")
-	}
-}
-
-// ErrorIs fails the test if errors.Is(err, target) is false.
-func ErrorIs(t testing.TB, err, target error, msgAndArgs ...any) {
-	t.Helper()
-	if !errors.Is(err, target) {
-		fatalf(t, msgAndArgs, "expected error chain to contain %v, got %v", target, err)
-	}
-}
-
-// ErrorAs fails the test if errors.As(err, target) is false.
-func ErrorAs(t testing.TB, err error, target any, msgAndArgs ...any) {
-	t.Helper()
-	if !errors.As(err, target) {
-		fatalf(t, msgAndArgs, "expected error chain to contain %T, got %v", target, err)
-	}
-}
-
-// Nil fails the test if v is non-nil. Typed nils inside interfaces (e.g. a
-// nil *T stored in an any) count as nil.
-func Nil(t testing.TB, v any, msgAndArgs ...any) {
-	t.Helper()
-	if !isNil(v) {
-		fatalf(t, msgAndArgs, "expected nil, got %#v", v)
-	}
-}
-
-// NotNil fails the test if v is nil (including typed nils, see Nil).
-func NotNil(t testing.TB, v any, msgAndArgs ...any) {
-	t.Helper()
-	if isNil(v) {
-		fatalf(t, msgAndArgs, "expected non-nil value")
-	}
-}
-
-func isNil(v any) bool {
-	if v == nil {
-		return true
-	}
-	rv := reflect.ValueOf(v)
-	switch rv.Kind() {
-	case reflect.Chan, reflect.Func, reflect.Interface, reflect.Map, reflect.Pointer, reflect.Slice:
-		return rv.IsNil()
-	}
-	return false
-}
-
-// Contains fails the test unless container (a string, slice, array, or map)
-// contains item (substring, element, or key respectively).
-func Contains(t testing.TB, container, item any, msgAndArgs ...any) {
-	t.Helper()
-	if !contains(t, container, item) {
-		fatalf(t, msgAndArgs, "%#v\ndoes not contain\n%#v", container, item)
-	}
-}
-
-// NotContains is the inverse of Contains.
-func NotContains(t testing.TB, container, item any, msgAndArgs ...any) {
-	t.Helper()
-	if contains(t, container, item) {
-		fatalf(t, msgAndArgs, "%#v\nunexpectedly contains\n%#v", container, item)
-	}
-}
-
-func contains(t testing.TB, container, item any) bool {
-	t.Helper()
-	if s, ok := container.(string); ok {
-		sub, ok := item.(string)
-		if !ok {
-			t.Fatalf("Contains: string container needs a string item, got %T", item)
-		}
-		return strings.Contains(s, sub)
-	}
-	rv := reflect.ValueOf(container)
-	switch rv.Kind() {
-	case reflect.Slice, reflect.Array:
-		for i := 0; i < rv.Len(); i++ {
-			if reflect.DeepEqual(rv.Index(i).Interface(), item) {
-				return true
-			}
-		}
-		return false
-	case reflect.Map:
-		for _, k := range rv.MapKeys() {
-			if reflect.DeepEqual(k.Interface(), item) {
-				return true
-			}
-		}
-		return false
-	}
-	t.Fatalf("Contains: unsupported container type %T", container)
-	return false
-}
-
-// Empty fails the test unless v is empty: nil, a zero-length string/slice/
-// map/array/channel, or a zero value.
-func Empty(t testing.TB, v any, msgAndArgs ...any) {
-	t.Helper()
-	if !isEmpty(v) {
-		fatalf(t, msgAndArgs, "expected empty, got %#v", v)
-	}
-}
-
-// NotEmpty is the inverse of Empty.
-func NotEmpty(t testing.TB, v any, msgAndArgs ...any) {
-	t.Helper()
-	if isEmpty(v) {
-		fatalf(t, msgAndArgs, "expected non-empty value of type %T", v)
-	}
-}
-
-func isEmpty(v any) bool {
-	if v == nil {
-		return true
-	}
-	rv := reflect.ValueOf(v)
-	switch rv.Kind() {
-	case reflect.String, reflect.Slice, reflect.Map, reflect.Array, reflect.Chan:
-		return rv.Len() == 0
-	case reflect.Pointer:
-		return rv.IsNil() || isEmpty(rv.Elem().Interface())
-	}
-	return rv.IsZero()
-}
-
-// Len fails the test unless v (a string, slice, array, map, or channel) has
-// length n.
-func Len(t testing.TB, v any, n int, msgAndArgs ...any) {
-	t.Helper()
-	rv := reflect.ValueOf(v)
-	switch rv.Kind() {
-	case reflect.String, reflect.Slice, reflect.Map, reflect.Array, reflect.Chan:
-		if rv.Len() != n {
-			fatalf(t, msgAndArgs, "expected length %d, got %d: %#v", n, rv.Len(), v)
-		}
-	default:
-		t.Fatalf("Len: unsupported type %T", v)
-	}
-}
-
-// InDelta fails the test unless expected and actual (any numeric kinds) are
-// within delta of each other.
-func InDelta(t testing.TB, expected, actual any, delta float64, msgAndArgs ...any) {
-	t.Helper()
-	e, ok1 := toFloat(expected)
-	a, ok2 := toFloat(actual)
-	if !ok1 || !ok2 {
-		t.Fatalf("InDelta: non-numeric arguments %T, %T", expected, actual)
-	}
-	if diff := e - a; diff < -delta || diff > delta {
-		fatalf(t, msgAndArgs, "expected %v within %v of %v", actual, delta, expected)
-	}
-}
-
-func toFloat(v any) (float64, bool) {
-	rv := reflect.ValueOf(v)
-	switch rv.Kind() {
-	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
-		return float64(rv.Int()), true
-	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-		return float64(rv.Uint()), true
-	case reflect.Float32, reflect.Float64:
-		return rv.Float(), true
-	}
-	return 0, false
-}
-
-// Regexp fails the test unless s matches the pattern (compiled with
-// regexp.MustCompile).
-func Regexp(t testing.TB, pattern, s string, msgAndArgs ...any) {
-	t.Helper()
-	if !regexp.MustCompile(pattern).MatchString(s) {
-		fatalf(t, msgAndArgs, "%q does not match pattern %q", s, pattern)
-	}
-}
-
-// ElementsMatch fails the test unless want and got contain the same elements
-// the same number of times, ignoring order.
-//
-// ponytail: O(n²) multiset compare via DeepEqual — fine for test-sized lists,
-// revisit if a caller ever passes thousands of elements.
-func ElementsMatch[A any](t testing.TB, want, got []A, msgAndArgs ...any) {
-	t.Helper()
-	if len(want) != len(got) {
-		fatalf(t, msgAndArgs, "element count differs: want %d, got %d\nwant: %#v\ngot:  %#v", len(want), len(got), want, got)
-		return
-	}
-	used := make([]bool, len(got))
-outer:
-	for _, w := range want {
-		for i, g := range got {
-			if !used[i] && reflect.DeepEqual(w, g) {
-				used[i] = true
-				continue outer
-			}
-		}
-		fatalf(t, msgAndArgs, "missing element %#v\nwant: %#v\ngot:  %#v", w, want, got)
-		return
-	}
-}
-
-// Less fails the test unless a < b.
-func Less[A ~int | ~int64 | ~float64 | ~string](t testing.TB, a, b A, msgAndArgs ...any) {
-	t.Helper()
-	if a >= b {
-		fatalf(t, msgAndArgs, "expected %v < %v", a, b)
-	}
-}
-
-// Greater fails the test unless a > b.
-func Greater[A ~int | ~int64 | ~float64 | ~string](t testing.TB, a, b A, msgAndArgs ...any) {
-	t.Helper()
-	if a <= b {
-		fatalf(t, msgAndArgs, "expected %v > %v", a, b)
-	}
-}
-
-// GreaterOrEqual fails the test unless a >= b.
-func GreaterOrEqual[A ~int | ~int64 | ~float64 | ~string](t testing.TB, a, b A, msgAndArgs ...any) {
-	t.Helper()
-	if a < b {
-		fatalf(t, msgAndArgs, "expected %v >= %v", a, b)
-	}
-}
-
-// Eventually polls cond every tick until it returns true, failing the test
-// if it hasn't within waitFor.
-func Eventually(t testing.TB, cond func() bool, waitFor, tick time.Duration, msgAndArgs ...any) {
-	t.Helper()
-	deadline := time.Now().Add(waitFor)
-	for {
-		if cond() {
-			return
-		}
-		if time.Now().After(deadline) {
-			fatalf(t, msgAndArgs, "condition not met within %v", waitFor)
-			return
-		}
-		time.Sleep(tick)
-	}
-}
-
-// Never polls cond every tick for the full waitFor window, failing the test
-// if it ever returns true.
-func Never(t testing.TB, cond func() bool, waitFor, tick time.Duration, msgAndArgs ...any) {
-	t.Helper()
-	deadline := time.Now().Add(waitFor)
-	for time.Now().Before(deadline) {
-		if cond() {
-			fatalf(t, msgAndArgs, "condition unexpectedly became true within %v", waitFor)
-			return
-		}
-		time.Sleep(tick)
-	}
-}
-
-// FileExists fails the test unless path exists and is not a directory.
-func FileExists(t testing.TB, path string, msgAndArgs ...any) {
-	t.Helper()
-	info, err := os.Stat(path)
-	if err != nil {
-		fatalf(t, msgAndArgs, "expected file %q to exist: %v", path, err)
-		return
-	}
-	if info.IsDir() {
-		fatalf(t, msgAndArgs, "expected %q to be a file, it is a directory", path)
-	}
-}
-
-// NoFileExists fails the test if path exists as a file.
-func NoFileExists(t testing.TB, path string, msgAndArgs ...any) {
-	t.Helper()
-	info, err := os.Stat(path)
-	if err != nil {
-		return
-	}
-	if !info.IsDir() {
-		fatalf(t, msgAndArgs, "expected file %q to not exist", path)
-	}
-}
diff --git a/internal/must/must_test.go b/internal/must/must_test.go
deleted file mode 100644
index ddb1ad2d..00000000
--- a/internal/must/must_test.go
+++ /dev/null
@@ -1,249 +0,0 @@
-package must
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-)
-
-// fakeT records failures instead of failing the real test. Only the methods
-// the assertions use are implemented; anything else nil-panics loudly.
-type fakeT struct {
-	testing.TB
-	failed bool
-	msg    string
-}
-
-func (f *fakeT) Helper() {}
-
-func (f *fakeT) Fatal(args ...any) {
-	f.failed = true
-	f.msg = fmt.Sprint(args...)
-}
-
-func (f *fakeT) Fatalf(format string, args ...any) {
-	f.failed = true
-	f.msg = fmt.Sprintf(format, args...)
-}
-
-func TestEq(t *testing.T) {
-	t.Parallel()
-
-	ft := &fakeT{}
-	Eq(ft, []int{1, 2}, []int{1, 2})
-	if ft.failed {
-		t.Fatal("Eq failed on equal values")
-	}
-
-	ft = &fakeT{}
-	Eq(ft, []int{1, 2}, []int{1, 3})
-	if !ft.failed {
-		t.Fatal("Eq passed on unequal values")
-	}
-	if !strings.Contains(ft.msg, "-want +got") {
-		t.Fatalf("Eq failure should carry a diff, got %q", ft.msg)
-	}
-}
-
-func TestMessageRendering(t *testing.T) {
-	t.Parallel()
-
-	ft := &fakeT{}
-	True(ft, false, "context %d", 42)
-	if !strings.Contains(ft.msg, "context 42") {
-		t.Fatalf("trailing msgAndArgs should be rendered, got %q", ft.msg)
-	}
-
-	ft = &fakeT{}
-	True(ft, false, "plain message")
-	if !strings.Contains(ft.msg, "plain message") {
-		t.Fatalf("lone message should be rendered, got %q", ft.msg)
-	}
-}
-
-func TestNilHandlesTypedNil(t *testing.T) {
-	t.Parallel()
-
-	var p *int
-	cases := map[string]struct {
-		v       any
-		wantNil bool
-	}{
-		"untyped nil":           {nil, true},
-		"typed nil pointer":     {p, true},
-		"nil slice":             {[]int(nil), true},
-		"nil map":               {map[string]int(nil), true},
-		"non-nil value":         {42, false},
-		"non-nil pointer":       {new(int), false},
-		"empty non-nil slice":   {[]int{}, false},
-		"zero non-pointer kind": {0, false},
-	}
-	for name, tc := range cases {
-		ft := &fakeT{}
-		Nil(ft, tc.v)
-		if ft.failed == tc.wantNil {
-			t.Errorf("%s: Nil failed=%v, want failure=%v", name, ft.failed, !tc.wantNil)
-		}
-		ft = &fakeT{}
-		NotNil(ft, tc.v)
-		if ft.failed != tc.wantNil {
-			t.Errorf("%s: NotNil failed=%v, want failure=%v", name, ft.failed, tc.wantNil)
-		}
-	}
-}
-
-// TestAssertions table-drives the pass/fail behavior of the simpler
-// assertions: each case runs the assertion against a fakeT and checks
-// whether it failed.
-func TestAssertions(t *testing.T) {
-	t.Parallel()
-
-	sentinel := errors.New("sentinel")
-	wrapped := fmt.Errorf("outer: %w", sentinel)
-
-	cases := map[string]struct {
-		run      func(t testing.TB)
-		wantFail bool
-	}{
-		"True ok":            {func(t testing.TB) { True(t, true) }, false},
-		"True bad":           {func(t testing.TB) { True(t, false) }, true},
-		"False ok":           {func(t testing.TB) { False(t, false) }, false},
-		"False bad":          {func(t testing.TB) { False(t, true) }, true},
-		"NoError ok":         {func(t testing.TB) { NoError(t, nil) }, false},
-		"NoError bad":        {func(t testing.TB) { NoError(t, sentinel) }, true},
-		"Error ok":           {func(t testing.TB) { Error(t, sentinel) }, false},
-		"Error bad":          {func(t testing.TB) { Error(t, nil) }, true},
-		"ErrorIs ok":         {func(t testing.TB) { ErrorIs(t, wrapped, sentinel) }, false},
-		"ErrorIs bad":        {func(t testing.TB) { ErrorIs(t, errors.New("other"), sentinel) }, true},
-		"NotEq ok":           {func(t testing.TB) { NotEq(t, 1, 2) }, false},
-		"NotEq bad":          {func(t testing.TB) { NotEq(t, 1, 1) }, true},
-		"Contains string ok": {func(t testing.TB) { Contains(t, "hello world", "world") }, false},
-		"Contains string bad": {func(t testing.TB) {
-			Contains(t, "hello world", "mars")
-		}, true},
-		"Contains slice ok":    {func(t testing.TB) { Contains(t, []string{"a", "b"}, "b") }, false},
-		"Contains slice bad":   {func(t testing.TB) { Contains(t, []string{"a", "b"}, "c") }, true},
-		"Contains map key ok":  {func(t testing.TB) { Contains(t, map[string]int{"k": 1}, "k") }, false},
-		"Contains map key bad": {func(t testing.TB) { Contains(t, map[string]int{"k": 1}, "x") }, true},
-		"NotContains ok":       {func(t testing.TB) { NotContains(t, "hello", "mars") }, false},
-		"NotContains bad":      {func(t testing.TB) { NotContains(t, "hello", "ell") }, true},
-		"Empty string ok":      {func(t testing.TB) { Empty(t, "") }, false},
-		"Empty string bad":     {func(t testing.TB) { Empty(t, "x") }, true},
-		"Empty slice ok":       {func(t testing.TB) { Empty(t, []int{}) }, false},
-		"Empty nil ok":         {func(t testing.TB) { Empty(t, nil) }, false},
-		"NotEmpty ok":          {func(t testing.TB) { NotEmpty(t, "x") }, false},
-		"NotEmpty bad":         {func(t testing.TB) { NotEmpty(t, "") }, true},
-		"Len ok":               {func(t testing.TB) { Len(t, []int{1, 2}, 2) }, false},
-		"Len bad":              {func(t testing.TB) { Len(t, []int{1, 2}, 3) }, true},
-		"InDelta ok":           {func(t testing.TB) { InDelta(t, 1, 1.0, 0) }, false},
-		"InDelta mixed ok":     {func(t testing.TB) { InDelta(t, 252, float64(252), 0) }, false},
-		"InDelta bad":          {func(t testing.TB) { InDelta(t, 1, 2, 0.5) }, true},
-		"Regexp ok":            {func(t testing.TB) { Regexp(t, `wor\w+`, "hello world") }, false},
-		"Regexp bad":           {func(t testing.TB) { Regexp(t, `^world`, "hello world") }, true},
-		"ElementsMatch ok": {func(t testing.TB) {
-			ElementsMatch(t, []string{"a", "b", "b"}, []string{"b", "a", "b"})
-		}, false},
-		"ElementsMatch count bad": {func(t testing.TB) {
-			ElementsMatch(t, []string{"a"}, []string{"a", "a"})
-		}, true},
-		"ElementsMatch multiset bad": {func(t testing.TB) {
-			ElementsMatch(t, []string{"a", "a"}, []string{"a", "b"})
-		}, true},
-		"Less ok":            {func(t testing.TB) { Less(t, 1, 2) }, false},
-		"Less bad":           {func(t testing.TB) { Less(t, 2, 2) }, true},
-		"Greater ok":         {func(t testing.TB) { Greater(t, 2, 1) }, false},
-		"Greater bad":        {func(t testing.TB) { Greater(t, 1, 2) }, true},
-		"GreaterOrEqual ok":  {func(t testing.TB) { GreaterOrEqual(t, 2, 2) }, false},
-		"GreaterOrEqual bad": {func(t testing.TB) { GreaterOrEqual(t, 1, 2) }, true},
-	}
-	for name, tc := range cases {
-		ft := &fakeT{}
-		tc.run(ft)
-		if ft.failed != tc.wantFail {
-			t.Errorf("%s: failed=%v, want %v (msg: %s)", name, ft.failed, tc.wantFail, ft.msg)
-		}
-	}
-}
-
-func TestErrorAs(t *testing.T) {
-	t.Parallel()
-
-	pathErr := &os.PathError{Op: "open", Path: "/nope", Err: os.ErrNotExist}
-	wrapped := fmt.Errorf("outer: %w", pathErr)
-
-	ft := &fakeT{}
-	var target *os.PathError
-	ErrorAs(ft, wrapped, &target)
-	if ft.failed {
-		t.Fatal("ErrorAs failed on matching chain")
-	}
-
-	ft = &fakeT{}
-	var other *os.LinkError
-	ErrorAs(ft, wrapped, &other)
-	if !ft.failed {
-		t.Fatal("ErrorAs passed on non-matching chain")
-	}
-}
-
-func TestEventuallyAndNever(t *testing.T) {
-	t.Parallel()
-
-	ft := &fakeT{}
-	n := 0
-	Eventually(ft, func() bool { n++; return n >= 3 }, time.Second, time.Millisecond)
-	if ft.failed {
-		t.Fatal("Eventually failed on condition that becomes true")
-	}
-
-	ft = &fakeT{}
-	Eventually(ft, func() bool { return false }, 10*time.Millisecond, time.Millisecond)
-	if !ft.failed {
-		t.Fatal("Eventually passed on condition that never becomes true")
-	}
-
-	ft = &fakeT{}
-	Never(ft, func() bool { return false }, 10*time.Millisecond, time.Millisecond)
-	if ft.failed {
-		t.Fatal("Never failed on condition that stays false")
-	}
-
-	ft = &fakeT{}
-	Never(ft, func() bool { return true }, time.Second, time.Millisecond)
-	if !ft.failed {
-		t.Fatal("Never passed on condition that becomes true")
-	}
-}
-
-func TestFileExists(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	file := filepath.Join(dir, "f.txt")
-	if err := os.WriteFile(file, []byte("x"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	cases := map[string]struct {
-		run      func(t testing.TB)
-		wantFail bool
-	}{
-		"FileExists ok":         {func(t testing.TB) { FileExists(t, file) }, false},
-		"FileExists missing":    {func(t testing.TB) { FileExists(t, filepath.Join(dir, "nope")) }, true},
-		"FileExists dir":        {func(t testing.TB) { FileExists(t, dir) }, true},
-		"NoFileExists ok":       {func(t testing.TB) { NoFileExists(t, filepath.Join(dir, "nope")) }, false},
-		"NoFileExists bad":      {func(t testing.TB) { NoFileExists(t, file) }, true},
-		"NoFileExists dir okay": {func(t testing.TB) { NoFileExists(t, dir) }, false},
-	}
-	for name, tc := range cases {
-		ft := &fakeT{}
-		tc.run(ft)
-		if ft.failed != tc.wantFail {
-			t.Errorf("%s: failed=%v, want %v", name, ft.failed, tc.wantFail)
-		}
-	}
-}
diff --git a/internal/output/envelope_sink_test.go b/internal/output/envelope_sink_test.go
index 5e475728..b9801a53 100644
--- a/internal/output/envelope_sink_test.go
+++ b/internal/output/envelope_sink_test.go
@@ -5,8 +5,8 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/internal/snap"
+	"github.com/stretchr/testify/require"
 )
 
 func TestEnvelopeSink_SuccessWithNoEvents(t *testing.T) {
@@ -44,10 +44,10 @@ func TestEnvelopeSink_EmulatorStoppedEventAccumulates(t *testing.T) {
 
 	envelope := sink.Result("stop", nil)
 	data, ok := envelope.Data.(map[string]any)
-	must.True(t, ok)
+	require.True(t, ok)
 	entries, ok := data["emulators"].([]JsonEmulatorEntry)
-	must.True(t, ok)
-	must.Eq(t, []JsonEmulatorEntry{
+	require.True(t, ok)
+	require.Equal(t, []JsonEmulatorEntry{
 		JsonStoppedEmulator{JsonEmulatorRef: JsonEmulatorRef{Type: "aws", Name: "localstack-aws"}, WasRunning: true},
 		JsonStoppedEmulator{JsonEmulatorRef: JsonEmulatorRef{Type: "snowflake", Name: "localstack-snowflake"}, WasRunning: true},
 	}, entries)
@@ -98,7 +98,7 @@ func TestEnvelopeSink_UpdateCheckedEnvelopeJSON(t *testing.T) {
 
 	envelope := sink.Result("update", nil)
 	raw, err := json.Marshal(envelope)
-	must.NoError(t, err)
+	require.NoError(t, err)
 	snap.MatchJSON(t, raw, "data.currentVersion", "data.latestVersion")
 }
 
@@ -153,10 +153,10 @@ func TestEnvelopeSink_ErrorEventSetsClassifiedError(t *testing.T) {
 	})
 
 	envelope := sink.Result("reset", errors.New("LocalStack is not running"))
-	must.Eq(t, StatusError, envelope.Status)
-	must.Nil(t, envelope.Data)
-	must.NotNil(t, envelope.Error)
-	must.Eq(t, &EnvelopeError{
+	require.Equal(t, StatusError, envelope.Status)
+	require.Nil(t, envelope.Data)
+	require.NotNil(t, envelope.Error)
+	require.Equal(t, &EnvelopeError{
 		Code:      ErrEmulatorNotRunning,
 		Category:  CategoryEmulator,
 		Message:   "LocalStack is not running",
diff --git a/internal/output/snapshot_sanitize_test.go b/internal/output/snapshot_sanitize_test.go
index 201cca5d..711071df 100644
--- a/internal/output/snapshot_sanitize_test.go
+++ b/internal/output/snapshot_sanitize_test.go
@@ -31,13 +31,13 @@ func TestSanitizeSnapshot(t *testing.T) {
 	t.Parallel()
 
 	cases := map[string]string{
-		"• Version: 4.14.1":            "• Version: <version>",
-		"• Version: v2.3.0-rc1":        "• Version: <version>",
-		"• Uptime: 4m 23s":             "• Uptime: <time>",
-		"• Uptime: 1h 2m 3s":           "• Uptime: <time>",
-		"• Uptime: 42s":                "• Uptime: <time>",
-		"• Endpoint: 127.0.0.1:4566":   "• Endpoint: 127.0.0.1:4566",
-		"plain text untouched":         "plain text untouched",
+		"• Version: 4.14.1":          "• Version: <version>",
+		"• Version: v2.3.0-rc1":      "• Version: <version>",
+		"• Uptime: 4m 23s":           "• Uptime: <time>",
+		"• Uptime: 1h 2m 3s":         "• Uptime: <time>",
+		"• Uptime: 42s":              "• Uptime: <time>",
+		"• Endpoint: 127.0.0.1:4566": "• Endpoint: 127.0.0.1:4566",
+		"plain text untouched":       "plain text untouched",
 		"• Version: 4.14.1\n• Uptime: 4m 23s\n• Container: localstack-aws": "• Version: <version>\n• Uptime: <time>\n• Container: localstack-aws",
 	}
 	for in, want := range cases {
diff --git a/test/integration/auth_token_precedence_test.go b/test/integration/auth_token_precedence_test.go
index a45fd44e..d8d40618 100644
--- a/test/integration/auth_token_precedence_test.go
+++ b/test/integration/auth_token_precedence_test.go
@@ -8,8 +8,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // seedStoredAuthToken writes a stored credential into the file-based keyring of
@@ -17,8 +17,8 @@ import (
 func seedStoredAuthToken(t *testing.T, home, token string) {
 	t.Helper()
 	configDir := expectedOSConfigDir(home, "")
-	must.NoError(t, os.MkdirAll(configDir, 0700))
-	must.NoError(t, os.WriteFile(filepath.Join(configDir, "auth-token"), []byte(token), 0600))
+	require.NoError(t, os.MkdirAll(configDir, 0700))
+	require.NoError(t, os.WriteFile(filepath.Join(configDir, "auth-token"), []byte(token), 0600))
 }
 
 func basicAuthHeader(token string) string {
@@ -43,11 +43,11 @@ func TestEnvAuthTokenOverridesStoredToken(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ,
 		"--non-interactive", "snapshot", "list",
 	)
-	must.NoError(t, err, "lstk snapshot list failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot list failed: %s", stderr)
 
 	called, _, auth := cap.get()
-	must.True(t, called, "the platform list endpoint should have been called")
-	must.Eq(t, basicAuthHeader("env-token"), auth, "LOCALSTACK_AUTH_TOKEN should override the stored token")
+	require.True(t, called, "the platform list endpoint should have been called")
+	require.Equal(t, basicAuthHeader("env-token"), auth, "LOCALSTACK_AUTH_TOKEN should override the stored token")
 }
 
 func TestStoredTokenUsedWithoutEnvAuthToken(t *testing.T) {
@@ -66,11 +66,11 @@ func TestStoredTokenUsedWithoutEnvAuthToken(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ,
 		"--non-interactive", "snapshot", "list",
 	)
-	must.NoError(t, err, "lstk snapshot list failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot list failed: %s", stderr)
 
 	called, _, auth := cap.get()
-	must.True(t, called, "the platform list endpoint should have been called")
-	must.Eq(t, basicAuthHeader("stored-token"), auth, "the stored token should be used when no env token is set")
+	require.True(t, called, "the platform list endpoint should have been called")
+	require.Equal(t, basicAuthHeader("stored-token"), auth, "the stored token should be used when no env token is set")
 }
 
 func TestEnvAuthTokenOverridesStoredTokenForExternalEmulator(t *testing.T) {
@@ -101,11 +101,11 @@ func TestEnvAuthTokenOverridesStoredTokenForExternalEmulator(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ,
 		"--non-interactive", "--endpoint-url", srv.URL, "snapshot", "load", "pod:my-baseline",
 	)
-	must.NoError(t, err, "lstk snapshot load failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot load failed: %s", stderr)
 
 	select {
 	case auth := <-authHeader:
-		must.Eq(t, basicAuthHeader("env-token"), auth, "LOCALSTACK_AUTH_TOKEN should override the stored token")
+		require.Equal(t, basicAuthHeader("env-token"), auth, "LOCALSTACK_AUTH_TOKEN should override the stored token")
 	default:
 		t.Fatal("the external emulator pod endpoint should have been called")
 	}
diff --git a/test/integration/aws_cmd_test.go b/test/integration/aws_cmd_test.go
index ac785eb8..b097d151 100644
--- a/test/integration/aws_cmd_test.go
+++ b/test/integration/aws_cmd_test.go
@@ -8,9 +8,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/require"
 )
 
 // writeFakeAWS creates a fake `aws` that prints its args and env vars.
@@ -49,10 +49,10 @@ func writeFakeAWS(t *testing.T) string {
 func writeAWSProfile(t *testing.T, homeDir string) {
 	t.Helper()
 	awsDir := filepath.Join(homeDir, ".aws")
-	must.NoError(t, os.MkdirAll(awsDir, 0700))
-	must.NoError(t, os.WriteFile(filepath.Join(awsDir, "config"),
+	require.NoError(t, os.MkdirAll(awsDir, 0700))
+	require.NoError(t, os.WriteFile(filepath.Join(awsDir, "config"),
 		[]byte("[profile localstack]\nregion = us-east-1\noutput = json\nendpoint_url = http://localhost.localstack.cloud:4566\n"), 0600))
-	must.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
+	require.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
 		[]byte("[localstack]\naws_access_key_id = test\naws_secret_access_key = test\n"), 0600))
 }
 
@@ -70,10 +70,10 @@ func TestAWSCommandInjectsEndpointAndArgs(t *testing.T) {
 		With(env.AnalyticsEndpoint, analyticsSrv.URL)
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	must.NoError(t, err, "lstk aws failed: %s", stderr)
+	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	must.Contains(t, stdout, "ENDPOINT:http://")
-	must.Contains(t, stdout, "ARGS:s3 ls")
+	require.Contains(t, stdout, "ENDPOINT:http://")
+	require.Contains(t, stdout, "ARGS:s3 ls")
 	assertCommandTelemetry(t, events, "aws", 0)
 }
 
@@ -90,16 +90,16 @@ func TestAWSCommandStripsGlobalFlagsFromPassthrough(t *testing.T) {
 
 	// --config must resolve to this file, not be forwarded to the aws binary.
 	configPath := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configPath, []byte("# lstk test config\n"), 0600))
+	require.NoError(t, os.WriteFile(configPath, []byte("# lstk test config\n"), 0600))
 
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(homeDir)
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "--config", configPath, "--non-interactive", "aws", "s3", "ls")
-	must.NoError(t, err, "lstk aws failed: %s", stderr)
+	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	must.Contains(t, stdout, "ARGS:s3 ls")
-	must.NotContains(t, stdout, "--config")
-	must.NotContains(t, stdout, "--non-interactive")
+	require.Contains(t, stdout, "ARGS:s3 ls")
+	require.NotContains(t, stdout, "--config")
+	require.NotContains(t, stdout, "--non-interactive")
 }
 
 func TestAWSCommandInjectsCredentials(t *testing.T) {
@@ -114,11 +114,11 @@ func TestAWSCommandInjectsCredentials(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "sts", "get-caller-identity")
-	must.NoError(t, err, "lstk aws failed: %s", stderr)
+	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=test")
-	must.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=test")
-	must.Contains(t, stdout, "AWS_DEFAULT_REGION=us-east-1")
+	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=test")
+	require.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=test")
+	require.Contains(t, stdout, "AWS_DEFAULT_REGION=us-east-1")
 }
 
 func TestAWSCommandRespectsExistingCredentials(t *testing.T) {
@@ -138,11 +138,11 @@ func TestAWSCommandRespectsExistingCredentials(t *testing.T) {
 		With("AWS_DEFAULT_REGION", "eu-west-1")
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	must.NoError(t, err, "lstk aws failed: %s", stderr)
+	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=custom-key")
-	must.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=custom-secret")
-	must.Contains(t, stdout, "AWS_DEFAULT_REGION=eu-west-1")
+	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=custom-key")
+	require.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=custom-secret")
+	require.Contains(t, stdout, "AWS_DEFAULT_REGION=eu-west-1")
 }
 
 // The profile is selected through AWS_PROFILE, never a --profile argument: an
@@ -162,17 +162,17 @@ func TestAWSCommandUsesProfileWhenAvailable(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(homeDir)
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	must.NoError(t, err, "lstk aws failed: %s", stderr)
+	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	must.Contains(t, stdout, "AWS_PROFILE=localstack")
-	must.NotContains(t, stdout, "--profile")
+	require.Contains(t, stdout, "AWS_PROFILE=localstack")
+	require.NotContains(t, stdout, "--profile")
 	// The profile is the sole credentials source: lstk removes the variables
 	// rather than seeding over them (7.10).
-	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=<unset>")
-	must.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=<unset>")
-	must.Contains(t, stdout, "AWS_SESSION_TOKEN=<unset>")
+	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=<unset>")
+	require.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=<unset>")
+	require.Contains(t, stdout, "AWS_SESSION_TOKEN=<unset>")
 	// No default region is seeded over the profile's own (7.12).
-	must.Contains(t, stdout, "AWS_DEFAULT_REGION=<unset>")
+	require.Contains(t, stdout, "AWS_DEFAULT_REGION=<unset>")
 }
 
 // 7.1 — the path that already worked: with no profile configured, a 12-digit
@@ -191,9 +191,9 @@ func TestAWSCommandAccountFromEnvWithoutProfile(t *testing.T) {
 		With("AWS_ACCESS_KEY_ID", "111111111111")
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	must.NoError(t, err, "lstk aws failed: %s", stderr)
+	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
+	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
 }
 
 // 7.2 — the silent failure this change fixes: the same command stopped working
@@ -216,12 +216,12 @@ func TestAWSCommandAccountFromEnvWithProfile(t *testing.T) {
 		With("AWS_ACCESS_KEY_ID", "111111111111")
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	must.NoError(t, err, "lstk aws failed: %s", stderr)
+	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
-	must.NotContains(t, stdout, "--profile")
+	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
+	require.NotContains(t, stdout, "--profile")
 	// The profile is still selected, so its other settings keep applying.
-	must.Contains(t, stdout, "AWS_PROFILE=localstack")
+	require.Contains(t, stdout, "AWS_PROFILE=localstack")
 }
 
 // 7.3 — the flag, with the profile present so the bypass path is exercised.
@@ -239,16 +239,16 @@ func TestAWSCommandAccountFlag(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(homeDir)
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "--account", "111111111111", "s3", "ls")
-	must.NoError(t, err, "lstk aws failed: %s", stderr)
+	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
+	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
 	// The flag is lstk's: it must not reach the AWS CLI.
-	must.Contains(t, stdout, "ARGS:s3 ls")
+	require.Contains(t, stdout, "ARGS:s3 ls")
 	// A secret is always supplied alongside the key — a lone access key id
 	// makes the AWS CLI fail with "Partial credentials found in env" (7.11).
-	must.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=test")
+	require.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=test")
 	// No default region is seeded over the profile's own (7.12).
-	must.Contains(t, stdout, "AWS_DEFAULT_REGION=<unset>")
+	require.Contains(t, stdout, "AWS_DEFAULT_REGION=<unset>")
 }
 
 // 7.4
@@ -266,10 +266,10 @@ func TestAWSCommandAccountFlagBeatsEnv(t *testing.T) {
 		With("AWS_ACCESS_KEY_ID", "111111111111")
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "--account=222222222222", "s3", "ls")
-	must.NoError(t, err, "lstk aws failed: %s", stderr)
+	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=222222222222")
-	must.NotContains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
+	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=222222222222")
+	require.NotContains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
 }
 
 // 7.9 — a real key in the environment is not an account selection: the profile
@@ -293,14 +293,14 @@ func TestAWSCommandRealAccessKeyDoesNotDisplaceProfile(t *testing.T) {
 		With("AWS_SESSION_TOKEN", "realtoken")
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	must.NoError(t, err, "lstk aws failed: %s", stderr)
+	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	must.Contains(t, stdout, "AWS_PROFILE=localstack")
-	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=<unset>")
-	must.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=<unset>")
-	must.Contains(t, stdout, "AWS_SESSION_TOKEN=<unset>")
-	must.NotContains(t, stdout, "AKIAIOSFODNN7EXAMPLE")
-	must.NotContains(t, stdout, "realsecret")
+	require.Contains(t, stdout, "AWS_PROFILE=localstack")
+	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=<unset>")
+	require.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=<unset>")
+	require.Contains(t, stdout, "AWS_SESSION_TOKEN=<unset>")
+	require.NotContains(t, stdout, "AKIAIOSFODNN7EXAMPLE")
+	require.NotContains(t, stdout, "realsecret")
 }
 
 // 7.9 (no-profile half) — with nothing else to supply credentials the key is
@@ -320,11 +320,11 @@ func TestAWSCommandDeactivatesRealAccessKeyWithoutProfile(t *testing.T) {
 		With("AWS_SESSION_TOKEN", "realtoken")
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	must.NoError(t, err, "lstk aws failed: %s", stderr)
+	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=LKIAIOSFODNN7EXAMPLE")
-	must.NotContains(t, stdout, "AKIAIOSFODNN7EXAMPLE")
-	must.Contains(t, stdout, "AWS_SESSION_TOKEN=<unset>")
+	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=LKIAIOSFODNN7EXAMPLE")
+	require.NotContains(t, stdout, "AKIAIOSFODNN7EXAMPLE")
+	require.Contains(t, stdout, "AWS_SESSION_TOKEN=<unset>")
 }
 
 // 7.7 — a --account after the AWS service belongs to the AWS CLI
@@ -340,10 +340,10 @@ func TestAWSCommandForwardsNonLeadingAccountFlag(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls", "--account", "111111111111")
-	must.NoError(t, err, "lstk aws failed: %s", stderr)
+	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	must.Contains(t, stdout, "ARGS:s3 ls --account 111111111111")
-	must.Contains(t, stdout, "AWS_ACCESS_KEY_ID=test")
+	require.Contains(t, stdout, "ARGS:s3 ls --account 111111111111")
+	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=test")
 }
 
 // 7.8 — --region is the AWS CLI's own flag and is never consumed by lstk, even
@@ -359,9 +359,9 @@ func TestAWSCommandForwardsRegionFlag(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "--region", "us-west-2", "s3", "ls")
-	must.NoError(t, err, "lstk aws failed: %s", stderr)
+	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	must.Contains(t, stdout, "ARGS:--region us-west-2 s3 ls")
+	require.Contains(t, stdout, "ARGS:--region us-west-2 s3 ls")
 }
 
 // 7.5 — rejected at the command boundary, before the AWS CLI is invoked. No
@@ -373,10 +373,10 @@ func TestAWSCommandRejectsInvalidAccount(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "--account", "12345", "s3", "ls")
-	must.Error(t, err)
-	must.Contains(t, stdout, "12-digit AWS account id")
+	require.Error(t, err)
+	require.Contains(t, stdout, "12-digit AWS account id")
 	// The AWS CLI must not have run.
-	must.NotContains(t, stdout, "ARGS:")
+	require.NotContains(t, stdout, "ARGS:")
 }
 
 // 7.5 (missing value)
@@ -387,9 +387,9 @@ func TestAWSCommandRejectsAccountWithoutValue(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "--account")
-	must.Error(t, err)
-	must.Contains(t, stdout, "--account requires a value")
-	must.NotContains(t, stdout, "ARGS:")
+	require.Error(t, err)
+	require.Contains(t, stdout, "--account requires a value")
+	require.NotContains(t, stdout, "ARGS:")
 }
 
 // 7.6 — a flag before the `aws` token would be eaten during Cobra's command
@@ -401,9 +401,9 @@ func TestAWSCommandRejectsPreSubcommandAccount(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "--account", "111111111111", "aws", "s3", "ls")
-	must.Error(t, err)
-	must.Contains(t, stdout, "must appear after the aws subcommand")
-	must.NotContains(t, stdout, "ARGS:")
+	require.Error(t, err)
+	require.Contains(t, stdout, "must appear after the aws subcommand")
+	require.NotContains(t, stdout, "ARGS:")
 }
 
 // The leading flag is consumed before the help short-circuit, so help still
@@ -415,9 +415,9 @@ func TestAWSCommandAccountWithHelp(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "--account", "111111111111", "help")
-	must.NoError(t, err, "lstk aws help failed: %s", stderr)
+	require.NoError(t, err, "lstk aws help failed: %s", stderr)
 
-	must.NotContains(t, stdout, "--account")
+	require.NotContains(t, stdout, "--account")
 }
 
 func TestAWSCommandFailsWhenAWSCLINotInstalled(t *testing.T) {
@@ -425,10 +425,10 @@ func TestAWSCommandFailsWhenAWSCLINotInstalled(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).WithHome(t.TempDir())
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "s3", "ls")
-	must.Error(t, err)
-	must.Contains(t, stdout, "aws CLI not found in PATH")
-	must.Contains(t, stdout, "Install AWS CLI:")
-	must.Contains(t, stdout, "https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html")
+	require.Error(t, err)
+	require.Contains(t, stdout, "aws CLI not found in PATH")
+	require.Contains(t, stdout, "Install AWS CLI:")
+	require.Contains(t, stdout, "https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html")
 }
 
 func TestAWSCommandUsesDefaultPortWithoutConfig(t *testing.T) {
@@ -445,9 +445,9 @@ func TestAWSCommandUsesDefaultPortWithoutConfig(t *testing.T) {
 		WithHome(t.TempDir()) // isolate from any real config file
 
 	stdout, stderr, err := runLstk(t, ctx, workDir, e, "aws", "s3", "ls")
-	must.NoError(t, err, "lstk aws failed: %s", stderr)
+	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	must.Contains(t, stdout, ":4566")
+	require.Contains(t, stdout, ":4566")
 }
 
 func TestAWSCommandUsesPortFromConfig(t *testing.T) {
@@ -467,15 +467,15 @@ tag = "latest"
 port = "4599"
 `
 	lstkDir := filepath.Join(workDir, ".lstk")
-	must.NoError(t, os.MkdirAll(lstkDir, 0755))
-	must.NoError(t, os.WriteFile(filepath.Join(lstkDir, "config.toml"), []byte(configContent), 0644))
+	require.NoError(t, os.MkdirAll(lstkDir, 0755))
+	require.NoError(t, os.WriteFile(filepath.Join(lstkDir, "config.toml"), []byte(configContent), 0644))
 
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir)
 
 	stdout, stderr, err := runLstk(t, ctx, workDir, e, "aws", "s3", "ls")
-	must.NoError(t, err, "lstk aws failed: %s", stderr)
+	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	must.Contains(t, stdout, ":4599")
+	require.Contains(t, stdout, ":4599")
 }
 
 // writeFakeAWSFailing creates a fake `aws` that mimics a failing command.
@@ -499,8 +499,8 @@ func TestAWSCommandPropagatesExitCode(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir)
 
 	_, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	must.Error(t, err, "lstk aws should fail when aws command fails")
-	must.Contains(t, stderr, "simulated failure")
+	require.Error(t, err, "lstk aws should fail when aws command fails")
+	require.Contains(t, stderr, "simulated failure")
 	requireExitCode(t, 42, err)
 }
 
@@ -522,10 +522,10 @@ func TestAWSCommandHelpSkipsDockerAndEmulator(t *testing.T) {
 
 			cmdArgs := append([]string{"aws"}, args...)
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, cmdArgs...)
-			must.NoError(t, err, "stderr: %s", stderr)
+			require.NoError(t, err, "stderr: %s", stderr)
 
-			must.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
-			must.NotContains(t, stdout, "--endpoint-url")
+			require.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
+			require.NotContains(t, stdout, "--endpoint-url")
 		})
 	}
 }
@@ -541,8 +541,8 @@ func TestAWSCommandFailsWhenDockerNotRunning(t *testing.T) {
 		With(env.Key("DOCKER_HOST"), "tcp://localhost:1")
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "s3", "ls")
-	must.Error(t, err)
-	must.Contains(t, stdout, "Docker is not available")
+	require.Error(t, err)
+	require.Contains(t, stdout, "Docker is not available")
 }
 
 func TestAWSCommandFailsWhenEmulatorNotRunning(t *testing.T) {
@@ -556,10 +556,10 @@ func TestAWSCommandFailsWhenEmulatorNotRunning(t *testing.T) {
 		With(env.AnalyticsEndpoint, analyticsSrv.URL)
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "s3", "ls")
-	must.Error(t, err)
-	must.Contains(t, stdout, "is not running")
-	must.Contains(t, stdout, "Start LocalStack:")
-	must.Contains(t, stdout, "lstk")
+	require.Error(t, err)
+	require.Contains(t, stdout, "is not running")
+	require.Contains(t, stdout, "Start LocalStack:")
+	require.Contains(t, stdout, "lstk")
 	assertCommandTelemetry(t, events, "aws", 1)
 }
 
@@ -574,8 +574,8 @@ func TestAWSCommandHintsSetupCommandWhenProfileMissing(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	must.NoError(t, err)
-	must.Contains(t, stdout, "lstk setup aws")
+	require.NoError(t, err)
+	require.Contains(t, stdout, "lstk setup aws")
 }
 
 func TestAWSCommandWorksWithExternalContainer(t *testing.T) {
@@ -587,7 +587,7 @@ func TestAWSCommandWorksWithExternalContainer(t *testing.T) {
 
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -598,8 +598,8 @@ func TestAWSCommandWorksWithExternalContainer(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	must.NoError(t, err, "lstk aws should work with externally-named container: %s", stderr)
-	must.Contains(t, stdout, "ENDPOINT:http://")
+	require.NoError(t, err, "lstk aws should work with externally-named container: %s", stderr)
+	require.Contains(t, stdout, "ENDPOINT:http://")
 }
 
 // writeSlowFakeAWS creates a fake `aws` that sleeps for the given duration
@@ -627,12 +627,12 @@ func TestAWSCommandShowsSpinnerForSlowOperation(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(homeDir)
 
 	out, err := runLstkInPTY(t, ctx, e, "aws", "s3", "ls")
-	must.NoError(t, err, "lstk aws failed: %s", out)
+	require.NoError(t, err, "lstk aws failed: %s", out)
 
-	must.Contains(t, out, "Loading service")
-	must.Contains(t, out, "ARGS:s3 ls")
+	require.Contains(t, out, "Loading service")
+	require.Contains(t, out, "ARGS:s3 ls")
 	// lstk selects the profile via AWS_PROFILE, never a --profile argument.
-	must.NotContains(t, out, "--profile")
+	require.NotContains(t, out, "--profile")
 }
 
 func TestAWSCommandSuppressesSpinnerInNonInteractiveMode(t *testing.T) {
@@ -651,12 +651,12 @@ func TestAWSCommandSuppressesSpinnerInNonInteractiveMode(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(homeDir)
 
 	out, err := runLstkInPTY(t, ctx, e, "--non-interactive", "aws", "s3", "ls")
-	must.NoError(t, err, "lstk aws failed: %s", out)
+	require.NoError(t, err, "lstk aws failed: %s", out)
 
-	must.NotContains(t, out, "Loading service")
-	must.Contains(t, out, "ARGS:s3 ls")
+	require.NotContains(t, out, "Loading service")
+	require.Contains(t, out, "ARGS:s3 ls")
 	// lstk selects the profile via AWS_PROFILE, never a --profile argument.
-	must.NotContains(t, out, "--profile")
+	require.NotContains(t, out, "--profile")
 }
 
 func TestAWSCommandSuppressesSpinnerForFastOperation(t *testing.T) {
@@ -673,12 +673,12 @@ func TestAWSCommandSuppressesSpinnerForFastOperation(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(homeDir)
 
 	out, err := runLstkInPTY(t, ctx, e, "aws", "s3", "ls")
-	must.NoError(t, err, "lstk aws failed: %s", out)
+	require.NoError(t, err, "lstk aws failed: %s", out)
 
-	must.NotContains(t, out, "Loading service")
-	must.Contains(t, out, "ARGS:s3 ls")
+	require.NotContains(t, out, "Loading service")
+	require.Contains(t, out, "ARGS:s3 ls")
 	// lstk selects the profile via AWS_PROFILE, never a --profile argument.
-	must.NotContains(t, out, "--profile")
+	require.NotContains(t, out, "--profile")
 }
 
 func TestAWSCommandSuppressesHintWhenProfileExists(t *testing.T) {
@@ -695,6 +695,6 @@ func TestAWSCommandSuppressesHintWhenProfileExists(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(homeDir)
 
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
-	must.NoError(t, err)
-	must.NotContains(t, stdout, "lstk setup aws")
+	require.NoError(t, err)
+	require.NotContains(t, stdout, "lstk setup aws")
 }
diff --git a/test/integration/aws_completion_test.go b/test/integration/aws_completion_test.go
index 4ad6534e..f944a213 100644
--- a/test/integration/aws_completion_test.go
+++ b/test/integration/aws_completion_test.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
+	"github.com/stretchr/testify/require"
 
 	"github.com/localstack/lstk/test/integration/env"
 )
@@ -32,16 +32,16 @@ func TestAWSCompletionDelegatesToAWSCompleter(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "__complete", "aws", "s3", "l")
-	must.NoError(t, err, "stderr: %s", stderr)
+	require.NoError(t, err, "stderr: %s", stderr)
 
 	// The completer strips the first word of COMP_LINE and resolves the rest
 	// against the aws command tree, so lstk's own name must not be in it.
-	must.Contains(t, stdout, "compline=[aws s3 l]")
-	must.NotContains(t, stdout, "compline=[lstk")
+	require.Contains(t, stdout, "compline=[aws s3 l]")
+	require.NotContains(t, stdout, "compline=[lstk")
 
 	completions := strings.Fields(stdout)
-	must.Contains(t, completions, "ls")
-	must.Contains(t, completions, "list-buckets")
+	require.Contains(t, completions, "ls")
+	require.Contains(t, completions, "list-buckets")
 }
 
 // TestAWSCompletionAppendsTrailingSpaceForNewWord verifies the cursor position
@@ -54,9 +54,9 @@ func TestAWSCompletionAppendsTrailingSpaceForNewWord(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "__complete", "aws", "s3", "")
-	must.NoError(t, err, "stderr: %s", stderr)
+	require.NoError(t, err, "stderr: %s", stderr)
 
-	must.Contains(t, stdout, "compline=[aws s3 ]")
+	require.Contains(t, stdout, "compline=[aws s3 ]")
 }
 
 // TestAWSCompletionStripsGlobalFlags keeps lstk's own persistent flags out of
@@ -70,9 +70,9 @@ func TestAWSCompletionStripsGlobalFlags(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"__complete", "aws", "--non-interactive", "s3", "l")
-	must.NoError(t, err, "stderr: %s", stderr)
+	require.NoError(t, err, "stderr: %s", stderr)
 
-	must.Contains(t, stdout, "compline=[aws s3 l]")
+	require.Contains(t, stdout, "compline=[aws s3 l]")
 }
 
 // TestAWSCompletionNeedsNoDockerOrEmulator guards the property that makes this
@@ -88,10 +88,10 @@ func TestAWSCompletionNeedsNoDockerOrEmulator(t *testing.T) {
 		With(env.Key("DOCKER_HOST"), "tcp://localhost:1")
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "__complete", "aws", "s3", "l")
-	must.NoError(t, err, "stderr: %s", stderr)
+	require.NoError(t, err, "stderr: %s", stderr)
 
-	must.Contains(t, stdout, "ls")
-	must.NotContains(t, stdout, "Docker is not available")
+	require.Contains(t, stdout, "ls")
+	require.NotContains(t, stdout, "Docker is not available")
 }
 
 // TestAWSCompletionDegradesWhenCompleterMissing verifies a machine without
@@ -103,11 +103,11 @@ func TestAWSCompletionDegradesWhenCompleterMissing(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "__complete", "aws", "s3", "l")
-	must.NoError(t, err, "stderr: %s", stderr)
+	require.NoError(t, err, "stderr: %s", stderr)
 
 	// ShellCompDirectiveDefault (0) — hand the word back to the shell's own
 	// file completion rather than offering nothing at all.
-	must.Eq(t, ":0", strings.TrimSpace(stdout))
+	require.Equal(t, ":0", strings.TrimSpace(stdout))
 }
 
 // TestBashCompletionForAWSSubcommand drives the real generated bash script the
@@ -120,10 +120,10 @@ func TestBashCompletionForAWSSubcommand(t *testing.T) {
 	driver := completeInDriver(`lstk aws s3 l`, 3, "lstk aws s3 l")
 
 	stdout, stderr, err := runBashCompletionDriver(t, driver, fakeDir)
-	must.NoError(t, err, "completion attempt failed\nstdout: %s\nstderr: %s", stdout, stderr)
-	must.NotContains(t, stderr, "command not found")
+	require.NoError(t, err, "completion attempt failed\nstdout: %s\nstderr: %s", stdout, stderr)
+	require.NotContains(t, stderr, "command not found")
 
 	completions := strings.Fields(stdout)
-	must.Contains(t, completions, "ls")
-	must.Contains(t, completions, "list-buckets")
+	require.Contains(t, completions, "ls")
+	require.Contains(t, completions, "list-buckets")
 }
diff --git a/test/integration/aws_e2e_test.go b/test/integration/aws_e2e_test.go
index 892c5823..33b4ae7e 100644
--- a/test/integration/aws_e2e_test.go
+++ b/test/integration/aws_e2e_test.go
@@ -7,8 +7,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // End-to-end tests for `lstk aws` that exercise the real aws CLI against a real
@@ -47,12 +47,12 @@ func TestAWSLogsTailFollowStreamsInPTY(t *testing.T) {
 	const marker = "hello-tail-follow"
 
 	_, stderr, err := runLstk(t, ctx, "", e, "aws", "logs", "create-log-group", "--log-group-name", logGroup)
-	must.NoError(t, err, "create-log-group failed: %s", stderr)
+	require.NoError(t, err, "create-log-group failed: %s", stderr)
 	_, stderr, err = runLstk(t, ctx, "", e, "aws", "logs", "create-log-stream", "--log-group-name", logGroup, "--log-stream-name", "s1")
-	must.NoError(t, err, "create-log-stream failed: %s", stderr)
+	require.NoError(t, err, "create-log-stream failed: %s", stderr)
 	events := fmt.Sprintf("timestamp=%d,message=%s", time.Now().UnixMilli(), marker)
 	_, stderr, err = runLstk(t, ctx, "", e, "aws", "logs", "put-log-events", "--log-group-name", logGroup, "--log-stream-name", "s1", "--log-events", events)
-	must.NoError(t, err, "put-log-events failed: %s", stderr)
+	require.NoError(t, err, "put-log-events failed: %s", stderr)
 
 	p := startLstkInPTY(t, ctx, e, "aws", "logs", "tail", logGroup, "--follow", "--since", "1h")
 
@@ -82,6 +82,6 @@ func TestAWSLogsTailFollowStreamsInPTY(t *testing.T) {
 		<-waited
 	}
 
-	must.True(t, seen,
+	require.True(t, seen,
 		"tail --follow produced no output while running; event appeared only after exit (DEVX-1026). Output after exit:\n%s", p.output())
 }
diff --git a/test/integration/aws_profile_precedence_test.go b/test/integration/aws_profile_precedence_test.go
index 5dda9729..0480be09 100644
--- a/test/integration/aws_profile_precedence_test.go
+++ b/test/integration/aws_profile_precedence_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
+	"github.com/stretchr/testify/require"
 )
 
 // These tests do not exercise lstk. They pin the botocore behavior lstk's
@@ -33,11 +33,11 @@ func awsProfileFixture(t *testing.T) []string {
 	dir := t.TempDir()
 
 	configPath := filepath.Join(dir, "config")
-	must.NoError(t, os.WriteFile(configPath, []byte(
+	require.NoError(t, os.WriteFile(configPath, []byte(
 		"[profile localstack]\nregion = eu-west-1\noutput = table\n"), 0600))
 
 	credsPath := filepath.Join(dir, "credentials")
-	must.NoError(t, os.WriteFile(credsPath, []byte(
+	require.NoError(t, os.WriteFile(credsPath, []byte(
 		"[localstack]\naws_access_key_id = test\naws_secret_access_key = test\n"), 0600))
 
 	return []string{
@@ -79,7 +79,7 @@ func awsConfigureList(t *testing.T, extraEnv ...string) string {
 	cmd.Env = awsProbeEnv(extraEnv...)
 
 	out, err := cmd.CombinedOutput()
-	must.NoError(t, err, "aws configure list failed: %s", out)
+	require.NoError(t, err, "aws configure list failed: %s", out)
 	return string(out)
 }
 
@@ -97,9 +97,9 @@ func TestAWSProfileEnvVarLetsEnvironmentCredentialsWin(t *testing.T) {
 	)
 	out := awsConfigureList(t, e...)
 
-	must.Regexp(t, `access_key\s*:\s*\**1111\s*:\s*env`, out,
+	require.Regexp(t, `access_key\s*:\s*\**1111\s*:\s*env`, out,
 		"credentials must come from the environment under AWS_PROFILE")
-	must.Regexp(t, `region\s*:\s*eu-west-1\s*:\s*config-file`, out,
+	require.Regexp(t, `region\s*:\s*eu-west-1\s*:\s*config-file`, out,
 		"the profile must still supply the region")
 }
 
@@ -120,9 +120,9 @@ func TestAWSProfileFlagSuppressesEnvironmentCredentials(t *testing.T) {
 	)...)
 
 	out, err := cmd.CombinedOutput()
-	must.NoError(t, err, "aws configure list failed: %s", out)
+	require.NoError(t, err, "aws configure list failed: %s", out)
 
-	must.Regexp(t, `access_key\s*:\s*\**test\s*:\s*shared-credentials-file`, string(out),
+	require.Regexp(t, `access_key\s*:\s*\**test\s*:\s*shared-credentials-file`, string(out),
 		"--profile must suppress the environment credentials (the behavior lstk avoids)")
 }
 
@@ -139,7 +139,7 @@ func TestAWSEnvironmentRegionOverridesProfileRegion(t *testing.T) {
 	)
 	out := awsConfigureList(t, e...)
 
-	must.Regexp(t, `region\s*:\s*us-east-1\s*:\s*env`, out,
+	require.Regexp(t, `region\s*:\s*us-east-1\s*:\s*env`, out,
 		"an environment region outranks the profile's, so lstk must not seed one")
 }
 
@@ -155,5 +155,5 @@ func TestAWSProfileOutranksDefaultProfile(t *testing.T) {
 	)
 	out := awsConfigureList(t, e...)
 
-	must.Regexp(t, `region\s*:\s*eu-west-1\s*:\s*config-file`, out)
+	require.Regexp(t, `region\s*:\s*eu-west-1\s*:\s*config-file`, out)
 }
diff --git a/test/integration/awsconfig_test.go b/test/integration/awsconfig_test.go
index ee0e71d3..2fa7069a 100644
--- a/test/integration/awsconfig_test.go
+++ b/test/integration/awsconfig_test.go
@@ -9,8 +9,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // awsConfigEnv returns a base environment with the home directory set to an
@@ -58,19 +58,19 @@ func TestStartPromptsWhenAWSProfileMissingEverywhere(t *testing.T) {
 	p.write("y")
 
 	_, err := p.wait()
-	must.NoError(t, err, "lstk start should exit successfully")
+	require.NoError(t, err, "lstk start should exit successfully")
 
 	configContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "config"))
-	must.NoError(t, err, "~/.aws/config should have been created")
-	must.Contains(t, string(configContent), "[profile localstack]")
-	must.Contains(t, string(configContent), "endpoint_url")
+	require.NoError(t, err, "~/.aws/config should have been created")
+	require.Contains(t, string(configContent), "[profile localstack]")
+	require.Contains(t, string(configContent), "endpoint_url")
 
 	credsContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "credentials"))
-	must.NoError(t, err, "~/.aws/credentials should have been created")
+	require.NoError(t, err, "~/.aws/credentials should have been created")
 	normalizedCreds := strings.Join(strings.Fields(string(credsContent)), " ")
-	must.Contains(t, normalizedCreds, "[localstack]")
-	must.Contains(t, normalizedCreds, "aws_access_key_id = test")
-	must.Contains(t, normalizedCreds, "aws_secret_access_key = test")
+	require.Contains(t, normalizedCreds, "[localstack]")
+	require.Contains(t, normalizedCreds, "aws_access_key_id = test")
+	require.Contains(t, normalizedCreds, "aws_secret_access_key = test")
 }
 
 func TestStartSkipsAWSProfilePromptWhenAlreadyConfigured(t *testing.T) {
@@ -85,10 +85,10 @@ func TestStartSkipsAWSProfilePromptWhenAlreadyConfigured(t *testing.T) {
 
 	// Pre-write a valid LocalStack AWS profile in the isolated home.
 	awsDir := filepath.Join(tmpHome, ".aws")
-	must.NoError(t, os.MkdirAll(awsDir, 0700))
-	must.NoError(t, os.WriteFile(filepath.Join(awsDir, "config"),
+	require.NoError(t, os.MkdirAll(awsDir, 0700))
+	require.NoError(t, os.WriteFile(filepath.Join(awsDir, "config"),
 		[]byte("[profile localstack]\nregion = us-east-1\noutput = json\nendpoint_url = http://127.0.0.1:4566\n"), 0600))
-	must.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
+	require.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
 		[]byte("[localstack]\naws_access_key_id = test\naws_secret_access_key = test\n"), 0600))
 
 	ctx := testContext(t)
@@ -102,7 +102,7 @@ func TestStartSkipsAWSProfilePromptWhenAlreadyConfigured(t *testing.T) {
 	_ = p.cmd.Process.Kill()
 	out, _ := p.wait()
 
-	must.NotContains(t, out, awsSetupPrompt,
+	require.NotContains(t, out, awsSetupPrompt,
 		"profile prompt should not appear when profile is already correctly configured")
 }
 
@@ -122,9 +122,9 @@ func TestStartNonInteractiveEmitsNoteWhenAWSProfileMissing(t *testing.T) {
 		baseEnv.With(env.APIEndpoint, mockServer.URL),
 		"start",
 	)
-	must.NoError(t, err)
+	require.NoError(t, err)
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdout, "LocalStack AWS profile is incomplete. Run 'lstk setup aws'.")
+	require.Contains(t, stdout, "LocalStack AWS profile is incomplete. Run 'lstk setup aws'.")
 }
 
 func TestStartEmitsNoteWhenAWSProfileIsPartial(t *testing.T) {
@@ -138,8 +138,8 @@ func TestStartEmitsNoteWhenAWSProfileIsPartial(t *testing.T) {
 	defer mockServer.Close()
 
 	awsDir := filepath.Join(tmpHome, ".aws")
-	must.NoError(t, os.MkdirAll(awsDir, 0700))
-	must.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
+	require.NoError(t, os.MkdirAll(awsDir, 0700))
+	require.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
 		[]byte("[localstack]\naws_access_key_id = test\naws_secret_access_key = test\n"), 0600))
 
 	ctx := testContext(t)
@@ -148,9 +148,9 @@ func TestStartEmitsNoteWhenAWSProfileIsPartial(t *testing.T) {
 	p.waitForOutputTimeout("LocalStack AWS profile is incomplete. Run 'lstk setup aws'.", 2*time.Minute, "AWS profile note should appear")
 
 	out, err := p.wait()
-	must.NoError(t, err, "lstk start should exit successfully")
+	require.NoError(t, err, "lstk start should exit successfully")
 
-	must.NotContains(t, out, "Set up a LocalStack profile for AWS CLI and SDKs in ~/.aws?",
+	require.NotContains(t, out, "Set up a LocalStack profile for AWS CLI and SDKs in ~/.aws?",
 		"profile prompt should not appear for a partial setup")
 }
 
@@ -166,22 +166,22 @@ func TestSetupAWSCreatesAWSProfileWhenConfirmed(t *testing.T) {
 	p.write("y")
 
 	out, err := p.wait()
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	configContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "config"))
-	must.NoError(t, err, "~/.aws/config should have been created")
-	must.Contains(t, string(configContent), "[profile localstack]")
-	must.Contains(t, string(configContent), "endpoint_url")
+	require.NoError(t, err, "~/.aws/config should have been created")
+	require.Contains(t, string(configContent), "[profile localstack]")
+	require.Contains(t, string(configContent), "endpoint_url")
 
 	credsContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "credentials"))
-	must.NoError(t, err, "~/.aws/credentials should have been created")
+	require.NoError(t, err, "~/.aws/credentials should have been created")
 	normalizedCreds := strings.Join(strings.Fields(string(credsContent)), " ")
-	must.Contains(t, normalizedCreds, "[localstack]")
-	must.Contains(t, normalizedCreds, "aws_access_key_id = test")
-	must.Contains(t, normalizedCreds, "aws_secret_access_key = test")
+	require.Contains(t, normalizedCreds, "[localstack]")
+	require.Contains(t, normalizedCreds, "aws_access_key_id = test")
+	require.Contains(t, normalizedCreds, "aws_secret_access_key = test")
 
-	must.Contains(t, out, "Created LocalStack profile in ~/.aws")
-	must.NotContains(t, out, "Skipped adding LocalStack AWS profile.")
+	require.Contains(t, out, "Created LocalStack profile in ~/.aws")
+	require.NotContains(t, out, "Skipped adding LocalStack AWS profile.")
 }
 
 // TestSetupAWSExitsNonZeroWhenProfileWriteFails guards DEVX-941. Writing the
@@ -203,7 +203,7 @@ func TestSetupAWSExitsNonZeroWhenProfileWriteFails(t *testing.T) {
 	// A read-only ~/.aws keeps the profile files absent (so the prompt still appears)
 	// while making their creation fail inside upsertSection's SaveTo.
 	awsDir := filepath.Join(tmpHome, ".aws")
-	must.NoError(t, os.MkdirAll(awsDir, 0500))
+	require.NoError(t, os.MkdirAll(awsDir, 0500))
 	// Restore write permission before t.TempDir cleanup so the dir can be removed.
 	t.Cleanup(func() { _ = os.Chmod(awsDir, 0700) })
 
@@ -216,8 +216,8 @@ func TestSetupAWSExitsNonZeroWhenProfileWriteFails(t *testing.T) {
 	out, err := p.wait()
 	requireExitCode(t, 1, err)
 
-	must.Contains(t, out, "Could not set up the LocalStack AWS profile")
-	must.NotContains(t, out, "Created LocalStack profile")
+	require.Contains(t, out, "Could not set up the LocalStack AWS profile")
+	require.NotContains(t, out, "Created LocalStack profile")
 }
 
 func TestSetupAWSDoesNotCreateAWSProfileWhenDeclined(t *testing.T) {
@@ -231,15 +231,15 @@ func TestSetupAWSDoesNotCreateAWSProfileWhenDeclined(t *testing.T) {
 	p.write("n")
 
 	out, err := p.wait()
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	_, err = os.Stat(filepath.Join(tmpHome, ".aws", "config"))
-	must.ErrorIs(t, err, os.ErrNotExist)
+	require.ErrorIs(t, err, os.ErrNotExist)
 	_, err = os.Stat(filepath.Join(tmpHome, ".aws", "credentials"))
-	must.ErrorIs(t, err, os.ErrNotExist)
+	require.ErrorIs(t, err, os.ErrNotExist)
 
-	must.Contains(t, out, "Skipped adding LocalStack AWS profile.")
-	must.NotContains(t, out, "Created LocalStack profile in ~/.aws/config")
+	require.Contains(t, out, "Skipped adding LocalStack AWS profile.")
+	require.NotContains(t, out, "Created LocalStack profile in ~/.aws/config")
 }
 
 func TestSetupAWSNonInteractiveCreatesProfile(t *testing.T) {
@@ -251,20 +251,20 @@ func TestSetupAWSNonInteractiveCreatesProfile(t *testing.T) {
 		"setup", "aws",
 	)
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdout, "Created LocalStack profile in ~/.aws")
-	must.NotContains(t, stdout, "requires an interactive terminal")
+	require.Contains(t, stdout, "Created LocalStack profile in ~/.aws")
+	require.NotContains(t, stdout, "requires an interactive terminal")
 
 	configContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "config"))
-	must.NoError(t, err, "~/.aws/config should have been created")
-	must.Contains(t, string(configContent), "[profile localstack]")
-	must.Contains(t, string(configContent), "endpoint_url")
+	require.NoError(t, err, "~/.aws/config should have been created")
+	require.Contains(t, string(configContent), "[profile localstack]")
+	require.Contains(t, string(configContent), "endpoint_url")
 
 	credsContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "credentials"))
-	must.NoError(t, err, "~/.aws/credentials should have been created")
+	require.NoError(t, err, "~/.aws/credentials should have been created")
 	normalizedCreds := strings.Join(strings.Fields(string(credsContent)), " ")
-	must.Contains(t, normalizedCreds, "[localstack]")
-	must.Contains(t, normalizedCreds, "aws_access_key_id = test")
-	must.Contains(t, normalizedCreds, "aws_secret_access_key = test")
+	require.Contains(t, normalizedCreds, "[localstack]")
+	require.Contains(t, normalizedCreds, "aws_access_key_id = test")
+	require.Contains(t, normalizedCreds, "aws_secret_access_key = test")
 }
 
 func TestSetupAWSNonInteractiveIsIdempotent(t *testing.T) {
@@ -279,7 +279,7 @@ func TestSetupAWSNonInteractiveIsIdempotent(t *testing.T) {
 	// not be treated as an overwrite (no --force required).
 	stdout, _, err := runLstk(t, testContext(t), "", baseEnv, "setup", "aws")
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdout, "already configured")
+	require.Contains(t, stdout, "already configured")
 }
 
 func TestSetupAWSNonInteractiveOverwriteRequiresForce(t *testing.T) {
@@ -288,23 +288,23 @@ func TestSetupAWSNonInteractiveOverwriteRequiresForce(t *testing.T) {
 
 	// Pre-seed a localstack profile with different values.
 	awsDir := filepath.Join(tmpHome, ".aws")
-	must.NoError(t, os.MkdirAll(awsDir, 0700))
-	must.NoError(t, os.WriteFile(filepath.Join(awsDir, "config"),
+	require.NoError(t, os.MkdirAll(awsDir, 0700))
+	require.NoError(t, os.WriteFile(filepath.Join(awsDir, "config"),
 		[]byte("[profile localstack]\nregion = us-east-1\noutput = json\nendpoint_url = http://example.com:9999\n"), 0600))
-	must.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
+	require.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
 		[]byte("[localstack]\naws_access_key_id = WRONG\naws_secret_access_key = WRONG\n"), 0600))
 
 	stdout, _, err := runLstk(t, testContext(t), "", baseEnv, "setup", "aws")
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "--force")
+	require.Contains(t, stdout, "--force")
 
 	// The existing profile must be left untouched.
 	configContent, err := os.ReadFile(filepath.Join(awsDir, "config"))
-	must.NoError(t, err)
-	must.Contains(t, string(configContent), "example.com:9999", "config must not be overwritten without --force")
+	require.NoError(t, err)
+	require.Contains(t, string(configContent), "example.com:9999", "config must not be overwritten without --force")
 	credsContent, err := os.ReadFile(filepath.Join(awsDir, "credentials"))
-	must.NoError(t, err)
-	must.Contains(t, string(credsContent), "WRONG", "credentials must not be overwritten without --force")
+	require.NoError(t, err)
+	require.Contains(t, string(credsContent), "WRONG", "credentials must not be overwritten without --force")
 }
 
 func TestSetupAWSNonInteractiveForceOverwrites(t *testing.T) {
@@ -312,22 +312,22 @@ func TestSetupAWSNonInteractiveForceOverwrites(t *testing.T) {
 	baseEnv, tmpHome := awsConfigEnv(t)
 
 	awsDir := filepath.Join(tmpHome, ".aws")
-	must.NoError(t, os.MkdirAll(awsDir, 0700))
-	must.NoError(t, os.WriteFile(filepath.Join(awsDir, "config"),
+	require.NoError(t, os.MkdirAll(awsDir, 0700))
+	require.NoError(t, os.WriteFile(filepath.Join(awsDir, "config"),
 		[]byte("[profile localstack]\nregion = us-east-1\noutput = json\nendpoint_url = http://example.com:9999\n"), 0600))
-	must.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
+	require.NoError(t, os.WriteFile(filepath.Join(awsDir, "credentials"),
 		[]byte("[localstack]\naws_access_key_id = WRONG\naws_secret_access_key = WRONG\n"), 0600))
 
 	_, _, err := runLstk(t, testContext(t), "", baseEnv, "setup", "aws", "--force")
 	requireExitCode(t, 0, err)
 
 	configContent, err := os.ReadFile(filepath.Join(awsDir, "config"))
-	must.NoError(t, err)
-	must.NotContains(t, string(configContent), "example.com", "--force should overwrite the stale endpoint")
-	must.Contains(t, string(configContent), "endpoint_url")
+	require.NoError(t, err)
+	require.NotContains(t, string(configContent), "example.com", "--force should overwrite the stale endpoint")
+	require.Contains(t, string(configContent), "endpoint_url")
 	credsContent, err := os.ReadFile(filepath.Join(awsDir, "credentials"))
-	must.NoError(t, err)
+	require.NoError(t, err)
 	normalizedCreds := strings.Join(strings.Fields(string(credsContent)), " ")
-	must.NotContains(t, normalizedCreds, "WRONG", "--force should overwrite stale credentials")
-	must.Contains(t, normalizedCreds, "aws_access_key_id = test")
+	require.NotContains(t, normalizedCreds, "WRONG", "--force should overwrite stale credentials")
+	require.Contains(t, normalizedCreds, "aws_access_key_id = test")
 }
diff --git a/test/integration/az_cmd_test.go b/test/integration/az_cmd_test.go
index 7c1fb74d..411f4993 100644
--- a/test/integration/az_cmd_test.go
+++ b/test/integration/az_cmd_test.go
@@ -8,8 +8,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 func TestAzCommandFailsWhenAzureCLINotInstalled(t *testing.T) {
@@ -20,10 +20,10 @@ func TestAzCommandFailsWhenAzureCLINotInstalled(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).WithHome(t.TempDir())
 
 	stdout, _, err := runLstk(t, testContext(t), workDir, e, "az", "group", "list")
-	must.Error(t, err)
-	must.Contains(t, stdout, "az CLI not found in PATH")
-	must.Contains(t, stdout, "Install Azure CLI:")
-	must.Contains(t, stdout, "https://learn.microsoft.com/en-us/cli/azure/")
+	require.Error(t, err)
+	require.Contains(t, stdout, "az CLI not found in PATH")
+	require.Contains(t, stdout, "Install Azure CLI:")
+	require.Contains(t, stdout, "https://learn.microsoft.com/en-us/cli/azure/")
 }
 
 // azureHealthServer answers like an Azure-flavored emulator: /_localstack/health
@@ -66,15 +66,15 @@ func azureConfigWithSetupMarker(t *testing.T) string {
 	t.Helper()
 	dir := t.TempDir()
 	configPath := filepath.Join(dir, "config.toml")
-	must.NoError(t, os.WriteFile(configPath, []byte(`
+	require.NoError(t, os.WriteFile(configPath, []byte(`
 [[containers]]
 type = "azure"
 tag  = "latest"
 port = "4566"
 `), 0644))
 	markerDir := filepath.Join(dir, "azure")
-	must.NoError(t, os.MkdirAll(markerDir, 0700))
-	must.NoError(t, os.WriteFile(filepath.Join(markerDir, ".lstk-setup-complete"), []byte("ok\n"), 0600))
+	require.NoError(t, os.MkdirAll(markerDir, 0700))
+	require.NoError(t, os.WriteFile(filepath.Join(markerDir, ".lstk-setup-complete"), []byte("ok\n"), 0600))
 	return configPath
 }
 
@@ -95,14 +95,14 @@ func azureHomeWithSetupMarker(t *testing.T) string {
 	t.Helper()
 	homeDir := t.TempDir()
 	lstkDir := filepath.Join(homeDir, ".config", "lstk")
-	must.NoError(t, os.MkdirAll(filepath.Join(lstkDir, "azure"), 0700))
-	must.NoError(t, os.WriteFile(filepath.Join(lstkDir, "config.toml"), []byte(`
+	require.NoError(t, os.MkdirAll(filepath.Join(lstkDir, "azure"), 0700))
+	require.NoError(t, os.WriteFile(filepath.Join(lstkDir, "config.toml"), []byte(`
 [[containers]]
 type = "azure"
 tag  = "latest"
 port = "4566"
 `), 0644))
-	must.NoError(t, os.WriteFile(filepath.Join(lstkDir, "azure", ".lstk-setup-complete"), []byte("ok\n"), 0600))
+	require.NoError(t, os.WriteFile(filepath.Join(lstkDir, "azure", ".lstk-setup-complete"), []byte("ok\n"), 0600))
 	return homeDir
 }
 
@@ -116,11 +116,11 @@ func TestAzCommandStripsGlobalFlagsFromPassthrough(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), azFakeEnv(t, writeFakeAz(t, 0), t.TempDir()),
 		"--endpoint-url", srv.URL, "--config", configPath, "--non-interactive", "az", "group", "list")
-	must.NoError(t, err, "stderr: %s", stderr)
+	require.NoError(t, err, "stderr: %s", stderr)
 
-	must.Contains(t, stdout, "AZ_ARGS:group list")
-	must.NotContains(t, stdout, "--non-interactive")
-	must.NotContains(t, stdout, "--config")
+	require.Contains(t, stdout, "AZ_ARGS:group list")
+	require.NotContains(t, stdout, "--non-interactive")
+	require.NotContains(t, stdout, "--config")
 }
 
 // --config must select the given config file for `lstk az` too: the Azure setup
@@ -135,13 +135,13 @@ func TestAzCommandConfigFlagSelectsConfigFile(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "--config", configPath, "az", "group", "list")
-	must.NoError(t, err, "stderr: %s", stderr)
-	must.Contains(t, stdout, "AZ_ARGS:group list")
+	require.NoError(t, err, "stderr: %s", stderr)
+	require.Contains(t, stdout, "AZ_ARGS:group list")
 
 	stdout, _, err = runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "az", "group", "list")
-	must.Error(t, err, "without --config the azure setup marker must not be found")
-	must.Contains(t, stdout, "Azure CLI integration is not set up")
+	require.Error(t, err, "without --config the azure setup marker must not be found")
+	require.Contains(t, stdout, "Azure CLI integration is not set up")
 }
 
 func TestAzCommandShowsSpinnerForSlowOperation(t *testing.T) {
@@ -151,10 +151,10 @@ func TestAzCommandShowsSpinnerForSlowOperation(t *testing.T) {
 	// The spinner only renders after 4s, so the fake `az` must outlast that.
 	out, err := runLstkInPTY(t, testContext(t), azFakeEnv(t, writeFakeAz(t, 5), azureHomeWithSetupMarker(t)),
 		"--endpoint-url", srv.URL, "az", "group", "list")
-	must.NoError(t, err, "lstk az failed: %s", out)
+	require.NoError(t, err, "lstk az failed: %s", out)
 
-	must.Contains(t, out, "Loading service")
-	must.Contains(t, out, "AZ_ARGS:group list")
+	require.Contains(t, out, "Loading service")
+	require.Contains(t, out, "AZ_ARGS:group list")
 }
 
 // --non-interactive must suppress the spinner: before the flag was stripped in
@@ -166,8 +166,8 @@ func TestAzCommandSuppressesSpinnerInNonInteractiveMode(t *testing.T) {
 
 	out, err := runLstkInPTY(t, testContext(t), azFakeEnv(t, writeFakeAz(t, 5), azureHomeWithSetupMarker(t)),
 		"--endpoint-url", srv.URL, "--non-interactive", "az", "group", "list")
-	must.NoError(t, err, "lstk az failed: %s", out)
+	require.NoError(t, err, "lstk az failed: %s", out)
 
-	must.NotContains(t, out, "Loading service")
-	must.Contains(t, out, "AZ_ARGS:group list")
+	require.NotContains(t, out, "Loading service")
+	require.Contains(t, out, "AZ_ARGS:group list")
 }
diff --git a/test/integration/az_e2e_test.go b/test/integration/az_e2e_test.go
index 271e6b9c..c8e73217 100644
--- a/test/integration/az_e2e_test.go
+++ b/test/integration/az_e2e_test.go
@@ -11,8 +11,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // End-to-end tests for `lstk az` that exercise the *real* Azure CLI against a
@@ -78,27 +78,27 @@ func TestAzE2ERealCLIOnPTYPreservesOutput(t *testing.T) {
 	ctx := testContext(t)
 
 	_, stderr, err := runLstk(t, ctx, workDir, baseEnv, "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 
 	// Registers the LocalStack cloud in an isolated AZURE_CONFIG_DIR and writes
 	// the setup marker `lstk az` requires. Non-interactive because runLstk is not
 	// on a terminal.
 	_, stderr, err = runLstk(t, ctx, workDir, baseEnv, "setup", "azure")
-	must.NoError(t, err, "lstk setup azure failed: %s", stderr)
+	require.NoError(t, err, "lstk setup azure failed: %s", stderr)
 
 	// Pipe path: no PTY, so no CR at all, and the JSON is byte-clean.
 	pipedOut, stderr, err := runLstk(t, ctx, workDir, baseEnv, "az", "cloud", "show", "-o", "json")
-	must.NoError(t, err, "lstk az cloud show failed: %s", stderr)
-	must.NotContains(t, pipedOut, "\r", "a redirected stdout must stay a pipe, so the Azure CLI emits bare LFs")
-	must.Eq(t, "LocalStack", cloudNameFromJSON(t, pipedOut))
+	require.NoError(t, err, "lstk az cloud show failed: %s", stderr)
+	require.NotContains(t, pipedOut, "\r", "a redirected stdout must stay a pipe, so the Azure CLI emits bare LFs")
+	require.Equal(t, "LocalStack", cloudNameFromJSON(t, pipedOut))
 
 	// PTY path: the real az ran on a terminal, and its output is still valid JSON
 	// once the PTY's CRs are stripped — the property a `lstk az ... -o json`
 	// consumer depends on.
 	ptyOut := runLstkAzInPTY(t, ctx, workDir, baseEnv, "az", "cloud", "show", "-o", "json")
-	must.True(t, hasInnerPTYLineEndings(ptyOut),
+	require.True(t, hasInnerPTYLineEndings(ptyOut),
 		"the real Azure CLI must run on a PTY when lstk's stdout and stderr are terminals (DEVX-1028); got:\n%q", ptyOut)
-	must.Eq(t, "LocalStack", cloudNameFromJSON(t, ptyOut))
+	require.Equal(t, "LocalStack", cloudNameFromJSON(t, ptyOut))
 }
 
 // cloudNameFromJSON extracts .name from an `az cloud show -o json` payload,
@@ -108,12 +108,12 @@ func cloudNameFromJSON(t *testing.T, out string) string {
 	t.Helper()
 	clean := strings.ReplaceAll(out, "\r", "")
 	start := strings.Index(clean, "{")
-	must.GreaterOrEqual(t, start, 0, "no JSON object in az output:\n%q", out)
+	require.GreaterOrEqual(t, start, 0, "no JSON object in az output:\n%q", out)
 
 	var payload struct {
 		Name string `json:"name"`
 	}
-	must.NoError(t, json.Unmarshal([]byte(clean[start:]), &payload),
+	require.NoError(t, json.Unmarshal([]byte(clean[start:]), &payload),
 		"az output is not valid JSON after stripping CRs:\n%q", clean[start:])
 	return payload.Name
 }
@@ -124,7 +124,7 @@ func cloudNameFromJSON(t *testing.T, out string) string {
 func runLstkAzInPTY(t *testing.T, ctx context.Context, workDir string, environ []string, args ...string) string {
 	t.Helper()
 	binPath, err := filepath.Abs(binaryPath())
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	cmd := exec.CommandContext(ctx, binPath, args...)
 	cmd.Dir = workDir
@@ -148,6 +148,6 @@ func runLstkAzInPTY(t *testing.T, ctx context.Context, workDir string, environ [
 		_ = p.cmd.Process.Kill()
 		r = <-done
 	}
-	must.NoError(t, r.err, "lstk %v failed on a PTY; output:\n%s", args, r.out)
+	require.NoError(t, r.err, "lstk %v failed on a PTY; output:\n%s", args, r.out)
 	return r.out
 }
diff --git a/test/integration/az_interception_test.go b/test/integration/az_interception_test.go
index 9085d12d..0170419b 100644
--- a/test/integration/az_interception_test.go
+++ b/test/integration/az_interception_test.go
@@ -9,8 +9,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // runAzRaw runs `az <args>` directly (not via lstk) with the given environment. The
@@ -20,7 +20,7 @@ import (
 func runAzRaw(t *testing.T, ctx context.Context, environ []string, args ...string) (string, error) {
 	t.Helper()
 	azBin, err := exec.LookPath("az")
-	must.NoError(t, err)
+	require.NoError(t, err)
 	cmd := exec.CommandContext(ctx, azBin, args...)
 	cmd.Env = environ
 	var out, errb bytes.Buffer
@@ -41,9 +41,9 @@ func TestAzStartInterceptionRoutesToSubcommand(t *testing.T) {
 		env.WithHome(t.TempDir()).With("PATH", t.TempDir()),
 		"az", "start-interception",
 	)
-	must.Error(t, err)
-	must.Contains(t, stdout, "az CLI not found in PATH")
-	must.NotContains(t, stdout, "not set up")
+	require.Error(t, err)
+	require.Contains(t, stdout, "az CLI not found in PATH")
+	require.NotContains(t, stdout, "not set up")
 }
 
 // stop-interception is a safe no-op when LocalStack is not the active cloud — e.g.
@@ -60,13 +60,13 @@ func TestAzStopInterceptionNoOpWhenNotIntercepting(t *testing.T) {
 		env.WithHome(home),
 		"az", "stop-interception",
 	)
-	must.NoError(t, err, "stop-interception must not fail when LocalStack is not active")
-	must.Contains(t, stdout, "not the active Azure cloud")
+	require.NoError(t, err, "stop-interception must not fail when LocalStack is not active")
+	require.Contains(t, stdout, "not the active Azure cloud")
 
 	// It must not have switched the active cloud to anything.
 	active, azErr := runAzRaw(t, testContext(t), env.WithHome(home), "cloud", "show", "--query", "name", "-o", "tsv")
-	must.NoError(t, azErr)
-	must.Eq(t, "AzureCloud", active)
+	require.NoError(t, azErr)
+	require.Equal(t, "AzureCloud", active)
 }
 
 func TestAzStopInterceptionFailsWhenAzureCLINotInstalled(t *testing.T) {
@@ -77,9 +77,9 @@ func TestAzStopInterceptionFailsWhenAzureCLINotInstalled(t *testing.T) {
 		env.WithHome(t.TempDir()).With("PATH", t.TempDir()),
 		"az", "stop-interception",
 	)
-	must.Error(t, err)
-	must.Contains(t, stdout, "az CLI not found in PATH")
-	must.Contains(t, stdout, "Install Azure CLI:")
+	require.Error(t, err)
+	require.Contains(t, stdout, "az CLI not found in PATH")
+	require.Contains(t, stdout, "Install Azure CLI:")
 }
 
 // TestAzInterception exercises the full start/stop-interception lifecycle against a real
@@ -114,46 +114,46 @@ func TestAzInterception(t *testing.T) {
 	ctx := testContext(t)
 
 	_, stderr, err := runLstk(t, ctx, workDir, baseEnv, "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 
 	activeCloud := func() string {
 		// baseEnv carries HOME=tmpHome and no AZURE_CONFIG_DIR, so this reads the same
 		// global config that interception mutated.
 		name, azErr := runAzRaw(t, ctx, baseEnv, "cloud", "show", "--query", "name", "-o", "tsv")
-		must.NoError(t, azErr)
+		require.NoError(t, azErr)
 		return name
 	}
 
 	// start-interception: global `az` now points at LocalStack.
 	stdout, stderr, err := runLstk(t, ctx, workDir, baseEnv, "az", "start-interception")
-	must.NoError(t, err, "start-interception failed: stdout=%s stderr=%s", stdout, stderr)
-	must.Contains(t, stdout, "Interception active")
-	must.Contains(t, stdout, "stop-interception")
-	must.Eq(t, "LocalStack", activeCloud(), "LocalStack should be the active global cloud after start-interception")
+	require.NoError(t, err, "start-interception failed: stdout=%s stderr=%s", stdout, stderr)
+	require.Contains(t, stdout, "Interception active")
+	require.Contains(t, stdout, "stop-interception")
+	require.Equal(t, "LocalStack", activeCloud(), "LocalStack should be the active global cloud after start-interception")
 
 	// stop-interception (default): back to AzureCloud.
 	stdout, stderr, err = runLstk(t, ctx, workDir, baseEnv, "az", "stop-interception")
-	must.NoError(t, err, "stop-interception failed: stdout=%s stderr=%s", stdout, stderr)
-	must.Contains(t, stdout, "Interception stopped")
-	must.Eq(t, "AzureCloud", activeCloud())
+	require.NoError(t, err, "stop-interception failed: stdout=%s stderr=%s", stdout, stderr)
+	require.Contains(t, stdout, "Interception stopped")
+	require.Equal(t, "AzureCloud", activeCloud())
 
 	// no-op guard: LocalStack is no longer active, so stop must not clobber AzureCloud.
 	stdout, _, err = runLstk(t, ctx, workDir, baseEnv, "az", "stop-interception")
-	must.NoError(t, err)
-	must.Contains(t, stdout, "not the active Azure cloud")
-	must.Eq(t, "AzureCloud", activeCloud())
+	require.NoError(t, err)
+	require.Contains(t, stdout, "not the active Azure cloud")
+	require.Equal(t, "AzureCloud", activeCloud())
 
 	// unknown --cloud is rejected (only reached because LocalStack is active again).
 	_, _, err = runLstk(t, ctx, workDir, baseEnv, "az", "start-interception")
-	must.NoError(t, err)
-	must.Eq(t, "LocalStack", activeCloud())
+	require.NoError(t, err)
+	require.Equal(t, "LocalStack", activeCloud())
 	_, stderr, err = runLstk(t, ctx, workDir, baseEnv, "az", "stop-interception", "--cloud", "NotARealCloud")
-	must.Error(t, err)
-	must.Contains(t, stderr, "unknown Azure cloud 'NotARealCloud'")
-	must.Eq(t, "LocalStack", activeCloud(), "rejected --cloud must not change the active cloud")
+	require.Error(t, err)
+	require.Contains(t, stderr, "unknown Azure cloud 'NotARealCloud'")
+	require.Equal(t, "LocalStack", activeCloud(), "rejected --cloud must not change the active cloud")
 
 	// --cloud override switches to the requested registered cloud.
 	stdout, stderr, err = runLstk(t, ctx, workDir, baseEnv, "az", "stop-interception", "--cloud", "AzureChinaCloud")
-	must.NoError(t, err, "stop-interception --cloud failed: stdout=%s stderr=%s", stdout, stderr)
-	must.Eq(t, "AzureChinaCloud", activeCloud())
+	require.NoError(t, err, "stop-interception --cloud failed: stdout=%s stderr=%s", stdout, stderr)
+	require.Equal(t, "AzureChinaCloud", activeCloud())
 }
diff --git a/test/integration/az_pty_test.go b/test/integration/az_pty_test.go
index 56688283..04efdaea 100644
--- a/test/integration/az_pty_test.go
+++ b/test/integration/az_pty_test.go
@@ -13,8 +13,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // azureLikeHealthServer answers the endpoint probe the way the Azure emulator
@@ -68,7 +68,7 @@ print("PYTHONUNBUFFERED:" + os.environ.get("PYTHONUNBUFFERED", "<unset>"))
 print(%q)
 time.sleep(%f)
 `, python, marker, holdFor.Seconds())
-	must.NoError(t, os.WriteFile(filepath.Join(dir, "az"), []byte(script), 0755))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "az"), []byte(script), 0755))
 	return dir
 }
 
@@ -97,7 +97,7 @@ func TestAzStreamsInPTY(t *testing.T) {
 
 	ctx := testContext(t)
 	binPath, err := filepath.Abs(binaryPath())
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	cmd := exec.CommandContext(ctx, binPath, "--endpoint-url", srv.URL, "az", "webapp", "log", "tail")
 	cmd.Dir = workDir
@@ -116,12 +116,12 @@ func TestAzStreamsInPTY(t *testing.T) {
 		}
 		time.Sleep(100 * time.Millisecond)
 	}
-	must.True(t, seen, "az produced no output while the child was still running — it was withheld in the CLI's stdout buffer until exit (DEVX-1028); output so far:\n%s", p.output())
+	require.True(t, seen, "az produced no output while the child was still running — it was withheld in the CLI's stdout buffer until exit (DEVX-1028); output so far:\n%s", p.output())
 
 	// The two mechanisms that keep the symptom above from returning, asserted
 	// separately so a regression in either one is named rather than inferred.
-	must.Contains(t, p.output(), "STDOUT_TTY:yes", "the Azure CLI must be handed a terminal, not a pipe (DEVX-1028)")
-	must.Contains(t, p.output(), "PYTHONUNBUFFERED:1")
+	require.Contains(t, p.output(), "STDOUT_TTY:yes", "the Azure CLI must be handed a terminal, not a pipe (DEVX-1028)")
+	require.Contains(t, p.output(), "PYTHONUNBUFFERED:1")
 
 	// Ctrl-C via the PTY reaches the whole foreground process group (lstk and
 	// the az child), matching how a user stops a streaming command.
@@ -151,7 +151,7 @@ func TestAzWithPipedStdoutKeepsPipe(t *testing.T) {
 		unreachableDockerHost)
 
 	stdout, stderr, err := runLstk(t, testContext(t), workDir, e, "--endpoint-url", srv.URL, "az", "group", "list")
-	must.NoError(t, err, "stderr: %s", stderr)
-	must.Contains(t, stdout, "STDOUT_TTY:no")
-	must.Contains(t, stdout, "piped")
+	require.NoError(t, err, "stderr: %s", stderr)
+	require.Contains(t, stdout, "STDOUT_TTY:no")
+	require.Contains(t, stdout, "piped")
 }
diff --git a/test/integration/cdk_cmd_test.go b/test/integration/cdk_cmd_test.go
index 8746878e..b586b754 100644
--- a/test/integration/cdk_cmd_test.go
+++ b/test/integration/cdk_cmd_test.go
@@ -4,9 +4,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // writeFakeCDK creates a stub `cdk` that answers `--version` with the given
@@ -48,8 +48,8 @@ func TestCDKForwardsArgs(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
-	must.NoError(t, err, "stderr: %s", stderr)
-	must.Contains(t, stdout, "ARGS:synth")
+	require.NoError(t, err, "stderr: %s", stderr)
+	require.Contains(t, stdout, "ARGS:synth")
 }
 
 // 7.1 — propagates the cdk exit code.
@@ -59,8 +59,8 @@ func TestCDKPropagatesExitCode(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
-	must.Error(t, err)
-	must.Contains(t, stderr, "simulated failure")
+	require.Error(t, err)
+	require.Contains(t, stderr, "simulated failure")
 	requireExitCode(t, 7, err)
 }
 
@@ -80,7 +80,7 @@ func TestCDKInjectsCleanAWSEnv(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"cdk", "--region", "eu-west-1", "synth")
-	must.NoError(t, err, "stderr: %s", stderr)
+	require.NoError(t, err, "stderr: %s", stderr)
 
 	// The snapshot pins the full env contract: both endpoints' scheme+port
 	// (host is DNS-dependent, masked), the region, the forced "test" access
@@ -102,10 +102,10 @@ func TestCDKOfflineCommandsNoEmulator(t *testing.T) {
 
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 				"cdk", "--region", "us-west-2", sub)
-			must.NoError(t, err, "stderr: %s", stderr)
+			require.NoError(t, err, "stderr: %s", stderr)
 
-			must.Contains(t, stdout, "ARGS:"+sub)
-			must.NotContains(t, stdout, "--region")
+			require.Contains(t, stdout, "ARGS:"+sub)
+			require.NotContains(t, stdout, "--region")
 		})
 	}
 }
@@ -124,8 +124,8 @@ func TestCDKHelpNoEmulator(t *testing.T) {
 
 			cmdArgs := append([]string{"cdk"}, args...)
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, cmdArgs...)
-			must.NoError(t, err, "stderr: %s", stderr)
-			must.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
+			require.NoError(t, err, "stderr: %s", stderr)
+			require.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
 		})
 	}
 }
@@ -137,10 +137,10 @@ func TestCDKVersionTooOld(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
-	must.Error(t, err)
-	must.Contains(t, stderr+stdout, "2.177.0")
+	require.Error(t, err)
+	require.Contains(t, stderr+stdout, "2.177.0")
 	// cdk was never run for real.
-	must.NotContains(t, stdout, "ARGS:synth")
+	require.NotContains(t, stdout, "ARGS:synth")
 }
 
 // 7.5 — a missing cdk binary yields the install error.
@@ -149,8 +149,8 @@ func TestCDKMissingBinary(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
-	must.Error(t, err)
-	must.Contains(t, stderr+stdout, "not found in PATH")
+	require.Error(t, err)
+	require.Contains(t, stderr+stdout, "not found in PATH")
 }
 
 // 7.6 — --account is not supported for cdk and is rejected at the command
@@ -166,9 +166,9 @@ func TestCDKAccountRejected(t *testing.T) {
 
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 				"cdk", "--account", value, "synth")
-			must.Error(t, err)
-			must.Contains(t, stderr+stdout, "not supported")
-			must.NotContains(t, stdout, "ARGS:synth")
+			require.Error(t, err)
+			require.Contains(t, stderr+stdout, "not supported")
+			require.NotContains(t, stdout, "ARGS:synth")
 		})
 	}
 }
@@ -181,8 +181,8 @@ func TestCDKFlagsAfterActionAreForwarded(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"cdk", "synth", "--region", "us-west-2")
-	must.NoError(t, err, "stderr: %s", stderr)
-	must.Contains(t, stdout, "ARGS:synth --region us-west-2")
+	require.NoError(t, err, "stderr: %s", stderr)
+	require.Contains(t, stdout, "ARGS:synth --region us-west-2")
 }
 
 // 7.6 — a flag before the subcommand is rejected with a clear message.
@@ -193,8 +193,8 @@ func TestCDKFlagBeforeSubcommandRejected(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--account", "111111111111", "cdk", "synth")
-	must.Error(t, err)
-	must.Contains(t, stderr+stdout, "must appear after the cdk subcommand")
+	require.Error(t, err)
+	require.Contains(t, stderr+stdout, "must appear after the cdk subcommand")
 }
 
 // 7.7 — LSTK_CDK_CMD selects the binary to invoke.
@@ -208,8 +208,8 @@ func TestCDKHonorsLstkCdkCmd(t *testing.T) {
 		With(env.Key("LSTK_CDK_CMD"), "mycdk")
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
-	must.NoError(t, err, "stderr: %s", stderr)
-	must.Contains(t, stdout, "MYCDK:synth")
+	require.NoError(t, err, "stderr: %s", stderr)
+	require.Contains(t, stdout, "MYCDK:synth")
 }
 
 // 7.3 — an AWS-contacting command with no running emulator fails with "not
@@ -223,10 +223,10 @@ func TestCDKFailsWhenEmulatorNotRunning(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "deploy")
-	must.Error(t, err)
-	must.Contains(t, stdout, "is not running")
-	must.Contains(t, stdout, "Start LocalStack:")
-	must.NotContains(t, stdout, "ARGS:deploy")
+	require.Error(t, err)
+	require.Contains(t, stdout, "is not running")
+	require.Contains(t, stdout, "Start LocalStack:")
+	require.NotContains(t, stdout, "ARGS:deploy")
 }
 
 // 7.3 — an AWS-contacting command fails with an AWS-specific error naming the
@@ -245,8 +245,8 @@ func TestCDKRequiresAWSEmulator(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), e, "cdk", "deploy")
-	must.Error(t, err)
-	must.Contains(t, stdout, "requires the")
-	must.Contains(t, stdout, "Snowflake")
-	must.NotContains(t, stdout, "ARGS:deploy")
+	require.Error(t, err)
+	require.Contains(t, stdout, "requires the")
+	require.Contains(t, stdout, "Snowflake")
+	require.NotContains(t, stdout, "ARGS:deploy")
 }
diff --git a/test/integration/cdk_e2e_test.go b/test/integration/cdk_e2e_test.go
index 436539f1..ecdb1015 100644
--- a/test/integration/cdk_e2e_test.go
+++ b/test/integration/cdk_e2e_test.go
@@ -7,8 +7,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // End-to-end tests for `lstk cdk` that exercise the real AWS CDK CLI against a
@@ -45,7 +45,7 @@ func copyCDKSample(t *testing.T, name string) string {
 	t.Helper()
 	work := t.TempDir()
 	src := filepath.Join("test-samples", "iac", "cdk", name)
-	must.NoError(t, os.CopyFS(work, os.DirFS(src)))
+	require.NoError(t, os.CopyFS(work, os.DirFS(src)))
 	return work
 }
 
@@ -90,7 +90,7 @@ func TestCDKE2ESynthOffline(t *testing.T) {
 	npmInstall(t, ctx, work, e)
 
 	_, stderr, err := runCDK(t, ctx, work, e, "synth")
-	must.NoError(t, err, "cdk synth stderr: %s", stderr)
+	require.NoError(t, err, "cdk synth stderr: %s", stderr)
 }
 
 // 8.1 + 8.2 — `cdk bootstrap` succeeds against a real LocalStack (also
@@ -110,7 +110,7 @@ func TestCDKE2EBootstrap(t *testing.T) {
 	npmInstall(t, ctx, work, e)
 
 	_, stderr, err := runCDK(t, ctx, work, e, "bootstrap")
-	must.NoError(t, err, "cdk bootstrap stderr: %s", stderr)
+	require.NoError(t, err, "cdk bootstrap stderr: %s", stderr)
 }
 
 // 8.3 — `cdk deploy` of a single bucket succeeds against LocalStack, and
@@ -130,13 +130,13 @@ func TestCDKE2EDeployDestroy(t *testing.T) {
 	npmInstall(t, ctx, work, e)
 
 	_, stderr, err := runCDK(t, ctx, work, e, "bootstrap")
-	must.NoError(t, err, "cdk bootstrap stderr: %s", stderr)
+	require.NoError(t, err, "cdk bootstrap stderr: %s", stderr)
 
 	_, stderr, err = runCDK(t, ctx, work, e, "deploy", "--require-approval", "never")
-	must.NoError(t, err, "cdk deploy stderr: %s", stderr)
+	require.NoError(t, err, "cdk deploy stderr: %s", stderr)
 
 	_, stderr, err = runCDK(t, ctx, work, e, "destroy", "--force")
-	must.NoError(t, err, "cdk destroy stderr: %s", stderr)
+	require.NoError(t, err, "cdk destroy stderr: %s", stderr)
 }
 
 // 8.6 + 8.7 — full Lambda round-trip against LocalStack. Unlike the single-bucket
@@ -165,10 +165,10 @@ func TestCDKE2ELambdaAssetDeployDestroy(t *testing.T) {
 	npmInstall(t, ctx, work, e)
 
 	_, stderr, err := runCDK(t, ctx, work, e, "bootstrap")
-	must.NoError(t, err, "cdk bootstrap stderr: %s", stderr)
+	require.NoError(t, err, "cdk bootstrap stderr: %s", stderr)
 
 	_, stderr, err = runCDK(t, ctx, work, e, "deploy", "--require-approval", "never")
-	must.NoError(t, err, "cdk deploy stderr: %s", stderr)
+	require.NoError(t, err, "cdk deploy stderr: %s", stderr)
 
 	// Strongest proof when available: invoke the function (provisioned from the
 	// uploaded asset) and assert the handler's response. lstk aws shells out to
@@ -178,15 +178,15 @@ func TestCDKE2ELambdaAssetDeployDestroy(t *testing.T) {
 		outFile := filepath.Join(work, "invoke-out.json")
 		_, stderr, err = runLstk(t, ctx, work, e, "aws", "lambda", "invoke",
 			"--function-name", "lstk-cdk-e2e-fn", outFile)
-		must.NoError(t, err, "lstk aws lambda invoke stderr: %s", stderr)
+		require.NoError(t, err, "lstk aws lambda invoke stderr: %s", stderr)
 
 		out, readErr := os.ReadFile(outFile)
-		must.NoError(t, readErr)
-		must.Contains(t, string(out), "ok from lstk cdk lambda", "lambda response: %s", out)
+		require.NoError(t, readErr)
+		require.Contains(t, string(out), "ok from lstk cdk lambda", "lambda response: %s", out)
 	} else {
 		t.Log("aws CLI not on PATH; skipping lambda invoke verification (deploy already exercised the S3 asset path)")
 	}
 
 	_, stderr, err = runCDK(t, ctx, work, e, "destroy", "--force")
-	must.NoError(t, err, "cdk destroy stderr: %s", stderr)
+	require.NoError(t, err, "cdk destroy stderr: %s", stderr)
 }
diff --git a/test/integration/completion_test.go b/test/integration/completion_test.go
index db1eefbb..4d5951c6 100644
--- a/test/integration/completion_test.go
+++ b/test/integration/completion_test.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
+	"github.com/stretchr/testify/require"
 
 	"github.com/localstack/lstk/test/integration/env"
 )
@@ -47,16 +47,16 @@ func runBashCompletionDriver(t *testing.T, driver string, extraPath ...string) (
 
 	tmpHome := t.TempDir()
 	script, genStderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(tmpHome, ""), "completion", "bash")
-	must.NoError(t, err, "lstk completion bash failed: %s", genStderr)
+	require.NoError(t, err, "lstk completion bash failed: %s", genStderr)
 
 	dir := t.TempDir()
 	scriptPath := filepath.Join(dir, "lstk-completion.bash")
-	must.NoError(t, os.WriteFile(scriptPath, []byte(script), 0o600))
+	require.NoError(t, os.WriteFile(scriptPath, []byte(script), 0o600))
 	driverPath := filepath.Join(dir, "driver.bash")
-	must.NoError(t, os.WriteFile(driverPath, []byte(driver), 0o600))
+	require.NoError(t, os.WriteFile(driverPath, []byte(driver), 0o600))
 
 	binDir, err := filepath.Abs(filepath.Dir(binaryPath()))
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	cmd := exec.CommandContext(testContext(t), bashPath, "--noprofile", "--norc", driverPath, scriptPath)
 	cmd.Dir = dir
@@ -101,13 +101,13 @@ func TestBashCompletionWorksWithoutBashCompletionPackage(t *testing.T) {
 	t.Parallel()
 
 	stdout, stderr, err := runBashCompletionDriver(t, completeInDriver("lstk st", 1, "lstk st"))
-	must.NoError(t, err, "completion attempt failed\nstdout: %s\nstderr: %s", stdout, stderr)
-	must.NotContains(t, stderr, "command not found")
+	require.NoError(t, err, "completion attempt failed\nstdout: %s\nstderr: %s", stdout, stderr)
+	require.NotContains(t, stderr, "command not found")
 
 	completions := strings.Fields(stdout)
-	must.Contains(t, completions, "start")
-	must.Contains(t, completions, "status")
-	must.Contains(t, completions, "stop")
+	require.Contains(t, completions, "start")
+	require.Contains(t, completions, "status")
+	require.Contains(t, completions, "stop")
 }
 
 // TestBashCompletionAfterWhitespaceSeparatedFlagValue covers the shape that
@@ -119,12 +119,12 @@ func TestBashCompletionAfterWhitespaceSeparatedFlagValue(t *testing.T) {
 	t.Parallel()
 
 	stdout, stderr, err := runBashCompletionDriver(t, completeInDriver(`lstk --config = st`, 3, "lstk --config= st"))
-	must.NoError(t, err, "completion attempt failed\nstdout: %s\nstderr: %s", stdout, stderr)
+	require.NoError(t, err, "completion attempt failed\nstdout: %s\nstderr: %s", stdout, stderr)
 
 	completions := strings.Fields(stdout)
-	must.Contains(t, completions, "start")
-	must.Contains(t, completions, "status")
-	must.Contains(t, completions, "stop")
+	require.Contains(t, completions, "start")
+	require.Contains(t, completions, "status")
+	require.Contains(t, completions, "stop")
 }
 
 // TestBashCompletionReassemblesWordbreakSplits verifies the self-contained
@@ -193,11 +193,11 @@ run_reassembly
 `, tc.compWords, tc.cword, tc.line, len(tc.line))
 
 			stdout, stderr, err := runBashCompletionDriver(t, driver)
-			must.NoError(t, err, "driver failed\nstdout: %s\nstderr: %s", stdout, stderr)
-			must.NotContains(t, stderr, "command not found")
+			require.NoError(t, err, "driver failed\nstdout: %s\nstderr: %s", stdout, stderr)
+			require.NotContains(t, stderr, "command not found")
 
 			lines := strings.Split(strings.TrimRight(stdout, "\n"), "\n")
-			must.Eq(t, tc.expect, lines)
+			require.Equal(t, tc.expect, lines)
 		})
 	}
 }
@@ -213,6 +213,6 @@ source "$1" || exit 1
 _get_comp_words_by_ref
 `
 	stdout, stderr, err := runBashCompletionDriver(t, driver)
-	must.NoError(t, err, "driver failed\nstdout: %s\nstderr: %s", stdout, stderr)
-	must.Contains(t, stdout, "package version")
+	require.NoError(t, err, "driver failed\nstdout: %s\nstderr: %s", stdout, stderr)
+	require.Contains(t, stdout, "package version")
 }
diff --git a/test/integration/config_test.go b/test/integration/config_test.go
index d6975507..bc794e4a 100644
--- a/test/integration/config_test.go
+++ b/test/integration/config_test.go
@@ -7,9 +7,9 @@ import (
 	"runtime"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/require"
 )
 
 func TestConfigFlagEnvVarsPassedToContainer(t *testing.T) {
@@ -33,16 +33,16 @@ env = ["test"]
 IAM_SOFT_MODE = "1"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
-	must.Contains(t, inspect.Container.Config.Env, "IAM_SOFT_MODE=1")
+	require.NoError(t, err, "failed to inspect container")
+	require.Contains(t, inspect.Container.Config.Env, "IAM_SOFT_MODE=1")
 }
 
 func TestConfigFlagOverridesConfigPath(t *testing.T) {
@@ -51,7 +51,7 @@ func TestConfigFlagOverridesConfigPath(t *testing.T) {
 	writeConfigFile(t, customConfig)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", customConfig, "config", "path")
-	must.NoError(t, err, stderr)
+	require.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 
 	assertSamePath(t, customConfig, stdout)
@@ -70,11 +70,11 @@ func TestLocalConfigTakesPrecedence(t *testing.T) {
 
 	e := testEnvWithHome(tmpHome, xdgOverride)
 	stdout, stderr, err := runLstk(t, testContext(t), workDir, e, "config", "path")
-	must.NoError(t, err, stderr)
+	require.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 
 	expectedLocalPath, err := filepath.Abs(localConfigFile)
-	must.NoError(t, err)
+	require.NoError(t, err)
 	assertSamePath(t, expectedLocalPath, stdout)
 }
 
@@ -91,7 +91,7 @@ func TestXDGConfigTakesPrecedence(t *testing.T) {
 
 	e := testEnvWithHome(tmpHome, xdgOverride)
 	stdout, stderr, err := runLstk(t, testContext(t), workDir, e, "config", "path")
-	must.NoError(t, err, stderr)
+	require.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 
 	assertSamePath(t, xdgConfigFile, stdout)
@@ -107,7 +107,7 @@ func TestConfigPathCommand(t *testing.T) {
 	analyticsSrv, events := mockAnalyticsServer(t)
 	e := env.Environ(testEnvWithHome(tmpHome, filepath.Join(tmpHome, "xdg-config-home"))).With(env.AnalyticsEndpoint, analyticsSrv.URL)
 	stdout, stderr, err := runLstk(t, testContext(t), workDir, e, "config", "path")
-	must.NoError(t, err, stderr)
+	require.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 
 	assertSamePath(t, xdgConfigFile, stdout)
@@ -123,11 +123,11 @@ func TestConfigPathCommandDoesNotCreateConfig(t *testing.T) {
 
 	e := testEnvWithHome(tmpHome, xdgOverride)
 	stdout, stderr, err := runLstk(t, testContext(t), workDir, e, "config", "path")
-	must.NoError(t, err, stderr)
+	require.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 
 	assertSamePath(t, expectedConfigFile, stdout)
-	must.NoFileExists(t, expectedConfigFile)
+	require.NoFileExists(t, expectedConfigFile)
 }
 
 func TestConfigWithUnknownFieldsIsAccepted(t *testing.T) {
@@ -142,10 +142,10 @@ port = "4566"
 future_field = "should be ignored"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "config", "path")
-	must.NoError(t, err, stderr)
+	require.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 }
 
@@ -157,12 +157,12 @@ type = "aws"
 tag = "latest"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "stop")
-	must.Error(t, err)
+	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "port is required")
+	require.Contains(t, stderr, "port is required")
 }
 
 func TestConfigWithInvalidContainerNameFails(t *testing.T) {
@@ -175,13 +175,13 @@ port = "4566"
 container_name = "my emulator"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	// Rejected at config load, so the failure needs no Docker daemon and no token.
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "stop")
-	must.Error(t, err)
+	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout+stderr, `invalid container name "my emulator"`)
+	require.Contains(t, stdout+stderr, `invalid container name "my emulator"`)
 }
 
 func TestStartWithMultipleContainersFailsFast(t *testing.T) {
@@ -196,14 +196,14 @@ type = "snowflake"
 port = "4567"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	// The guard runs at the very top of container.Start, before any Docker health
 	// check, auth, or image pull — so start fails fast even without a daemon/token.
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "start")
-	must.Error(t, err)
+	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout+stderr, "only one is supported at a time")
+	require.Contains(t, stdout+stderr, "only one is supported at a time")
 }
 
 func TestLegacyYAMLConfigGivesHelpfulError(t *testing.T) {
@@ -213,8 +213,8 @@ func TestLegacyYAMLConfigGivesHelpfulError(t *testing.T) {
 	xdgOverride := filepath.Join(tmpHome, "xdg-config-home")
 
 	legacyConfigDir := filepath.Join(tmpHome, ".config", "lstk")
-	must.NoError(t, os.MkdirAll(legacyConfigDir, 0755))
-	must.NoError(t, os.WriteFile(
+	require.NoError(t, os.MkdirAll(legacyConfigDir, 0755))
+	require.NoError(t, os.WriteFile(
 		filepath.Join(legacyConfigDir, "config.yaml"),
 		[]byte("emulators:\n  - type: aws\n    port: 4566\n"),
 		0644,
@@ -222,10 +222,10 @@ func TestLegacyYAMLConfigGivesHelpfulError(t *testing.T) {
 
 	e := testEnvWithHome(tmpHome, xdgOverride)
 	_, stderr, err := runLstk(t, testContext(t), workDir, e, "logout")
-	must.Error(t, err)
+	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "config.yaml")
-	must.Contains(t, stderr, "TOML")
+	require.Contains(t, stderr, "config.yaml")
+	require.Contains(t, stderr, "TOML")
 }
 
 func TestConfigWithMissingOptionalTagSucceeds(t *testing.T) {
@@ -236,10 +236,10 @@ type = "aws"
 port = "4566"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "config", "path")
-	must.NoError(t, err, stderr)
+	require.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 }
 
@@ -275,14 +275,14 @@ func expectedOSConfigDir(tmpHome, xdgConfigHome string) string {
 
 func writeConfigFile(t *testing.T, path string) {
 	t.Helper()
-	must.NoError(t, os.MkdirAll(filepath.Dir(path), 0755))
+	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0755))
 	content := "[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"
-	must.NoError(t, os.WriteFile(path, []byte(content), 0644))
+	require.NoError(t, os.WriteFile(path, []byte(content), 0644))
 }
 
 func assertSamePath(t *testing.T, expectedPath, actualPath string) {
 	t.Helper()
-	must.Eq(
+	require.Equal(
 		t,
 		normalizedPath(expectedPath),
 		normalizedPath(actualPath),
diff --git a/test/integration/docker_unhealthy_test.go b/test/integration/docker_unhealthy_test.go
index 0c502809..fd33fe3b 100644
--- a/test/integration/docker_unhealthy_test.go
+++ b/test/integration/docker_unhealthy_test.go
@@ -4,8 +4,8 @@ import (
 	"runtime"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // unhealthyDockerEnv returns an environment with DOCKER_HOST pointing to a
@@ -21,10 +21,10 @@ func TestStartShowsDockerErrorWhenUnhealthy(t *testing.T) {
 	}
 
 	stdout, _, err := runLstk(t, testContext(t), "", unhealthyDockerEnv(), "start")
-	must.Error(t, err)
+	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "Docker is not available")
-	must.Contains(t, stdout, "Install Docker:")
+	require.Contains(t, stdout, "Docker is not available")
+	require.Contains(t, stdout, "Install Docker:")
 }
 
 func TestStopShowsDockerErrorWhenUnhealthy(t *testing.T) {
@@ -34,10 +34,10 @@ func TestStopShowsDockerErrorWhenUnhealthy(t *testing.T) {
 	}
 
 	stdout, _, err := runLstk(t, testContext(t), "", unhealthyDockerEnv(), "stop")
-	must.Error(t, err)
+	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "Docker is not available")
-	must.Contains(t, stdout, "Install Docker:")
+	require.Contains(t, stdout, "Docker is not available")
+	require.Contains(t, stdout, "Install Docker:")
 }
 
 // TestStopJSONIncludesDockerErrorDetail covers PR #374's report that --json
@@ -54,11 +54,11 @@ func TestStopJSONIncludesDockerErrorDetail(t *testing.T) {
 	requireExitCode(t, 1, err)
 
 	envelope := decodeEnvelope(t, stdout)
-	must.NotNil(t, envelope.Error)
-	must.Eq(t, "RUNTIME_UNAVAILABLE", envelope.Error.Code)
-	must.Eq(t, "Docker is not available", envelope.Error.Message)
+	require.NotNil(t, envelope.Error)
+	require.Equal(t, "RUNTIME_UNAVAILABLE", envelope.Error.Code)
+	require.Equal(t, "Docker is not available", envelope.Error.Message)
 	summary, _ := envelope.Error.Details["summary"].(string)
-	must.Contains(t, summary, "cannot connect to Docker daemon")
+	require.Contains(t, summary, "cannot connect to Docker daemon")
 }
 
 func TestStatusShowsDockerErrorWhenUnhealthy(t *testing.T) {
@@ -68,10 +68,10 @@ func TestStatusShowsDockerErrorWhenUnhealthy(t *testing.T) {
 	}
 
 	stdout, _, err := runLstk(t, testContext(t), "", unhealthyDockerEnv(), "status")
-	must.Error(t, err)
+	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "Docker is not available")
-	must.Contains(t, stdout, "Install Docker:")
+	require.Contains(t, stdout, "Docker is not available")
+	require.Contains(t, stdout, "Install Docker:")
 }
 
 func TestLogsShowsDockerErrorWhenUnhealthy(t *testing.T) {
@@ -81,8 +81,8 @@ func TestLogsShowsDockerErrorWhenUnhealthy(t *testing.T) {
 	}
 
 	stdout, _, err := runLstk(t, testContext(t), "", unhealthyDockerEnv(), "logs")
-	must.Error(t, err)
+	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "Docker is not available")
-	must.Contains(t, stdout, "Install Docker:")
+	require.Contains(t, stdout, "Docker is not available")
+	require.Contains(t, stdout, "Install Docker:")
 }
diff --git a/test/integration/docker_windows_test.go b/test/integration/docker_windows_test.go
index 14c3b26a..a24fd50a 100644
--- a/test/integration/docker_windows_test.go
+++ b/test/integration/docker_windows_test.go
@@ -4,8 +4,8 @@ import (
 	"runtime"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // windowsDockerErrorEnv returns an Environ with an invalid DOCKER_HOST and no PSModulePath.
@@ -23,9 +23,9 @@ func TestWindowsDockerErrorShowsDockerCLICommand(t *testing.T) {
 	}
 
 	stdout, _, err := runLstk(t, testContext(t), "", windowsDockerErrorEnv(), "start")
-	must.Error(t, err)
+	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "docker desktop start")
+	require.Contains(t, stdout, "docker desktop start")
 }
 
 // Verifies that the verbose Docker error message is suppressed on Windows.
@@ -36,8 +36,8 @@ func TestWindowsDockerErrorOmitsVerboseSummary(t *testing.T) {
 	}
 
 	stdout, _, err := runLstk(t, testContext(t), "", windowsDockerErrorEnv(), "start")
-	must.Error(t, err)
+	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "Docker is not available")
-	must.NotContains(t, stdout, "cannot connect to Docker daemon")
+	require.Contains(t, stdout, "Docker is not available")
+	require.NotContains(t, stdout, "cannot connect to Docker daemon")
 }
diff --git a/test/integration/docs_test.go b/test/integration/docs_test.go
index eeebf23b..d9e8f3ce 100644
--- a/test/integration/docs_test.go
+++ b/test/integration/docs_test.go
@@ -4,7 +4,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
+	"github.com/stretchr/testify/require"
 )
 
 func TestDocsCommandGeneratesManPages(t *testing.T) {
@@ -12,12 +12,12 @@ func TestDocsCommandGeneratesManPages(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "manpages")
 
 	_, stderr, err := runLstk(t, testContext(t), "", testEnvWithHome(t.TempDir(), ""), "docs", "--format", "man", "--dir", dir)
-	must.NoError(t, err, stderr)
+	require.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 
-	must.FileExists(t, filepath.Join(dir, "lstk.1"))
-	must.FileExists(t, filepath.Join(dir, "lstk-start.1"))
-	must.FileExists(t, filepath.Join(dir, "lstk-stop.1"))
+	require.FileExists(t, filepath.Join(dir, "lstk.1"))
+	require.FileExists(t, filepath.Join(dir, "lstk-start.1"))
+	require.FileExists(t, filepath.Join(dir, "lstk-stop.1"))
 }
 
 func TestDocsCommandGeneratesMarkdown(t *testing.T) {
@@ -25,12 +25,12 @@ func TestDocsCommandGeneratesMarkdown(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "markdown")
 
 	_, stderr, err := runLstk(t, testContext(t), "", testEnvWithHome(t.TempDir(), ""), "docs", "--format", "markdown", "--dir", dir)
-	must.NoError(t, err, stderr)
+	require.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 
-	must.FileExists(t, filepath.Join(dir, "lstk.md"))
-	must.FileExists(t, filepath.Join(dir, "lstk_start.md"))
-	must.FileExists(t, filepath.Join(dir, "lstk_stop.md"))
+	require.FileExists(t, filepath.Join(dir, "lstk.md"))
+	require.FileExists(t, filepath.Join(dir, "lstk_start.md"))
+	require.FileExists(t, filepath.Join(dir, "lstk_stop.md"))
 }
 
 func TestDocsCommandRejectsInvalidFormat(t *testing.T) {
@@ -38,14 +38,14 @@ func TestDocsCommandRejectsInvalidFormat(t *testing.T) {
 	dir := t.TempDir()
 
 	_, _, err := runLstk(t, testContext(t), "", testEnvWithHome(t.TempDir(), ""), "docs", "--format", "invalid", "--dir", dir)
-	must.Error(t, err)
+	require.Error(t, err)
 	requireExitCode(t, 1, err)
 }
 
 func TestDocsCommandIsHidden(t *testing.T) {
 	t.Parallel()
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--help")
-	must.NoError(t, err, stderr)
+	require.NoError(t, err, stderr)
 
-	must.NotContains(t, stdout, "docs")
+	require.NotContains(t, stdout, "docs")
 }
diff --git a/test/integration/emulator_select_test.go b/test/integration/emulator_select_test.go
index 6ff3dfca..bc26af74 100644
--- a/test/integration/emulator_select_test.go
+++ b/test/integration/emulator_select_test.go
@@ -8,30 +8,30 @@ import (
 	"testing"
 	"time"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 func TestNoEmulatorSelectionWhenConfigExists(t *testing.T) {
 	t.Parallel()
 
 	tmpHome := t.TempDir()
-	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).
 		With(env.DisableEvents, "1")
 
 	// Pre-create the config so lstk does not treat this as a first run.
 	configPath, _, err := runLstk(t, testContext(t), "", e, "config", "path")
-	must.NoError(t, err)
-	must.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
-	must.NoError(t, os.WriteFile(configPath, []byte("[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
+	require.NoError(t, err)
+	require.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
+	require.NoError(t, os.WriteFile(configPath, []byte("[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
 	p := startLstkInPTY(t, ctx, e, "start")
 
-	must.Never(t, func() bool {
+	require.Never(t, func() bool {
 		return strings.Contains(p.output(), "Which emulator would you like to use?")
 	}, 2*time.Second, 100*time.Millisecond, "emulator selection prompt should not appear when config already exists")
 
@@ -43,14 +43,14 @@ func TestFirstRunShowsEmulatorSelectionPrompt(t *testing.T) {
 	t.Parallel()
 
 	tmpHome := t.TempDir()
-	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).
 		With(env.DisableEvents, "1")
 
 	// Confirm no config exists at the path lstk would use — this is what triggers first-run.
 	configPath, _, err := runLstk(t, testContext(t), "", e, "config", "path")
-	must.NoError(t, err)
-	must.NoFileExists(t, configPath)
+	require.NoError(t, err)
+	require.NoFileExists(t, configPath)
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
@@ -67,8 +67,8 @@ func TestFirstRunShowsEmulatorSelectionPrompt(t *testing.T) {
 	// SetEmulatorType writes the config before emitting the confirmation message,
 	// so the file is guaranteed to exist and contain the selection by this point.
 	configData, err := os.ReadFile(configPath)
-	must.NoError(t, err)
-	must.Contains(t, string(configData), `type = "aws"`)
+	require.NoError(t, err)
+	require.Contains(t, string(configData), `type = "aws"`)
 
 	p.kill()
 }
@@ -84,20 +84,20 @@ func TestFirstRunStillShowsSelectionPromptAfterRunningAnotherCommand(t *testing.
 	t.Parallel()
 
 	tmpHome := t.TempDir()
-	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).
 		With(env.DisableEvents, "1")
 
 	configPath, _, err := runLstk(t, testContext(t), "", e, "config", "path")
-	must.NoError(t, err)
-	must.NoFileExists(t, configPath)
+	require.NoError(t, err)
+	require.NoFileExists(t, configPath)
 
 	// Run a command that doesn't start the emulator — this used to eagerly
 	// create the default (type = "aws") config via config.Init, consuming
 	// firstRun before the user ever saw the selector.
 	_, _, err = runLstk(t, testContext(t), "", e, "volume", "path")
-	must.NoError(t, err)
-	must.NoFileExists(t, configPath, "running an unrelated command must not create the default config")
+	require.NoError(t, err)
+	require.NoFileExists(t, configPath, "running an unrelated command must not create the default config")
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
@@ -115,13 +115,13 @@ func TestFirstRunCanSelectAzureEmulator(t *testing.T) {
 	t.Parallel()
 
 	tmpHome := t.TempDir()
-	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).
 		With(env.DisableEvents, "1")
 
 	configPath, _, err := runLstk(t, testContext(t), "", e, "config", "path")
-	must.NoError(t, err)
-	must.NoFileExists(t, configPath)
+	require.NoError(t, err)
+	require.NoFileExists(t, configPath)
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
@@ -130,7 +130,7 @@ func TestFirstRunCanSelectAzureEmulator(t *testing.T) {
 
 	p.waitForOutput("Which emulator would you like to use?", "emulator selection prompt should appear on first run")
 
-	must.Contains(t, p.output(), "Azure", "Azure should be offered as a selectable emulator")
+	require.Contains(t, p.output(), "Azure", "Azure should be offered as a selectable emulator")
 
 	// Press the Azure selection key ('z') instead of the default-highlighted AWS.
 	p.write("z")
@@ -138,8 +138,8 @@ func TestFirstRunCanSelectAzureEmulator(t *testing.T) {
 	p.waitForOutput("Azure emulator selected.", "Azure selection confirmation should appear")
 
 	configData, err := os.ReadFile(configPath)
-	must.NoError(t, err)
-	must.Contains(t, string(configData), `type = "azure"`)
+	require.NoError(t, err)
+	require.Contains(t, string(configData), `type = "azure"`)
 
 	p.kill()
 }
@@ -152,7 +152,7 @@ func TestFirstRunPromptsForLoginBeforeEmulatorSelection(t *testing.T) {
 	defer mockServer.Close()
 
 	tmpHome := t.TempDir()
-	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).
 		Without(env.AuthToken).
 		With(env.APIEndpoint, mockServer.URL).
@@ -160,8 +160,8 @@ func TestFirstRunPromptsForLoginBeforeEmulatorSelection(t *testing.T) {
 
 	// No config exists so this is a first run; no token means login fires before emulator selection.
 	configPath, _, err := runLstk(t, testContext(t), "", e, "config", "path")
-	must.NoError(t, err)
-	must.NoFileExists(t, configPath)
+	require.NoError(t, err)
+	require.NoFileExists(t, configPath)
 
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
@@ -170,7 +170,7 @@ func TestFirstRunPromptsForLoginBeforeEmulatorSelection(t *testing.T) {
 
 	p.waitForOutput("Press any key when complete", "auth prompt should appear on first run when no token is set")
 
-	must.NotContains(t, p.output(), "Which emulator would you like to use?",
+	require.NotContains(t, p.output(), "Which emulator would you like to use?",
 		"emulator selection prompt must not appear before auth completes")
 
 	p.write("\r")
@@ -183,18 +183,18 @@ func TestFirstRunPromptsForLoginBeforeEmulatorSelection(t *testing.T) {
 func TestFirstRunNonInteractiveEmitsDefaultEmulatorNote(t *testing.T) {
 	t.Parallel()
 	tmpHome := t.TempDir()
-	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).With(env.DisableEvents, "1")
 
 	// Verify no config exists — this is what triggers first-run.
 	configPath, _, err := runLstk(t, testContext(t), "", e, "config", "path")
-	must.NoError(t, err)
-	must.NoFileExists(t, configPath)
+	require.NoError(t, err)
+	require.NoFileExists(t, configPath)
 
 	// Process fails at container.Start (no Docker), but the note is emitted before that.
 	stdout, _, runErr := runLstk(t, testContext(t), "", e.With(env.AuthToken, "test-token"), "--non-interactive")
-	must.Error(t, runErr, "expected failure: no Docker available")
-	must.Contains(t, stdout, "Configured with default emulator", "non-interactive first run should note the default emulator")
+	require.Error(t, runErr, "expected failure: no Docker available")
+	require.Contains(t, stdout, "Configured with default emulator", "non-interactive first run should note the default emulator")
 }
 
 // A first run that fails before doing any work (no Docker) leaves no config, so
@@ -204,18 +204,18 @@ func TestEmulatorSelectionReappearsAfterFailedFirstRun(t *testing.T) {
 	t.Parallel()
 
 	tmpHome := t.TempDir()
-	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	base := env.Environ(testEnvWithHome(tmpHome, tmpHome)).With(env.DisableEvents, "1")
 
 	configPath, _, err := runLstk(t, testContext(t), "", base, "config", "path")
-	must.NoError(t, err)
-	must.NoFileExists(t, configPath)
+	require.NoError(t, err)
+	require.NoFileExists(t, configPath)
 
 	noDocker := base.With(env.Key("DOCKER_HOST"), "tcp://localhost:1")
 	stdout, _, runErr := runLstk(t, testContext(t), "", noDocker, "--non-interactive")
-	must.Error(t, runErr, "first run should fail when Docker is unavailable")
-	must.Contains(t, stdout, "Docker is not available")
-	must.NoFileExists(t, configPath, "a run that fails before doing any work must not create a config")
+	require.Error(t, runErr, "first run should fail when Docker is unavailable")
+	require.Contains(t, stdout, "Docker is not available")
+	require.NoFileExists(t, configPath, "a run that fails before doing any work must not create a config")
 
 	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
 	defer cancel()
@@ -236,7 +236,7 @@ func TestEmulatorSelectionReappearsAfterConfigDirDeleted(t *testing.T) {
 	t.Parallel()
 
 	tmpHome := t.TempDir()
-	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).
 		With(env.DisableEvents, "1").
 		With(env.AuthToken, "test-token")
@@ -244,14 +244,14 @@ func TestEmulatorSelectionReappearsAfterConfigDirDeleted(t *testing.T) {
 	// Resolve where lstk would create the config, then pre-create it so lstk
 	// believes this is not a first run (simulates a previous successful start).
 	configPath, _, err := runLstk(t, testContext(t), "", e, "config", "path")
-	must.NoError(t, err)
-	must.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
-	must.NoError(t, os.WriteFile(configPath, []byte("[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
-	must.FileExists(t, configPath)
+	require.NoError(t, err)
+	require.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
+	require.NoError(t, os.WriteFile(configPath, []byte("[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
+	require.FileExists(t, configPath)
 
 	// Delete the entire config directory — this is what the user reported.
-	must.NoError(t, os.RemoveAll(filepath.Dir(configPath)))
-	must.NoFileExists(t, configPath)
+	require.NoError(t, os.RemoveAll(filepath.Dir(configPath)))
+	require.NoFileExists(t, configPath)
 
 	// The next run must show the emulator selector again, not silently default to AWS.
 	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
@@ -272,7 +272,7 @@ func TestFirstRunChecksDockerBeforeAuthAndSelection(t *testing.T) {
 	defer mockServer.Close()
 
 	tmpHome := t.TempDir()
-	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).
 		Without(env.AuthToken).
 		With(env.APIEndpoint, mockServer.URL).
@@ -283,11 +283,11 @@ func TestFirstRunChecksDockerBeforeAuthAndSelection(t *testing.T) {
 	defer cancel()
 
 	out, err := runLstkInPTY(t, ctx, e, "start")
-	must.Error(t, err)
+	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	must.Contains(t, out, "Docker is not available")
-	must.NotContains(t, out, "Press any key when complete",
+	require.Contains(t, out, "Docker is not available")
+	require.NotContains(t, out, "Press any key when complete",
 		"login prompt must not appear when the runtime is unavailable")
-	must.NotContains(t, out, "Which emulator would you like to use?",
+	require.NotContains(t, out, "Which emulator would you like to use?",
 		"emulator selection must not appear when the runtime is unavailable")
 }
diff --git a/test/integration/emulator_type_test.go b/test/integration/emulator_type_test.go
index 76b69806..13478854 100644
--- a/test/integration/emulator_type_test.go
+++ b/test/integration/emulator_type_test.go
@@ -6,9 +6,9 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/require"
 )
 
 // dockerHostKey points the binary at a non-existent Docker socket so that
@@ -21,7 +21,7 @@ const dockerHostKey = env.Key("DOCKER_HOST")
 func typeTestEnv(t *testing.T) (env.Environ, string) {
 	t.Helper()
 	tmpHome := t.TempDir()
-	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).
 		With(env.DisableEvents, "1").
 		With(env.AuthToken, "dummy-token").
@@ -35,7 +35,7 @@ func typeTestEnv(t *testing.T) (env.Environ, string) {
 func typeTestEnvWithDocker(t *testing.T) (env.Environ, string) {
 	t.Helper()
 	tmpHome := t.TempDir()
-	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	e := env.Environ(testEnvWithHome(tmpHome, tmpHome)).
 		With(env.DisableEvents, "1").
 		With(env.AuthToken, "fake-token")
@@ -45,7 +45,7 @@ func typeTestEnvWithDocker(t *testing.T) (env.Environ, string) {
 func resolvedConfigPath(t *testing.T, e env.Environ) string {
 	t.Helper()
 	configPath, _, err := runLstk(t, testContext(t), t.TempDir(), e, "config", "path")
-	must.NoError(t, err)
+	require.NoError(t, err)
 	return configPath
 }
 
@@ -53,14 +53,14 @@ func TestStartTypeFlagFirstRunCreatesConfig(t *testing.T) {
 	t.Parallel()
 	e, _ := typeTestEnv(t)
 	configPath := resolvedConfigPath(t, e)
-	must.NoFileExists(t, configPath)
+	require.NoFileExists(t, configPath)
 
 	stdout, _, _ := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "snowflake", "--non-interactive")
 
-	must.Contains(t, stdout, "Snowflake emulator selected.")
+	require.Contains(t, stdout, "Snowflake emulator selected.")
 	data, err := os.ReadFile(configPath)
-	must.NoError(t, err)
-	must.Contains(t, string(data), `type = "snowflake"`)
+	require.NoError(t, err)
+	require.Contains(t, string(data), `type = "snowflake"`)
 }
 
 // TestBareRootTypeFlagCreatesConfig covers the bare-root form (no "start"
@@ -71,66 +71,66 @@ func TestBareRootTypeFlagCreatesConfig(t *testing.T) {
 	t.Parallel()
 	e, _ := typeTestEnv(t)
 	configPath := resolvedConfigPath(t, e)
-	must.NoFileExists(t, configPath)
+	require.NoFileExists(t, configPath)
 
 	stdout, _, _ := runLstk(t, testContext(t), t.TempDir(), e, "--type", "azure", "--non-interactive")
 
-	must.Contains(t, stdout, "Azure emulator selected.")
+	require.Contains(t, stdout, "Azure emulator selected.")
 	data, err := os.ReadFile(configPath)
-	must.NoError(t, err)
-	must.Contains(t, string(data), `type = "azure"`)
+	require.NoError(t, err)
+	require.Contains(t, string(data), `type = "azure"`)
 }
 
 func TestStartTypeFlagSwitchesInPlace(t *testing.T) {
 	t.Parallel()
 	e, _ := typeTestEnv(t)
 	configPath := resolvedConfigPath(t, e)
-	must.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
-	must.NoError(t, os.WriteFile(configPath, []byte("[[containers]]\ntype = \"aws\"     # keep me\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
+	require.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
+	require.NoError(t, os.WriteFile(configPath, []byte("[[containers]]\ntype = \"aws\"     # keep me\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
 
 	stdout, _, _ := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "azure", "--non-interactive")
 
-	must.Contains(t, stdout, "Switched configured emulator to Azure")
+	require.Contains(t, stdout, "Switched configured emulator to Azure")
 	data, err := os.ReadFile(configPath)
-	must.NoError(t, err)
-	must.Contains(t, string(data), `type = "azure"`)
+	require.NoError(t, err)
+	require.Contains(t, string(data), `type = "azure"`)
 	// The surgical rewrite preserves the inline comment and other fields.
-	must.Contains(t, string(data), "# keep me")
-	must.Contains(t, string(data), `port = "4566"`)
+	require.Contains(t, string(data), "# keep me")
+	require.Contains(t, string(data), `port = "4566"`)
 }
 
 func TestStartTypeFlagNoOpWhenMatching(t *testing.T) {
 	t.Parallel()
 	e, _ := typeTestEnv(t)
 	configPath := resolvedConfigPath(t, e)
-	must.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
+	require.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
 	content := "[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"
-	must.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
+	require.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
 
 	stdout, _, _ := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "aws", "--non-interactive")
 
-	must.NotContains(t, stdout, "Switched configured emulator")
+	require.NotContains(t, stdout, "Switched configured emulator")
 	data, err := os.ReadFile(configPath)
-	must.NoError(t, err)
-	must.Eq(t, content, string(data))
+	require.NoError(t, err)
+	require.Equal(t, content, string(data))
 }
 
 func TestStartTypeFlagErrorsWhenImageSet(t *testing.T) {
 	t.Parallel()
 	e, _ := typeTestEnv(t)
 	configPath := resolvedConfigPath(t, e)
-	must.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
+	require.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
 	content := "[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\nimage = \"my-registry.example.com/localstack-pro:3.0\"\n"
-	must.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
+	require.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "snowflake", "--non-interactive")
 
-	must.Error(t, err)
-	must.Contains(t, stdout, "Cannot switch emulator to Snowflake while a custom image is set")
+	require.Error(t, err)
+	require.Contains(t, stdout, "Cannot switch emulator to Snowflake while a custom image is set")
 	// Config must be left untouched.
 	data, readErr := os.ReadFile(configPath)
-	must.NoError(t, readErr)
-	must.Eq(t, content, string(data))
+	require.NoError(t, readErr)
+	require.Equal(t, content, string(data))
 }
 
 // TestStartTypeErrorsOnMultipleBlocks verifies the switch refuses a config with
@@ -140,18 +140,18 @@ func TestStartTypeErrorsOnMultipleBlocks(t *testing.T) {
 	t.Parallel()
 	e, _ := typeTestEnv(t)
 	configPath := resolvedConfigPath(t, e)
-	must.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
+	require.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
 	content := "[[containers]]\ntype = \"aws\"\nport = \"4566\"\n\n[[containers]]\ntype = \"snowflake\"\nport = \"4567\"\n"
-	must.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
+	require.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "azure", "--non-interactive")
 
-	must.Error(t, err)
-	must.Contains(t, stdout, "Unsupported configuration")
+	require.Error(t, err)
+	require.Contains(t, stdout, "Unsupported configuration")
 	// Config must be left untouched — neither block's type is rewritten.
 	data, readErr := os.ReadFile(configPath)
-	must.NoError(t, readErr)
-	must.Eq(t, content, string(data))
+	require.NoError(t, readErr)
+	require.Equal(t, content, string(data))
 }
 
 // TestStartTypePositionalRejected pins that the emulator is a flag only: a
@@ -166,9 +166,9 @@ func TestStartTypePositionalRejected(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "azure", "--non-interactive")
 
-	must.Error(t, err)
-	must.Contains(t, stderr, "select the emulator with --type")
-	must.NoFileExists(t, configPath)
+	require.Error(t, err)
+	require.Contains(t, stderr, "select the emulator with --type")
+	require.NoFileExists(t, configPath)
 }
 
 // TestStartTypeErrorsWhenNoContainersBlock is the end-to-end regression for the
@@ -179,18 +179,18 @@ func TestStartTypeErrorsWhenNoContainersBlock(t *testing.T) {
 	t.Parallel()
 	e, _ := typeTestEnv(t)
 	configPath := resolvedConfigPath(t, e)
-	must.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
+	require.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
 	content := "[env.default]\ntype = \"custom\"\n"
-	must.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
+	require.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "azure", "--non-interactive")
 
-	must.Error(t, err)
-	must.Contains(t, stderr, "[[containers]] block")
+	require.Error(t, err)
+	require.Contains(t, stderr, "[[containers]] block")
 	// The env table's type key must be left untouched, not corrupted to "azure".
 	data, readErr := os.ReadFile(configPath)
-	must.NoError(t, readErr)
-	must.Eq(t, content, string(data))
+	require.NoError(t, readErr)
+	require.Equal(t, content, string(data))
 }
 
 func TestStartTypeInvalidValue(t *testing.T) {
@@ -199,8 +199,8 @@ func TestStartTypeInvalidValue(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "bogus", "--non-interactive")
 
-	must.Error(t, err)
-	must.Contains(t, stderr, `invalid emulator type "bogus"`)
+	require.Error(t, err)
+	require.Contains(t, stderr, `invalid emulator type "bogus"`)
 }
 
 // TestStartTypeFlagRefusesSwitchWhenDifferentEmulatorRunning is the end-to-end
@@ -223,7 +223,7 @@ func TestStartTypeFlagRefusesSwitchWhenDifferentEmulatorRunning(t *testing.T) {
 
 	const fakeImage = "localstack/localstack-azure:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -231,19 +231,19 @@ func TestStartTypeFlagRefusesSwitchWhenDifferentEmulatorRunning(t *testing.T) {
 
 	e, _ := typeTestEnvWithDocker(t)
 	configPath := resolvedConfigPath(t, e)
-	must.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
+	require.NoError(t, os.MkdirAll(filepath.Dir(configPath), 0755))
 	content := "[[containers]]\ntype = \"azure\"\ntag = \"latest\"\nport = \"4566\"\n"
-	must.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
+	require.NoError(t, os.WriteFile(configPath, []byte(content), 0644))
 
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), e, "start", "--type", "snowflake", "--non-interactive")
 
-	must.Error(t, err)
-	must.Contains(t, stdout, "LocalStack Azure Emulator is running on port 4566")
-	must.Contains(t, stdout, "config was not changed")
-	must.Contains(t, stdout, "docker stop localstack-external-azure")
+	require.Error(t, err)
+	require.Contains(t, stdout, "LocalStack Azure Emulator is running on port 4566")
+	require.Contains(t, stdout, "config was not changed")
+	require.Contains(t, stdout, "docker stop localstack-external-azure")
 
 	// Config must be left untouched: still Azure, not rewritten to Snowflake.
 	data, readErr := os.ReadFile(configPath)
-	must.NoError(t, readErr)
-	must.Eq(t, content, string(data))
+	require.NoError(t, readErr)
+	require.Equal(t, content, string(data))
 }
diff --git a/test/integration/endpoint_url_https_test.go b/test/integration/endpoint_url_https_test.go
index 28ed7b52..90d680de 100644
--- a/test/integration/endpoint_url_https_test.go
+++ b/test/integration/endpoint_url_https_test.go
@@ -13,9 +13,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // minimalStateZip builds a minimal valid state export ZIP, mirroring
@@ -25,10 +25,10 @@ func minimalStateZip(t *testing.T) []byte {
 	var buf bytes.Buffer
 	zw := zip.NewWriter(&buf)
 	f, err := zw.Create("state.json")
-	must.NoError(t, err)
+	require.NoError(t, err)
 	_, err = f.Write([]byte(`{"services":{}}`))
-	must.NoError(t, err)
-	must.NoError(t, zw.Close())
+	require.NoError(t, err)
+	require.NoError(t, zw.Close())
 	return buf.Bytes()
 }
 
@@ -48,7 +48,7 @@ func httpsCertFileEnv(t *testing.T, srv *httptest.Server) string {
 	t.Helper()
 	path := filepath.Join(t.TempDir(), "test-ca.pem")
 	pemBytes := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: srv.Certificate().Raw})
-	must.NoError(t, os.WriteFile(path, pemBytes, 0o600))
+	require.NoError(t, os.WriteFile(path, pemBytes, 0o600))
 	return "SSL_CERT_FILE=" + path
 }
 
@@ -83,9 +83,9 @@ func TestAWSCommandEndpointURLHTTPSNoDockerRequired(t *testing.T) {
 	e = append(e, unreachableDockerHost, httpsCertFileEnv(t, srv))
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "aws", "s3", "ls")
-	must.NoError(t, err, "stderr: %s", stderr)
-	must.Contains(t, stdout, "ENDPOINT:"+srv.URL)
-	must.Contains(t, stdout, "ARGS:s3 ls")
+	require.NoError(t, err, "stderr: %s", stderr)
+	require.Contains(t, stdout, "ENDPOINT:"+srv.URL)
+	require.Contains(t, stdout, "ARGS:s3 ls")
 }
 
 // TestCDKCommandEndpointURLHTTPSNoDockerRequired mirrors
@@ -105,8 +105,8 @@ func TestCDKCommandEndpointURLHTTPSNoDockerRequired(t *testing.T) {
 	e = append(e, unreachableDockerHost, httpsCertFileEnv(t, srv))
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "cdk", "deploy", "MyStack")
-	must.NoError(t, err, "stderr: %s", stderr)
-	must.Contains(t, stdout, "ENV_AWS_ENDPOINT_URL="+srv.URL)
+	require.NoError(t, err, "stderr: %s", stderr)
+	require.Contains(t, stdout, "ENV_AWS_ENDPOINT_URL="+srv.URL)
 }
 
 // TestSnapshotSaveEndpointURLHTTPSNoDockerRequired proves the emulator-client
@@ -142,9 +142,9 @@ func TestSnapshotSaveEndpointURLHTTPSNoDockerRequired(t *testing.T) {
 	e = append(e, unreachableDockerHost, httpsCertFileEnv(t, srv))
 
 	stdout, stderr, err := runLstk(t, testContext(t), dir, e, "--endpoint-url", srv.URL, "snapshot", "save")
-	must.NoError(t, err, "stderr: %s", stderr)
-	must.Contains(t, stdout, "Snapshot saved")
-	must.Eq(t, "/_localstack/pods/state", gotPath)
+	require.NoError(t, err, "stderr: %s", stderr)
+	require.Contains(t, stdout, "Snapshot saved")
+	require.Equal(t, "/_localstack/pods/state", gotPath)
 }
 
 // TestStatusEndpointURLHTTPSchemeMismatchSuggestsHTTPS covers the confusing
@@ -164,11 +164,11 @@ func TestStatusEndpointURLHTTPSchemeMismatchSuggestsHTTPS(t *testing.T) {
 	e = append(e, unreachableDockerHost, httpsCertFileEnv(t, srv))
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", httpURL, "status")
-	must.Error(t, err)
-	must.Contains(t, stderr, "could not reach LocalStack emulator at "+httpURL)
-	must.Contains(t, stderr, srv.URL+" responded")
-	must.Contains(t, stderr, "retry with that URL")
-	must.NotContains(t, stderr, "lstk start")
+	require.Error(t, err)
+	require.Contains(t, stderr, "could not reach LocalStack emulator at "+httpURL)
+	require.Contains(t, stderr, srv.URL+" responded")
+	require.Contains(t, stderr, "retry with that URL")
+	require.NotContains(t, stderr, "lstk start")
 }
 
 // TestStatusEndpointURLHTTPSSchemeMismatchSuggestsHTTP is the mirror image:
@@ -186,10 +186,10 @@ func TestStatusEndpointURLHTTPSSchemeMismatchSuggestsHTTP(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", httpsURL, "status")
-	must.Error(t, err)
-	must.Contains(t, stderr, "could not reach LocalStack emulator at "+httpsURL)
-	must.Contains(t, stderr, srv.URL+" responded")
-	must.Contains(t, stderr, "retry with that URL")
+	require.Error(t, err)
+	require.Contains(t, stderr, "could not reach LocalStack emulator at "+httpsURL)
+	require.Contains(t, stderr, srv.URL+" responded")
+	require.Contains(t, stderr, "retry with that URL")
 }
 
 // TestStatusEndpointURLHTTPSRendersReducedOutput is the https counterpart of
@@ -205,7 +205,7 @@ func TestStatusEndpointURLHTTPSRendersReducedOutput(t *testing.T) {
 	e = append(e, unreachableDockerHost, httpsCertFileEnv(t, srv))
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "status")
-	must.NoError(t, err, "stderr: %s", stderr)
+	require.NoError(t, err, "stderr: %s", stderr)
 	// The snapshot pins the reduced remote-status card: running headline and
 	// endpoint only — no Container/Uptime lines, which need local Docker.
 	snap.Match(t, sanitizeOutput(stdout))
diff --git a/test/integration/endpoint_url_test.go b/test/integration/endpoint_url_test.go
index f8a75086..fc48ab5a 100644
--- a/test/integration/endpoint_url_test.go
+++ b/test/integration/endpoint_url_test.go
@@ -8,9 +8,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // unreachableDockerHost points DOCKER_HOST at a closed TCP port (valid on
@@ -74,9 +74,9 @@ func TestAWSCommandEndpointURLNoDockerRequired(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "aws", "s3", "ls")
-	must.NoError(t, err, "stderr: %s", stderr)
-	must.Contains(t, stdout, "ENDPOINT:"+srv.URL)
-	must.Contains(t, stdout, "ARGS:s3 ls")
+	require.NoError(t, err, "stderr: %s", stderr)
+	require.Contains(t, stdout, "ENDPOINT:"+srv.URL)
+	require.Contains(t, stdout, "ARGS:s3 ls")
 }
 
 // TestAWSCommandEndpointURLAfterSubcommandPassesThrough proves the aws-CLI
@@ -98,13 +98,13 @@ func TestAWSCommandEndpointURLAfterSubcommandPassesThrough(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "aws", "--endpoint-url", "http://127.0.0.1:9", "s3", "ls")
-	must.NoError(t, err, "stderr: %s", stderr)
+	require.NoError(t, err, "stderr: %s", stderr)
 	// lstk's own resolution used the pre-command mock — proven by succeeding
 	// at all with DOCKER_HOST broken.
-	must.Contains(t, stdout, "ENDPOINT:"+srv.URL)
+	require.Contains(t, stdout, "ENDPOINT:"+srv.URL)
 	// The user's own post-command --endpoint-url reached the wrapped aws
 	// binary untouched, appearing in its forwarded args.
-	must.Contains(t, stdout, "ARGS:--endpoint-url http://127.0.0.1:9 s3 ls")
+	require.Contains(t, stdout, "ARGS:--endpoint-url http://127.0.0.1:9 s3 ls")
 }
 
 // TestLogsRejectsExplicitEndpointURL proves logs (a Docker-lifecycle command
@@ -119,9 +119,9 @@ func TestLogsRejectsExplicitEndpointURL(t *testing.T) {
 	// (stdout), with a silent error returned so the top-level handler doesn't
 	// print a second copy to stderr.
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "logs", "--endpoint-url", "http://localhost:4566")
-	must.Error(t, err)
-	must.Contains(t, stdout, "logs")
-	must.Contains(t, stdout, "does not support --endpoint-url")
+	require.Error(t, err)
+	require.Contains(t, stdout, "logs")
+	require.Contains(t, stdout, "does not support --endpoint-url")
 }
 
 // TestVolumePathRejectsExplicitEndpointURL mirrors the logs case for the
@@ -131,8 +131,8 @@ func TestVolumePathRejectsExplicitEndpointURL(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").WithHome(t.TempDir())
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "volume", "path", "--endpoint-url", "http://localhost:4566")
-	must.Error(t, err)
-	must.Contains(t, stdout, "does not support --endpoint-url")
+	require.Error(t, err)
+	require.Contains(t, stdout, "does not support --endpoint-url")
 }
 
 // TestStartRejectsExplicitEndpointURL proves `start` (previously missing from
@@ -144,9 +144,9 @@ func TestStartRejectsExplicitEndpointURL(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--endpoint-url", "http://localhost:4566")
-	must.Error(t, err)
-	must.Contains(t, stdout, "start")
-	must.Contains(t, stdout, "does not support --endpoint-url")
+	require.Error(t, err)
+	require.Contains(t, stdout, "start")
+	require.Contains(t, stdout, "does not support --endpoint-url")
 }
 
 // The following tests prove the corrected behavior from design.md's Decision
@@ -162,10 +162,10 @@ func TestLogsRejectsAmbientEndpointURL(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "logs")
-	must.Error(t, err)
-	must.Contains(t, stdout, "logs")
-	must.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
-	must.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
+	require.Error(t, err)
+	require.Contains(t, stdout, "logs")
+	require.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	require.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
 }
 
 func TestStopRejectsAmbientEndpointURL(t *testing.T) {
@@ -174,8 +174,8 @@ func TestStopRejectsAmbientEndpointURL(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "stop")
-	must.Error(t, err)
-	must.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	require.Error(t, err)
+	require.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
 }
 
 func TestRestartRejectsAmbientEndpointURL(t *testing.T) {
@@ -184,9 +184,9 @@ func TestRestartRejectsAmbientEndpointURL(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "restart")
-	must.Error(t, err)
-	must.Contains(t, stdout, "does not support AWS_ENDPOINT_URL")
-	must.Contains(t, stdout, "AWS_ENDPOINT_URL is set")
+	require.Error(t, err)
+	require.Contains(t, stdout, "does not support AWS_ENDPOINT_URL")
+	require.Contains(t, stdout, "AWS_ENDPOINT_URL is set")
 }
 
 func TestVolumePathRejectsAmbientEndpointURL(t *testing.T) {
@@ -194,8 +194,8 @@ func TestVolumePathRejectsAmbientEndpointURL(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").WithHome(t.TempDir()).With("LSTK_ENDPOINT_URL", "http://localhost:4566")
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "volume", "path")
-	must.Error(t, err)
-	must.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	require.Error(t, err)
+	require.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
 }
 
 func TestVolumeClearRejectsAmbientEndpointURL(t *testing.T) {
@@ -203,8 +203,8 @@ func TestVolumeClearRejectsAmbientEndpointURL(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").WithHome(t.TempDir()).With("LSTK_ENDPOINT_URL", "http://localhost:4566")
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "volume", "clear")
-	must.Error(t, err)
-	must.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	require.Error(t, err)
+	require.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
 }
 
 func TestStartRejectsAmbientEndpointURL(t *testing.T) {
@@ -213,9 +213,9 @@ func TestStartRejectsAmbientEndpointURL(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "start")
-	must.Error(t, err)
-	must.Contains(t, stdout, "start")
-	must.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	require.Error(t, err)
+	require.Contains(t, stdout, "start")
+	require.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
 }
 
 // TestSnapshotShowIgnoresEndpointURL proves `snapshot show` silently ignores
@@ -228,9 +228,9 @@ func TestSnapshotShowIgnoresEndpointURL(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").WithHome(t.TempDir()).With(env.APIEndpoint, "http://127.0.0.1:1")
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "snapshot", "show", "pod:my-baseline", "--endpoint-url", "http://localhost:4566")
-	must.Error(t, err)
-	must.NotContains(t, stdout, "does not support --endpoint-url")
-	must.NotContains(t, stderr, "does not support --endpoint-url")
+	require.Error(t, err)
+	require.NotContains(t, stdout, "does not support --endpoint-url")
+	require.NotContains(t, stderr, "does not support --endpoint-url")
 }
 
 // TestSnapshotListBareIgnoresEndpointURL mirrors the show case for `snapshot
@@ -240,9 +240,9 @@ func TestSnapshotListBareIgnoresEndpointURL(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").WithHome(t.TempDir()).With(env.APIEndpoint, "http://127.0.0.1:1")
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "snapshot", "list", "--endpoint-url", "http://localhost:4566")
-	must.Error(t, err)
-	must.NotContains(t, stdout, "does not support --endpoint-url")
-	must.NotContains(t, stderr, "does not support --endpoint-url")
+	require.Error(t, err)
+	require.NotContains(t, stdout, "does not support --endpoint-url")
+	require.NotContains(t, stderr, "does not support --endpoint-url")
 }
 
 // TestStatusEndpointURLRendersReducedOutput proves `status` skips Docker
@@ -257,7 +257,7 @@ func TestStatusEndpointURLRendersReducedOutput(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "status")
-	must.NoError(t, err, "stderr: %s", stderr)
+	require.NoError(t, err, "stderr: %s", stderr)
 	// The snapshot pins the reduced remote-status card: running headline and
 	// endpoint only — no Container/Uptime lines, which need local Docker.
 	snap.Match(t, sanitizeOutput(stdout))
@@ -292,11 +292,11 @@ func TestStatusEndpointURLShowsResources(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "status")
-	must.NoError(t, err, "stderr: %s", stderr)
-	must.Contains(t, stdout, "SERVICE")
-	must.Contains(t, stdout, "RESOURCE")
-	must.Contains(t, stdout, "S3")
-	must.Contains(t, stdout, "my-test-bucket")
+	require.NoError(t, err, "stderr: %s", stderr)
+	require.Contains(t, stdout, "SERVICE")
+	require.Contains(t, stdout, "RESOURCE")
+	require.Contains(t, stdout, "S3")
+	require.Contains(t, stdout, "my-test-bucket")
 }
 
 // TestStatusEndpointURLInteractiveRendersTUI proves `status` against an
@@ -327,7 +327,7 @@ func TestStatusEndpointURLInteractiveRendersTUI(t *testing.T) {
 	e := append(env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.DisableEvents, "1"), unreachableDockerHost)
 	p := startLstkInPTY(t, testContext(t), e, "--endpoint-url", srv.URL, "status")
 	_, err := p.wait()
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	lines := ptyLines(p.out.String())
 	summary := -1
@@ -337,15 +337,15 @@ func TestStatusEndpointURLInteractiveRendersTUI(t *testing.T) {
 			break
 		}
 	}
-	must.NotEq(t, -1, summary, "resource summary should be rendered, got:\n%s", strings.Join(lines, "\n"))
-	must.Greater(t, summary, 0)
-	must.Empty(t, lines[summary-1], "TUI puts a blank line before the resource summary")
-	must.Empty(t, lines[summary+1], "TUI puts a blank line after the resource summary")
+	require.NotEqual(t, -1, summary, "resource summary should be rendered, got:\n%s", strings.Join(lines, "\n"))
+	require.Greater(t, summary, 0)
+	require.Empty(t, lines[summary-1], "TUI puts a blank line before the resource summary")
+	require.Empty(t, lines[summary+1], "TUI puts a blank line after the resource summary")
 
 	joined := strings.Join(lines, "\n")
-	must.Contains(t, joined, "my-test-bucket")
-	must.NotContains(t, joined, "Container:")
-	must.NotContains(t, joined, "Uptime:")
+	require.Contains(t, joined, "my-test-bucket")
+	require.NotContains(t, joined, "Container:")
+	require.NotContains(t, joined, "Uptime:")
 }
 
 // TestStatusUnreachableEndpointURLFailsClosed proves an endpoint that
@@ -362,9 +362,9 @@ func TestStatusUnreachableEndpointURLFailsClosed(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", notLocalStack.URL, "status")
-	must.Error(t, err)
-	must.Contains(t, stderr, "could not reach")
-	must.NotContains(t, stderr, "lstk start")
+	require.Error(t, err)
+	require.Contains(t, stderr, "could not reach")
+	require.NotContains(t, stderr, "lstk start")
 }
 
 // TestCDKAWSEndpointURLBypassesDockerCheck proves the BREAKING change:
@@ -382,8 +382,8 @@ func TestCDKAWSEndpointURLBypassesDockerCheck(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "deploy", "MyStack")
-	must.NoError(t, err, "stderr: %s", stderr)
-	must.Contains(t, stdout, fmt.Sprintf("ENV_AWS_ENDPOINT_URL=%s", srv.URL))
+	require.NoError(t, err, "stderr: %s", stderr)
+	require.Contains(t, stdout, fmt.Sprintf("ENV_AWS_ENDPOINT_URL=%s", srv.URL))
 }
 
 // TestCDKAWSEndpointURLWrongTypeFails proves the type-detection gate: an
@@ -408,7 +408,7 @@ func TestCDKAWSEndpointURLWrongTypeFails(t *testing.T) {
 	e = append(e, unreachableDockerHost)
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", azureLike.URL, "cdk", "deploy", "MyStack")
-	must.Error(t, err)
-	must.Contains(t, stdout, "requires the AWS emulator")
-	must.Contains(t, stdout, "Azure")
+	require.Error(t, err)
+	require.Contains(t, stdout, "requires the AWS emulator")
+	require.Contains(t, stdout, "Azure")
 }
diff --git a/test/integration/exit_code_test.go b/test/integration/exit_code_test.go
index 6690ef6f..dda90495 100644
--- a/test/integration/exit_code_test.go
+++ b/test/integration/exit_code_test.go
@@ -3,7 +3,7 @@ package integration_test
 import (
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
+	"github.com/stretchr/testify/require"
 )
 
 // TestInvalidUsageExitsNonZero guards against regressions of DEVX-941, where
@@ -38,9 +38,9 @@ func TestInvalidUsageExitsNonZero(t *testing.T) {
 			t.Parallel()
 			e := testEnvWithHome(t.TempDir(), "")
 			_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, tc.args...)
-			must.Error(t, err, "expected %v to fail", tc.args)
+			require.Error(t, err, "expected %v to fail", tc.args)
 			requireExitCode(t, 1, err)
-			must.Contains(t, stderr, tc.wantText)
+			require.Contains(t, stderr, tc.wantText)
 		})
 	}
 }
@@ -57,9 +57,9 @@ func TestBareParentCommandExitsZero(t *testing.T) {
 			t.Parallel()
 			e := testEnvWithHome(t.TempDir(), "")
 			stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, parent)
-			must.NoError(t, err)
+			require.NoError(t, err)
 			requireExitCode(t, 0, err)
-			must.Contains(t, stdout, "Usage:")
+			require.Contains(t, stdout, "Usage:")
 		})
 	}
 }
diff --git a/test/integration/extension_test.go b/test/integration/extension_test.go
index 22ba9c02..725db33a 100644
--- a/test/integration/extension_test.go
+++ b/test/integration/extension_test.go
@@ -13,9 +13,9 @@ import (
 	"testing"
 
 	"github.com/google/uuid"
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // The extension mechanism resolves and execs `lstk-<name>` executables for
@@ -58,7 +58,7 @@ func referenceExtensionBinary(t *testing.T) string {
 		}
 		refExtPath = out
 	})
-	must.NoError(t, refExtErr)
+	require.NoError(t, refExtErr)
 	return refExtPath
 }
 
@@ -72,13 +72,13 @@ func execName(base string) string {
 func copyExecutable(t *testing.T, src, dst string) {
 	t.Helper()
 	in, err := os.Open(src)
-	must.NoError(t, err)
+	require.NoError(t, err)
 	defer func() { _ = in.Close() }()
 	out, err := os.OpenFile(dst, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o755)
-	must.NoError(t, err)
+	require.NoError(t, err)
 	_, err = io.Copy(out, in)
-	must.NoError(t, err)
-	must.NoError(t, out.Close())
+	require.NoError(t, err)
+	require.NoError(t, out.Close())
 }
 
 // installExtension places the reference extension under the name `lstk-<name>`
@@ -94,7 +94,7 @@ func installExtension(t *testing.T, dir, name string) {
 func installLstkBundle(t *testing.T, dir string) string {
 	t.Helper()
 	binPath, err := filepath.Abs(binaryPath())
-	must.NoError(t, err)
+	require.NoError(t, err)
 	dst := filepath.Join(dir, execName("lstk"))
 	copyExecutable(t, binPath, dst)
 	return dst
@@ -136,10 +136,10 @@ func TestExtensionBuiltinTakesPrecedence(t *testing.T) {
 
 	tmpHome := t.TempDir()
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), envWithPath(tmpHome, extDir), "config", "path")
-	must.NoError(t, err, stderr)
+	require.NoError(t, err, stderr)
 	// The built-in prints a config path; the extension would have printed ARGS=.
-	must.Contains(t, stdout, "config.toml")
-	must.NotContains(t, stdout, "ARGS=")
+	require.Contains(t, stdout, "config.toml")
+	require.NotContains(t, stdout, "ARGS=")
 }
 
 func TestExtensionUnknownCommandDispatches(t *testing.T) {
@@ -152,7 +152,7 @@ func TestExtensionUnknownCommandDispatches(t *testing.T) {
 	// the EMULATOR_COUNT/EMULATOR lines) can't vary with the host's Docker state.
 	environ := append(envWithPath(tmpHome, extDir), "DOCKER_HOST=tcp://127.0.0.1:1")
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "hello", "world")
-	must.NoError(t, err, stderr)
+	require.NoError(t, err, stderr)
 	snap.Match(t, sanitizeOutput(stdout))
 }
 
@@ -163,7 +163,7 @@ func TestExtensionUnknownCommandNoExtensionErrors(t *testing.T) {
 	// goes to stderr, matching Cobra's own unknown-command output.
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), envWithPath(tmpHome, t.TempDir()), "nope")
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "unknown command")
+	require.Contains(t, stderr, "unknown command")
 }
 
 func TestExtensionExitCodePropagates(t *testing.T) {
@@ -183,10 +183,10 @@ func TestExtensionGlobalFlagConveyedNotForwarded(t *testing.T) {
 
 	tmpHome := t.TempDir()
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), envWithPath(tmpHome, extDir), "--non-interactive", "hello", "--foo")
-	must.NoError(t, err, stderr)
+	require.NoError(t, err, stderr)
 	// --non-interactive is consumed by lstk and conveyed via env, not forwarded.
-	must.Contains(t, stdout, "ARGS=[--foo]")
-	must.Contains(t, stdout, "NON_INTERACTIVE=true")
+	require.Contains(t, stdout, "ARGS=[--foo]")
+	require.Contains(t, stdout, "NON_INTERACTIVE=true")
 }
 
 func TestExtensionAuthTokenConveyedWhenAuthed(t *testing.T) {
@@ -198,8 +198,8 @@ func TestExtensionAuthTokenConveyedWhenAuthed(t *testing.T) {
 	environ := envWithPath(tmpHome, extDir)
 	environ = append(environ, string(env.AuthToken)+"=tok-abc-123")
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "ref")
-	must.NoError(t, err, stderr)
-	must.Contains(t, stdout, "AUTH_TOKEN=tok-abc-123")
+	require.NoError(t, err, stderr)
+	require.Contains(t, stdout, "AUTH_TOKEN=tok-abc-123")
 }
 
 func TestExtensionEndpointOmittedWhenNoRuntime(t *testing.T) {
@@ -213,7 +213,7 @@ func TestExtensionEndpointOmittedWhenNoRuntime(t *testing.T) {
 	// emulator context is deterministically omitted.
 	environ = append(environ, "DOCKER_HOST=tcp://127.0.0.1:1")
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "ref")
-	must.NoError(t, err, stderr)
+	require.NoError(t, err, stderr)
 	// The snapshot pins EMULATOR_COUNT=0 with no EMULATOR= lines, while the
 	// always-present variables are still conveyed.
 	snap.Match(t, sanitizeOutput(stdout))
@@ -231,7 +231,7 @@ func TestExtensionSelfAuthorizationRefusesWithoutToken(t *testing.T) {
 	environ = append(environ, "DOCKER_HOST=tcp://127.0.0.1:1")
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "deploy", "auth")
 	requireExitCode(t, 13, err)
-	must.Contains(t, stderr, "not authorized")
+	require.Contains(t, stderr, "not authorized")
 }
 
 func TestExtensionInvocationRecordedInTelemetry(t *testing.T) {
@@ -246,7 +246,7 @@ func TestExtensionInvocationRecordedInTelemetry(t *testing.T) {
 		With(env.AnalyticsEndpoint, analyticsSrv.URL)
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "hello", "world")
-	must.NoError(t, err, stderr)
+	require.NoError(t, err, stderr)
 
 	// The invocation is recorded in product telemetry as ext:<name>, so the
 	// warehouse tracks which extension ran — and is NOT mislabeled as "start".
@@ -271,16 +271,16 @@ func TestExtensionSessionIDConveyedAndMatchesCommandEvent(t *testing.T) {
 		With(env.Key("DOCKER_HOST"), "tcp://127.0.0.1:1")
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "ref")
-	must.NoError(t, err, stderr)
+	require.NoError(t, err, stderr)
 
 	conveyed := echoedValue(t, stdout, "SESSION_ID")
 	_, parseErr := uuid.Parse(conveyed)
-	must.NoError(t, parseErr, "conveyed sessionId must be a UUID, got %q", conveyed)
+	require.NoError(t, parseErr, "conveyed sessionId must be a UUID, got %q", conveyed)
 
 	event := receiveEventByName(t, events, "lstk_command")
 	metadata, ok := event["metadata"].(map[string]any)
-	must.True(t, ok, "event has no metadata object: %v", event)
-	must.Eq[any](t, conveyed, metadata["session_id"],
+	require.True(t, ok, "event has no metadata object: %v", event)
+	require.Equal(t, conveyed, metadata["session_id"],
 		"conveyed sessionId must equal the session id on the ext:<name> event")
 }
 
@@ -333,9 +333,9 @@ func TestExtensionEndpointConveyedWhenEmulatorRunning(t *testing.T) {
 	environ := envWithPath(tmpHome, extDir)
 	environ = append(environ, string(env.AuthToken)+"=tok-xyz")
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), environ, "ref")
-	must.NoError(t, err, stderr)
-	must.Contains(t, stdout, "EMULATOR=aws http")
-	must.Contains(t, stdout, "AUTH_TOKEN=tok-xyz")
+	require.NoError(t, err, stderr)
+	require.Contains(t, stdout, "EMULATOR=aws http")
+	require.Contains(t, stdout, "AUTH_TOKEN=tok-xyz")
 }
 
 func TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly(t *testing.T) {
@@ -343,7 +343,7 @@ func TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly(t *testing.T) {
 	bundleDir := t.TempDir()
 	lstkBin := installLstkBundle(t, bundleDir)
 	installExtension(t, bundleDir, "deploy") // bundled
-	must.NoError(t, os.WriteFile(
+	require.NoError(t, os.WriteFile(
 		filepath.Join(bundleDir, "lstk-extensions.toml"),
 		[]byte("deploy = \"Deploy your application to LocalStack\"\n"), 0o644))
 
@@ -352,7 +352,7 @@ func TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly(t *testing.T) {
 
 	tmpHome := t.TempDir()
 	stdout, stderr, err := runBinary(t, t.TempDir(), envWithPath(tmpHome, extDir), lstkBin, "--help")
-	must.NoError(t, err, stderr)
+	require.NoError(t, err, stderr)
 
 	// The snapshot pins the Extensions section (bundled `deploy` with its
 	// description, PATH-only `hello` without) and that no extension was
@@ -370,19 +370,19 @@ func TestExtensionHelpDescriptionColumnAlignsWithCommands(t *testing.T) {
 	bundleDir := t.TempDir()
 	lstkBin := installLstkBundle(t, bundleDir)
 	installExtension(t, bundleDir, "deploy")
-	must.NoError(t, os.WriteFile(
+	require.NoError(t, os.WriteFile(
 		filepath.Join(bundleDir, "lstk-extensions.toml"),
 		[]byte("deploy = \"Deploy your application to LocalStack\"\n"), 0o644))
 
 	tmpHome := t.TempDir()
 	stdout, stderr, err := runBinary(t, t.TempDir(), envWithPath(tmpHome, t.TempDir()), lstkBin, "--help")
-	must.NoError(t, err, stderr)
+	require.NoError(t, err, stderr)
 
 	lines := strings.Split(stdout, "\n")
 	// The built-in `aws` command (in the Tools group) sets the reference column.
 	cmdCol := descriptionColumn(t, lines, "aws", "Run AWS CLI commands against LocalStack")
 	extCol := descriptionColumn(t, lines, "deploy", "Deploy your application to LocalStack")
-	must.Eq(t, cmdCol, extCol,
+	require.Equal(t, cmdCol, extCol,
 		"extension description column (%d) must align with command description column (%d)", extCol, cmdCol)
 }
 
@@ -408,9 +408,9 @@ func TestExtensionHelpMissingDescriptionsFileDegrades(t *testing.T) {
 
 	tmpHome := t.TempDir()
 	stdout, stderr, err := runBinary(t, t.TempDir(), envWithPath(tmpHome, t.TempDir()), lstkBin, "--help")
-	must.NoError(t, err, stderr)
-	must.Contains(t, stdout, "Extensions:")
-	must.Contains(t, stdout, "deploy")
+	require.NoError(t, err, stderr)
+	require.Contains(t, stdout, "Extensions:")
+	require.Contains(t, stdout, "deploy")
 }
 
 func TestExtensionResolvableViaSymlinkedLstk(t *testing.T) {
@@ -427,13 +427,13 @@ func TestExtensionResolvableViaSymlinkedLstk(t *testing.T) {
 
 	linkDir := t.TempDir()
 	link := filepath.Join(linkDir, "lstk")
-	must.NoError(t, os.Symlink(realLstk, link))
+	require.NoError(t, os.Symlink(realLstk, link))
 
 	tmpHome := t.TempDir()
 	// Empty PATH extension dir: deploy can only come from the bundled location.
 	stdout, stderr, err := runBinary(t, t.TempDir(), envWithPath(tmpHome, t.TempDir()), link, "deploy", "ok")
-	must.NoError(t, err, stderr)
-	must.Contains(t, stdout, "ARGS=[ok]")
+	require.NoError(t, err, stderr)
+	require.Contains(t, stdout, "ARGS=[ok]")
 }
 
 func TestExtensionBundledPremiumSelfAuthorizes(t *testing.T) {
@@ -455,8 +455,8 @@ func TestExtensionBundledPremiumSelfAuthorizes(t *testing.T) {
 	// Authed: the bundled extension authorizes successfully.
 	authed := append(noRuntime, string(env.AuthToken)+"=tok-premium")
 	stdout, stderr, err := runBinary(t, t.TempDir(), authed, lstkBin, "deploy", "auth")
-	must.NoError(t, err, stderr)
-	must.Contains(t, stdout, "authorized")
+	require.NoError(t, err, stderr)
+	require.Contains(t, stdout, "authorized")
 }
 
 func TestExtensionBundledWinsOverPath(t *testing.T) {
@@ -472,17 +472,17 @@ func TestExtensionBundledWinsOverPath(t *testing.T) {
 	// The reference extension echoes its own resolved executable path as SELF=,
 	// so we can confirm the *bundled* copy ran, not the same-named PATH copy.
 	stdout, stderr, err := runBinary(t, t.TempDir(), envWithPath(tmpHome, extDir), lstkBin, "deploy", "world")
-	must.NoError(t, err, stderr)
-	must.Contains(t, stdout, "ARGS=[world]")
+	require.NoError(t, err, stderr)
+	require.Contains(t, stdout, "ARGS=[world]")
 	// lstk derives its bundled dir from the symlink-resolved executable path, so
 	// compare SELF against the resolved bundle dir (TempDir may be a symlink,
 	// e.g. /var → /private/var on macOS).
 	resolvedBundle, err := filepath.EvalSymlinks(bundleDir)
-	must.NoError(t, err)
-	must.Contains(t, stdout, "SELF="+resolvedBundle, "expected the bundled extension to run, not the PATH one")
+	require.NoError(t, err)
+	require.Contains(t, stdout, "SELF="+resolvedBundle, "expected the bundled extension to run, not the PATH one")
 
 	// Help lists the de-duplicated name exactly once.
 	helpOut, _, err := runBinary(t, t.TempDir(), envWithPath(tmpHome, extDir), lstkBin, "--help")
-	must.NoError(t, err)
-	must.Eq(t, 1, strings.Count(helpOut, "\n  deploy"))
+	require.NoError(t, err)
+	require.Equal(t, 1, strings.Count(helpOut, "\n  deploy"))
 }
diff --git a/test/integration/faketool_test.go b/test/integration/faketool_test.go
index 594b2429..0b36e329 100644
--- a/test/integration/faketool_test.go
+++ b/test/integration/faketool_test.go
@@ -9,7 +9,7 @@ import (
 	"sync"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
+	"github.com/stretchr/testify/require"
 )
 
 // fakeToolConfig and fakeToolCase mirror the config structs in
@@ -68,7 +68,7 @@ func fakeToolBinary(t *testing.T) string {
 		}
 		fakeToolPath = out
 	})
-	must.NoError(t, fakeToolErr)
+	require.NoError(t, fakeToolErr)
 	return fakeToolPath
 }
 
@@ -79,8 +79,8 @@ func installFakeTool(t *testing.T, dir, name string, cfg fakeToolConfig) {
 	bin := filepath.Join(dir, execName(name))
 	copyExecutable(t, fakeToolBinary(t), bin)
 	b, err := json.Marshal(cfg)
-	must.NoError(t, err)
-	must.NoError(t, os.WriteFile(bin+".fakecfg", b, 0o644))
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(bin+".fakecfg", b, 0o644))
 }
 
 // writeFakeTool installs the faketool binary as `name` in a fresh temp dir
diff --git a/test/integration/go.mod b/test/integration/go.mod
index c68c0a6e..e5a083af 100644
--- a/test/integration/go.mod
+++ b/test/integration/go.mod
@@ -15,10 +15,16 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/moby/moby/api v1.55.0
 	github.com/moby/moby/client v0.5.1
+	github.com/stretchr/testify v1.11.1
 	github.com/zalando/go-keyring v0.2.8
 )
 
-require github.com/google/go-cmp v0.7.0 // indirect
+require (
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
 
 require (
 	github.com/Microsoft/go-winio v0.6.2 // indirect
diff --git a/test/integration/go.sum b/test/integration/go.sum
index e3bd5290..33ebe64e 100644
--- a/test/integration/go.sum
+++ b/test/integration/go.sum
@@ -79,6 +79,10 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/moby/api v1.55.0 h1:2/sexvQyqIWS8pRSCFddBfpW2qE7vR7FCL+vN8pxwMc=
@@ -91,6 +95,8 @@ github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJw
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
@@ -113,6 +119,9 @@ go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOy
 go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
diff --git a/test/integration/json_envelope_test.go b/test/integration/json_envelope_test.go
index 8d40e71a..7f9132a9 100644
--- a/test/integration/json_envelope_test.go
+++ b/test/integration/json_envelope_test.go
@@ -6,8 +6,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/internal/snap"
+	"github.com/stretchr/testify/require"
 )
 
 // jsonEnvelope mirrors the shape documented in output-envelope/spec.md and
@@ -40,8 +40,8 @@ type jsonError struct {
 func decodeEnvelope(t *testing.T, stdout string) jsonEnvelope {
 	t.Helper()
 	var envelope jsonEnvelope
-	must.NoError(t, json.Unmarshal([]byte(stdout), &envelope), "stdout should be exactly one JSON object: %s", stdout)
-	must.NotNil(t, envelope.Warnings, "warnings should always be an array, never omitted/null")
+	require.NoError(t, json.Unmarshal([]byte(stdout), &envelope), "stdout should be exactly one JSON object: %s", stdout)
+	require.NotNil(t, envelope.Warnings, "warnings should always be an array, never omitted/null")
 	return envelope
 }
 
@@ -83,8 +83,8 @@ func TestUsageErrorBeforeJSONFallsBackToPlainText(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), testEnvWithHome(t.TempDir(), ""), "stop", "--bogus-flag", "--json")
 	requireExitCode(t, 1, err)
 
-	must.Empty(t, stdout, "no JSON should be attempted when --json wasn't parsed yet")
-	must.Contains(t, stderr, "bogus-flag")
+	require.Empty(t, stdout, "no JSON should be attempted when --json wasn't parsed yet")
+	require.Contains(t, stderr, "bogus-flag")
 }
 
 // TestConfigLoadFailureRendersJSONEnvelope covers PR #374's review comment:
@@ -99,12 +99,12 @@ func TestConfigLoadFailureRendersJSONEnvelope(t *testing.T) {
 
 	workDir := t.TempDir()
 	lstkDir := filepath.Join(workDir, ".lstk")
-	must.NoError(t, os.MkdirAll(lstkDir, 0755))
-	must.NoError(t, os.WriteFile(filepath.Join(lstkDir, "config.toml"), []byte("[[containers]\ntype = \"aws\"\n"), 0644))
+	require.NoError(t, os.MkdirAll(lstkDir, 0755))
+	require.NoError(t, os.WriteFile(filepath.Join(lstkDir, "config.toml"), []byte("[[containers]\ntype = \"aws\"\n"), 0644))
 
 	stdout, stderr, err := runLstk(t, ctx, workDir, testEnvWithHome(t.TempDir(), ""), "stop", "--json")
 	requireExitCode(t, 1, err)
-	must.Empty(t, stderr, "the plain-text fallback in Execute() must not also fire alongside the envelope")
+	require.Empty(t, stderr, "the plain-text fallback in Execute() must not also fire alongside the envelope")
 
 	decodeEnvelope(t, stdout)
 	// error.message embeds the temp-dir config path, so it is masked.
@@ -122,12 +122,12 @@ func TestConfigNotFoundRendersJSONEnvelope(t *testing.T) {
 		"--config", missingConfig, "reset", "--force", "--json",
 	)
 	requireExitCode(t, 1, err)
-	must.Empty(t, stderr, "the plain-text fallback in Execute() must not also fire alongside the envelope")
+	require.Empty(t, stderr, "the plain-text fallback in Execute() must not also fire alongside the envelope")
 
 	envelope := decodeEnvelope(t, stdout)
-	must.Eq(t, "error", envelope.Status)
-	must.Eq(t, "reset", envelope.Command)
-	must.NotNil(t, envelope.Error)
-	must.Eq(t, "CONFIG_NOT_FOUND", envelope.Error.Code)
-	must.Eq(t, "CONFIG", envelope.Error.Category)
+	require.Equal(t, "error", envelope.Status)
+	require.Equal(t, "reset", envelope.Command)
+	require.NotNil(t, envelope.Error)
+	require.Equal(t, "CONFIG_NOT_FOUND", envelope.Error.Code)
+	require.Equal(t, "CONFIG", envelope.Error.Category)
 }
diff --git a/test/integration/json_flag_test.go b/test/integration/json_flag_test.go
index b9b0280a..36f9cac3 100644
--- a/test/integration/json_flag_test.go
+++ b/test/integration/json_flag_test.go
@@ -3,9 +3,9 @@ package integration_test
 import (
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // Most built-in commands haven't opted into --json output yet (see
@@ -19,12 +19,12 @@ func TestJSONFlagRejectsUnannotatedBuiltinCommand(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "status", "--json")
 	requireExitCode(t, 1, err)
 	envelope := decodeEnvelope(t, stdout)
-	must.Eq(t, "status", envelope.Command)
-	must.Eq(t, "error", envelope.Status)
-	must.NotNil(t, envelope.Error)
-	must.Eq(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
-	must.Contains(t, envelope.Error.Message, "status")
-	must.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
+	require.Equal(t, "status", envelope.Command)
+	require.Equal(t, "error", envelope.Status)
+	require.NotNil(t, envelope.Error)
+	require.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
+	require.Contains(t, envelope.Error.Message, "status")
+	require.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
 }
 
 func TestJSONFlagRejectsDefaultStartBehavior(t *testing.T) {
@@ -32,11 +32,11 @@ func TestJSONFlagRejectsDefaultStartBehavior(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--json")
 	requireExitCode(t, 1, err)
 	envelope := decodeEnvelope(t, stdout)
-	must.Eq(t, "start", envelope.Command)
-	must.Eq(t, "error", envelope.Status)
-	must.NotNil(t, envelope.Error)
-	must.Eq(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
-	must.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
+	require.Equal(t, "start", envelope.Command)
+	require.Equal(t, "error", envelope.Status)
+	require.NotNil(t, envelope.Error)
+	require.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
+	require.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
 }
 
 func TestJSONFlagDoesNotLaunchTUIOnPTY(t *testing.T) {
@@ -44,10 +44,10 @@ func TestJSONFlagDoesNotLaunchTUIOnPTY(t *testing.T) {
 
 	out, err := runLstkInPTY(t, testContext(t), testEnvWithHome(t.TempDir(), ""), "start", "--json")
 	requireExitCode(t, 1, err)
-	must.Contains(t, out, "start")
+	require.Contains(t, out, "start")
 	// If the TUI had launched, it would have shown the auth prompt (start with
 	// no auth token requires interactive login) rather than exiting immediately.
-	must.NotContains(t, out, "Press any key")
+	require.NotContains(t, out, "Press any key")
 }
 
 // proxyCase describes one proxy command's forwarding/rejection setup, shared
@@ -101,7 +101,7 @@ func TestJSONFlagProxyCommandsForwardJSON(t *testing.T) {
 			workDir, environ := tc.setup(t)
 			args := append([]string{tc.name, "--json"}, tc.args...)
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, environ, args...)
-			must.Error(t, err)
+			require.Error(t, err)
 			// The snapshot pins the wrapped tool's missing-binary error —
 			// proof --json was forwarded, not rejected by lstk.
 			snap.Match(t, sanitizeOutput(stdout+"\n"+stderr))
@@ -112,7 +112,7 @@ func TestJSONFlagProxyCommandsForwardJSON(t *testing.T) {
 			workDir, environ := tc.setup(t)
 			args := append(append([]string{tc.name}, tc.args...), "--json")
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, environ, args...)
-			must.Error(t, err)
+			require.Error(t, err)
 			snap.Match(t, sanitizeOutput(stdout+"\n"+stderr))
 		})
 	}
@@ -137,7 +137,7 @@ func TestJSONFlagProxyCommandsRejectBeforeCommandName(t *testing.T) {
 			requireExitCode(t, 1, err)
 			decodeEnvelope(t, stdout)
 			snap.MatchJSON(t, []byte(stdout))
-			must.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
+			require.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
 		})
 	}
 }
@@ -161,10 +161,10 @@ func TestJSONFlagBeforeCommandNameBooleanValues(t *testing.T) {
 	t.Run("--json=false before the command name is not rejected", func(t *testing.T) {
 		t.Parallel()
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).WithHome(t.TempDir()), "--json=false", "aws", "s3", "ls")
-		must.Error(t, err)
+		require.Error(t, err)
 		combined := stdout + stderr
-		must.Contains(t, combined, "not found in PATH", "the wrapped tool should have run (and failed for its own, unrelated reason)")
-		must.NotContains(t, combined, "is not able to provide output in JSON format")
+		require.Contains(t, combined, "not found in PATH", "the wrapped tool should have run (and failed for its own, unrelated reason)")
+		require.NotContains(t, combined, "is not able to provide output in JSON format")
 	})
 
 	t.Run("a malformed value before the command name is rejected", func(t *testing.T) {
@@ -184,12 +184,12 @@ func TestExtensionReceivesJSONFlagInContext(t *testing.T) {
 	environ := envWithPath(tmpHome, extDir)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "--json", "hello", "--foo")
-	must.NoError(t, err, stderr)
+	require.NoError(t, err, stderr)
 	// --json is consumed by lstk and conveyed via env, not forwarded; it also
 	// forces non-interactive rendering, so the extension sees that too.
 	snap.Match(t, sanitizeOutput(stdout))
 
 	stdoutDefault, stderrDefault, errDefault := runLstk(t, testContext(t), t.TempDir(), environ, "hello", "--foo")
-	must.NoError(t, errDefault, stderrDefault)
-	must.Contains(t, stdoutDefault, "JSON=false")
+	require.NoError(t, errDefault, stderrDefault)
+	require.Contains(t, stdoutDefault, "JSON=false")
 }
diff --git a/test/integration/license_test.go b/test/integration/license_test.go
index 8cbfa357..711d9ad7 100644
--- a/test/integration/license_test.go
+++ b/test/integration/license_test.go
@@ -18,9 +18,9 @@ import (
 	"time"
 
 	"github.com/creack/pty"
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/require"
 )
 
 func TestLicenseValidationSuccess(t *testing.T) {
@@ -75,12 +75,12 @@ func TestLicenseValidationSuccess(t *testing.T) {
 	default:
 	}
 
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
-	must.True(t, inspect.Container.State.Running, "container should be running")
+	require.NoError(t, err, "failed to inspect container")
+	require.True(t, inspect.Container.State.Running, "container should be running")
 }
 
 func TestLicenseValidationFailure(t *testing.T) {
@@ -93,17 +93,17 @@ func TestLicenseValidationFailure(t *testing.T) {
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL).With(env.AuthToken, "test-token-for-license-validation"), "start")
-	must.Error(t, err, "expected lstk start to fail with forbidden license")
+	require.Error(t, err, "expected lstk start to fail with forbidden license")
 	requireExitCode(t, 1, err)
 	// Not a snapshot: the output embeds pull-progress lines that depend on
 	// the runner's image cache and the live emulator image version.
-	must.Contains(t, stdout, "License validation failed")
-	must.Contains(t, stdout, "invalid, inactive, or expired")
-	must.Contains(t, stdout, "lstk logout", "the error should point at re-authentication")
-	must.NotContains(t, stderr, "license validation failed", "the error event replaces the raw stderr error")
+	require.Contains(t, stdout, "License validation failed")
+	require.Contains(t, stdout, "invalid, inactive, or expired")
+	require.Contains(t, stdout, "lstk logout", "the error should point at re-authentication")
+	require.NotContains(t, stderr, "license validation failed", "the error event replaces the raw stderr error")
 
 	_, err = dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.Error(t, err, "container should not exist after license failure")
+	require.Error(t, err, "container should not exist after license failure")
 }
 
 // TestLicenseRejectionOffersReloginAndRetries covers DEVX-658: a definitively
@@ -170,7 +170,7 @@ func TestLicenseRejectionOffersReloginAndRetries(t *testing.T) {
 	// An explicit config prevents firstRun=true, which would block the TUI on the
 	// emulator selection prompt before the license check runs.
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte("[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte("[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
 
 	p := startLstkInPTY(t, ctx, environ, "start", "--config", configFile)
 
@@ -222,13 +222,13 @@ func TestLicenseRejectionOffersReloginAndRetries(t *testing.T) {
 			t.Logf("health endpoint unreachable: %v", herr)
 		}
 	}
-	must.NoError(t, err, "start should succeed after re-login: %s", out)
-	must.True(t, staleRejected.Load(), "the stale token must have been rejected by the license server first")
-	must.Contains(t, out, "Valid license")
+	require.NoError(t, err, "start should succeed after re-login: %s", out)
+	require.True(t, staleRejected.Load(), "the stale token must have been rejected by the license server first")
+	require.Contains(t, out, "Valid license")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
-	must.True(t, inspect.Container.State.Running, "container should be running after the retried start")
+	require.NoError(t, err, "failed to inspect container")
+	require.True(t, inspect.Container.State.Running, "container should be running after the retried start")
 
 	// lstk's file-keyring fallback stores the token next to the active config
 	// file (ConfigDir follows --config), so on headless CI runners the token
@@ -237,13 +237,13 @@ func TestLicenseRejectionOffersReloginAndRetries(t *testing.T) {
 	var storedToken string
 	if useFileKeyring {
 		data, rerr := os.ReadFile(filepath.Join(filepath.Dir(configFile), authTokenFile))
-		must.NoError(t, rerr, "the re-logged-in token should be stored in the file keyring next to the config file")
+		require.NoError(t, rerr, "the re-logged-in token should be stored in the file keyring next to the config file")
 		storedToken = string(data)
 	} else {
 		storedToken, err = GetAuthTokenFromKeyring()
-		must.NoError(t, err, "the re-logged-in token should be stored in the system keyring")
+		require.NoError(t, err, "the re-logged-in token should be stored in the system keyring")
 	}
-	must.Eq(t, realToken, storedToken, "the fresh token must replace the rejected one")
+	require.Equal(t, realToken, storedToken, "the fresh token must replace the rejected one")
 }
 
 // TestLicenseRejectionEscDeclineShowsManualSteps covers DEVX-1045: the re-login
@@ -274,7 +274,7 @@ func TestLicenseRejectionEscDeclineShowsManualSteps(t *testing.T) {
 
 	tmpHome := t.TempDir()
 	configFile := filepath.Join(tmpHome, "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte("[[containers]]\ntype = \"aws\"\ntag = \"2020.1\"\nport = \"4591\"\n"), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte("[[containers]]\ntype = \"aws\"\ntag = \"2020.1\"\nport = \"4591\"\n"), 0644))
 
 	environ := append(testEnvWithHome(tmpHome, ""),
 		fmt.Sprintf("%s=%s", env.APIEndpoint, mockServer.URL),
@@ -288,7 +288,7 @@ func TestLicenseRejectionEscDeclineShowsManualSteps(t *testing.T) {
 	cmd := exec.CommandContext(ctx, binaryPath(), "start", "--config", configFile)
 	cmd.Env = environ
 	ptmx, err := pty.Start(cmd)
-	must.NoError(t, err, "failed to start command in PTY")
+	require.NoError(t, err, "failed to start command in PTY")
 	defer func() { _ = ptmx.Close() }()
 
 	out := &syncBuffer{}
@@ -297,7 +297,7 @@ func TestLicenseRejectionEscDeclineShowsManualSteps(t *testing.T) {
 		_, _ = io.Copy(out, ptmx)
 		close(outputCh)
 	}()
-	// must.Eventually's message args are evaluated before the wait, so the
+	// require.Eventually's message args are evaluated before the wait, so the
 	// transcript has to be logged from a cleanup to be of any use.
 	t.Cleanup(func() {
 		if t.Failed() {
@@ -305,25 +305,25 @@ func TestLicenseRejectionEscDeclineShowsManualSteps(t *testing.T) {
 		}
 	})
 
-	must.Eventually(t, func() bool {
+	require.Eventually(t, func() bool {
 		return bytes.Contains(out.Bytes(), []byte("ESC to exit"))
 	}, 60*time.Second, 100*time.Millisecond, "the re-login prompt must be on screen, advertising the decline key")
 
 	_, err = ptmx.Write([]byte{0x1b})
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	err = cmd.Wait()
 	<-outputCh
 	requireExitCode(t, 1, err)
-	must.Contains(t, out.String(), "License validation failed", "declining must render the failure")
-	must.Contains(t, out.String(), "lstk logout", "declining must point at the manual recovery")
-	must.Contains(t, out.String(), "LOCALSTACK_AUTH_TOKEN", "declining must mention the env var alternative")
+	require.Contains(t, out.String(), "License validation failed", "declining must render the failure")
+	require.Contains(t, out.String(), "lstk logout", "declining must point at the manual recovery")
+	require.Contains(t, out.String(), "LOCALSTACK_AUTH_TOKEN", "declining must mention the env var alternative")
 }
 
 func licenseFilePath(t *testing.T) string {
 	t.Helper()
 	cacheDir, err := os.UserCacheDir()
-	must.NoError(t, err)
+	require.NoError(t, err)
 	return filepath.Join(cacheDir, "lstk", "license.json")
 }
 
@@ -348,14 +348,14 @@ func TestLicenseCacheAndMount(t *testing.T) {
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 
 	data, err := os.ReadFile(licenseFilePath(t))
-	must.NoError(t, err, "license cache file should exist after successful start")
-	must.Eq(t, licenseBody, string(data))
+	require.NoError(t, err, "license cache file should exist after successful start")
+	require.Equal(t, licenseBody, string(data))
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
+	require.NoError(t, err, "failed to inspect container")
 
 	var mounted bool
 	for _, m := range inspect.Container.Mounts {
@@ -364,5 +364,5 @@ func TestLicenseCacheAndMount(t *testing.T) {
 			break
 		}
 	}
-	must.True(t, mounted, "license file should be mounted into container at /etc/localstack/conf.d/license.json")
+	require.True(t, mounted, "license file should be mounted into container at /etc/localstack/conf.d/license.json")
 }
diff --git a/test/integration/localstack_test.go b/test/integration/localstack_test.go
index 0e6696bf..97fae72f 100644
--- a/test/integration/localstack_test.go
+++ b/test/integration/localstack_test.go
@@ -5,8 +5,8 @@ import (
 	"os"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // Helpers for e2e tests that need a *real* LocalStack — one that serves the AWS
@@ -53,7 +53,7 @@ func startRealLocalStack(t *testing.T, ctx context.Context, token string) {
 func startRealLocalStackWithConfig(t *testing.T, ctx context.Context, token, configPath string) {
 	t.Helper()
 	home, err := os.MkdirTemp("", "lstk-e2e-home")
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() { _ = os.RemoveAll(home) })
 
 	e := env.With(env.DisableEvents, "1").WithHome(home).With(env.AuthToken, token)
@@ -65,5 +65,5 @@ func startRealLocalStackWithConfig(t *testing.T, ctx context.Context, token, con
 	stdout, stderr, err := runLstk(t, ctx, "", e, args...)
 	// User-facing failures render through the sink on stdout; stderr alone is
 	// usually empty when start fails.
-	must.NoError(t, err, "lstk start failed: stdout: %s\nstderr: %s", stdout, stderr)
+	require.NoError(t, err, "lstk start failed: stdout: %s\nstderr: %s", stdout, stderr)
 }
diff --git a/test/integration/logging_test.go b/test/integration/logging_test.go
index 3eeeed9d..c8babecc 100644
--- a/test/integration/logging_test.go
+++ b/test/integration/logging_test.go
@@ -6,7 +6,7 @@ import (
 	"runtime"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
+	"github.com/stretchr/testify/require"
 )
 
 func TestLogging_NonTTY_WritesToLogFile(t *testing.T) {
@@ -17,35 +17,35 @@ func TestLogging_NonTTY_WritesToLogFile(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		logPath = filepath.Join(tmpHome, "AppData", "Roaming", "lstk", "lstk.log")
 	} else {
-		must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+		require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 		logPath = filepath.Join(tmpHome, ".config", "lstk", "lstk.log")
 	}
 	e := testEnvWithHome(tmpHome, "")
 
 	ctx := testContext(t)
 	_, _, err := runLstk(t, ctx, "", e, "--version")
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	logContents, err := os.ReadFile(logPath)
-	must.NoError(t, err, "expected lstk.log to be created at %s", logPath)
-	must.Contains(t, string(logContents), "[INFO] lstk")
-	must.Contains(t, string(logContents), "starting")
+	require.NoError(t, err, "expected lstk.log to be created at %s", logPath)
+	require.Contains(t, string(logContents), "[INFO] lstk")
+	require.Contains(t, string(logContents), "starting")
 }
 
 func TestLogging_TTY_WritesToLogFile(t *testing.T) {
 	t.Parallel()
 
 	tmpHome := t.TempDir()
-	must.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
+	require.NoError(t, os.MkdirAll(filepath.Join(tmpHome, ".config"), 0755))
 	logPath := filepath.Join(tmpHome, ".config", "lstk", "lstk.log")
 	e := testEnvWithHome(tmpHome, "")
 
 	ctx := testContext(t)
 	_, err := runLstkInPTY(t, ctx, e, "--version")
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	logContents, err := os.ReadFile(logPath)
-	must.NoError(t, err, "expected lstk.log to be created at %s", logPath)
-	must.Contains(t, string(logContents), "[INFO] lstk")
-	must.Contains(t, string(logContents), "starting")
+	require.NoError(t, err, "expected lstk.log to be created at %s", logPath)
+	require.Contains(t, string(logContents), "[INFO] lstk")
+	require.Contains(t, string(logContents), "starting")
 }
diff --git a/test/integration/login_test.go b/test/integration/login_test.go
index 8442e378..dc55e4f9 100644
--- a/test/integration/login_test.go
+++ b/test/integration/login_test.go
@@ -12,8 +12,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // createMockAPIServer creates a mock LocalStack API server for testing
@@ -28,9 +28,9 @@ func createMockAPIServer(t *testing.T, licenseToken string, confirmed bool) *htt
 			// Validate request payload
 			var payload map[string]string
 			err := json.NewDecoder(r.Body).Decode(&payload)
-			must.NoError(t, err, "failed to decode auth request payload")
-			must.Eq(t, "lstk", payload["actor"], "actor should be lstk")
-			must.NotEmpty(t, payload["version"], "version should not be empty")
+			require.NoError(t, err, "failed to decode auth request payload")
+			require.Equal(t, "lstk", payload["actor"], "actor should be lstk")
+			require.NotEmpty(t, payload["version"], "version should not be empty")
 
 			w.WriteHeader(http.StatusCreated)
 			err = json.NewEncoder(w).Encode(map[string]string{
@@ -38,14 +38,14 @@ func createMockAPIServer(t *testing.T, licenseToken string, confirmed bool) *htt
 				"code":           "TEST123",
 				"exchange_token": exchangeToken,
 			})
-			must.NoError(t, err)
+			require.NoError(t, err)
 
 		case r.Method == "GET" && r.URL.Path == fmt.Sprintf("/v1/auth/request/%s", authReqID):
 			w.WriteHeader(http.StatusOK)
 			err := json.NewEncoder(w).Encode(map[string]bool{
 				"confirmed": confirmed,
 			})
-			must.NoError(t, err)
+			require.NoError(t, err)
 
 		case r.Method == "POST" && r.URL.Path == fmt.Sprintf("/v1/auth/request/%s/exchange", authReqID):
 			w.WriteHeader(http.StatusOK)
@@ -53,14 +53,14 @@ func createMockAPIServer(t *testing.T, licenseToken string, confirmed bool) *htt
 				"id":         authReqID,
 				"auth_token": bearerToken,
 			})
-			must.NoError(t, err)
+			require.NoError(t, err)
 
 		case r.Method == "GET" && r.URL.Path == "/v1/license/credentials":
 			w.WriteHeader(http.StatusOK)
 			err := json.NewEncoder(w).Encode(map[string]string{
 				"token": licenseToken,
 			})
-			must.NoError(t, err)
+			require.NoError(t, err)
 
 		case r.Method == "POST" && r.URL.Path == "/v1/license/request":
 			w.WriteHeader(http.StatusOK)
@@ -123,22 +123,22 @@ func TestDeviceFlowSuccess(t *testing.T) {
 	p.write("\r")
 
 	out, err := p.wait()
-	must.NoError(t, err, "login should succeed: %s", out)
+	require.NoError(t, err, "login should succeed: %s", out)
 	requireExitCode(t, 0, err)
-	must.Eq(t, mockServer.URL+"/auth/request/test-auth-req-id?code=TEST123", openedURL(), "login should open the auth URL in a browser")
-	must.Contains(t, out, "Opening browser to login...")
-	must.Contains(t, out, "Browser didn't open? Visit")
-	must.Contains(t, out, "/auth/request/test-auth-req-id?code=TEST123")
-	must.Contains(t, out, "Waiting for authorization")
-	must.Contains(t, out, "Checking if auth request is confirmed")
-	must.Contains(t, out, "Auth request confirmed")
-	must.Contains(t, out, "Fetching license token")
-	must.Contains(t, out, "Login successful")
+	require.Equal(t, mockServer.URL+"/auth/request/test-auth-req-id?code=TEST123", openedURL(), "login should open the auth URL in a browser")
+	require.Contains(t, out, "Opening browser to login...")
+	require.Contains(t, out, "Browser didn't open? Visit")
+	require.Contains(t, out, "/auth/request/test-auth-req-id?code=TEST123")
+	require.Contains(t, out, "Waiting for authorization")
+	require.Contains(t, out, "Checking if auth request is confirmed")
+	require.Contains(t, out, "Auth request confirmed")
+	require.Contains(t, out, "Fetching license token")
+	require.Contains(t, out, "Login successful")
 
 	// Verify token was stored in keyring
 	storedToken, err := GetAuthTokenFromKeyring()
-	must.NoError(t, err)
-	must.Eq(t, licenseToken, storedToken)
+	require.NoError(t, err)
+	require.Equal(t, licenseToken, storedToken)
 	assertCommandTelemetry(t, events, "login", 0)
 }
 
@@ -163,19 +163,19 @@ func TestDeviceFlowFailure_RequestNotConfirmed(t *testing.T) {
 	p.write("\r")
 
 	out, err := p.wait()
-	must.Error(t, err, "expected login to fail when request not confirmed")
+	require.Error(t, err, "expected login to fail when request not confirmed")
 	requireExitCode(t, 1, err)
-	must.Eq(t, mockServer.URL+"/auth/request/test-auth-req-id?code=TEST123", openedURL(), "login should open the auth URL in a browser")
-	must.Contains(t, out, "Opening browser to login...")
-	must.Contains(t, out, "Browser didn't open? Visit")
-	must.Contains(t, out, "/auth/request/test-auth-req-id?code=TEST123")
-	must.Contains(t, out, "Waiting for authorization")
-	must.Contains(t, out, "Checking if auth request is confirmed")
-	must.Contains(t, out, "auth request not confirmed")
+	require.Equal(t, mockServer.URL+"/auth/request/test-auth-req-id?code=TEST123", openedURL(), "login should open the auth URL in a browser")
+	require.Contains(t, out, "Opening browser to login...")
+	require.Contains(t, out, "Browser didn't open? Visit")
+	require.Contains(t, out, "/auth/request/test-auth-req-id?code=TEST123")
+	require.Contains(t, out, "Waiting for authorization")
+	require.Contains(t, out, "Checking if auth request is confirmed")
+	require.Contains(t, out, "auth request not confirmed")
 
 	// Verify no token was stored in keyring
 	_, err = GetAuthTokenFromKeyring()
-	must.Error(t, err, "no token should be stored when login fails")
+	require.Error(t, err, "no token should be stored when login fails")
 	assertCommandTelemetry(t, events, "login", 1)
 }
 
@@ -185,11 +185,11 @@ func TestLoginShortCircuitsWhenEnvTokenSet(t *testing.T) {
 	environ := append(testEnvWithHome(t.TempDir(), ""), string(env.AuthToken)+"=fake-env-token")
 
 	out, err := runLstkInPTY(t, testContext(t), environ, "login")
-	must.NoError(t, err, "login should succeed when env token is set: %s", out)
+	require.NoError(t, err, "login should succeed when env token is set: %s", out)
 	requireExitCode(t, 0, err)
-	must.Contains(t, out, "You're already logged in")
-	must.NotContains(t, out, "Opening browser")
-	must.NotContains(t, out, "Waiting for authorization")
+	require.Contains(t, out, "You're already logged in")
+	require.NotContains(t, out, "Opening browser")
+	require.NotContains(t, out, "Waiting for authorization")
 }
 
 func TestLoginShortCircuitsWhenStoredTokenExists(t *testing.T) {
@@ -197,15 +197,15 @@ func TestLoginShortCircuitsWhenStoredTokenExists(t *testing.T) {
 
 	tmpHome := t.TempDir()
 	tokenDir := filepath.Join(tmpHome, ".config", "lstk")
-	must.NoError(t, os.MkdirAll(tokenDir, 0700))
-	must.NoError(t, os.WriteFile(filepath.Join(tokenDir, "auth-token"), []byte("stored-token"), 0600))
+	require.NoError(t, os.MkdirAll(tokenDir, 0700))
+	require.NoError(t, os.WriteFile(filepath.Join(tokenDir, "auth-token"), []byte("stored-token"), 0600))
 
 	environ := env.Environ(testEnvWithHome(tmpHome, "")).Without(env.AuthToken)
 
 	out, err := runLstkInPTY(t, testContext(t), environ, "login")
-	must.NoError(t, err, "login should succeed when stored token exists: %s", out)
+	require.NoError(t, err, "login should succeed when stored token exists: %s", out)
 	requireExitCode(t, 0, err)
-	must.Contains(t, out, "You're already logged in")
-	must.NotContains(t, out, "Opening browser")
-	must.NotContains(t, out, "Waiting for authorization")
+	require.Contains(t, out, "You're already logged in")
+	require.NotContains(t, out, "Opening browser")
+	require.NotContains(t, out, "Waiting for authorization")
 }
diff --git a/test/integration/logout_test.go b/test/integration/logout_test.go
index 658244a8..65ad699b 100644
--- a/test/integration/logout_test.go
+++ b/test/integration/logout_test.go
@@ -6,9 +6,9 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/require"
 )
 
 func TestLogoutCommandRemovesToken(t *testing.T) {
@@ -18,16 +18,16 @@ func TestLogoutCommandRemovesToken(t *testing.T) {
 	})
 
 	err := SetAuthTokenInKeyring("test-token")
-	must.NoError(t, err, "failed to store token in keyring")
+	require.NoError(t, err, "failed to store token in keyring")
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, stderr, err := runLstk(t, testContext(t), "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "logout")
-	must.NoError(t, err, "lstk logout failed: %s", stderr)
+	require.NoError(t, err, "lstk logout failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdout, "Logged out successfully")
+	require.Contains(t, stdout, "Logged out successfully")
 
 	_, err = GetAuthTokenFromKeyring()
-	must.Error(t, err, "token should be removed from keyring")
+	require.Error(t, err, "token should be removed from keyring")
 	assertCommandTelemetry(t, events, "logout", 0)
 }
 
@@ -36,9 +36,9 @@ func TestLogoutCommandSucceedsWhenNoToken(t *testing.T) {
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, stderr, err := runLstk(t, testContext(t), "", env.Without(env.AuthToken).With(env.AnalyticsEndpoint, analyticsSrv.URL), "logout")
-	must.NoError(t, err, "lstk logout should succeed even with no token: %s", stderr)
+	require.NoError(t, err, "lstk logout should succeed even with no token: %s", stderr)
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdout, "Not currently logged in")
+	require.Contains(t, stdout, "Not currently logged in")
 	assertCommandTelemetry(t, events, "logout", 0)
 }
 
@@ -46,9 +46,9 @@ func TestLogoutCommandWithEnvVarToken(t *testing.T) {
 	_ = DeleteAuthTokenFromKeyring()
 
 	stdout, stderr, err := runLstk(t, testContext(t), "", env.Without(env.AuthToken).With(env.AuthToken, "test-env-token"), "logout")
-	must.NoError(t, err, "lstk logout should succeed: %s", stderr)
+	require.NoError(t, err, "lstk logout should succeed: %s", stderr)
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdout, "LOCALSTACK_AUTH_TOKEN")
+	require.Contains(t, stdout, "LOCALSTACK_AUTH_TOKEN")
 }
 
 func TestLogoutCommandNotesWhenEmulatorStillRunning(t *testing.T) {
@@ -63,12 +63,12 @@ func TestLogoutCommandNotesWhenEmulatorStillRunning(t *testing.T) {
 	startTestContainer(t, ctx)
 
 	err := SetAuthTokenInKeyring("test-token")
-	must.NoError(t, err, "failed to store token in keyring")
+	require.NoError(t, err, "failed to store token in keyring")
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "logout")
-	must.NoError(t, err, "lstk logout failed: %s", stderr)
+	require.NoError(t, err, "lstk logout failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdout, "LocalStack AWS Emulator is still running in the background")
+	require.Contains(t, stdout, "LocalStack AWS Emulator is still running in the background")
 }
 
 func TestLogoutCommandReportsBothEmulatorsWhenMultipleRunning(t *testing.T) {
@@ -86,9 +86,9 @@ func TestLogoutCommandReportsBothEmulatorsWhenMultipleRunning(t *testing.T) {
 	const fakeAWSImage = "localstack/localstack-pro:test-fake"
 	const fakeSnowflakeImage = "localstack/snowflake:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeAWSImage})
-	must.NoError(t, err)
+	require.NoError(t, err)
 	_, err = dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeSnowflakeImage})
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeAWSImage, client.ImageRemoveOptions{})
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeSnowflakeImage, client.ImageRemoveOptions{})
@@ -96,10 +96,10 @@ func TestLogoutCommandReportsBothEmulatorsWhenMultipleRunning(t *testing.T) {
 	startExternalContainer(t, ctx, fakeAWSImage, "localstack-external-aws", "4566")
 	startExternalContainer(t, ctx, fakeSnowflakeImage, "localstack-external-snowflake", "4567")
 
-	must.NoError(t, SetAuthTokenInKeyring("test-token"), "failed to store token in keyring")
+	require.NoError(t, SetAuthTokenInKeyring("test-token"), "failed to store token in keyring")
 
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(`
+	require.NoError(t, os.WriteFile(configFile, []byte(`
 [[containers]]
 type = "aws"
 tag  = "test-fake"
@@ -112,9 +112,9 @@ port = "4567"
 `), 0644))
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "--config", configFile, "logout")
-	must.NoError(t, err, "lstk logout failed: %s", stderr)
+	require.NoError(t, err, "lstk logout failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdout, "LocalStack AWS Emulator, LocalStack Snowflake Emulator are still running in the background")
+	require.Contains(t, stdout, "LocalStack AWS Emulator, LocalStack Snowflake Emulator are still running in the background")
 }
 
 func TestLogoutCommandDoesNotReportForeignEmulatorAsRunning(t *testing.T) {
@@ -132,19 +132,19 @@ func TestLogoutCommandDoesNotReportForeignEmulatorAsRunning(t *testing.T) {
 	// AWS image running on 4566 while config targets snowflake.
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
 	startExternalContainer(t, ctx, fakeImage, "localstack-external-aws", "4566")
 
-	must.NoError(t, SetAuthTokenInKeyring("test-token"), "failed to store token in keyring")
+	require.NoError(t, SetAuthTokenInKeyring("test-token"), "failed to store token in keyring")
 
 	configFile := writeSnowflakeConfig(t, "4566")
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "--config", configFile, "logout")
-	must.NoError(t, err, "lstk logout failed: %s", stderr)
+	require.NoError(t, err, "lstk logout failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	must.NotContains(t, stdout, "still running",
+	require.NotContains(t, stdout, "still running",
 		"snowflake-targeted logout should not detect the AWS container as the configured emulator")
 }
diff --git a/test/integration/logs_test.go b/test/integration/logs_test.go
index ab5c5b15..5f627bcf 100644
--- a/test/integration/logs_test.go
+++ b/test/integration/logs_test.go
@@ -12,9 +12,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/require"
 )
 
 // writeAwsConfig writes a minimal aws-only config so tests don't inherit the
@@ -23,7 +23,7 @@ import (
 func writeAwsConfig(t *testing.T) string {
 	t.Helper()
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(`
+	require.NoError(t, os.WriteFile(configFile, []byte(`
 [[containers]]
 type = "aws"
 tag  = "latest"
@@ -43,7 +43,7 @@ func TestLogsExitsByDefault(t *testing.T) {
 	configFile := writeAwsConfig(t)
 	analyticsSrv, events := mockAnalyticsServer(t)
 	_, _, err := runLstk(t, ctx, "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "--config", configFile, "logs")
-	must.NoError(t, err, "lstk logs should exit cleanly when container is running")
+	require.NoError(t, err, "lstk logs should exit cleanly when container is running")
 	requireExitCode(t, 0, err)
 	assertCommandTelemetry(t, events, "logs", 0)
 }
@@ -56,9 +56,9 @@ func TestLogsCommandFailsWhenNotRunning(t *testing.T) {
 	configFile := writeAwsConfig(t)
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "--config", configFile, "logs", "--follow")
-	must.Error(t, err, "expected lstk logs --follow to fail when container not running")
+	require.Error(t, err, "expected lstk logs --follow to fail when container not running")
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "LocalStack AWS Emulator is not running")
+	require.Contains(t, stdout, "LocalStack AWS Emulator is not running")
 	assertCommandTelemetry(t, events, "logs", 1)
 }
 
@@ -74,7 +74,7 @@ func TestLogsWorksWithExternalContainer(t *testing.T) {
 
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -84,7 +84,7 @@ func TestLogsWorksWithExternalContainer(t *testing.T) {
 	configFile := writeAwsConfig(t)
 	analyticsSrv, events := mockAnalyticsServer(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "--config", configFile, "logs")
-	must.NoError(t, err, "lstk logs should work with externally-named container: %s", stderr)
+	require.NoError(t, err, "lstk logs should work with externally-named container: %s", stderr)
 	requireExitCode(t, 0, err)
 	assertCommandTelemetry(t, events, "logs", 0)
 }
@@ -119,11 +119,11 @@ func writeContainerLogs(t *testing.T, ctx context.Context, script, lastMarker st
 	execResp, err := dockerClient.ExecCreate(ctx, containerName, client.ExecCreateOptions{
 		Cmd: []string{"sh", "-c", "{ " + script + " } >/proc/1/fd/1"},
 	})
-	must.NoError(t, err, "failed to create exec")
+	require.NoError(t, err, "failed to create exec")
 	_, err = dockerClient.ExecStart(ctx, execResp.ID, client.ExecStartOptions{Detach: true})
-	must.NoError(t, err, "failed to start exec")
+	require.NoError(t, err, "failed to start exec")
 
-	must.Eventually(t, func() bool {
+	require.Eventually(t, func() bool {
 		reader, err := dockerClient.ContainerLogs(ctx, containerName, client.ContainerLogsOptions{
 			ShowStdout: true,
 			ShowStderr: true,
@@ -158,9 +158,9 @@ func TestLogsTailCountsVisibleLinesNotFilteredOnes(t *testing.T) {
 
 	configFile := writeAwsConfig(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.Without(), "--config", configFile, "logs", "--tail", "1")
-	must.NoError(t, err, "lstk logs --tail 1 should exit cleanly, stderr: %s", stderr)
-	must.Contains(t, stdout, "tail-visible-marker", "--tail 1 must show the newest visible line, not an empty result")
-	must.NotContains(t, stdout, "tail-filtered-marker", "filtered request logs must stay hidden")
+	require.NoError(t, err, "lstk logs --tail 1 should exit cleanly, stderr: %s", stderr)
+	require.Contains(t, stdout, "tail-visible-marker", "--tail 1 must show the newest visible line, not an empty result")
+	require.NotContains(t, stdout, "tail-filtered-marker", "filtered request logs must stay hidden")
 }
 
 func TestLogsTailLimitsOutput(t *testing.T) {
@@ -177,12 +177,12 @@ func TestLogsTailLimitsOutput(t *testing.T) {
 	for _, flags := range [][]string{{"--tail", "3"}, {"-n", "3"}} {
 		args := append([]string{"--config", configFile, "logs"}, flags...)
 		stdout, stderr, err := runLstk(t, ctx, "", env.Without(), args...)
-		must.NoError(t, err, "lstk logs %s should exit cleanly, stderr: %s", strings.Join(flags, " "), stderr)
+		require.NoError(t, err, "lstk logs %s should exit cleanly, stderr: %s", strings.Join(flags, " "), stderr)
 		for i := 8; i <= 10; i++ {
-			must.Contains(t, stdout, fmt.Sprintf("tail-marker-%d", i), "last 3 lines should be shown with %s", strings.Join(flags, " "))
+			require.Contains(t, stdout, fmt.Sprintf("tail-marker-%d", i), "last 3 lines should be shown with %s", strings.Join(flags, " "))
 		}
 		for i := 1; i <= 7; i++ {
-			must.NotContains(t, stdout, fmt.Sprintf("tail-marker-%d\n", i), "older lines should be cut off with %s", strings.Join(flags, " "))
+			require.NotContains(t, stdout, fmt.Sprintf("tail-marker-%d\n", i), "older lines should be cut off with %s", strings.Join(flags, " "))
 		}
 	}
 }
@@ -198,9 +198,9 @@ func TestLogsWithoutTailShowsAllLines(t *testing.T) {
 
 	configFile := writeAwsConfig(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.Without(), "--config", configFile, "logs")
-	must.NoError(t, err, "lstk logs should exit cleanly, stderr: %s", stderr)
+	require.NoError(t, err, "lstk logs should exit cleanly, stderr: %s", stderr)
 	for i := 1; i <= 10; i++ {
-		must.Contains(t, stdout, fmt.Sprintf("tail-marker-%d", i), "all lines should be shown without --tail")
+		require.Contains(t, stdout, fmt.Sprintf("tail-marker-%d", i), "all lines should be shown without --tail")
 	}
 }
 
@@ -209,10 +209,10 @@ func TestLogsTailRejectsInvalidValue(t *testing.T) {
 
 	configFile := writeAwsConfig(t)
 	_, stderr, err := runLstk(t, testContext(t), "", env.Without(), "--config", configFile, "logs", "--tail", "bogus")
-	must.Error(t, err, "expected lstk logs --tail bogus to fail")
+	require.Error(t, err, "expected lstk logs --tail bogus to fail")
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "bogus", "error should name the invalid value")
-	must.Contains(t, stderr, "--tail", "error should name the flag")
+	require.Contains(t, stderr, "bogus", "error should name the invalid value")
+	require.Contains(t, stderr, "--tail", "error should name the flag")
 }
 
 func TestLogsTailWithFollowStartsFromTail(t *testing.T) {
@@ -229,10 +229,10 @@ func TestLogsTailWithFollowStartsFromTail(t *testing.T) {
 	logsCmd := exec.CommandContext(ctx, binaryPath(), "--config", configFile, "logs", "--follow", "--tail", "3")
 	logsCmd.Env = env.Without()
 	stdout, err := logsCmd.StdoutPipe()
-	must.NoError(t, err, "failed to get stdout pipe")
+	require.NoError(t, err, "failed to get stdout pipe")
 
 	err = logsCmd.Start()
-	must.NoError(t, err, "failed to start lstk logs --follow --tail 3")
+	require.NoError(t, err, "failed to start lstk logs --follow --tail 3")
 	t.Cleanup(func() { _ = logsCmd.Process.Kill() })
 
 	// The backlog is capped at the last 3 lines, so the first line streamed
@@ -251,7 +251,7 @@ func TestLogsTailWithFollowStartsFromTail(t *testing.T) {
 
 	select {
 	case line := <-firstLine:
-		must.Contains(t, line, "tail-marker-8", "follow should start from the last 3 lines")
+		require.Contains(t, line, "tail-marker-8", "follow should start from the last 3 lines")
 	case <-ctx.Done():
 		t.Fatal("no marker appeared in lstk logs --follow --tail output within timeout")
 	}
@@ -273,10 +273,10 @@ func TestLogsInteractivePreservesFullScrollback(t *testing.T) {
 
 	configFile := writeAwsConfig(t)
 	out, err := runLstkInPTY(t, ctx, env.Without(), "--config", configFile, "logs")
-	must.NoError(t, err, "lstk logs should exit cleanly in interactive mode, output: %s", out)
+	require.NoError(t, err, "lstk logs should exit cleanly in interactive mode, output: %s", out)
 
 	for i := 1; i <= lineCount; i++ {
-		must.Contains(t, out, fmt.Sprintf("tail-marker-%d", i), "expected tail-marker-%d to survive scrollback", i)
+		require.Contains(t, out, fmt.Sprintf("tail-marker-%d", i), "expected tail-marker-%d to survive scrollback", i)
 	}
 }
 
@@ -294,10 +294,10 @@ func TestLogsFollowStreamsOutput(t *testing.T) {
 	// Uses StdoutPipe for streaming — cannot use runLstk.
 	logsCmd := exec.CommandContext(ctx, binaryPath(), "--config", configFile, "logs", "--follow")
 	stdout, err := logsCmd.StdoutPipe()
-	must.NoError(t, err, "failed to get stdout pipe")
+	require.NoError(t, err, "failed to get stdout pipe")
 
 	err = logsCmd.Start()
-	must.NoError(t, err, "failed to start lstk logs --follow")
+	require.NoError(t, err, "failed to start lstk logs --follow")
 	t.Cleanup(func() { _ = logsCmd.Process.Kill() })
 
 	// Give lstk logs a moment to connect before generating output
@@ -307,9 +307,9 @@ func TestLogsFollowStreamsOutput(t *testing.T) {
 	execResp, err := dockerClient.ExecCreate(ctx, containerName, client.ExecCreateOptions{
 		Cmd: []string{"sh", "-c", "echo " + marker + " >/proc/1/fd/1"},
 	})
-	must.NoError(t, err, "failed to create exec")
+	require.NoError(t, err, "failed to create exec")
 	_, err = dockerClient.ExecStart(ctx, execResp.ID, client.ExecStartOptions{Detach: true})
-	must.NoError(t, err, "failed to start exec")
+	require.NoError(t, err, "failed to start exec")
 
 	// Scan lines in a goroutine because reading from the pipe blocks until lstk logs exits, which it never does on its own.
 	found := make(chan struct{}, 1)
diff --git a/test/integration/main_test.go b/test/integration/main_test.go
index 65920a74..f8b41d36 100644
--- a/test/integration/main_test.go
+++ b/test/integration/main_test.go
@@ -19,11 +19,11 @@ import (
 
 	"net/netip"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/api/types/network"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/require"
 	"github.com/zalando/go-keyring"
 )
 
@@ -183,7 +183,7 @@ func startTestContainer(t *testing.T, ctx context.Context, hostPort ...string) {
 	t.Helper()
 
 	reader, err := dockerClient.ImagePull(ctx, testImage, client.ImagePullOptions{})
-	must.NoError(t, err, "failed to pull test image")
+	require.NoError(t, err, "failed to pull test image")
 	_, _ = io.Copy(io.Discard, reader)
 	_ = reader.Close()
 
@@ -208,9 +208,9 @@ func startTestContainer(t *testing.T, ctx context.Context, hostPort ...string) {
 		HostConfig: hostCfg,
 		Name:       containerName,
 	})
-	must.NoError(t, err, "failed to create test container")
+	require.NoError(t, err, "failed to create test container")
 	_, err = dockerClient.ContainerStart(ctx, resp.ID, client.ContainerStartOptions{})
-	must.NoError(t, err, "failed to start test container")
+	require.NoError(t, err, "failed to start test container")
 }
 
 // Use this to simulate a LocalStack container started outside lstk.
@@ -231,9 +231,9 @@ func startExternalContainer(t *testing.T, ctx context.Context, imgName, name, ho
 		},
 		Name: name,
 	})
-	must.NoError(t, err, "failed to create external container")
+	require.NoError(t, err, "failed to create external container")
 	_, err = dockerClient.ContainerStart(ctx, resp.ID, client.ContainerStartOptions{})
-	must.NoError(t, err, "failed to start external container")
+	require.NoError(t, err, "failed to start external container")
 	t.Cleanup(func() {
 		_, _ = dockerClient.ContainerRemove(context.Background(), name, client.ContainerRemoveOptions{Force: true})
 	})
@@ -251,7 +251,7 @@ func commitNeverHealthyImage(t *testing.T, ctx context.Context) string {
 	t.Helper()
 
 	reader, err := dockerClient.ImagePull(ctx, testImage, client.ImagePullOptions{})
-	must.NoError(t, err, "failed to pull test image")
+	require.NoError(t, err, "failed to pull test image")
 	_, _ = io.Copy(io.Discard, reader)
 	_ = reader.Close()
 
@@ -259,7 +259,7 @@ func commitNeverHealthyImage(t *testing.T, ctx context.Context) string {
 		Config: &container.Config{Image: testImage},
 		Name:   "lstk-never-healthy-src",
 	})
-	must.NoError(t, err, "failed to create source container")
+	require.NoError(t, err, "failed to create source container")
 	t.Cleanup(func() {
 		_, _ = dockerClient.ContainerRemove(context.Background(), resp.ID, client.ContainerRemoveOptions{Force: true})
 	})
@@ -269,7 +269,7 @@ func commitNeverHealthyImage(t *testing.T, ctx context.Context) string {
 		Reference: imageRef,
 		Changes:   []string{`CMD ["sleep", "infinity"]`},
 	})
-	must.NoError(t, err, "failed to commit never-healthy image")
+	require.NoError(t, err, "failed to commit never-healthy image")
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), imageRef, client.ImageRemoveOptions{Force: true})
 	})
@@ -292,7 +292,7 @@ func startNamedTestContainer(t *testing.T, ctx context.Context, name, label stri
 	t.Helper()
 
 	reader, err := dockerClient.ImagePull(ctx, testImage, client.ImagePullOptions{})
-	must.NoError(t, err, "failed to pull test image")
+	require.NoError(t, err, "failed to pull test image")
 	_, _ = io.Copy(io.Discard, reader)
 	_ = reader.Close()
 
@@ -303,9 +303,9 @@ func startNamedTestContainer(t *testing.T, ctx context.Context, name, label stri
 		},
 		Name: name,
 	})
-	must.NoError(t, err, "failed to create %s test container", label)
+	require.NoError(t, err, "failed to create %s test container", label)
 	_, err = dockerClient.ContainerStart(ctx, resp.ID, client.ContainerStartOptions{})
-	must.NoError(t, err, "failed to start %s test container", label)
+	require.NoError(t, err, "failed to start %s test container", label)
 }
 
 func testContext(t *testing.T) context.Context {
@@ -319,7 +319,7 @@ func runLstk(t *testing.T, ctx context.Context, dir string, env []string, args .
 	t.Helper()
 
 	binPath, err := filepath.Abs(binaryPath())
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	cmd := exec.CommandContext(ctx, binPath, args...)
 	cmd.Dir = dir
@@ -339,12 +339,12 @@ func runLstk(t *testing.T, ctx context.Context, dir string, env []string, args .
 func requireExitCode(t *testing.T, expected int, err error) {
 	t.Helper()
 	if expected == 0 {
-		must.NoError(t, err)
+		require.NoError(t, err)
 		return
 	}
 	var exitErr *exec.ExitError
-	must.ErrorAs(t, err, &exitErr)
-	must.Eq(t, expected, exitErr.ExitCode())
+	require.ErrorAs(t, err, &exitErr)
+	require.Equal(t, expected, exitErr.ExitCode())
 }
 
 func createMockLicenseServer(success bool) *httptest.Server {
diff --git a/test/integration/multiple_installs_test.go b/test/integration/multiple_installs_test.go
index 4ad60d73..083f2b15 100644
--- a/test/integration/multiple_installs_test.go
+++ b/test/integration/multiple_installs_test.go
@@ -6,8 +6,8 @@ import (
 	"runtime"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // copyBinaryTo copies the built lstk binary into dir under the platform's
@@ -16,15 +16,15 @@ import (
 func copyBinaryTo(t *testing.T, dir string) string {
 	t.Helper()
 	src, err := filepath.Abs(binaryPath())
-	must.NoError(t, err)
+	require.NoError(t, err)
 	data, err := os.ReadFile(src)
-	must.NoError(t, err)
+	require.NoError(t, err)
 	name := "lstk"
 	if runtime.GOOS == "windows" {
 		name = "lstk.exe"
 	}
 	dst := filepath.Join(dir, name)
-	must.NoError(t, os.WriteFile(dst, data, 0o755))
+	require.NoError(t, os.WriteFile(dst, data, 0o755))
 	return dst
 }
 
@@ -38,10 +38,10 @@ func TestUpdateCheckWarnsOnMultipleInstallsOnPath(t *testing.T) {
 		With(env.Path, dirA+string(os.PathListSeparator)+dirB)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "update", "--check")
-	must.NoError(t, err, stderr)
-	must.Contains(t, stdout, "Multiple lstk installations found on PATH:")
-	must.Contains(t, stdout, pathA)
-	must.Contains(t, stdout, pathB)
+	require.NoError(t, err, stderr)
+	require.Contains(t, stdout, "Multiple lstk installations found on PATH:")
+	require.Contains(t, stdout, pathA)
+	require.Contains(t, stdout, pathB)
 }
 
 func TestUpdateCheckDoesNotWarnOnSingleInstall(t *testing.T) {
@@ -52,8 +52,8 @@ func TestUpdateCheckDoesNotWarnOnSingleInstall(t *testing.T) {
 	environ := env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.Path, dir)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "update", "--check")
-	must.NoError(t, err, stderr)
-	must.NotContains(t, stdout, "Multiple lstk installations found")
+	require.NoError(t, err, stderr)
+	require.NotContains(t, stdout, "Multiple lstk installations found")
 }
 
 func TestUpdateCheckDoesNotWarnOnSymlinkedAliases(t *testing.T) {
@@ -63,14 +63,14 @@ func TestUpdateCheckDoesNotWarnOnSymlinkedAliases(t *testing.T) {
 	t.Parallel()
 	dirA, dirB := t.TempDir(), t.TempDir()
 	pathA := copyBinaryTo(t, dirA)
-	must.NoError(t, os.Symlink(pathA, filepath.Join(dirB, "lstk")))
+	require.NoError(t, os.Symlink(pathA, filepath.Join(dirB, "lstk")))
 
 	environ := env.Environ(testEnvWithHome(t.TempDir(), "")).
 		With(env.Path, dirA+string(os.PathListSeparator)+dirB)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "update", "--check")
-	must.NoError(t, err, stderr)
-	must.NotContains(t, stdout, "Multiple lstk installations found")
+	require.NoError(t, err, stderr)
+	require.NotContains(t, stdout, "Multiple lstk installations found")
 }
 
 func TestUpdateCheckJSONReportsMultipleInstallsWarning(t *testing.T) {
@@ -83,6 +83,6 @@ func TestUpdateCheckJSONReportsMultipleInstallsWarning(t *testing.T) {
 		With(env.Path, dirA+string(os.PathListSeparator)+dirB)
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "update", "--check", "--json")
-	must.NoError(t, err, stderr)
-	must.Contains(t, stdout, `"MULTIPLE_INSTALLS"`)
+	require.NoError(t, err, stderr)
+	require.Contains(t, stdout, `"MULTIPLE_INSTALLS"`)
 }
diff --git a/test/integration/non_interactive_test.go b/test/integration/non_interactive_test.go
index a8419acf..09c11915 100644
--- a/test/integration/non_interactive_test.go
+++ b/test/integration/non_interactive_test.go
@@ -3,16 +3,16 @@ package integration_test
 import (
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 func TestNonInteractiveFlagBlocksLogin(t *testing.T) {
 	t.Parallel()
 	out, err := runLstkInPTY(t, testContext(t), testEnvWithHome(t.TempDir(), ""), "login", "--non-interactive")
-	must.Error(t, err, "expected login --non-interactive to fail")
+	require.Error(t, err, "expected login --non-interactive to fail")
 	requireExitCode(t, 1, err)
-	must.Contains(t, out, "login requires an interactive terminal")
+	require.Contains(t, out, "login requires an interactive terminal")
 }
 
 func TestNonInteractiveFlagFailsWithoutToken(t *testing.T) {
@@ -24,9 +24,9 @@ func TestNonInteractiveFlagFailsWithoutToken(t *testing.T) {
 	defer mockServer.Close()
 
 	out, err := runLstkInPTY(t, testContext(t), env.Without(env.AuthToken).With(env.APIEndpoint, mockServer.URL), "start", "--non-interactive")
-	must.Error(t, err, "expected start --non-interactive to fail with no auth token")
+	require.Error(t, err, "expected start --non-interactive to fail with no auth token")
 	requireExitCode(t, 1, err)
-	must.Contains(t, out, "authentication required: set LOCALSTACK_AUTH_TOKEN or run in interactive mode")
+	require.Contains(t, out, "authentication required: set LOCALSTACK_AUTH_TOKEN or run in interactive mode")
 }
 
 func TestRootNonInteractiveFlagFailsWithoutToken(t *testing.T) {
@@ -38,7 +38,7 @@ func TestRootNonInteractiveFlagFailsWithoutToken(t *testing.T) {
 	defer mockServer.Close()
 
 	out, err := runLstkInPTY(t, testContext(t), env.Without(env.AuthToken).With(env.APIEndpoint, mockServer.URL), "--non-interactive")
-	must.Error(t, err, "expected lstk --non-interactive to fail with no auth token")
+	require.Error(t, err, "expected lstk --non-interactive to fail with no auth token")
 	requireExitCode(t, 1, err)
-	must.Contains(t, out, "authentication required: set LOCALSTACK_AUTH_TOKEN or run in interactive mode")
+	require.Contains(t, out, "authentication required: set LOCALSTACK_AUTH_TOKEN or run in interactive mode")
 }
diff --git a/test/integration/pty_helpers_test.go b/test/integration/pty_helpers_test.go
index cdb4570e..32124813 100644
--- a/test/integration/pty_helpers_test.go
+++ b/test/integration/pty_helpers_test.go
@@ -12,7 +12,7 @@ import (
 	"time"
 
 	"github.com/charmbracelet/x/xpty"
-	"github.com/localstack/lstk/internal/must"
+	"github.com/stretchr/testify/require"
 )
 
 // newTestPty opens a cross-platform PTY: a classic Unix PTY, or a ConPTY on
@@ -28,7 +28,7 @@ func newTestPty(t *testing.T) xpty.Pty {
 		width, height = 300, 80
 	}
 	pt, err := xpty.NewPty(width, height)
-	must.NoError(t, err, "failed to open PTY")
+	require.NoError(t, err, "failed to open PTY")
 	return pt
 }
 
@@ -51,7 +51,7 @@ func startCmdInPTY(t *testing.T, ctx context.Context, cmd *exec.Cmd) *ptyProc {
 
 	pt := newTestPty(t)
 	makeSessionLeader(cmd)
-	must.NoError(t, pt.Start(cmd), "failed to start command in PTY")
+	require.NoError(t, pt.Start(cmd), "failed to start command in PTY")
 	if up, ok := pt.(*xpty.UnixPty); ok {
 		// Close the parent's copy of the slave end so reads on the master
 		// return EOF once the child exits (creack's pty.Start does the same;
@@ -80,7 +80,7 @@ func startLstkInPTY(t *testing.T, ctx context.Context, environ []string, args ..
 	t.Helper()
 
 	binPath, err := filepath.Abs(binaryPath())
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	cmd := exec.CommandContext(ctx, binPath, args...)
 	if environ != nil {
@@ -100,7 +100,7 @@ func runLstkInPTY(t *testing.T, ctx context.Context, environ []string, args ...s
 func (p *ptyProc) write(s string) {
 	p.t.Helper()
 	_, err := p.pt.Write([]byte(s))
-	must.NoError(p.t, err)
+	require.NoError(p.t, err)
 }
 
 // output returns the ANSI-stripped output captured so far.
@@ -118,7 +118,7 @@ func (p *ptyProc) waitForOutput(want string, msgAndArgs ...any) {
 // prompts that only appear after slow work (e.g. a container becoming ready).
 func (p *ptyProc) waitForOutputTimeout(want string, timeout time.Duration, msgAndArgs ...any) {
 	p.t.Helper()
-	must.Eventually(p.t, func() bool {
+	require.Eventually(p.t, func() bool {
 		return strings.Contains(p.output(), want)
 	}, timeout, 100*time.Millisecond, msgAndArgs...)
 }
diff --git a/test/integration/reset_test.go b/test/integration/reset_test.go
index a101d1f6..f839a3f8 100644
--- a/test/integration/reset_test.go
+++ b/test/integration/reset_test.go
@@ -7,8 +7,8 @@ import (
 	"sync/atomic"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // mockResetServer returns a test server that records POST /_localstack/state/reset calls and replies with status.
@@ -40,9 +40,9 @@ func TestResetSucceedsWithForce(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "reset", "--force",
 	)
-	must.NoError(t, err, "lstk reset failed: %s", stderr)
-	must.Contains(t, stdout, "Emulator state reset")
-	must.Eq(t, int32(1), calls.Load(), "reset endpoint should be called exactly once")
+	require.NoError(t, err, "lstk reset failed: %s", stderr)
+	require.Contains(t, stdout, "Emulator state reset")
+	require.Equal(t, int32(1), calls.Load(), "reset endpoint should be called exactly once")
 }
 
 func TestResetFailsWithoutForceInNonInteractive(t *testing.T) {
@@ -61,8 +61,8 @@ func TestResetFailsWithoutForceInNonInteractive(t *testing.T) {
 		"--non-interactive", "reset",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "--force")
-	must.Eq(t, int32(0), calls.Load(), "reset endpoint should not be called when confirmation is required")
+	require.Contains(t, stderr, "--force")
+	require.Equal(t, int32(0), calls.Load(), "reset endpoint should not be called when confirmation is required")
 }
 
 func TestResetLocalStackNotRunning(t *testing.T) {
@@ -77,7 +77,7 @@ func TestResetLocalStackNotRunning(t *testing.T) {
 		"--non-interactive", "reset", "--force",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "not running")
+	require.Contains(t, stdout, "not running")
 }
 
 func TestResetReturnsErrorOnAPIFailure(t *testing.T) {
@@ -94,7 +94,7 @@ func TestResetReturnsErrorOnAPIFailure(t *testing.T) {
 		"--non-interactive", "reset", "--force",
 	)
 	requireExitCode(t, 1, err)
-	must.NotEmpty(t, stderr)
+	require.NotEmpty(t, stderr)
 }
 
 func TestResetTelemetryEmitted(t *testing.T) {
@@ -113,7 +113,7 @@ func TestResetTelemetryEmitted(t *testing.T) {
 			With(env.AnalyticsEndpoint, analyticsSrv.URL),
 		"--non-interactive", "reset", "--force",
 	)
-	must.NoError(t, err, "lstk reset failed: %s", stderr)
+	require.NoError(t, err, "lstk reset failed: %s", stderr)
 	assertCommandTelemetry(t, events, "reset", 0)
 }
 
@@ -154,10 +154,10 @@ func TestResetInteractive(t *testing.T) {
 		p := startReset(t, srv)
 		p.write("y")
 		out, err := p.wait()
-		must.NoError(t, err)
+		require.NoError(t, err)
 
-		must.Contains(t, out, "Emulator state reset")
-		must.Eq(t, int32(1), calls.Load(), "reset endpoint should be called after confirmation")
+		require.Contains(t, out, "Emulator state reset")
+		require.Equal(t, int32(1), calls.Load(), "reset endpoint should be called after confirmation")
 	})
 
 	t.Run("cancels with n", func(t *testing.T) {
@@ -165,10 +165,10 @@ func TestResetInteractive(t *testing.T) {
 		p := startReset(t, srv)
 		p.write("n")
 		out, err := p.wait()
-		must.NoError(t, err)
+		require.NoError(t, err)
 
-		must.Contains(t, out, "Cancelled")
-		must.Eq(t, int32(0), calls.Load(), "reset endpoint must not be called when user cancels")
+		require.Contains(t, out, "Cancelled")
+		require.Equal(t, int32(0), calls.Load(), "reset endpoint must not be called when user cancels")
 	})
 }
 
@@ -185,13 +185,13 @@ func TestResetJSONSucceeds(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"reset", "--force", "--json",
 	)
-	must.NoError(t, err, "lstk reset --json failed: %s", stderr)
+	require.NoError(t, err, "lstk reset --json failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	must.Eq(t, int32(1), calls.Load(), "reset endpoint should be called exactly once")
+	require.Equal(t, int32(1), calls.Load(), "reset endpoint should be called exactly once")
 
 	envelope := decodeEnvelope(t, stdout)
-	must.Eq(t, "ok", envelope.Status)
-	must.Eq(t, "reset", envelope.Command)
+	require.Equal(t, "ok", envelope.Status)
+	require.Equal(t, "reset", envelope.Command)
 
 	var data struct {
 		Emulator struct {
@@ -200,9 +200,9 @@ func TestResetJSONSucceeds(t *testing.T) {
 		} `json:"emulator"`
 		Reset bool `json:"reset"`
 	}
-	must.NoError(t, json.Unmarshal(envelope.Data, &data))
-	must.Eq(t, "aws", data.Emulator.Type)
-	must.True(t, data.Reset)
+	require.NoError(t, json.Unmarshal(envelope.Data, &data))
+	require.Equal(t, "aws", data.Emulator.Type)
+	require.True(t, data.Reset)
 }
 
 func TestResetJSONRequiresConfirmation(t *testing.T) {
@@ -219,11 +219,11 @@ func TestResetJSONRequiresConfirmation(t *testing.T) {
 	requireExitCode(t, 3, err)
 
 	envelope := decodeEnvelope(t, stdout)
-	must.Eq(t, "error", envelope.Status)
-	must.NotNil(t, envelope.Error)
-	must.Eq(t, "CONFIRMATION_REQUIRED", envelope.Error.Code)
-	must.Eq(t, "USAGE", envelope.Error.Category)
-	must.False(t, envelope.Error.Retryable)
+	require.Equal(t, "error", envelope.Status)
+	require.NotNil(t, envelope.Error)
+	require.Equal(t, "CONFIRMATION_REQUIRED", envelope.Error.Code)
+	require.Equal(t, "USAGE", envelope.Error.Category)
+	require.False(t, envelope.Error.Retryable)
 }
 
 func TestResetJSONNotConfigured(t *testing.T) {
@@ -238,8 +238,8 @@ func TestResetJSONNotConfigured(t *testing.T) {
 	requireExitCode(t, 1, err)
 
 	envelope := decodeEnvelope(t, stdout)
-	must.Eq(t, "error", envelope.Status)
-	must.NotNil(t, envelope.Error)
-	must.Eq(t, "EMULATOR_NOT_CONFIGURED", envelope.Error.Code)
-	must.Eq(t, "EMULATOR", envelope.Error.Category)
+	require.Equal(t, "error", envelope.Status)
+	require.NotNil(t, envelope.Error)
+	require.Equal(t, "EMULATOR_NOT_CONFIGURED", envelope.Error.Code)
+	require.Equal(t, "EMULATOR", envelope.Error.Category)
 }
diff --git a/test/integration/restart_test.go b/test/integration/restart_test.go
index c0360485..14c89ccf 100644
--- a/test/integration/restart_test.go
+++ b/test/integration/restart_test.go
@@ -3,9 +3,9 @@ package integration_test
 import (
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/require"
 )
 
 func TestRestartCommandSucceeds(t *testing.T) {
@@ -20,30 +20,30 @@ func TestRestartCommandSucceeds(t *testing.T) {
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL).With(env.AnalyticsEndpoint, analyticsSrv.URL), "restart")
-	must.NoError(t, err, "lstk restart failed: %s", stderr)
+	require.NoError(t, err, "lstk restart failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdout, "stopped")
-	must.Contains(t, stdout, "LocalStack")
+	require.Contains(t, stdout, "stopped")
+	require.Contains(t, stdout, "LocalStack")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container after restart")
-	must.True(t, inspect.Container.State.Running, "container should be running after restart")
+	require.NoError(t, err, "failed to inspect container after restart")
+	require.True(t, inspect.Container.State.Running, "container should be running after restart")
 
 	// Both lstk_lifecycle (stop + start) and lstk_command events should be emitted.
 	byName := collectTelemetryByName(t, events, 2)
-	must.Contains(t, byName, "lstk_lifecycle")
+	require.Contains(t, byName, "lstk_lifecycle")
 	cmdEvent, ok := byName["lstk_command"]
-	must.True(t, ok, "lstk_command event not received")
+	require.True(t, ok, "lstk_command event not received")
 	{
 		payload, _ := cmdEvent["payload"].(map[string]any)
 		params, _ := payload["parameters"].(map[string]any)
-		must.Eq(t, "restart", params["command"])
+		require.Equal(t, "restart", params["command"])
 		result, _ := payload["result"].(map[string]any)
-		must.InDelta(t, 0, result["exit_code"], 0)
+		require.InDelta(t, 0, result["exit_code"], 0)
 	}
 }
 
@@ -64,13 +64,13 @@ func TestRestartCommandRejectsAmbientEndpointURLEvenWithLocalContainerRunning(t
 	startTestContainer(t, ctx)
 
 	stdout, _, err := runLstk(t, ctx, "", env.With(env.DisableEvents, "1").With("LSTK_ENDPOINT_URL", "http://127.0.0.1:1"), "restart")
-	must.Error(t, err)
-	must.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
-	must.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
+	require.Error(t, err)
+	require.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	require.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "container should still exist — restart must reject before stopping/restarting it")
-	must.True(t, inspect.Container.State.Running, "container should still be running, untouched")
+	require.NoError(t, err, "container should still exist — restart must reject before stopping/restarting it")
+	require.True(t, inspect.Container.State.Running, "container should still be running, untouched")
 }
 
 func TestRestartCommandPersistFlagSetsPersistenceEnv(t *testing.T) {
@@ -85,18 +85,18 @@ func TestRestartCommandPersistFlagSetsPersistenceEnv(t *testing.T) {
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 
 	_, stderr, err = runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "restart", "--persist")
-	must.NoError(t, err, "lstk restart --persist failed: %s", stderr)
+	require.NoError(t, err, "lstk restart --persist failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container after restart")
-	must.True(t, inspect.Container.State.Running)
+	require.NoError(t, err, "failed to inspect container after restart")
+	require.True(t, inspect.Container.State.Running)
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	must.Eq(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
+	require.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
 }
 
 func TestRestartCommandPreservesPersistenceWithoutFlag(t *testing.T) {
@@ -111,19 +111,19 @@ func TestRestartCommandPreservesPersistenceWithoutFlag(t *testing.T) {
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start", "--persist")
-	must.NoError(t, err, "lstk start --persist failed: %s", stderr)
+	require.NoError(t, err, "lstk start --persist failed: %s", stderr)
 
 	// Restart without --persist should carry the setting forward from the running instance.
 	_, stderr, err = runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "restart")
-	must.NoError(t, err, "lstk restart failed: %s", stderr)
+	require.NoError(t, err, "lstk restart failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container after restart")
-	must.True(t, inspect.Container.State.Running)
+	require.NoError(t, err, "failed to inspect container after restart")
+	require.True(t, inspect.Container.State.Running)
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	must.Eq(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
+	require.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
 }
 
 func TestRestartCommandFailsWhenNotRunning(t *testing.T) {
@@ -133,8 +133,8 @@ func TestRestartCommandFailsWhenNotRunning(t *testing.T) {
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "restart")
-	must.Error(t, err, "expected lstk restart to fail when emulator is not running")
+	require.Error(t, err, "expected lstk restart to fail when emulator is not running")
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "LocalStack AWS Emulator is not running")
+	require.Contains(t, stdout, "LocalStack AWS Emulator is not running")
 	assertCommandTelemetry(t, events, "restart", 1)
 }
diff --git a/test/integration/sam_cmd_test.go b/test/integration/sam_cmd_test.go
index cc5812b1..43affdc0 100644
--- a/test/integration/sam_cmd_test.go
+++ b/test/integration/sam_cmd_test.go
@@ -4,9 +4,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // writeFakeSAM creates a stub `sam` that answers `--version` with the given
@@ -49,8 +49,8 @@ func TestSAMForwardsArgs(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
-	must.NoError(t, err, "stderr: %s", stderr)
-	must.Contains(t, stdout, "ARGS:build")
+	require.NoError(t, err, "stderr: %s", stderr)
+	require.Contains(t, stdout, "ARGS:build")
 }
 
 // propagates the sam exit code.
@@ -60,8 +60,8 @@ func TestSAMPropagatesExitCode(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
-	must.Error(t, err)
-	must.Contains(t, stderr, "simulated failure")
+	require.Error(t, err)
+	require.Contains(t, stderr, "simulated failure")
 	requireExitCode(t, 7, err)
 }
 
@@ -78,7 +78,7 @@ func TestSAMInjectsCleanAWSEnv(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"sam", "--region", "eu-west-1", "--account", "111111111111", "build")
-	must.NoError(t, err, "stderr: %s", stderr)
+	require.NoError(t, err, "stderr: %s", stderr)
 
 	// The snapshot pins the full env contract: endpoint scheme+port (host is
 	// DNS-dependent, masked), both region vars, --account in the access key
@@ -100,10 +100,10 @@ func TestSAMOfflineCommandsNoEmulator(t *testing.T) {
 
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 				"sam", "--region", "us-west-2", sub)
-			must.NoError(t, err, "stderr: %s", stderr)
+			require.NoError(t, err, "stderr: %s", stderr)
 
-			must.Contains(t, stdout, "ARGS:"+sub)
-			must.NotContains(t, stdout, "--region")
+			require.Contains(t, stdout, "ARGS:"+sub)
+			require.NotContains(t, stdout, "--region")
 		})
 	}
 }
@@ -121,8 +121,8 @@ func TestSAMHelpNoEmulator(t *testing.T) {
 
 			cmdArgs := append([]string{"sam"}, args...)
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, cmdArgs...)
-			must.NoError(t, err, "stderr: %s", stderr)
-			must.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
+			require.NoError(t, err, "stderr: %s", stderr)
+			require.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
 		})
 	}
 }
@@ -134,10 +134,10 @@ func TestSAMVersionTooOld(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
-	must.Error(t, err)
-	must.Contains(t, stderr+stdout, "1.95.0")
+	require.Error(t, err)
+	require.Contains(t, stderr+stdout, "1.95.0")
 	// sam was never run for real.
-	must.NotContains(t, stdout, "ARGS:build")
+	require.NotContains(t, stdout, "ARGS:build")
 }
 
 // a missing sam binary yields the install error.
@@ -146,8 +146,8 @@ func TestSAMMissingBinary(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
-	must.Error(t, err)
-	must.Contains(t, stderr+stdout, "not found in PATH")
+	require.Error(t, err)
+	require.Contains(t, stderr+stdout, "not found in PATH")
 }
 
 // --account is supported for sam (unlike cdk): a valid 12-digit value is
@@ -159,8 +159,8 @@ func TestSAMAccountSupported(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"sam", "--account", "123456789012", "build")
-	must.NoError(t, err, "stderr: %s", stderr)
-	must.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=123456789012")
+	require.NoError(t, err, "stderr: %s", stderr)
+	require.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=123456789012")
 }
 
 // an invalid --account value is rejected at the command boundary before sam runs.
@@ -171,9 +171,9 @@ func TestSAMInvalidAccountRejected(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"sam", "--account", "12345", "build")
-	must.Error(t, err)
-	must.Contains(t, stderr+stdout, "12-digit")
-	must.NotContains(t, stdout, "ARGS:build")
+	require.Error(t, err)
+	require.Contains(t, stderr+stdout, "12-digit")
+	require.NotContains(t, stdout, "ARGS:build")
 }
 
 // flags after the subcommand are forwarded to sam unchanged.
@@ -184,8 +184,8 @@ func TestSAMFlagsAfterActionAreForwarded(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"sam", "build", "--region", "us-west-2")
-	must.NoError(t, err, "stderr: %s", stderr)
-	must.Contains(t, stdout, "ARGS:build --region us-west-2")
+	require.NoError(t, err, "stderr: %s", stderr)
+	require.Contains(t, stdout, "ARGS:build --region us-west-2")
 }
 
 // a flag before the subcommand is rejected with a clear message.
@@ -196,8 +196,8 @@ func TestSAMFlagBeforeSubcommandRejected(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--account", "111111111111", "sam", "build")
-	must.Error(t, err)
-	must.Contains(t, stderr+stdout, "must appear after the sam subcommand")
+	require.Error(t, err)
+	require.Contains(t, stderr+stdout, "must appear after the sam subcommand")
 }
 
 // LSTK_SAM_CMD selects the binary to invoke.
@@ -211,8 +211,8 @@ func TestSAMHonorsLstkSamCmd(t *testing.T) {
 		With(env.Key("LSTK_SAM_CMD"), "mysam")
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
-	must.NoError(t, err, "stderr: %s", stderr)
-	must.Contains(t, stdout, "MYSAM:build")
+	require.NoError(t, err, "stderr: %s", stderr)
+	require.Contains(t, stdout, "MYSAM:build")
 }
 
 // an AWS-contacting command with no running emulator fails with "not running"
@@ -226,10 +226,10 @@ func TestSAMFailsWhenEmulatorNotRunning(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "deploy")
-	must.Error(t, err)
-	must.Contains(t, stdout, "is not running")
-	must.Contains(t, stdout, "Start LocalStack:")
-	must.NotContains(t, stdout, "ARGS:deploy")
+	require.Error(t, err)
+	require.Contains(t, stdout, "is not running")
+	require.Contains(t, stdout, "Start LocalStack:")
+	require.NotContains(t, stdout, "ARGS:deploy")
 }
 
 // an AWS-contacting command fails with an AWS-specific error naming the running
@@ -248,10 +248,10 @@ func TestSAMRequiresAWSEmulator(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), e, "sam", "deploy")
-	must.Error(t, err)
-	must.Contains(t, stdout, "requires the")
-	must.Contains(t, stdout, "Snowflake")
-	must.NotContains(t, stdout, "ARGS:deploy")
+	require.Error(t, err)
+	require.Contains(t, stdout, "requires the")
+	require.Contains(t, stdout, "Snowflake")
+	require.NotContains(t, stdout, "ARGS:deploy")
 }
 
 // The region must reach SAM on its command line, not only through AWS_REGION.
@@ -267,11 +267,11 @@ func TestSAMPutsSelectedRegionOnTheCommandLine(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "sam", "--region", "ap-northeast-1", "--account", "121212122323", "deploy")
-	must.NoError(t, err, "stderr: %s", stderr)
+	require.NoError(t, err, "stderr: %s", stderr)
 
-	must.Contains(t, stdout, "--region ap-northeast-1", "the region must be on sam's command line")
-	must.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
-	must.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=121212122323")
+	require.Contains(t, stdout, "--region ap-northeast-1", "the region must be on sam's command line")
+	require.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
+	require.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=121212122323")
 }
 
 // Without lstk's --region there is nothing to assert over samconfig.toml, so
@@ -285,11 +285,11 @@ func TestSAMDoesNotInjectRegionWhenNotSelected(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "sam", "deploy")
-	must.NoError(t, err, "stderr: %s", stderr)
+	require.NoError(t, err, "stderr: %s", stderr)
 
-	must.NotContains(t, stdout, "--region")
+	require.NotContains(t, stdout, "--region")
 	// The environment still carries the default, as before.
-	must.Contains(t, stdout, "ENV_AWS_REGION=us-east-1")
+	require.Contains(t, stdout, "ENV_AWS_REGION=us-east-1")
 }
 
 // An ambient AWS_REGION is used but is not a selection: it is commonly exported
@@ -303,10 +303,10 @@ func TestSAMDoesNotInjectAmbientRegion(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "sam", "deploy")
-	must.NoError(t, err, "stderr: %s", stderr)
+	require.NoError(t, err, "stderr: %s", stderr)
 
-	must.NotContains(t, stdout, "--region")
-	must.Contains(t, stdout, "ENV_AWS_REGION=eu-west-1")
+	require.NotContains(t, stdout, "--region")
+	require.Contains(t, stdout, "ENV_AWS_REGION=eu-west-1")
 }
 
 // Offline subcommands never get the flag: `init` and `docs` reject --region
@@ -318,11 +318,11 @@ func TestSAMDoesNotInjectRegionForOfflineSubcommand(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"sam", "--region", "ap-northeast-1", "build")
-	must.NoError(t, err, "stderr: %s", stderr)
+	require.NoError(t, err, "stderr: %s", stderr)
 
-	must.Contains(t, stdout, "ARGS:build")
-	must.NotContains(t, stdout, "--region")
-	must.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
+	require.Contains(t, stdout, "ARGS:build")
+	require.NotContains(t, stdout, "--region")
+	require.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
 }
 
 // A --region the user addressed to sam directly wins: appending lstk's after it
@@ -335,11 +335,11 @@ func TestSAMLeavesUserSuppliedRegionFlagAlone(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "sam", "--region", "ap-northeast-1", "deploy", "--region", "us-west-1")
-	must.NoError(t, err, "stderr: %s", stderr)
+	require.NoError(t, err, "stderr: %s", stderr)
 
 	// Pinned to the whole ARGS line: lstk must not append a second --region.
-	must.Contains(t, stdout, "ARGS:deploy --region us-west-1\n")
+	require.Contains(t, stdout, "ARGS:deploy --region us-west-1\n")
 	// The environment still carries lstk's resolved region, as it always has;
 	// sam's own command-line flag is what outranks it.
-	must.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
+	require.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
 }
diff --git a/test/integration/sam_e2e_test.go b/test/integration/sam_e2e_test.go
index f01b3f18..dd836de0 100644
--- a/test/integration/sam_e2e_test.go
+++ b/test/integration/sam_e2e_test.go
@@ -7,8 +7,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // End-to-end tests for `lstk sam` that exercise the real AWS SAM CLI against a
@@ -37,7 +37,7 @@ func copySAMSample(t *testing.T, name string) string {
 	t.Helper()
 	work := t.TempDir()
 	src := filepath.Join("test-samples", "iac", "sam", name)
-	must.NoError(t, os.CopyFS(work, os.DirFS(src)))
+	require.NoError(t, os.CopyFS(work, os.DirFS(src)))
 	return work
 }
 
@@ -63,7 +63,7 @@ func TestSAME2EValidateOffline(t *testing.T) {
 	e := samE2EEnv(t)
 
 	stdout, stderr, err := runSAM(t, ctx, work, e, "validate", "--lint")
-	must.NoError(t, err, "sam validate stdout: %s\nstderr: %s", stdout, stderr)
+	require.NoError(t, err, "sam validate stdout: %s\nstderr: %s", stdout, stderr)
 }
 
 // `sam deploy` of a single function succeeds against LocalStack, and `sam delete`
@@ -85,11 +85,11 @@ func TestSAME2EDeployDelete(t *testing.T) {
 	_, stderr, err := runSAM(t, ctx, work, e, "deploy",
 		"--stack-name", stack, "--resolve-s3", "--no-confirm-changeset",
 		"--no-fail-on-empty-changeset", "--capabilities", "CAPABILITY_IAM", "--region", "us-east-1")
-	must.NoError(t, err, "sam deploy stderr: %s", stderr)
+	require.NoError(t, err, "sam deploy stderr: %s", stderr)
 
 	_, stderr, err = runSAM(t, ctx, work, e, "delete",
 		"--stack-name", stack, "--no-prompts", "--region", "us-east-1")
-	must.NoError(t, err, "sam delete stderr: %s", stderr)
+	require.NoError(t, err, "sam delete stderr: %s", stderr)
 }
 
 // `sam deploy --account <id>` lands the stack under that LocalStack account: the
@@ -112,14 +112,14 @@ func TestSAME2EDeployCustomAccount(t *testing.T) {
 	_, stderr, err := runSAM(t, ctx, work, e, "--account", account, "deploy",
 		"--stack-name", stack, "--resolve-s3", "--no-confirm-changeset",
 		"--no-fail-on-empty-changeset", "--capabilities", "CAPABILITY_IAM", "--region", "us-east-1")
-	must.NoError(t, err, "sam deploy stderr: %s", stderr)
+	require.NoError(t, err, "sam deploy stderr: %s", stderr)
 
 	stdout, stderr, err := runSAM(t, ctx, work, e, "--account", account, "list", "stack-outputs",
 		"--stack-name", stack, "--output", "json", "--region", "us-east-1")
-	must.NoError(t, err, "sam list stack-outputs stderr: %s", stderr)
-	must.Contains(t, stdout, account, "function ARN should carry the custom account id")
+	require.NoError(t, err, "sam list stack-outputs stderr: %s", stderr)
+	require.Contains(t, stdout, account, "function ARN should carry the custom account id")
 
 	_, stderr, err = runSAM(t, ctx, work, e, "--account", account, "delete",
 		"--stack-name", stack, "--no-prompts", "--region", "us-east-1")
-	must.NoError(t, err, "sam delete stderr: %s", stderr)
+	require.NoError(t, err, "sam delete stderr: %s", stderr)
 }
diff --git a/test/integration/setup_azure_test.go b/test/integration/setup_azure_test.go
index 404d870f..293dafd0 100644
--- a/test/integration/setup_azure_test.go
+++ b/test/integration/setup_azure_test.go
@@ -7,8 +7,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 func requireAzCLI(t *testing.T) {
@@ -26,7 +26,7 @@ func requireAzCLI(t *testing.T) {
 func azTempHome(t *testing.T) string {
 	t.Helper()
 	dir, err := os.MkdirTemp("", "lstk-az-home-")
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() { _ = os.RemoveAll(dir) })
 	return dir
 }
@@ -41,8 +41,8 @@ func azureWorkDir(t *testing.T) string {
 	t.Helper()
 	workDir := t.TempDir()
 	lstkDir := filepath.Join(workDir, ".lstk")
-	must.NoError(t, os.MkdirAll(lstkDir, 0755))
-	must.NoError(t, os.WriteFile(filepath.Join(lstkDir, "config.toml"), []byte(`
+	require.NoError(t, os.MkdirAll(lstkDir, 0755))
+	require.NoError(t, os.WriteFile(filepath.Join(lstkDir, "config.toml"), []byte(`
 [[containers]]
 type = "azure"
 tag  = "latest"
@@ -54,8 +54,8 @@ port = "4566"
 func writeAzureSetupMarker(t *testing.T, workDir string) {
 	t.Helper()
 	dir := filepath.Join(workDir, ".lstk", "azure")
-	must.NoError(t, os.MkdirAll(dir, 0700))
-	must.NoError(t, os.WriteFile(filepath.Join(dir, ".lstk-setup-complete"), []byte("ok\n"), 0600))
+	require.NoError(t, os.MkdirAll(dir, 0700))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, ".lstk-setup-complete"), []byte("ok\n"), 0600))
 }
 
 func TestAzCommandErrorsWhenNotSetUp(t *testing.T) {
@@ -66,10 +66,10 @@ func TestAzCommandErrorsWhenNotSetUp(t *testing.T) {
 		env.WithHome(t.TempDir()),
 		"az", "group", "list",
 	)
-	must.Error(t, err)
+	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "Azure CLI integration is not set up")
-	must.Contains(t, stdout, "lstk setup azure")
+	require.Contains(t, stdout, "Azure CLI integration is not set up")
+	require.Contains(t, stdout, "lstk setup azure")
 }
 
 // Non-interactive mode must not be rejected upfront (CI use case): with no
@@ -82,9 +82,9 @@ func TestSetupAzureNonInteractiveRunsWithoutTerminal(t *testing.T) {
 		env.WithHome(t.TempDir()),
 		"setup", "azure",
 	)
-	must.Error(t, err)
-	must.Contains(t, stderr, "no azure emulator configured")
-	must.NotContains(t, stderr, "interactive terminal")
+	require.Error(t, err)
+	require.Contains(t, stderr, "no azure emulator configured")
+	require.NotContains(t, stderr, "interactive terminal")
 }
 
 // `lstk setup az` must resolve to `setup azure`: the Azure tool-proxy command
@@ -98,9 +98,9 @@ func TestSetupAzureAliasAz(t *testing.T) {
 		env.WithHome(t.TempDir()),
 		"setup", "az",
 	)
-	must.Error(t, err)
-	must.NotContains(t, stderr, "unknown command")
-	must.Contains(t, stderr, "no azure emulator configured")
+	require.Error(t, err)
+	require.NotContains(t, stderr, "unknown command")
+	require.Contains(t, stderr, "no azure emulator configured")
 }
 
 // When the az CLI is missing, the error must be reported exactly once —
@@ -113,10 +113,10 @@ func TestSetupAzureReportsMissingAzCLIOnce(t *testing.T) {
 		env.WithHome(t.TempDir()).With("PATH", t.TempDir()),
 		"setup", "azure",
 	)
-	must.Error(t, err)
-	must.Contains(t, stderr, "az CLI not found in PATH")
+	require.Error(t, err)
+	require.Contains(t, stderr, "az CLI not found in PATH")
 	combined := stdout + stderr
-	must.Eq(t, 1, strings.Count(combined, "az CLI not found in PATH"),
+	require.Equal(t, 1, strings.Count(combined, "az CLI not found in PATH"),
 		"missing az CLI must be reported exactly once, got:\n%s", combined)
 }
 
@@ -135,10 +135,10 @@ func TestAzCommandErrorsWhenEmulatorNotRunning(t *testing.T) {
 		env.WithHome(t.TempDir()),
 		"az", "group", "list",
 	)
-	must.Error(t, err)
+	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "is not running")
-	must.Contains(t, stdout, "Start LocalStack")
+	require.Contains(t, stdout, "is not running")
+	require.Contains(t, stdout, "Start LocalStack")
 }
 
 // TestSetupAzureAndAzCommandSucceed requires Docker, the Azure CLI, and LOCALSTACK_AUTH_TOKEN.
@@ -173,21 +173,21 @@ func TestSetupAzureAndAzCommandSucceed(t *testing.T) {
 		baseEnv.With(env.APIEndpoint, mockServer.URL),
 		"start",
 	)
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 
 	binPath, err := filepath.Abs(binaryPath())
-	must.NoError(t, err)
+	require.NoError(t, err)
 	cmd := exec.CommandContext(ctx, binPath, "setup", "azure")
 	cmd.Dir = workDir
 	cmd.Env = baseEnv.With(env.APIEndpoint, mockServer.URL)
 	p := startCmdInPTY(t, ctx, cmd)
 	out, err := p.wait()
-	must.NoError(t, err, "setup azure should succeed; output:\n%s", out)
-	must.Contains(t, out, "Azure CLI integration ready")
+	require.NoError(t, err, "setup azure should succeed; output:\n%s", out)
+	require.Contains(t, out, "Azure CLI integration ready")
 
 	markerPath := filepath.Join(workDir, ".lstk", "azure", ".lstk-setup-complete")
 	_, err = os.Stat(markerPath)
-	must.NoError(t, err, "marker file should be written on successful setup")
+	require.NoError(t, err, "marker file should be written on successful setup")
 
 	// `az cloud show` reads the isolated config dir locally, so the assertion
 	// doesn't depend on emulator-side behaviour for any specific Azure service.
@@ -195,8 +195,8 @@ func TestSetupAzureAndAzCommandSucceed(t *testing.T) {
 		baseEnv.With(env.APIEndpoint, mockServer.URL),
 		"az", "cloud", "show", "--name", "LocalStack",
 	)
-	must.NoError(t, err, "lstk az cloud show failed: %s", stderr2)
-	must.Contains(t, stdout, "azure.localhost.localstack.cloud:4566",
+	require.NoError(t, err, "lstk az cloud show failed: %s", stderr2)
+	require.Contains(t, stdout, "azure.localhost.localstack.cloud:4566",
 		"registered cloud should expose the LocalStack Azure endpoint")
 
 	// Setup must also work without a terminal (CI use case): runLstk uses
@@ -206,6 +206,6 @@ func TestSetupAzureAndAzCommandSucceed(t *testing.T) {
 		baseEnv.With(env.APIEndpoint, mockServer.URL),
 		"setup", "azure",
 	)
-	must.NoError(t, err, "non-interactive setup azure failed: stdout=%s stderr=%s", stdoutNI, stderrNI)
-	must.Contains(t, stdoutNI, "Azure CLI integration ready")
+	require.NoError(t, err, "non-interactive setup azure failed: stdout=%s stderr=%s", stdoutNI, stderrNI)
+	require.Contains(t, stdoutNI, "Azure CLI integration ready")
 }
diff --git a/test/integration/signal_forwarding_test.go b/test/integration/signal_forwarding_test.go
index b91d2c1e..c641024d 100644
--- a/test/integration/signal_forwarding_test.go
+++ b/test/integration/signal_forwarding_test.go
@@ -13,7 +13,7 @@ import (
 	"time"
 
 	"github.com/creack/pty"
-	"github.com/localstack/lstk/internal/must"
+	"github.com/stretchr/testify/require"
 )
 
 // These tests cover proc.Run's signal handling for wrapped tools end to end,
@@ -30,7 +30,7 @@ func startSignalWait(t *testing.T, wire func(*exec.Cmd)) *exec.Cmd {
 	installExtension(t, extDir, "sig")
 
 	binPath, err := filepath.Abs(binaryPath())
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	cmd := exec.CommandContext(testContext(t), binPath, "sig", "signal-wait")
 	cmd.Dir = t.TempDir()
@@ -87,10 +87,10 @@ func TestWrappedToolReceivesForwardedSignalNonInteractive(t *testing.T) {
 				c.Stdout = out
 				c.Stderr = out
 			})
-			must.NoError(t, cmd.Start())
+			require.NoError(t, cmd.Start())
 
 			waitForMarker(t, out)
-			must.NoError(t, cmd.Process.Signal(tc.sig))
+			require.NoError(t, cmd.Process.Signal(tc.sig))
 
 			err := cmd.Wait()
 			requireExitCode(t, 41, err)
@@ -107,12 +107,12 @@ func TestWrappedToolReceivesForwardedSIGTERMInTerminal(t *testing.T) {
 	var ptmx *os.File
 	cmd := startSignalWait(t, func(c *exec.Cmd) {})
 	ptmx, err := pty.Start(cmd)
-	must.NoError(t, err)
+	require.NoError(t, err)
 	defer func() { _ = ptmx.Close() }()
 
 	out, copied := drainPTY(ptmx)
 	waitForMarker(t, out)
-	must.NoError(t, cmd.Process.Signal(syscall.SIGTERM))
+	require.NoError(t, cmd.Process.Signal(syscall.SIGTERM))
 
 	err = cmd.Wait()
 	<-copied
@@ -127,13 +127,13 @@ func TestWrappedToolSingleSIGINTOnCtrlCInTerminal(t *testing.T) {
 	t.Parallel()
 	cmd := startSignalWait(t, func(c *exec.Cmd) {})
 	ptmx, err := pty.Start(cmd)
-	must.NoError(t, err)
+	require.NoError(t, err)
 	defer func() { _ = ptmx.Close() }()
 
 	out, copied := drainPTY(ptmx)
 	waitForMarker(t, out)
 	_, err = ptmx.Write([]byte{0x03}) // Ctrl-C → SIGINT to the foreground process group
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	err = cmd.Wait()
 	<-copied
@@ -148,11 +148,11 @@ func TestWrappedToolSingleSIGINTOnCtrlCInTerminal(t *testing.T) {
 func TestWrappedToolSingleSIGINTOnCtrlCWithRedirectedStdin(t *testing.T) {
 	t.Parallel()
 	ptmx, tty, err := pty.Open()
-	must.NoError(t, err)
+	require.NoError(t, err)
 	defer func() { _ = ptmx.Close() }()
 
 	devNull, err := os.Open(os.DevNull)
-	must.NoError(t, err)
+	require.NoError(t, err)
 	defer func() { _ = devNull.Close() }()
 
 	cmd := startSignalWait(t, func(c *exec.Cmd) {
@@ -163,13 +163,13 @@ func TestWrappedToolSingleSIGINTOnCtrlCWithRedirectedStdin(t *testing.T) {
 		// foreground process group, exactly like a real interactive session.
 		c.SysProcAttr = &syscall.SysProcAttr{Setsid: true, Setctty: true, Ctty: 1}
 	})
-	must.NoError(t, cmd.Start())
+	require.NoError(t, cmd.Start())
 	_ = tty.Close() // child holds its own copy of the slave side
 
 	out, copied := drainPTY(ptmx)
 	waitForMarker(t, out)
 	_, err = ptmx.Write([]byte{0x03}) // Ctrl-C → SIGINT to the foreground process group
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	err = cmd.Wait()
 	<-copied
diff --git a/test/integration/snapshot_experimental_test.go b/test/integration/snapshot_experimental_test.go
index 57e4f415..d15e3e7d 100644
--- a/test/integration/snapshot_experimental_test.go
+++ b/test/integration/snapshot_experimental_test.go
@@ -5,8 +5,8 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // save/load work for Snowflake and Azure but emit an experimental warning.
@@ -111,10 +111,10 @@ func TestSnapshotNonAWSShowsExperimentalWarning(t *testing.T) {
 
 				args := append([]string{"--config", em.writeConfig(t, "4566"), "--non-interactive"}, subArgs...)
 				stdout, stderr, err := runLstk(t, ctx, dir, environ, args...)
-				must.NoError(t, err, "lstk snapshot %s failed: %s", op.name, stderr)
-				must.Contains(t, stdout, op.successText)
-				must.Contains(t, stdout, experimentalWarningFragment)
-				must.Contains(t, stdout, em.name)
+				require.NoError(t, err, "lstk snapshot %s failed: %s", op.name, stderr)
+				require.Contains(t, stdout, op.successText)
+				require.Contains(t, stdout, experimentalWarningFragment)
+				require.Contains(t, stdout, em.name)
 			})
 		}
 	}
@@ -136,7 +136,7 @@ func TestSnapshotSaveAWSNoExperimentalWarning(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "save",
 	)
-	must.NoError(t, err, "lstk snapshot save failed: %s", stderr)
-	must.Contains(t, stdout, "Snapshot saved")
-	must.NotContains(t, stdout, experimentalWarningFragment)
+	require.NoError(t, err, "lstk snapshot save failed: %s", stderr)
+	require.Contains(t, stdout, "Snapshot saved")
+	require.NotContains(t, stdout, experimentalWarningFragment)
 }
diff --git a/test/integration/snapshot_list_test.go b/test/integration/snapshot_list_test.go
index 34f07f52..19609e1d 100644
--- a/test/integration/snapshot_list_test.go
+++ b/test/integration/snapshot_list_test.go
@@ -9,9 +9,9 @@ import (
 	"sync"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // listCapture records what the platform list endpoint received. It is written from the
@@ -40,7 +40,7 @@ func (c *listCapture) get() (called bool, creator, auth string) {
 func mockCloudPodsServer(t *testing.T, pods []map[string]any, cap *listCapture) *httptest.Server {
 	t.Helper()
 	body, err := json.Marshal(pods)
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/v1/cloudpods" && r.Method == http.MethodGet {
@@ -78,10 +78,10 @@ func TestSnapshotListSuccessWithoutDocker(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "list",
 	)
-	must.NoError(t, err, "lstk snapshot list failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot list failed: %s", stderr)
 	called, creator, _ := cap.get()
-	must.True(t, called, "the platform list endpoint should have been called")
-	must.Eq(t, "me", creator, "default list should send ?creator=me")
+	require.True(t, called, "the platform list endpoint should have been called")
+	require.Equal(t, "me", creator, "default list should send ?creator=me")
 	snap.Match(t, sanitizeOutput(stdout))
 }
 
@@ -97,12 +97,12 @@ func TestSnapshotListAllFlag(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "list", "--all",
 	)
-	must.NoError(t, err, "lstk snapshot list --all failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot list --all failed: %s", stderr)
 	called, creator, _ := cap.get()
-	must.True(t, called, "the platform list endpoint should have been called")
-	must.Eq(t, "", creator, "--all should omit the ?creator param")
-	must.Contains(t, stdout, "~ 1 snapshot")
-	must.Contains(t, stdout, "org-pod")
+	require.True(t, called, "the platform list endpoint should have been called")
+	require.Equal(t, "", creator, "--all should omit the ?creator param")
+	require.Contains(t, stdout, "~ 1 snapshot")
+	require.Contains(t, stdout, "org-pod")
 }
 
 func TestSnapshotListEmpty(t *testing.T) {
@@ -114,8 +114,8 @@ func TestSnapshotListEmpty(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "list",
 	)
-	must.NoError(t, err, "lstk snapshot list failed: %s", stderr)
-	must.Contains(t, stdout, "No snapshots found")
+	require.NoError(t, err, "lstk snapshot list failed: %s", stderr)
+	require.Contains(t, stdout, "No snapshots found")
 }
 
 func TestSnapshotListSendsBasicAuthHeader(t *testing.T) {
@@ -128,10 +128,10 @@ func TestSnapshotListSendsBasicAuthHeader(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "list",
 	)
-	must.NoError(t, err, "lstk snapshot list failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot list failed: %s", stderr)
 	_, _, auth := cap.get()
 	expected := "Basic " + base64.StdEncoding.EncodeToString([]byte(":test-token"))
-	must.Eq(t, expected, auth, "list should authenticate to the platform with Basic base64(\":\"+token)")
+	require.Equal(t, expected, auth, "list should authenticate to the platform with Basic base64(\":\"+token)")
 }
 
 func TestSnapshotListRequiresAuthToken(t *testing.T) {
@@ -152,8 +152,8 @@ func TestSnapshotListRequiresAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "list",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "Authentication required")
-	must.Contains(t, stdout, "lstk login")
+	require.Contains(t, stdout, "Authentication required")
+	require.Contains(t, stdout, "lstk login")
 }
 
 func TestSnapshotListServerError(t *testing.T) {
@@ -172,7 +172,7 @@ func TestSnapshotListServerError(t *testing.T) {
 		"--non-interactive", "snapshot", "list",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, strings.ToLower(stderr), "error")
+	require.Contains(t, strings.ToLower(stderr), "error")
 }
 
 func TestSnapshotListInteractive(t *testing.T) {
@@ -186,6 +186,6 @@ func TestSnapshotListInteractive(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"snapshot", "list",
 	)
-	must.NoError(t, err, "interactive lstk snapshot list failed")
-	must.Contains(t, out, "my-pod")
+	require.NoError(t, err, "interactive lstk snapshot list failed")
+	require.Contains(t, out, "my-pod")
 }
diff --git a/test/integration/snapshot_load_test.go b/test/integration/snapshot_load_test.go
index 3e8767b2..81288db5 100644
--- a/test/integration/snapshot_load_test.go
+++ b/test/integration/snapshot_load_test.go
@@ -9,8 +9,8 @@ import (
 	"sync/atomic"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // mockPodDiffServer returns a test server that handles GET /_localstack/pods/{name}/diff.
@@ -139,7 +139,7 @@ func mockPodDiffNotFoundServer(t *testing.T) *httptest.Server {
 func writeTestSnapFile(t *testing.T, dir, name string) string {
 	t.Helper()
 	path := filepath.Join(dir, name)
-	must.NoError(t, os.WriteFile(path, []byte("SNAP"), 0600))
+	require.NoError(t, os.WriteFile(path, []byte("SNAP"), 0600))
 	return path
 }
 
@@ -156,7 +156,7 @@ func TestSnapshotLoadRemoteRejected(t *testing.T) {
 				"--non-interactive", "snapshot", "load", ref,
 			)
 			requireExitCode(t, 1, err)
-			must.Contains(t, stderr, "not yet supported")
+			require.Contains(t, stderr, "not yet supported")
 		})
 	}
 }
@@ -171,7 +171,7 @@ func TestSnapshotLoadS3RequiresPodName(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "s3://bucket/key",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "pod name is required")
+	require.Contains(t, stderr, "pod name is required")
 }
 
 func TestSnapshotLoadPodNoAuthToken(t *testing.T) {
@@ -183,7 +183,7 @@ func TestSnapshotLoadPodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "authentication")
+	require.Contains(t, stderr, "authentication")
 }
 
 func TestSnapshotLoadPodInvalidName(t *testing.T) {
@@ -197,7 +197,7 @@ func TestSnapshotLoadPodInvalidName(t *testing.T) {
 				"--non-interactive", "snapshot", "load", ref,
 			)
 			requireExitCode(t, 1, err)
-			must.Contains(t, stderr, "invalid pod name")
+			require.Contains(t, stderr, "invalid pod name")
 		})
 	}
 }
@@ -211,7 +211,7 @@ func TestSnapshotLoadFileNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "/no/such/snapshot.snapshot",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "snapshot file not found")
+	require.Contains(t, stderr, "snapshot file not found")
 }
 
 // TestSnapshotLoadPathIsDirectory ensures passing a directory instead of a
@@ -223,14 +223,14 @@ func TestSnapshotLoadPathIsDirectory(t *testing.T) {
 
 	dir := t.TempDir()
 	target := filepath.Join(dir, "some-directory")
-	must.NoError(t, os.Mkdir(target, 0o755))
+	require.NoError(t, os.Mkdir(target, 0o755))
 
 	_, stderr, err := runLstk(t, ctx, t.TempDir(),
 		testEnvWithHome(t.TempDir(), ""),
 		"--non-interactive", "snapshot", "load", target,
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "is a directory")
+	require.Contains(t, stderr, "is a directory")
 }
 
 // --- Docker required ---
@@ -251,8 +251,8 @@ func TestSnapshotLoadLocalSuccess(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "load", snapPath,
 	)
-	must.NoError(t, err, "lstk snapshot load failed: %s", stderr)
-	must.Contains(t, stdout, "Snapshot loaded")
+	require.NoError(t, err, "lstk snapshot load failed: %s", stderr)
+	require.Contains(t, stdout, "Snapshot loaded")
 }
 
 func TestSnapshotLoadLocalBareNameFallback(t *testing.T) {
@@ -272,8 +272,8 @@ func TestSnapshotLoadLocalBareNameFallback(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "load", filepath.Join(dir, "snap"),
 	)
-	must.NoError(t, err, "bare name fallback failed: %s", stderr)
-	must.Contains(t, stdout, "Snapshot loaded")
+	require.NoError(t, err, "bare name fallback failed: %s", stderr)
+	require.Contains(t, stdout, "Snapshot loaded")
 }
 
 // TestSnapshotLoadLocalLegacyZipFallback verifies that snapshots saved as .zip by
@@ -295,8 +295,8 @@ func TestSnapshotLoadLocalLegacyZipFallback(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "load", filepath.Join(dir, "snap"),
 	)
-	must.NoError(t, err, "legacy .zip fallback failed: %s", stderr)
-	must.Contains(t, stdout, "Snapshot loaded")
+	require.NoError(t, err, "legacy .zip fallback failed: %s", stderr)
+	require.Contains(t, stdout, "Snapshot loaded")
 }
 
 func TestSnapshotLoadLocalInvalidFile(t *testing.T) {
@@ -318,8 +318,8 @@ func TestSnapshotLoadLocalInvalidFile(t *testing.T) {
 	requireExitCode(t, 1, err)
 	// The user-facing error is emitted through the sink (stdout); the underlying
 	// "zip archive" detail must not leak to the user.
-	must.Contains(t, stdout, "not a valid snapshot")
-	must.NotContains(t, strings.ToLower(stdout+stderr), "zip")
+	require.Contains(t, stdout, "not a valid snapshot")
+	require.NotContains(t, strings.ToLower(stdout+stderr), "zip")
 }
 
 func TestSnapshotLoadLocalOverwriteStrategy(t *testing.T) {
@@ -338,8 +338,8 @@ func TestSnapshotLoadLocalOverwriteStrategy(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "load", "--merge=overwrite", snapPath,
 	)
-	must.NoError(t, err, "lstk snapshot load --merge=overwrite failed: %s", stderr)
-	must.True(t, wasReset(), "/_localstack/state/reset should have been called for overwrite strategy")
+	require.NoError(t, err, "lstk snapshot load --merge=overwrite failed: %s", stderr)
+	require.True(t, wasReset(), "/_localstack/state/reset should have been called for overwrite strategy")
 }
 
 func TestSnapshotLoadPodSuccess(t *testing.T) {
@@ -357,11 +357,11 @@ func TestSnapshotLoadPodSuccess(t *testing.T) {
 			With(env.AuthToken, "test-token"),
 		"--non-interactive", "snapshot", "load", "pod:my-baseline",
 	)
-	must.NoError(t, err, "lstk snapshot load pod:my-baseline failed: %s", stderr)
-	must.Contains(t, stdout, "Snapshot loaded")
-	must.Contains(t, stdout, "my-baseline")
-	must.Contains(t, stdout, "s3")
-	must.Contains(t, stdout, "dynamodb")
+	require.NoError(t, err, "lstk snapshot load pod:my-baseline failed: %s", stderr)
+	require.Contains(t, stdout, "Snapshot loaded")
+	require.Contains(t, stdout, "my-baseline")
+	require.Contains(t, stdout, "s3")
+	require.Contains(t, stdout, "dynamodb")
 }
 
 func TestSnapshotLoadPodServerError(t *testing.T) {
@@ -380,7 +380,7 @@ func TestSnapshotLoadPodServerError(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "platform unavailable")
+	require.Contains(t, stderr, "platform unavailable")
 }
 
 // TestSnapshotLoadPodNotFound covers a non-existent cloud snapshot. The emulator
@@ -405,8 +405,8 @@ func TestSnapshotLoadPodNotFound(t *testing.T) {
 	requireExitCode(t, 1, err)
 	// The user-facing error is emitted through the sink (stdout); the raw
 	// platform diagnostic must not leak to the user.
-	must.Contains(t, stdout, "not found on the LocalStack platform")
-	must.NotContains(t, strings.ToLower(stdout+stderr), "version information")
+	require.Contains(t, stdout, "not found on the LocalStack platform")
+	require.NotContains(t, strings.ToLower(stdout+stderr), "version information")
 }
 
 func TestSnapshotLoadTelemetryEmitted(t *testing.T) {
@@ -428,7 +428,7 @@ func TestSnapshotLoadTelemetryEmitted(t *testing.T) {
 			With(env.AnalyticsEndpoint, analyticsSrv.URL),
 		"--non-interactive", "snapshot", "load", snapPath,
 	)
-	must.NoError(t, err, "lstk snapshot load failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot load failed: %s", stderr)
 	assertCommandTelemetry(t, events, "snapshot load", 0)
 }
 
@@ -448,8 +448,8 @@ func TestSnapshotLoadInteractive(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"snapshot", "load", snapPath,
 	)
-	must.NoError(t, err, "interactive lstk snapshot load failed")
-	must.Contains(t, out, "Snapshot loaded")
+	require.NoError(t, err, "interactive lstk snapshot load failed")
+	require.Contains(t, out, "Snapshot loaded")
 }
 
 func TestLoadAliasMatchesSnapshotLoad(t *testing.T) {
@@ -471,8 +471,8 @@ func TestLoadAliasMatchesSnapshotLoad(t *testing.T) {
 			With(env.AnalyticsEndpoint, analyticsSrv.URL),
 		"--non-interactive", "load", snapPath,
 	)
-	must.NoError(t, err, "lstk load failed: %s", stderr)
-	must.Contains(t, stdout, "Snapshot loaded")
+	require.NoError(t, err, "lstk load failed: %s", stderr)
+	require.Contains(t, stdout, "Snapshot loaded")
 
 	// Alias must emit telemetry under the canonical name so usage isn't
 	// split across "load" and "snapshot load" labels.
@@ -492,7 +492,7 @@ func TestSnapshotLoadDryRunOnLocalRef(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "--dry-run", snapPath,
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "pod refs")
+	require.Contains(t, stderr, "pod refs")
 }
 
 func TestSnapshotLoadDryRunPodNoAuthToken(t *testing.T) {
@@ -504,7 +504,7 @@ func TestSnapshotLoadDryRunPodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "--dry-run", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "authentication")
+	require.Contains(t, stderr, "authentication")
 }
 
 func TestSnapshotLoadDryRunPodSuccess(t *testing.T) {
@@ -522,10 +522,10 @@ func TestSnapshotLoadDryRunPodSuccess(t *testing.T) {
 			With(env.AuthToken, "test-token"),
 		"--non-interactive", "snapshot", "load", "--dry-run", "pod:my-baseline",
 	)
-	must.NoError(t, err, "lstk snapshot load --dry-run failed: %s", stderr)
-	must.Contains(t, stdout, "Dry-run results")
-	must.Contains(t, stdout, "my-baseline")
-	must.Contains(t, stdout, "No state was modified.")
+	require.NoError(t, err, "lstk snapshot load --dry-run failed: %s", stderr)
+	require.Contains(t, stdout, "Dry-run results")
+	require.Contains(t, stdout, "my-baseline")
+	require.Contains(t, stdout, "No state was modified.")
 }
 
 // TestSnapshotLoadDryRunPodNotFound covers a non-existent cloud snapshot, mirroring
@@ -549,8 +549,8 @@ func TestSnapshotLoadDryRunPodNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "--dry-run", "pod:does-not-exist",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "not found on the LocalStack platform")
-	must.NotContains(t, strings.ToLower(stdout+stderr), "version information")
+	require.Contains(t, stdout, "not found on the LocalStack platform")
+	require.NotContains(t, strings.ToLower(stdout+stderr), "version information")
 }
 
 // mockUnlicensedPodsServer mimics an emulator whose license does not include
@@ -587,9 +587,9 @@ func TestSnapshotLoadFeatureUnavailable(t *testing.T) {
 	)
 	requireExitCode(t, 1, err)
 	// The user-facing error is emitted through the sink (stdout).
-	must.Contains(t, stdout, "Snapshots require a paid LocalStack plan")
-	must.Contains(t, stdout, "https://www.localstack.cloud/pricing")
-	must.NotContains(t, stdout+stderr, "status 404", "the raw HTTP status must not leak to the user")
+	require.Contains(t, stdout, "Snapshots require a paid LocalStack plan")
+	require.Contains(t, stdout, "https://www.localstack.cloud/pricing")
+	require.NotContains(t, stdout+stderr, "status 404", "the raw HTTP status must not leak to the user")
 }
 
 // The save path funnels through a different shared helper than load, so it needs
@@ -610,7 +610,7 @@ func TestSnapshotSaveFeatureUnavailable(t *testing.T) {
 		"--non-interactive", "snapshot", "save", filepath.Join(dir, "out.snapshot"),
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "Snapshots require a paid LocalStack plan")
-	must.Contains(t, stdout, "https://www.localstack.cloud/pricing")
-	must.NotContains(t, stdout+stderr, "status 404")
+	require.Contains(t, stdout, "Snapshots require a paid LocalStack plan")
+	require.Contains(t, stdout, "https://www.localstack.cloud/pricing")
+	require.NotContains(t, stdout+stderr, "status 404")
 }
diff --git a/test/integration/snapshot_load_version_test.go b/test/integration/snapshot_load_version_test.go
index 85e12515..f1062903 100644
--- a/test/integration/snapshot_load_version_test.go
+++ b/test/integration/snapshot_load_version_test.go
@@ -7,8 +7,8 @@ import (
 	"sync"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // queryCapture records the query string of the pod load/diff request the emulator
@@ -91,15 +91,15 @@ func TestSnapshotLoadPodVersionReachesWire(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), versionedLoadEnv(t),
 		"--non-interactive", "--endpoint-url", srv.URL, "snapshot", "load", "pod:my-baseline:3",
 	)
-	must.NoError(t, err, "lstk snapshot load failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot load failed: %s", stderr)
 
 	called, path, query := cap.get()
-	must.True(t, called, "the pod load endpoint should have been called")
-	must.Eq(t, "/_localstack/pods/my-baseline", path)
-	must.Eq(t, "3", query.Get("version"))
-	must.Eq(t, "account-region-merge", query.Get("merge"), "the default merge strategy still applies")
+	require.True(t, called, "the pod load endpoint should have been called")
+	require.Equal(t, "/_localstack/pods/my-baseline", path)
+	require.Equal(t, "3", query.Get("version"))
+	require.Equal(t, "account-region-merge", query.Get("merge"), "the default merge strategy still applies")
 
-	must.Contains(t, stdout, "pod:my-baseline:3", "the loaded source should name the pinned version")
+	require.Contains(t, stdout, "pod:my-baseline:3", "the loaded source should name the pinned version")
 }
 
 // TestSnapshotLoadPodWithoutVersionOmitsParam: an unpinned ref must not send
@@ -113,14 +113,14 @@ func TestSnapshotLoadPodWithoutVersionOmitsParam(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), versionedLoadEnv(t),
 		"--non-interactive", "--endpoint-url", srv.URL, "snapshot", "load", "pod:my-baseline",
 	)
-	must.NoError(t, err, "lstk snapshot load failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot load failed: %s", stderr)
 
 	called, _, query := cap.get()
-	must.True(t, called, "the pod load endpoint should have been called")
-	must.False(t, query.Has("version"), "an unpinned load must not send a version parameter")
+	require.True(t, called, "the pod load endpoint should have been called")
+	require.False(t, query.Has("version"), "an unpinned load must not send a version parameter")
 
-	must.Contains(t, stdout, "pod:my-baseline")
-	must.NotContains(t, stdout, "pod:my-baseline:")
+	require.Contains(t, stdout, "pod:my-baseline")
+	require.NotContains(t, stdout, "pod:my-baseline:")
 }
 
 // TestLoadAliasAcceptsPodVersion: the root `lstk load` alias shares the REF
@@ -134,11 +134,11 @@ func TestLoadAliasAcceptsPodVersion(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), versionedLoadEnv(t),
 		"--non-interactive", "--endpoint-url", srv.URL, "load", "pod:my-baseline:2",
 	)
-	must.NoError(t, err, "lstk load failed: %s", stderr)
+	require.NoError(t, err, "lstk load failed: %s", stderr)
 
 	called, _, query := cap.get()
-	must.True(t, called, "the pod load endpoint should have been called")
-	must.Eq(t, "2", query.Get("version"))
+	require.True(t, called, "the pod load endpoint should have been called")
+	require.Equal(t, "2", query.Get("version"))
 }
 
 // TestSnapshotLoadPodVersionDryRun: --dry-run previews the same version the load
@@ -152,15 +152,15 @@ func TestSnapshotLoadPodVersionDryRun(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), versionedLoadEnv(t),
 		"--non-interactive", "--endpoint-url", srv.URL, "snapshot", "load", "pod:my-baseline:3", "--dry-run",
 	)
-	must.NoError(t, err, "lstk snapshot load --dry-run failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot load --dry-run failed: %s", stderr)
 
 	called, path, query := cap.get()
-	must.True(t, called, "the diff endpoint should have been called")
-	must.Eq(t, "/_localstack/pods/my-baseline/diff", path)
-	must.Eq(t, "3", query.Get("version"))
+	require.True(t, called, "the diff endpoint should have been called")
+	require.Equal(t, "/_localstack/pods/my-baseline/diff", path)
+	require.Equal(t, "3", query.Get("version"))
 
-	must.Contains(t, stdout, "Dry-run results for pod:my-baseline:3")
-	must.Contains(t, stdout, "No state was modified")
+	require.Contains(t, stdout, "Dry-run results for pod:my-baseline:3")
+	require.Contains(t, stdout, "No state was modified")
 }
 
 // TestSnapshotLoadPodVersionNotFound: the emulator's own message already names
@@ -179,10 +179,10 @@ func TestSnapshotLoadPodVersionNotFound(t *testing.T) {
 	requireExitCode(t, 1, err)
 
 	_, _, query := cap.get()
-	must.Eq(t, "99", query.Get("version"))
+	require.Equal(t, "99", query.Get("version"))
 
-	must.Contains(t, stdout, "maximum version available in the remote storage is 3")
-	must.Contains(t, stdout, "lstk snapshot versions pod:my-baseline")
+	require.Contains(t, stdout, "maximum version available in the remote storage is 3")
+	require.Contains(t, stdout, "lstk snapshot versions pod:my-baseline")
 }
 
 // TestSnapshotLoadRejectsMalformedVersion: a colon in a ref is unambiguously a
@@ -204,8 +204,8 @@ func TestSnapshotLoadRejectsMalformedVersion(t *testing.T) {
 				"--non-interactive", "--endpoint-url", srv.URL, "snapshot", "load", ref,
 			)
 			requireExitCode(t, 1, err)
-			must.Contains(t, stderr, "invalid version")
-			must.NotContains(t, stderr, "invalid pod name")
+			require.Contains(t, stderr, "invalid version")
+			require.NotContains(t, stderr, "invalid pod name")
 		})
 	}
 }
@@ -220,7 +220,7 @@ func TestSnapshotLoadS3RejectsPodVersion(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "my-pod:3", "s3://bucket/prefix",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "S3 remotes do not support snapshot versions")
+	require.Contains(t, stderr, "S3 remotes do not support snapshot versions")
 }
 
 // TestSnapshotSaveRejectsPodVersion: the platform assigns a version on every
@@ -234,8 +234,8 @@ func TestSnapshotSaveRejectsPodVersion(t *testing.T) {
 			"--non-interactive", "snapshot", "save", "pod:my-baseline:3",
 		)
 		requireExitCode(t, 1, err)
-		must.Contains(t, stderr, "the platform assigns the version on each save")
-		must.NotContains(t, stderr, "invalid pod name")
+		require.Contains(t, stderr, "the platform assigns the version on each save")
+		require.NotContains(t, stderr, "invalid pod name")
 	})
 
 	t.Run("s3 remote", func(t *testing.T) {
@@ -244,7 +244,7 @@ func TestSnapshotSaveRejectsPodVersion(t *testing.T) {
 			"--non-interactive", "snapshot", "save", "my-pod:3", "s3://bucket/prefix",
 		)
 		requireExitCode(t, 1, err)
-		must.Contains(t, stderr, "S3 remotes do not support snapshot versions")
+		require.Contains(t, stderr, "S3 remotes do not support snapshot versions")
 	})
 }
 
@@ -258,7 +258,7 @@ func TestSnapshotRemoveRejectsPodVersion(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline:3", "--force",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "drop the ':3'")
+	require.Contains(t, stderr, "drop the ':3'")
 }
 
 // TestStartSnapshotFlagAcceptsPodVersion: --snapshot goes through the same REF
@@ -271,5 +271,5 @@ func TestStartSnapshotFlagAcceptsPodVersion(t *testing.T) {
 		"--non-interactive", "start", "--snapshot", "pod:my-baseline:abc",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "invalid version")
+	require.Contains(t, stderr, "invalid version")
 }
diff --git a/test/integration/snapshot_merge_e2e_test.go b/test/integration/snapshot_merge_e2e_test.go
index a8155e6f..bf9e19b0 100644
--- a/test/integration/snapshot_merge_e2e_test.go
+++ b/test/integration/snapshot_merge_e2e_test.go
@@ -9,9 +9,9 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/require"
 )
 
 // End-to-end tests for `lstk snapshot load --merge` that exercise the real
@@ -40,7 +40,7 @@ func requireAWSCLI(t *testing.T) {
 func createSNSTopic(t *testing.T, ctx context.Context, e env.Environ, region, name string) {
 	t.Helper()
 	_, stderr, err := runLstk(t, ctx, "", e, "aws", "sns", "create-topic", "--name", name, "--region", region)
-	must.NoError(t, err, "create-topic %s/%s failed: %s", region, name, stderr)
+	require.NoError(t, err, "create-topic %s/%s failed: %s", region, name, stderr)
 }
 
 // createSQSQueue creates an SQS queue named name in region via `lstk aws`,
@@ -59,14 +59,14 @@ func createSQSQueue(t *testing.T, ctx context.Context, e env.Environ, region, na
 		args = append(args, "--attributes", shorthand)
 	}
 	_, stderr, err := runLstk(t, ctx, "", e, args...)
-	must.NoError(t, err, "create-queue %s/%s failed: %s", region, name, stderr)
+	require.NoError(t, err, "create-queue %s/%s failed: %s", region, name, stderr)
 }
 
 // createS3Bucket creates an S3 bucket named name in region via `lstk aws`.
 func createS3Bucket(t *testing.T, ctx context.Context, e env.Environ, region, name string) {
 	t.Helper()
 	_, stderr, err := runLstk(t, ctx, "", e, "aws", "s3", "mb", "s3://"+name, "--region", region)
-	must.NoError(t, err, "s3 mb %s/%s failed: %s", region, name, stderr)
+	require.NoError(t, err, "s3 mb %s/%s failed: %s", region, name, stderr)
 }
 
 // snsTopicNames lists the SNS topics in region and returns their names (the
@@ -74,14 +74,14 @@ func createS3Bucket(t *testing.T, ctx context.Context, e env.Environ, region, na
 func snsTopicNames(t *testing.T, ctx context.Context, e env.Environ, region string) []string {
 	t.Helper()
 	stdout, stderr, err := runLstk(t, ctx, "", e, "aws", "sns", "list-topics", "--region", region, "--output", "json")
-	must.NoError(t, err, "list-topics %s failed: %s", region, stderr)
+	require.NoError(t, err, "list-topics %s failed: %s", region, stderr)
 
 	var resp struct {
 		Topics []struct {
 			TopicArn string `json:"TopicArn"`
 		} `json:"Topics"`
 	}
-	must.NoError(t, json.Unmarshal([]byte(stdout), &resp), "parsing list-topics output: %s", stdout)
+	require.NoError(t, json.Unmarshal([]byte(stdout), &resp), "parsing list-topics output: %s", stdout)
 
 	names := make([]string, 0, len(resp.Topics))
 	for _, topic := range resp.Topics {
@@ -111,13 +111,13 @@ func topicNameFromARN(arn string) string {
 func sqsQueueURLsByName(t *testing.T, ctx context.Context, e env.Environ, region string) map[string]string {
 	t.Helper()
 	stdout, stderr, err := runLstk(t, ctx, "", e, "aws", "sqs", "list-queues", "--region", region, "--output", "json")
-	must.NoError(t, err, "list-queues %s failed: %s", region, stderr)
+	require.NoError(t, err, "list-queues %s failed: %s", region, stderr)
 
 	var resp struct {
 		QueueUrls []string `json:"QueueUrls"`
 	}
 	if stdout != "" {
-		must.NoError(t, json.Unmarshal([]byte(stdout), &resp), "parsing list-queues output: %s", stdout)
+		require.NoError(t, json.Unmarshal([]byte(stdout), &resp), "parsing list-queues output: %s", stdout)
 	}
 
 	byName := make(map[string]string, len(resp.QueueUrls))
@@ -133,14 +133,14 @@ func sqsQueueVisibilityTimeout(t *testing.T, ctx context.Context, e env.Environ,
 	t.Helper()
 	stdout, stderr, err := runLstk(t, ctx, "", e, "aws", "sqs", "get-queue-attributes",
 		"--queue-url", queueURL, "--attribute-names", "VisibilityTimeout", "--region", region, "--output", "json")
-	must.NoError(t, err, "get-queue-attributes %s failed: %s", queueURL, stderr)
+	require.NoError(t, err, "get-queue-attributes %s failed: %s", queueURL, stderr)
 
 	var resp struct {
 		Attributes struct {
 			VisibilityTimeout string `json:"VisibilityTimeout"`
 		} `json:"Attributes"`
 	}
-	must.NoError(t, json.Unmarshal([]byte(stdout), &resp), "parsing get-queue-attributes output: %s", stdout)
+	require.NoError(t, json.Unmarshal([]byte(stdout), &resp), "parsing get-queue-attributes output: %s", stdout)
 	return resp.Attributes.VisibilityTimeout
 }
 
@@ -148,14 +148,14 @@ func sqsQueueVisibilityTimeout(t *testing.T, ctx context.Context, e env.Environ,
 func s3BucketNames(t *testing.T, ctx context.Context, e env.Environ) []string {
 	t.Helper()
 	stdout, stderr, err := runLstk(t, ctx, "", e, "aws", "s3api", "list-buckets", "--output", "json")
-	must.NoError(t, err, "list-buckets failed: %s", stderr)
+	require.NoError(t, err, "list-buckets failed: %s", stderr)
 
 	var resp struct {
 		Buckets []struct {
 			Name string `json:"Name"`
 		} `json:"Buckets"`
 	}
-	must.NoError(t, json.Unmarshal([]byte(stdout), &resp), "parsing list-buckets output: %s", stdout)
+	require.NoError(t, json.Unmarshal([]byte(stdout), &resp), "parsing list-buckets output: %s", stdout)
 
 	names := make([]string, len(resp.Buckets))
 	for i, b := range resp.Buckets {
@@ -179,10 +179,10 @@ func buildMergeTestSnapshots(t *testing.T, ctx context.Context, e env.Environ, d
 
 	snap1 = filepath.Join(dir, "snapshot1.snapshot")
 	_, stderr, err := runLstk(t, ctx, "", e, "snapshot", "save", snap1)
-	must.NoError(t, err, "snapshot save (1) failed: %s", stderr)
+	require.NoError(t, err, "snapshot save (1) failed: %s", stderr)
 
 	_, stderr, err = runLstk(t, ctx, "", e, "reset", "--force")
-	must.NoError(t, err, "reset before snapshot 2 failed: %s", stderr)
+	require.NoError(t, err, "reset before snapshot 2 failed: %s", stderr)
 
 	createSNSTopic(t, ctx, e, "us-east-1", "topic3")
 	createSQSQueue(t, ctx, e, "us-east-1", "queue3", nil)
@@ -190,7 +190,7 @@ func buildMergeTestSnapshots(t *testing.T, ctx context.Context, e env.Environ, d
 
 	snap2 = filepath.Join(dir, "snapshot2.snapshot")
 	_, stderr, err = runLstk(t, ctx, "", e, "snapshot", "save", snap2)
-	must.NoError(t, err, "snapshot save (2) failed: %s", stderr)
+	require.NoError(t, err, "snapshot save (2) failed: %s", stderr)
 
 	return snap1, snap2
 }
@@ -215,7 +215,7 @@ func TestSnapshotLoadMergeStrategies(t *testing.T) {
 	// Pinned to the "dev" image tag rather than the default "latest" so we can
 	// catch problems with the merge logic in a known-good image before they hit users.
 	configPath := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configPath, []byte("[[containers]]\ntype = \"aws\"\ntag = \""+mergeTestAWSTag+"\"\nport = \"4566\"\n"), 0644))
+	require.NoError(t, os.WriteFile(configPath, []byte("[[containers]]\ntype = \"aws\"\ntag = \""+mergeTestAWSTag+"\"\nport = \"4566\"\n"), 0644))
 	startRealLocalStackWithConfig(t, ctx, token, configPath)
 
 	e := env.With(env.DisableEvents, "1").WithHome(t.TempDir())
@@ -225,7 +225,7 @@ func TestSnapshotLoadMergeStrategies(t *testing.T) {
 	// first (runLstk has no TTY, so this is non-interactive) so every later
 	// `aws` call's stdout is clean JSON.
 	_, stderr, err := runLstk(t, ctx, "", e, "setup", "aws")
-	must.NoError(t, err, "lstk setup aws failed: %s", stderr)
+	require.NoError(t, err, "lstk setup aws failed: %s", stderr)
 
 	snap1, snap2 := buildMergeTestSnapshots(t, ctx, e, t.TempDir())
 
@@ -266,35 +266,35 @@ func TestSnapshotLoadMergeStrategies(t *testing.T) {
 	for _, tc := range tests {
 		t.Run(tc.strategy, func(t *testing.T) {
 			_, stderr, err := runLstk(t, ctx, "", e, "reset", "--force")
-			must.NoError(t, err, "reset failed: %s", stderr)
+			require.NoError(t, err, "reset failed: %s", stderr)
 
 			_, stderr, err = runLstk(t, ctx, "", e, "snapshot", "load", snap1)
-			must.NoError(t, err, "loading snapshot1 failed: %s", stderr)
+			require.NoError(t, err, "loading snapshot1 failed: %s", stderr)
 
 			_, stderr, err = runLstk(t, ctx, "", e, "snapshot", "load", snap2, "--merge="+tc.strategy)
-			must.NoError(t, err, "loading snapshot2 (merge=%s) failed: %s", tc.strategy, stderr)
+			require.NoError(t, err, "loading snapshot2 (merge=%s) failed: %s", tc.strategy, stderr)
 
-			must.ElementsMatch(t, tc.wantUSEastSNS, snsTopicNames(t, ctx, e, "us-east-1"), "us-east-1 SNS topics")
-			must.ElementsMatch(t, tc.wantUSEastS3, s3BucketNames(t, ctx, e), "S3 buckets")
-			must.ElementsMatch(t, tc.wantAPSoutheast2["sns"], snsTopicNames(t, ctx, e, "ap-southeast-2"), "ap-southeast-2 SNS topics")
+			require.ElementsMatch(t, tc.wantUSEastSNS, snsTopicNames(t, ctx, e, "us-east-1"), "us-east-1 SNS topics")
+			require.ElementsMatch(t, tc.wantUSEastS3, s3BucketNames(t, ctx, e), "S3 buckets")
+			require.ElementsMatch(t, tc.wantAPSoutheast2["sns"], snsTopicNames(t, ctx, e, "ap-southeast-2"), "ap-southeast-2 SNS topics")
 
 			usEastQueues := sqsQueueURLsByName(t, ctx, e, "us-east-1")
 			gotUSEastSQS := make([]string, 0, len(usEastQueues))
 			for name := range usEastQueues {
 				gotUSEastSQS = append(gotUSEastSQS, name)
 			}
-			must.ElementsMatch(t, tc.wantUSEastSQS, gotUSEastSQS, "us-east-1 SQS queues")
+			require.ElementsMatch(t, tc.wantUSEastSQS, gotUSEastSQS, "us-east-1 SQS queues")
 
 			apSoutheastQueues := sqsQueueURLsByName(t, ctx, e, "ap-southeast-2")
 			gotAPSoutheastSQS := make([]string, 0, len(apSoutheastQueues))
 			for name := range apSoutheastQueues {
 				gotAPSoutheastSQS = append(gotAPSoutheastSQS, name)
 			}
-			must.ElementsMatch(t, tc.wantAPSoutheast2["sqs"], gotAPSoutheastSQS, "ap-southeast-2 SQS queues")
+			require.ElementsMatch(t, tc.wantAPSoutheast2["sqs"], gotAPSoutheastSQS, "ap-southeast-2 SQS queues")
 
 			queueToReplaceURL, ok := usEastQueues["queue-to-replace"]
-			must.True(t, ok, "queue-to-replace should exist in us-east-1 after merge=%s", tc.strategy)
-			must.Eq(t, tc.wantVisibility, sqsQueueVisibilityTimeout(t, ctx, e, "us-east-1", queueToReplaceURL),
+			require.True(t, ok, "queue-to-replace should exist in us-east-1 after merge=%s", tc.strategy)
+			require.Equal(t, tc.wantVisibility, sqsQueueVisibilityTimeout(t, ctx, e, "us-east-1", queueToReplaceURL),
 				"queue-to-replace VisibilityTimeout after merge=%s", tc.strategy)
 		})
 	}
diff --git a/test/integration/snapshot_remove_test.go b/test/integration/snapshot_remove_test.go
index 76e312c8..ae71ddd5 100644
--- a/test/integration/snapshot_remove_test.go
+++ b/test/integration/snapshot_remove_test.go
@@ -7,8 +7,8 @@ import (
 	"sync/atomic"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // mockPodRemoveServer returns a test server that handles DELETE /_localstack/pods/{name}.
@@ -40,8 +40,8 @@ func TestSnapshotRemoveLocalRefRejected(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "./my-baseline.zip",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "resolves to a local file")
-	must.Contains(t, stderr, "CLI cannot delete local files")
+	require.Contains(t, stderr, "resolves to a local file")
+	require.Contains(t, stderr, "CLI cannot delete local files")
 }
 
 func TestSnapshotRemoveLocalBareNameRejected(t *testing.T) {
@@ -53,8 +53,8 @@ func TestSnapshotRemoveLocalBareNameRejected(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "resolves to a local file")
-	must.Contains(t, stderr, "CLI cannot delete local files")
+	require.Contains(t, stderr, "resolves to a local file")
+	require.Contains(t, stderr, "CLI cannot delete local files")
 }
 
 func TestSnapshotRemovePodNoAuthToken(t *testing.T) {
@@ -66,7 +66,7 @@ func TestSnapshotRemovePodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline", "--force",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "authentication")
+	require.Contains(t, stderr, "authentication")
 }
 
 func TestSnapshotRemovePodInvalidName(t *testing.T) {
@@ -81,7 +81,7 @@ func TestSnapshotRemovePodInvalidName(t *testing.T) {
 				"--non-interactive", "snapshot", "remove", ref,
 			)
 			requireExitCode(t, 1, err)
-			must.Contains(t, stderr, "invalid pod name")
+			require.Contains(t, stderr, "invalid pod name")
 		})
 	}
 }
@@ -95,7 +95,7 @@ func TestSnapshotRemoveNonInteractiveRequiresForce(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "--force")
+	require.Contains(t, stderr, "--force")
 }
 
 func TestSnapshotRemoteSchemeRejected(t *testing.T) {
@@ -110,7 +110,7 @@ func TestSnapshotRemoteSchemeRejected(t *testing.T) {
 				"--non-interactive", "snapshot", "remove", ref,
 			)
 			requireExitCode(t, 1, err)
-			must.Contains(t, stderr, "not yet supported")
+			require.Contains(t, stderr, "not yet supported")
 		})
 	}
 }
@@ -132,10 +132,10 @@ func TestSnapshotRemovePodSuccess(t *testing.T) {
 			With(env.AuthToken, "test-token"),
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline", "--force",
 	)
-	must.NoError(t, err, "lstk snapshot remove pod:my-baseline failed: %s", stderr)
-	must.Contains(t, stdout, "my-baseline")
-	must.Contains(t, stdout, "deleted")
-	must.Eq(t, int32(1), calls(), "DELETE endpoint should be called exactly once")
+	require.NoError(t, err, "lstk snapshot remove pod:my-baseline failed: %s", stderr)
+	require.Contains(t, stdout, "my-baseline")
+	require.Contains(t, stdout, "deleted")
+	require.Equal(t, int32(1), calls(), "DELETE endpoint should be called exactly once")
 }
 
 func TestSnapshotRemovePodServerError(t *testing.T) {
@@ -154,8 +154,8 @@ func TestSnapshotRemovePodServerError(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline", "--force",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "pod remove failed")
-	must.Eq(t, int32(1), calls(), "DELETE endpoint should be called even when server errors")
+	require.Contains(t, stderr, "pod remove failed")
+	require.Equal(t, int32(1), calls(), "DELETE endpoint should be called even when server errors")
 }
 
 func TestSnapshotRemovePodNotFound(t *testing.T) {
@@ -183,10 +183,10 @@ func TestSnapshotRemovePodNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-snapshot", "--force",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, `"my-snapshot"`)
-	must.Contains(t, stderr, "not found")
-	must.NotContains(t, stderr, "HTTP 500")
-	must.NotContains(t, stderr, "pod remove failed")
+	require.Contains(t, stderr, `"my-snapshot"`)
+	require.Contains(t, stderr, "not found")
+	require.NotContains(t, stderr, "HTTP 500")
+	require.NotContains(t, stderr, "pod remove failed")
 }
 
 func TestSnapshotRemoveInteractive(t *testing.T) {
@@ -215,10 +215,10 @@ func TestSnapshotRemoveInteractive(t *testing.T) {
 		p := startRemove(t, srv)
 		p.write("y")
 		out, err := p.wait()
-		must.NoError(t, err)
+		require.NoError(t, err)
 
-		must.Contains(t, out, "deleted")
-		must.Eq(t, int32(1), calls(), "DELETE endpoint should be called after confirmation")
+		require.Contains(t, out, "deleted")
+		require.Equal(t, int32(1), calls(), "DELETE endpoint should be called after confirmation")
 	})
 
 	t.Run("cancels with n", func(t *testing.T) {
@@ -226,10 +226,10 @@ func TestSnapshotRemoveInteractive(t *testing.T) {
 		p := startRemove(t, srv)
 		p.write("n")
 		out, err := p.wait()
-		must.NoError(t, err)
+		require.NoError(t, err)
 
-		must.Contains(t, out, "Cancelled")
-		must.Eq(t, int32(0), calls(), "DELETE endpoint must not be called when user cancels")
+		require.Contains(t, out, "Cancelled")
+		require.Equal(t, int32(0), calls(), "DELETE endpoint must not be called when user cancels")
 	})
 
 	t.Run("force skips confirmation prompt", func(t *testing.T) {
@@ -241,10 +241,10 @@ func TestSnapshotRemoveInteractive(t *testing.T) {
 				With(env.AuthToken, "test-token"),
 			"snapshot", "remove", "pod:my-baseline", "--force")
 		out, err := p.wait()
-		must.NoError(t, err)
+		require.NoError(t, err)
 
-		must.NotContains(t, out, "Delete cloud snapshot", "confirmation prompt must not appear with --force")
-		must.Contains(t, out, "deleted")
-		must.Eq(t, int32(1), calls(), "DELETE endpoint should be called without confirmation")
+		require.NotContains(t, out, "Delete cloud snapshot", "confirmation prompt must not appear with --force")
+		require.Contains(t, out, "deleted")
+		require.Equal(t, int32(1), calls(), "DELETE endpoint should be called without confirmation")
 	})
 }
diff --git a/test/integration/snapshot_save_test.go b/test/integration/snapshot_save_test.go
index 5dd06f34..d1e56a69 100644
--- a/test/integration/snapshot_save_test.go
+++ b/test/integration/snapshot_save_test.go
@@ -14,8 +14,8 @@ import (
 	"sync"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // mockStateServer returns a test server that serves a minimal ZIP at /_localstack/pods/state.
@@ -24,10 +24,10 @@ func mockStateServer(t *testing.T) *httptest.Server {
 	var zipBuf bytes.Buffer
 	zw := zip.NewWriter(&zipBuf)
 	f, err := zw.Create("state.json")
-	must.NoError(t, err)
+	require.NoError(t, err)
 	_, err = f.Write([]byte(`{"services":{}}`))
-	must.NoError(t, err)
-	must.NoError(t, zw.Close())
+	require.NoError(t, err)
+	require.NoError(t, zw.Close())
 	zipData := zipBuf.Bytes()
 
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -58,10 +58,10 @@ func mockStateServerCapturing(t *testing.T) (*httptest.Server, func() string) {
 	var zipBuf bytes.Buffer
 	zw := zip.NewWriter(&zipBuf)
 	f, err := zw.Create("state.json")
-	must.NoError(t, err)
+	require.NoError(t, err)
 	_, err = f.Write([]byte(`{"services":{}}`))
-	must.NoError(t, err)
-	must.NoError(t, zw.Close())
+	require.NoError(t, err)
+	require.NoError(t, zw.Close())
 	zipData := zipBuf.Bytes()
 
 	var (
@@ -108,11 +108,11 @@ func TestSnapshotSaveDefaultDestination(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "save",
 	)
-	must.NoError(t, err, "lstk snapshot save failed: %s", stderr)
-	must.Contains(t, stdout, "Snapshot saved")
+	require.NoError(t, err, "lstk snapshot save failed: %s", stderr)
+	require.Contains(t, stdout, "Snapshot saved")
 
 	entries, readErr := os.ReadDir(dir)
-	must.NoError(t, readErr)
+	require.NoError(t, readErr)
 	var found bool
 	for _, e := range entries {
 		if strings.HasPrefix(e.Name(), "snapshot-") && strings.HasSuffix(e.Name(), ".snapshot") {
@@ -120,7 +120,7 @@ func TestSnapshotSaveDefaultDestination(t *testing.T) {
 			break
 		}
 	}
-	must.True(t, found, "default snapshot file (snapshot-*.snapshot) should exist in %s", dir)
+	require.True(t, found, "default snapshot file (snapshot-*.snapshot) should exist in %s", dir)
 }
 
 func TestSnapshotSaveCustomPath(t *testing.T) {
@@ -138,17 +138,17 @@ func TestSnapshotSaveCustomPath(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "save", outPath,
 	)
-	must.NoError(t, err, "lstk snapshot save failed: %s", stderr)
-	must.Contains(t, stdout, "Snapshot saved")
-	must.Contains(t, stdout, "./my-snap.snapshot")
+	require.NoError(t, err, "lstk snapshot save failed: %s", stderr)
+	require.Contains(t, stdout, "Snapshot saved")
+	require.Contains(t, stdout, "./my-snap.snapshot")
 
 	data, err := os.ReadFile(outPath)
-	must.NoError(t, err, "output file should exist")
-	must.True(t, len(data) > 0, "output file should be non-empty")
+	require.NoError(t, err, "output file should exist")
+	require.True(t, len(data) > 0, "output file should be non-empty")
 
 	r, err := zip.NewReader(bytes.NewReader(data), int64(len(data)))
-	must.NoError(t, err, "output file should be a valid ZIP")
-	must.NotEmpty(t, r.File)
+	require.NoError(t, err, "output file should be a valid ZIP")
+	require.NotEmpty(t, r.File)
 }
 
 func TestSnapshotSaveRelativePath(t *testing.T) {
@@ -165,11 +165,11 @@ func TestSnapshotSaveRelativePath(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "save", "./my-state",
 	)
-	must.NoError(t, err, "lstk snapshot save failed: %s", stderr)
-	must.Contains(t, stdout, "Snapshot saved")
+	require.NoError(t, err, "lstk snapshot save failed: %s", stderr)
+	require.Contains(t, stdout, "Snapshot saved")
 
 	_, statErr := os.Stat(filepath.Join(dir, "my-state.snapshot"))
-	must.NoError(t, statErr, "relative output file should exist")
+	require.NoError(t, statErr, "relative output file should exist")
 }
 
 // TestSnapshotSaveForcesSnapshotExtension verifies that a user-supplied extension
@@ -188,13 +188,13 @@ func TestSnapshotSaveForcesSnapshotExtension(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "save", "./x.zip",
 	)
-	must.NoError(t, err, "lstk snapshot save failed: %s", stderr)
-	must.Contains(t, stdout, "./x.snapshot")
+	require.NoError(t, err, "lstk snapshot save failed: %s", stderr)
+	require.Contains(t, stdout, "./x.snapshot")
 
 	_, statErr := os.Stat(filepath.Join(dir, "x.snapshot"))
-	must.NoError(t, statErr, "extension should be forced to .snapshot")
+	require.NoError(t, statErr, "extension should be forced to .snapshot")
 	_, zipErr := os.Stat(filepath.Join(dir, "x.zip"))
-	must.True(t, os.IsNotExist(zipErr), "the user-supplied .zip path should not be created")
+	require.True(t, os.IsNotExist(zipErr), "the user-supplied .zip path should not be created")
 }
 
 func TestSnapshotSaveOverwritesExistingFile(t *testing.T) {
@@ -207,17 +207,17 @@ func TestSnapshotSaveOverwritesExistingFile(t *testing.T) {
 	srv := mockStateServer(t)
 	dir := t.TempDir()
 	outPath := filepath.Join(dir, "snap.snapshot")
-	must.NoError(t, os.WriteFile(outPath, []byte("OLD"), 0600))
+	require.NoError(t, os.WriteFile(outPath, []byte("OLD"), 0600))
 
 	_, stderr, err := runLstk(t, ctx, dir,
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "save", outPath,
 	)
-	must.NoError(t, err, "lstk snapshot save should overwrite: %s", stderr)
+	require.NoError(t, err, "lstk snapshot save should overwrite: %s", stderr)
 
 	data, err := os.ReadFile(outPath)
-	must.NoError(t, err)
-	must.NotEq(t, "OLD", string(data), "file should have been overwritten")
+	require.NoError(t, err)
+	require.NotEqual(t, "OLD", string(data), "file should have been overwritten")
 }
 
 func TestSnapshotSaveRemoteRejected(t *testing.T) {
@@ -231,7 +231,7 @@ func TestSnapshotSaveRemoteRejected(t *testing.T) {
 
 			_, stderr, err := runLstk(t, ctx, t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--non-interactive", "snapshot", "save", dest)
 			requireExitCode(t, 1, err)
-			must.Contains(t, stderr, "not yet supported")
+			require.Contains(t, stderr, "not yet supported")
 		})
 	}
 }
@@ -247,7 +247,7 @@ func TestSnapshotSaveS3MissingCredentials(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "my-pod", "s3://my-bucket/prefix",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "AWS credentials required")
+	require.Contains(t, stderr, "AWS credentials required")
 }
 
 func TestSnapshotSaveS3CredentialsInURLRejected(t *testing.T) {
@@ -261,7 +261,7 @@ func TestSnapshotSaveS3CredentialsInURLRejected(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "my-pod", "s3://my-bucket/prefix?access_key_id=AKIA&secret_access_key=secret",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "do not put credentials")
+	require.Contains(t, stderr, "do not put credentials")
 }
 
 // mockPodS3Server handles the remote registration plus pod save against an S3
@@ -326,18 +326,18 @@ func TestSnapshotSaveS3Success(t *testing.T) {
 			With(env.AWSSecretAccessKey, "topsecret"),
 		"--non-interactive", "snapshot", "save", "my-pod", s3URL,
 	)
-	must.NoError(t, err, "lstk snapshot save to s3 failed: %s", stderr)
-	must.Contains(t, stdout, "Snapshot saved to "+s3URL)
-	must.Contains(t, stdout, "my-pod")
+	require.NoError(t, err, "lstk snapshot save to s3 failed: %s", stderr)
+	require.Contains(t, stdout, "Snapshot saved to "+s3URL)
+	require.Contains(t, stdout, "my-pod")
 
 	remoteURL, saveBody := captured()
 	// The registered URL carries placeholders, never the secret values.
-	must.Contains(t, remoteURL, "{access_key_id}")
-	must.NotContains(t, remoteURL, "topsecret")
-	must.NotContains(t, remoteURL, "AKIAEXAMPLE")
+	require.Contains(t, remoteURL, "{access_key_id}")
+	require.NotContains(t, remoteURL, "topsecret")
+	require.NotContains(t, remoteURL, "AKIAEXAMPLE")
 	// The secrets travel only in the ephemeral save params.
-	must.Contains(t, string(saveBody), "topsecret")
-	must.Contains(t, string(saveBody), "remote_params")
+	require.Contains(t, string(saveBody), "topsecret")
+	require.Contains(t, string(saveBody), "remote_params")
 }
 
 // mockPodSaveServer returns a test server that handles POST /_localstack/pods/{name}
@@ -377,11 +377,11 @@ func TestSnapshotSavePodSuccess(t *testing.T) {
 			With(env.AuthToken, "test-token"),
 		"--non-interactive", "snapshot", "save", "pod:my-baseline",
 	)
-	must.NoError(t, err, "lstk snapshot save pod:my-baseline failed: %s", stderr)
-	must.Contains(t, stdout, "Snapshot saved")
-	must.Contains(t, stdout, "my-baseline")
-	must.Contains(t, stdout, "Version: 1")
-	must.Contains(t, stdout, "dynamodb, s3")
+	require.NoError(t, err, "lstk snapshot save pod:my-baseline failed: %s", stderr)
+	require.Contains(t, stdout, "Snapshot saved")
+	require.Contains(t, stdout, "my-baseline")
+	require.Contains(t, stdout, "Version: 1")
+	require.Contains(t, stdout, "dynamodb, s3")
 }
 
 func TestSnapshotSavePodServerError(t *testing.T) {
@@ -400,7 +400,7 @@ func TestSnapshotSavePodServerError(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "platform error")
+	require.Contains(t, stderr, "platform error")
 }
 
 func TestSnapshotSavePodNoAuthToken(t *testing.T) {
@@ -412,7 +412,7 @@ func TestSnapshotSavePodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "authentication")
+	require.Contains(t, stderr, "authentication")
 }
 
 func TestSnapshotSavePodInvalidName(t *testing.T) {
@@ -428,7 +428,7 @@ func TestSnapshotSavePodInvalidName(t *testing.T) {
 
 			_, stderr, err := runLstk(t, ctx, t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--non-interactive", "snapshot", "save", dest)
 			requireExitCode(t, 1, err)
-			must.Contains(t, stderr, "invalid pod name")
+			require.Contains(t, stderr, "invalid pod name")
 		})
 	}
 }
@@ -501,18 +501,18 @@ func TestSnapshotSavePodWithServices(t *testing.T) {
 			With(env.AuthToken, "test-token"),
 		"--non-interactive", "snapshot", "save", "pod:my-baseline", "--services", "s3,dynamodb",
 	)
-	must.NoError(t, err, "lstk snapshot save pod:my-baseline --services failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot save pod:my-baseline --services failed: %s", stderr)
 
 	var parsed struct {
 		Attributes struct {
 			Services []string `json:"services"`
 		} `json:"attributes"`
 	}
-	must.NoError(t, json.Unmarshal(capturedBody(), &parsed))
-	must.Eq(t, []string{"s3", "dynamodb"}, parsed.Attributes.Services, "request body must carry exactly the requested services")
+	require.NoError(t, json.Unmarshal(capturedBody(), &parsed))
+	require.Equal(t, []string{"s3", "dynamodb"}, parsed.Attributes.Services, "request body must carry exactly the requested services")
 
-	must.Contains(t, stdout, "Snapshot saved")
-	must.Contains(t, stdout, "Services: s3, dynamodb")
+	require.Contains(t, stdout, "Snapshot saved")
+	require.Contains(t, stdout, "Services: s3, dynamodb")
 }
 
 func TestSnapshotSavePodServicesSingleValue(t *testing.T) {
@@ -530,15 +530,15 @@ func TestSnapshotSavePodServicesSingleValue(t *testing.T) {
 			With(env.AuthToken, "test-token"),
 		"--non-interactive", "snapshot", "save", "pod:my-baseline", "-s", "s3",
 	)
-	must.NoError(t, err, "lstk snapshot save pod:my-baseline -s s3 failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot save pod:my-baseline -s s3 failed: %s", stderr)
 
 	var parsed struct {
 		Attributes struct {
 			Services []string `json:"services"`
 		} `json:"attributes"`
 	}
-	must.NoError(t, json.Unmarshal(capturedBody(), &parsed))
-	must.Eq(t, []string{"s3"}, parsed.Attributes.Services)
+	require.NoError(t, json.Unmarshal(capturedBody(), &parsed))
+	require.Equal(t, []string{"s3"}, parsed.Attributes.Services)
 }
 
 func TestSnapshotSavePodServicesInvalidFormat(t *testing.T) {
@@ -558,7 +558,7 @@ func TestSnapshotSavePodServicesInvalidFormat(t *testing.T) {
 				"--non-interactive", "snapshot", "save", "pod:my-baseline", "--services", value,
 			)
 			requireExitCode(t, 1, err)
-			must.Contains(t, stderr, "comma-separated list of service names")
+			require.Contains(t, stderr, "comma-separated list of service names")
 		})
 	}
 }
@@ -578,14 +578,14 @@ func TestSnapshotSaveLocalWithServices(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"--non-interactive", "snapshot", "save", dest, "--services", "s3,dynamodb",
 	)
-	must.NoError(t, err, "lstk snapshot save --services failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot save --services failed: %s", stderr)
 
-	must.Eq(t, "services=s3,dynamodb", capturedQuery(), "request must carry exactly the requested services")
-	must.Contains(t, stdout, "Snapshot saved")
-	must.Contains(t, stdout, "Services: s3, dynamodb")
+	require.Equal(t, "services=s3,dynamodb", capturedQuery(), "request must carry exactly the requested services")
+	require.Contains(t, stdout, "Snapshot saved")
+	require.Contains(t, stdout, "Services: s3, dynamodb")
 
 	_, statErr := os.Stat(dest)
-	must.NoError(t, statErr, "snapshot file should have been created")
+	require.NoError(t, statErr, "snapshot file should have been created")
 }
 
 func TestSnapshotSaveS3WithServices(t *testing.T) {
@@ -605,7 +605,7 @@ func TestSnapshotSaveS3WithServices(t *testing.T) {
 			With(env.AWSSecretAccessKey, "topsecret"),
 		"--non-interactive", "snapshot", "save", "my-pod", s3URL, "--services", "s3,lambda",
 	)
-	must.NoError(t, err, "lstk snapshot save to s3 with --services failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot save to s3 with --services failed: %s", stderr)
 
 	_, saveBody := captured()
 	var parsed struct {
@@ -613,8 +613,8 @@ func TestSnapshotSaveS3WithServices(t *testing.T) {
 			Services []string `json:"services"`
 		} `json:"attributes"`
 	}
-	must.NoError(t, json.Unmarshal(saveBody, &parsed))
-	must.Eq(t, []string{"s3", "lambda"}, parsed.Attributes.Services)
+	require.NoError(t, json.Unmarshal(saveBody, &parsed))
+	require.Equal(t, []string{"s3", "lambda"}, parsed.Attributes.Services)
 }
 
 func TestSnapshotSaveEmulatorNotRunning(t *testing.T) {
@@ -648,7 +648,7 @@ func TestSnapshotSaveEmulatorNotRunning(t *testing.T) {
 			}
 			stdout, _, err := runLstk(t, ctx, t.TempDir(), e, tc.args...)
 			requireExitCode(t, 1, err)
-			must.Contains(t, stdout, "not running")
+			require.Contains(t, stdout, "not running")
 		})
 	}
 }
@@ -667,7 +667,7 @@ func TestSnapshotSaveInvalidParentDir(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "/no/such/dir/state",
 	)
 	requireExitCode(t, 1, err)
-	must.NotEmpty(t, stderr)
+	require.NotEmpty(t, stderr)
 }
 
 func TestSnapshotSaveTelemetryEmitted(t *testing.T) {
@@ -684,7 +684,7 @@ func TestSnapshotSaveTelemetryEmitted(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)).With(env.AnalyticsEndpoint, analyticsSrv.URL),
 		"--non-interactive", "snapshot", "save",
 	)
-	must.NoError(t, err, "lstk snapshot save failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot save failed: %s", stderr)
 	assertCommandTelemetry(t, events, "snapshot save", 0)
 }
 
@@ -721,16 +721,16 @@ func TestSaveAliasMatchesSnapshotSave(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)).With(env.AnalyticsEndpoint, analyticsSrv.URL),
 		"--non-interactive", "save", outPath,
 	)
-	must.NoError(t, err, "lstk save failed: %s", stderr)
-	must.Contains(t, stdout, "Snapshot saved")
+	require.NoError(t, err, "lstk save failed: %s", stderr)
+	require.Contains(t, stdout, "Snapshot saved")
 
 	data, err := os.ReadFile(outPath)
-	must.NoError(t, err, "output file should exist")
-	must.True(t, len(data) > 0, "output file should be non-empty")
+	require.NoError(t, err, "output file should exist")
+	require.True(t, len(data) > 0, "output file should be non-empty")
 
 	r, err := zip.NewReader(bytes.NewReader(data), int64(len(data)))
-	must.NoError(t, err, "output file should be a valid ZIP")
-	must.NotEmpty(t, r.File)
+	require.NoError(t, err, "output file should be a valid ZIP")
+	require.NotEmpty(t, r.File)
 
 	// Alias must emit telemetry under the canonical name so usage isn't
 	// split across "save" and "snapshot save" labels.
@@ -751,6 +751,6 @@ func TestSnapshotSaveInteractive(t *testing.T) {
 		env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.LocalStackHost, lsHost(srv)),
 		"snapshot", "save", filepath.Join(dir, "snap"),
 	)
-	must.NoError(t, err, "interactive lstk snapshot save failed")
-	must.Contains(t, out, "Snapshot saved")
+	require.NoError(t, err, "interactive lstk snapshot save failed")
+	require.Contains(t, out, "Snapshot saved")
 }
diff --git a/test/integration/snapshot_show_test.go b/test/integration/snapshot_show_test.go
index 7febd53c..0018d0fb 100644
--- a/test/integration/snapshot_show_test.go
+++ b/test/integration/snapshot_show_test.go
@@ -8,9 +8,9 @@ import (
 	"sync"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // showCapture records what the single-pod platform endpoint received.
@@ -77,11 +77,11 @@ func TestSnapshotShowSuccessWithoutDocker(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "show", "pod:my-baseline",
 	)
-	must.NoError(t, err, "lstk snapshot show failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot show failed: %s", stderr)
 
 	called, path, _ := cap.get()
-	must.True(t, called, "the single-pod endpoint should have been called")
-	must.Eq(t, "/v1/cloudpods/my-baseline", path)
+	require.True(t, called, "the single-pod endpoint should have been called")
+	require.Equal(t, "/v1/cloudpods/my-baseline", path)
 
 	snap.Match(t, sanitizeOutput(stdout))
 }
@@ -97,9 +97,9 @@ func TestSnapshotShowWithoutResources(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "show", "pod:bare",
 	)
-	must.NoError(t, err, "lstk snapshot show failed: %s", stderr)
-	must.Contains(t, stdout, "s3, sqs")
-	must.NotContains(t, stdout, "Resources", "Resources section must be omitted when no counts are available")
+	require.NoError(t, err, "lstk snapshot show failed: %s", stderr)
+	require.Contains(t, stdout, "s3, sqs")
+	require.NotContains(t, stdout, "Resources", "Resources section must be omitted when no counts are available")
 }
 
 // TestSnapshotShowPodNameLeadingUnderscore covers a name the platform's
@@ -117,11 +117,11 @@ func TestSnapshotShowPodNameLeadingUnderscore(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "show", "pod:"+name,
 	)
-	must.NoError(t, err, "lstk snapshot show failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot show failed: %s", stderr)
 
 	called, path, _ := cap.get()
-	must.True(t, called, "the single-pod endpoint should have been called")
-	must.Eq(t, "/v1/cloudpods/"+name, path)
+	require.True(t, called, "the single-pod endpoint should have been called")
+	require.Equal(t, "/v1/cloudpods/"+name, path)
 }
 
 // TestSnapshotShowRejectsPodNameWithPeriod: dots are outside the platform's
@@ -137,11 +137,11 @@ func TestSnapshotShowRejectsPodNameWithPeriod(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "show", "pod:release.v1",
 	)
-	must.Error(t, err, "a dotted pod name must be rejected client-side")
-	must.Contains(t, stderr, "invalid pod name")
+	require.Error(t, err, "a dotted pod name must be rejected client-side")
+	require.Contains(t, stderr, "invalid pod name")
 
 	called, _, _ := cap.get()
-	must.False(t, called, "the platform endpoint must not be called for an invalid name")
+	require.False(t, called, "the platform endpoint must not be called for an invalid name")
 }
 
 func TestSnapshotShowSendsBasicAuthHeader(t *testing.T) {
@@ -155,10 +155,10 @@ func TestSnapshotShowSendsBasicAuthHeader(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "show", "pod:p",
 	)
-	must.NoError(t, err, "lstk snapshot show failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot show failed: %s", stderr)
 	_, _, auth := cap.get()
 	expected := "Basic " + base64.StdEncoding.EncodeToString([]byte(":test-token"))
-	must.Eq(t, expected, auth)
+	require.Equal(t, expected, auth)
 }
 
 func TestSnapshotShowRejectsLocalPath(t *testing.T) {
@@ -175,7 +175,7 @@ func TestSnapshotShowRejectsLocalPath(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "./my-snapshot",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, strings.ToLower(stderr), "local")
+	require.Contains(t, strings.ToLower(stderr), "local")
 }
 
 func TestSnapshotShowNotFound(t *testing.T) {
@@ -191,8 +191,8 @@ func TestSnapshotShowNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "pod:missing",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "not found")
-	must.Contains(t, stdout, "lstk snapshot list")
+	require.Contains(t, stdout, "not found")
+	require.Contains(t, stdout, "lstk snapshot list")
 }
 
 func TestSnapshotShowRequiresAuthToken(t *testing.T) {
@@ -213,6 +213,6 @@ func TestSnapshotShowRequiresAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "Authentication required")
-	must.Contains(t, stdout, "lstk login")
+	require.Contains(t, stdout, "Authentication required")
+	require.Contains(t, stdout, "lstk login")
 }
diff --git a/test/integration/snapshot_versions_test.go b/test/integration/snapshot_versions_test.go
index f066d65a..d1ba1ecb 100644
--- a/test/integration/snapshot_versions_test.go
+++ b/test/integration/snapshot_versions_test.go
@@ -6,9 +6,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // threeVersionPod is a platform payload with a deliberately out-of-order
@@ -47,11 +47,11 @@ func TestSnapshotVersionsSuccessWithoutDocker(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "versions", "pod:my-baseline",
 	)
-	must.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
 
 	called, path, _ := cap.get()
-	must.True(t, called, "the single-pod endpoint should have been called")
-	must.Eq(t, "/v1/cloudpods/my-baseline", path)
+	require.True(t, called, "the single-pod endpoint should have been called")
+	require.Equal(t, "/v1/cloudpods/my-baseline", path)
 
 	// The snapshot pins column set (no DESCRIPTION), newest-first ordering,
 	// and that descriptions are no longer rendered.
@@ -75,7 +75,7 @@ func TestSnapshotVersionsFiltersDeletedVersions(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "versions", "pod:p",
 	)
-	must.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
 
 	snap.Match(t, sanitizeOutput(stdout))
 }
@@ -90,8 +90,8 @@ func TestSnapshotVersionsSingleVersionUsesSingularNoun(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "versions", "pod:solo",
 	)
-	must.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
-	must.Contains(t, stdout, "~ 1 version\n")
+	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
+	require.Contains(t, stdout, "~ 1 version\n")
 }
 
 func TestSnapshotVersionsEmptyHistory(t *testing.T) {
@@ -103,9 +103,9 @@ func TestSnapshotVersionsEmptyHistory(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "versions", "pod:blank",
 	)
-	must.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
-	must.Contains(t, stdout, "No versions found for 'pod:blank'")
-	must.NotContains(t, stdout, "VERSION", "no table should be rendered")
+	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
+	require.Contains(t, stdout, "No versions found for 'pod:blank'")
+	require.NotContains(t, stdout, "VERSION", "no table should be rendered")
 }
 
 // TestSnapshotVersionsNoDockerRequired proves the command reads the platform API
@@ -120,8 +120,8 @@ func TestSnapshotVersionsNoDockerRequired(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--non-interactive", "snapshot", "versions", "pod:my-baseline",
 	)
-	must.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
-	must.Contains(t, stdout, "~ 3 versions")
+	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
+	require.Contains(t, stdout, "~ 3 versions")
 }
 
 func TestSnapshotVersionsRejectsLocalPath(t *testing.T) {
@@ -134,8 +134,8 @@ func TestSnapshotVersionsRejectsLocalPath(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "./my-snapshot",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, strings.ToLower(stderr), "local")
-	must.Contains(t, stderr, "list versions of local snapshots")
+	require.Contains(t, strings.ToLower(stderr), "local")
+	require.Contains(t, stderr, "list versions of local snapshots")
 }
 
 // TestSnapshotVersionsRejectsS3Ref: S3 remotes are fully supported by
@@ -168,7 +168,7 @@ func TestSnapshotVersionsOrasKeepsComingSoon(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "oras://registry/image",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "coming soon")
+	require.Contains(t, stderr, "coming soon")
 }
 
 // TestSnapshotShowPinnedVersion: show is read-only and the platform returns every
@@ -193,7 +193,7 @@ func TestSnapshotShowPinnedVersion(t *testing.T) {
 		listEnv(t, srv, "test-token"),
 		"--non-interactive", "snapshot", "show", "pod:my-baseline:1",
 	)
-	must.NoError(t, err, "lstk snapshot show failed: %s", stderr)
+	require.NoError(t, err, "lstk snapshot show failed: %s", stderr)
 
 	// Snapshot of version 1's card: the pinned version's metadata must win
 	// over the latest version's.
@@ -226,7 +226,7 @@ func TestSnapshotVersionsRejectsVersionSuffix(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:my-baseline:3",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "drop the ':3'")
+	require.Contains(t, stderr, "drop the ':3'")
 }
 
 func TestSnapshotVersionsRejectsInvalidPodName(t *testing.T) {
@@ -239,7 +239,7 @@ func TestSnapshotVersionsRejectsInvalidPodName(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:release.v1",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "invalid pod name")
+	require.Contains(t, stderr, "invalid pod name")
 }
 
 func TestSnapshotVersionsNotFound(t *testing.T) {
@@ -255,8 +255,8 @@ func TestSnapshotVersionsNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:missing",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "not found")
-	must.Contains(t, stdout, "lstk snapshot list")
+	require.Contains(t, stdout, "not found")
+	require.Contains(t, stdout, "lstk snapshot list")
 }
 
 func TestSnapshotVersionsRequiresAuthToken(t *testing.T) {
@@ -271,6 +271,6 @@ func TestSnapshotVersionsRequiresAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "Authentication required")
-	must.Contains(t, stdout, "lstk login")
+	require.Contains(t, stdout, "Authentication required")
+	require.Contains(t, stdout, "lstk login")
 }
diff --git a/test/integration/start_snapshot_test.go b/test/integration/start_snapshot_test.go
index 3b941178..1221b111 100644
--- a/test/integration/start_snapshot_test.go
+++ b/test/integration/start_snapshot_test.go
@@ -5,8 +5,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // --- no Docker required (parallel) ---
@@ -20,7 +20,7 @@ func TestStartSnapshotConflictingFlags(t *testing.T) {
 		"--non-interactive", "start", "--snapshot", "pod:my-baseline", "--no-snapshot",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "cannot be used together")
+	require.Contains(t, stderr, "cannot be used together")
 }
 
 func TestStartSnapshotInvalidPodName(t *testing.T) {
@@ -32,7 +32,7 @@ func TestStartSnapshotInvalidPodName(t *testing.T) {
 		"--non-interactive", "start", "--snapshot", "pod:bad.name",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "invalid pod name")
+	require.Contains(t, stderr, "invalid pod name")
 }
 
 func TestStartSnapshotLocalFileNotFound(t *testing.T) {
@@ -44,7 +44,7 @@ func TestStartSnapshotLocalFileNotFound(t *testing.T) {
 		"--non-interactive", "start", "--snapshot", "/no/such/snapshot.snapshot",
 	)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "snapshot file not found")
+	require.Contains(t, stderr, "snapshot file not found")
 }
 
 // --- Docker required ---
@@ -72,17 +72,17 @@ port = "4566"
 snapshot = "pod:my-baseline"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "",
 		env.With(env.APIEndpoint, licenseServer.URL).With(env.LocalStackHost, lsHost(podServer)),
 		"--config", configFile, "start",
 	)
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdout, "Snapshot loaded", "configured snapshot should auto-load after start")
-	must.Contains(t, stdout, "my-baseline")
+	require.Contains(t, stdout, "Snapshot loaded", "configured snapshot should auto-load after start")
+	require.Contains(t, stdout, "my-baseline")
 }
 
 // TestStartNoSnapshotSkipsAutoLoad verifies that --no-snapshot skips auto-loading
@@ -105,14 +105,14 @@ port = "4566"
 snapshot = "pod:my-baseline"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "",
 		env.With(env.APIEndpoint, licenseServer.URL),
 		"--config", configFile, "start", "--no-snapshot",
 	)
-	must.NoError(t, err, "lstk start --no-snapshot failed: %s", stderr)
+	require.NoError(t, err, "lstk start --no-snapshot failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	must.NotContains(t, stdout, "Snapshot loaded", "--no-snapshot should skip auto-loading")
+	require.NotContains(t, stdout, "Snapshot loaded", "--no-snapshot should skip auto-loading")
 }
diff --git a/test/integration/start_test.go b/test/integration/start_test.go
index 9990012f..63104907 100644
--- a/test/integration/start_test.go
+++ b/test/integration/start_test.go
@@ -18,10 +18,10 @@ import (
 	"testing"
 	"time"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/api/types/network"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/require"
 )
 
 const snowflakeContainerName = "localstack-snowflake"
@@ -38,14 +38,14 @@ func TestStartCommandSucceedsWithValidToken(t *testing.T) {
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
-	must.True(t, inspect.Container.State.Running, "container should be running")
+	require.NoError(t, err, "failed to inspect container")
+	require.True(t, inspect.Container.State.Running, "container should be running")
 
-	must.NotContains(t, stdout, "• Persistence:",
+	require.NotContains(t, stdout, "• Persistence:",
 		"persistence bullet must be omitted when --persist is not set")
 }
 
@@ -66,18 +66,18 @@ func TestStartCommandReusesLocalImageWhenPresent(t *testing.T) {
 	const pinnedTag = "reuse-local-test"
 	const pinnedImage = "localstack/localstack-pro:" + pinnedTag
 	reader, err := dockerClient.ImagePull(ctx, testImage, client.ImagePullOptions{})
-	must.NoError(t, err, "failed to pull test image")
+	require.NoError(t, err, "failed to pull test image")
 	_, _ = io.Copy(io.Discard, reader)
 	_ = reader.Close()
 	_, err = dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: pinnedImage})
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), pinnedImage, client.ImageRemoveOptions{})
 	})
 
 	home := t.TempDir()
 	configFile := filepath.Join(home, "config.toml")
-	must.NoError(t, os.WriteFile(configFile,
+	require.NoError(t, os.WriteFile(configFile,
 		[]byte(fmt.Sprintf("[[containers]]\ntype = \"aws\"\ntag = %q\nport = \"4599\"\n", pinnedTag)), 0644))
 
 	mockServer := createMockLicenseServer(true)
@@ -88,8 +88,8 @@ func TestStartCommandReusesLocalImageWhenPresent(t *testing.T) {
 		string(env.AuthToken)+"=fake-token")
 	stdout, _, _ := runLstk(t, ctx, "", e, "--config", configFile, "start")
 
-	must.Contains(t, stdout, "Using local image "+pinnedImage, "a pinned image present locally should be reused")
-	must.NotContains(t, stdout, "Pulling", "lstk must not re-pull an image that is already present")
+	require.Contains(t, stdout, "Using local image "+pinnedImage, "a pinned image present locally should be reused")
+	require.NotContains(t, stdout, "Pulling", "lstk must not re-pull an image that is already present")
 }
 
 // A container that exits during startup must fail with a styled
@@ -106,11 +106,11 @@ func TestStartFailsWhenContainerExitsDuringStartup(t *testing.T) {
 	const pinnedTag = "exit-during-startup-test"
 	const pinnedImage = "localstack/localstack-pro:" + pinnedTag
 	reader, err := dockerClient.ImagePull(ctx, testImage, client.ImagePullOptions{})
-	must.NoError(t, err, "failed to pull test image")
+	require.NoError(t, err, "failed to pull test image")
 	_, _ = io.Copy(io.Discard, reader)
 	_ = reader.Close()
 	_, err = dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: pinnedImage})
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), pinnedImage, client.ImageRemoveOptions{})
 	})
@@ -123,7 +123,7 @@ func TestStartFailsWhenContainerExitsDuringStartup(t *testing.T) {
 
 	home := t.TempDir()
 	configFile := filepath.Join(home, "config.toml")
-	must.NoError(t, os.WriteFile(configFile,
+	require.NoError(t, os.WriteFile(configFile,
 		[]byte(fmt.Sprintf("[[containers]]\ntype = \"aws\"\ntag = %q\nport = \"4599\"\n", pinnedTag)), 0644))
 
 	mockServer := createMockLicenseServer(true)
@@ -134,11 +134,11 @@ func TestStartFailsWhenContainerExitsDuringStartup(t *testing.T) {
 		string(env.AuthToken)+"=fake-token")
 	stdout, stderr, err := runLstk(t, ctx, "", e, "--config", configFile, "--non-interactive", "start")
 
-	must.Error(t, err, "expected start to fail when the container exits during startup")
+	require.Error(t, err, "expected start to fail when the container exits during startup")
 	requireExitCode(t, 1, err)
 	combined := stdout + stderr
-	must.Contains(t, combined, "exited unexpectedly", "the failure must be surfaced as a styled error")
-	must.Contains(t, combined, "exit code 0", "the captured exit code must be reported")
+	require.Contains(t, combined, "exited unexpectedly", "the failure must be surfaced as a styled error")
+	require.Contains(t, combined, "exit code 0", "the captured exit code must be reported")
 }
 
 // A container that stays running but never serves /_localstack/health must not wait forever.
@@ -157,11 +157,11 @@ func TestStartFailsWhenContainerNeverBecomesHealthy(t *testing.T) {
 	const pinnedTag = "never-healthy-test"
 	const pinnedImage = "localstack/localstack-pro:" + pinnedTag
 	reader, err := dockerClient.ImagePull(ctx, standInImage, client.ImagePullOptions{})
-	must.NoError(t, err, "failed to pull nginx test image")
+	require.NoError(t, err, "failed to pull nginx test image")
 	_, _ = io.Copy(io.Discard, reader)
 	_ = reader.Close()
 	_, err = dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: standInImage, Target: pinnedImage})
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), pinnedImage, client.ImageRemoveOptions{})
 	})
@@ -175,7 +175,7 @@ func TestStartFailsWhenContainerNeverBecomesHealthy(t *testing.T) {
 
 	home := t.TempDir()
 	configFile := filepath.Join(home, "config.toml")
-	must.NoError(t, os.WriteFile(configFile,
+	require.NoError(t, os.WriteFile(configFile,
 		[]byte(fmt.Sprintf("[[containers]]\ntype = \"aws\"\ntag = %q\nport = \"4599\"\n", pinnedTag)), 0644))
 
 	mockServer := createMockLicenseServer(true)
@@ -187,12 +187,12 @@ func TestStartFailsWhenContainerNeverBecomesHealthy(t *testing.T) {
 		string(env.StartupTimeout)+"=5s")
 	stdout, stderr, err := runLstk(t, ctx, "", e, "--config", configFile, "--non-interactive", "start")
 
-	must.Error(t, err, "expected start to fail when the container never becomes healthy")
+	require.Error(t, err, "expected start to fail when the container never becomes healthy")
 	requireExitCode(t, 1, err)
 	combined := stdout + stderr
-	must.Contains(t, combined, "did not become ready within 5s", "the bounded timeout must be surfaced")
-	must.Contains(t, combined, "lstk logs", "the guidance must point at lstk logs")
-	must.Contains(t, combined, "lstk stop", "the guidance must point at lstk stop")
+	require.Contains(t, combined, "did not become ready within 5s", "the bounded timeout must be surfaced")
+	require.Contains(t, combined, "lstk logs", "the guidance must point at lstk logs")
+	require.Contains(t, combined, "lstk stop", "the guidance must point at lstk stop")
 }
 
 // Interrupting a start while it awaits readiness (Ctrl+C / SIGINT) renders no
@@ -216,11 +216,11 @@ func TestStartEmitsTelemetryWhenInterruptedDuringStartup(t *testing.T) {
 	const pinnedTag = "interrupted-startup-test"
 	const pinnedImage = "localstack/localstack-pro:" + pinnedTag
 	reader, err := dockerClient.ImagePull(ctx, standInImage, client.ImagePullOptions{})
-	must.NoError(t, err, "failed to pull nginx test image")
+	require.NoError(t, err, "failed to pull nginx test image")
 	_, _ = io.Copy(io.Discard, reader)
 	_ = reader.Close()
 	_, err = dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: standInImage, Target: pinnedImage})
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), pinnedImage, client.ImageRemoveOptions{})
 	})
@@ -234,7 +234,7 @@ func TestStartEmitsTelemetryWhenInterruptedDuringStartup(t *testing.T) {
 
 	home := t.TempDir()
 	configFile := filepath.Join(home, "config.toml")
-	must.NoError(t, os.WriteFile(configFile,
+	require.NoError(t, os.WriteFile(configFile,
 		[]byte(fmt.Sprintf("[[containers]]\ntype = \"aws\"\ntag = %q\nport = \"4599\"\n", pinnedTag)), 0644))
 
 	mockServer := createMockLicenseServer(true)
@@ -242,7 +242,7 @@ func TestStartEmitsTelemetryWhenInterruptedDuringStartup(t *testing.T) {
 	analyticsSrv, events := mockAnalyticsServer(t)
 
 	binPath, err := filepath.Abs(binaryPath())
-	must.NoError(t, err)
+	require.NoError(t, err)
 	cmd := exec.CommandContext(ctx, binPath, "--config", configFile, "--non-interactive", "start")
 	cmd.Env = append(testEnvWithHome(home, ""),
 		string(env.APIEndpoint)+"="+mockServer.URL,
@@ -251,25 +251,25 @@ func TestStartEmitsTelemetryWhenInterruptedDuringStartup(t *testing.T) {
 	out := &syncBuffer{}
 	cmd.Stdout = out
 	cmd.Stderr = out
-	must.NoError(t, cmd.Start())
+	require.NoError(t, cmd.Start())
 
 	// Interrupt only once the container is running, so the SIGINT lands in the
 	// readiness wait rather than during container creation.
-	must.Eventually(t, func() bool {
+	require.Eventually(t, func() bool {
 		inspect, ierr := dockerClient.ContainerInspect(ctx, wantContainer, client.ContainerInspectOptions{})
 		return ierr == nil && inspect.Container.State.Running
 	}, 60*time.Second, 100*time.Millisecond, "container never started; output:\n%s", out.String())
-	must.NoError(t, cmd.Process.Signal(os.Interrupt))
+	require.NoError(t, cmd.Process.Signal(os.Interrupt))
 	_ = cmd.Wait()
 
 	byName := collectTelemetryByName(t, events, 2)
 	lifecycle, ok := byName["lstk_lifecycle"]
-	must.True(t, ok, "an interrupted start must still emit a lifecycle telemetry event")
+	require.True(t, ok, "an interrupted start must still emit a lifecycle telemetry event")
 	lifePayload, _ := lifecycle["payload"].(map[string]any)
-	must.Eq(t, "start_error", lifePayload["event_type"])
-	must.Eq(t, "start_failed", lifePayload["error_code"])
-	must.Contains(t, lifePayload["error_msg"], "context canceled")
-	must.Contains(t, byName, "lstk_command")
+	require.Equal(t, "start_error", lifePayload["event_type"])
+	require.Equal(t, "start_failed", lifePayload["error_code"])
+	require.Contains(t, lifePayload["error_msg"], "context canceled")
+	require.Contains(t, byName, "lstk_command")
 }
 
 func TestStartCommandSucceedsWithKeyringToken(t *testing.T) {
@@ -280,7 +280,7 @@ func TestStartCommandSucceedsWithKeyringToken(t *testing.T) {
 	// Store token in keyring before running command
 	authToken := env.Require(t, env.AuthToken)
 	err := SetAuthTokenInKeyring(authToken)
-	must.NoError(t, err, "failed to store token in keyring")
+	require.NoError(t, err, "failed to store token in keyring")
 
 	mockServer := createMockLicenseServer(true)
 	defer mockServer.Close()
@@ -288,12 +288,12 @@ func TestStartCommandSucceedsWithKeyringToken(t *testing.T) {
 	ctx := testContext(t)
 	// Run without LOCALSTACK_AUTH_TOKEN should use keyring
 	_, stderr, err := runLstk(t, ctx, "", env.Without(env.AuthToken).With(env.APIEndpoint, mockServer.URL), "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
-	must.True(t, inspect.Container.State.Running, "container should be running")
+	require.NoError(t, err, "failed to inspect container")
+	require.True(t, inspect.Container.State.Running, "container should be running")
 }
 
 func TestStartCommandFailsWithInvalidToken(t *testing.T) {
@@ -305,9 +305,9 @@ func TestStartCommandFailsWithInvalidToken(t *testing.T) {
 	defer mockServer.Close()
 
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AuthToken, "invalid-token").With(env.APIEndpoint, mockServer.URL), "start")
-	must.Error(t, err, "expected lstk start to fail with invalid token")
+	require.Error(t, err, "expected lstk start to fail with invalid token")
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "License validation failed")
+	require.Contains(t, stdout, "License validation failed")
 }
 
 func TestStartCommandDoesNothingWhenAlreadyRunning(t *testing.T) {
@@ -320,9 +320,9 @@ func TestStartCommandDoesNothingWhenAlreadyRunning(t *testing.T) {
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.AuthToken, "fake-token").With(env.AnalyticsEndpoint, analyticsSrv.URL), "start")
-	must.NoError(t, err, "lstk start should succeed when container is already running: %s", stderr)
+	require.NoError(t, err, "lstk start should succeed when container is already running: %s", stderr)
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdout, "already running")
+	require.Contains(t, stdout, "already running")
 	assertCommandTelemetry(t, events, "start", 0)
 }
 
@@ -333,21 +333,21 @@ func TestStartCommandFailsWhenPortInUse(t *testing.T) {
 
 	// Simulates port in use by non-LocalStack process (/_localstack/info will fail)
 	ln, err := net.Listen("tcp", ":4566")
-	must.NoError(t, err, "failed to bind port 4566 for test")
+	require.NoError(t, err, "failed to bind port 4566 for test")
 	defer func() { _ = ln.Close() }()
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AuthToken, "fake-token").With(env.AnalyticsEndpoint, analyticsSrv.URL), "start")
-	must.Error(t, err, "expected lstk start to fail when port is in use")
+	require.Error(t, err, "expected lstk start to fail when port is in use")
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "Port 4566 already in use")
-	must.Contains(t, stdout, "Free the port or configure a different one.")
-	must.Contains(t, stdout, "Use another port in the configuration:")
+	require.Contains(t, stdout, "Port 4566 already in use")
+	require.Contains(t, stdout, "Free the port or configure a different one.")
+	require.Contains(t, stdout, "Use another port in the configuration:")
 
 	// Both lstk_lifecycle (start_error) and lstk_command events should be emitted.
 	byName := collectTelemetryByName(t, events, 2)
-	must.Contains(t, byName, "lstk_lifecycle")
-	must.Contains(t, byName, "lstk_command")
+	require.Contains(t, byName, "lstk_lifecycle")
+	require.Contains(t, byName, "lstk_command")
 }
 
 func TestStartDoesNotHangWithExternalContainerAndNoCachedLabel(t *testing.T) {
@@ -359,7 +359,7 @@ func TestStartDoesNotHangWithExternalContainerAndNoCachedLabel(t *testing.T) {
 
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -370,14 +370,14 @@ func TestStartDoesNotHangWithExternalContainerAndNoCachedLabel(t *testing.T) {
 	// trigger emulator selection and block on keyboard input.
 	home := t.TempDir()
 	configFile := filepath.Join(home, "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte("[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte("[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"), 0644))
 
 	stdout, err := runLstkInPTY(t, ctx,
 		env.With(env.AuthToken, "fake-token").WithHome(home),
 		"start", "--config", configFile,
 	)
-	must.NoError(t, err, "lstk start hung: TUI did not exit when external container was running and no plan label was cached")
-	must.Contains(t, stdout, "already running")
+	require.NoError(t, err, "lstk start hung: TUI did not exit when external container was running and no plan label was cached")
+	require.Contains(t, stdout, "already running")
 }
 
 func TestStartCommandAttachesToExternalContainer(t *testing.T) {
@@ -389,7 +389,7 @@ func TestStartCommandAttachesToExternalContainer(t *testing.T) {
 
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -399,9 +399,9 @@ func TestStartCommandAttachesToExternalContainer(t *testing.T) {
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.AuthToken, "fake-token").With(env.AnalyticsEndpoint, analyticsSrv.URL), "start")
-	must.NoError(t, err, "lstk start should succeed when external container is running: %s", stderr)
+	require.NoError(t, err, "lstk start should succeed when external container is running: %s", stderr)
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdout, "already running")
+	require.Contains(t, stdout, "already running")
 	assertCommandTelemetry(t, events, "start", 0)
 }
 
@@ -412,7 +412,7 @@ func TestStartCommandAttachesWhenLocalStackRespondingOnPort(t *testing.T) {
 
 	// Serve a mock /_localstack/info on port 4566 so lstk can identify the running version.
 	ln, err := net.Listen("tcp", ":4566")
-	must.NoError(t, err, "failed to bind port 4566 for test")
+	require.NoError(t, err, "failed to bind port 4566 for test")
 	srv := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/_localstack/info" {
 			w.Header().Set("Content-Type", "application/json")
@@ -426,10 +426,10 @@ func TestStartCommandAttachesWhenLocalStackRespondingOnPort(t *testing.T) {
 	defer srv.Close()
 
 	stdout, stderr, err := runLstk(t, testContext(t), "", env.With(env.AuthToken, "fake-token"), "start")
-	must.NoError(t, err, "lstk start should succeed when LocalStack is already running: %s", stderr)
+	require.NoError(t, err, "lstk start should succeed when LocalStack is already running: %s", stderr)
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdout, "3.4.0")
-	must.Contains(t, stdout, "already running")
+	require.Contains(t, stdout, "3.4.0")
+	require.Contains(t, stdout, "already running")
 }
 
 func TestStartCommandFailsWhenLocalStackRunningOnDifferentPort(t *testing.T) {
@@ -442,7 +442,7 @@ func TestStartCommandFailsWhenLocalStackRunningOnDifferentPort(t *testing.T) {
 	// Tag the test image as a LocalStack pro image to simulate an instance running.
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -456,13 +456,13 @@ type = "aws"
 port = "4567"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, _, err := runLstk(t, ctx, "", env.With(env.AuthToken, "fake-token").With(env.AnalyticsEndpoint, analyticsSrv.URL), "--config", configFile, "start")
-	must.Error(t, err, "expected lstk start to fail when LS is already running on a different port")
+	require.Error(t, err, "expected lstk start to fail when LS is already running on a different port")
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "already running")
+	require.Contains(t, stdout, "already running")
 	assertCommandTelemetry(t, events, "start", 1)
 }
 
@@ -478,7 +478,7 @@ func TestStartCommandFailsOnEmulatorTypeMismatch(t *testing.T) {
 	// Tag the test image as a LocalStack pro image to simulate AWS LocalStack running.
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -490,26 +490,26 @@ func TestStartCommandFailsOnEmulatorTypeMismatch(t *testing.T) {
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, _, err := runLstk(t, ctx, "", env.With(env.AuthToken, "fake-token").With(env.AnalyticsEndpoint, analyticsSrv.URL), "--config", configFile, "start")
-	must.Error(t, err, "lstk start should fail on emulator type mismatch")
+	require.Error(t, err, "lstk start should fail on emulator type mismatch")
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "LocalStack AWS Emulator is running on port 4566")
-	must.Contains(t, stdout, "Your config specifies the LocalStack Snowflake Emulator")
-	must.Contains(t, stdout, "docker stop localstack-external-aws")
+	require.Contains(t, stdout, "LocalStack AWS Emulator is running on port 4566")
+	require.Contains(t, stdout, "Your config specifies the LocalStack Snowflake Emulator")
+	require.Contains(t, stdout, "docker stop localstack-external-aws")
 
 	byName := collectTelemetryByName(t, events, 2)
 	cmdPayload, _ := byName["lstk_command"]["payload"].(map[string]any)
 	cmdParams, _ := cmdPayload["parameters"].(map[string]any)
 	cmdResult, _ := cmdPayload["result"].(map[string]any)
-	must.Eq(t, "start", cmdParams["command"])
-	must.InDelta(t, 1, cmdResult["exit_code"], 0)
+	require.Equal(t, "start", cmdParams["command"])
+	require.InDelta(t, 1, cmdResult["exit_code"], 0)
 
 	lifecycle, ok := byName["lstk_lifecycle"]
-	must.True(t, ok, "expected lstk_lifecycle telemetry event")
+	require.True(t, ok, "expected lstk_lifecycle telemetry event")
 	lifePayload, _ := lifecycle["payload"].(map[string]any)
-	must.Eq(t, "start_error", lifePayload["event_type"])
-	must.Eq(t, "emulator_mismatch", lifePayload["error_code"])
-	must.Eq(t, "snowflake", lifePayload["emulator"])
-	must.Contains(t, lifePayload["error_msg"], "running aws on port 4566, configured snowflake")
+	require.Equal(t, "start_error", lifePayload["event_type"])
+	require.Equal(t, "emulator_mismatch", lifePayload["error_code"])
+	require.Equal(t, "snowflake", lifePayload["emulator"])
+	require.Contains(t, lifePayload["error_msg"], "running aws on port 4566, configured snowflake")
 }
 
 func TestStartCommandSucceedsWithNonDefaultPort(t *testing.T) {
@@ -529,16 +529,16 @@ tag = "latest"
 port = "4567"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
+	require.NoError(t, err, "failed to inspect container")
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	must.Eq(t, "localhost.localstack.cloud:4567", envVars["LOCALSTACK_HOST"],
+	require.Equal(t, "localhost.localstack.cloud:4567", envVars["LOCALSTACK_HOST"],
 		"LOCALSTACK_HOST must reflect configured host port so LocalStack accepts requests on it")
 }
 
@@ -566,23 +566,23 @@ env = ["expose"]
 GATEWAY_LISTEN = "0.0.0.0:4566,0.0.0.0:443,0.0.0.0:8443"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
+	require.NoError(t, err, "failed to inspect container")
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	must.Eq(t, "0.0.0.0:4566,0.0.0.0:443,0.0.0.0:8443", envVars["GATEWAY_LISTEN"],
+	require.Equal(t, "0.0.0.0:4566,0.0.0.0:443,0.0.0.0:8443", envVars["GATEWAY_LISTEN"],
 		"configured GATEWAY_LISTEN must be passed to the container")
 
 	for _, p := range []string{"4566/tcp", "443/tcp", "8443/tcp", "4510/tcp"} {
 		bindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort(p)]
-		must.NotEmpty(t, bindings, "port %s should be bound", p)
-		must.Eq(t, "0.0.0.0", bindings[0].HostIP.String(),
+		require.NotEmpty(t, bindings, "port %s should be bound", p)
+		require.Equal(t, "0.0.0.0", bindings[0].HostIP.String(),
 			"port %s should bind to the host IP from GATEWAY_LISTEN", p)
 	}
 }
@@ -609,14 +609,14 @@ port = "4566"
 expose_ports = [15353, "15354:15355/udp"]
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
+	require.NoError(t, err, "failed to inspect container")
 
 	// A bare port is published on the same host port for both protocols (DNS needs
 	// both); an entry with an explicit host port and protocol is published as written.
@@ -627,11 +627,11 @@ expose_ports = [15353, "15354:15355/udp"]
 	}
 	for port, hostPort := range expected {
 		bindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort(port)]
-		must.NotEmpty(t, bindings, "port %s should be bound", port)
-		must.Eq(t, hostPort, bindings[0].HostPort)
-		must.Eq(t, "127.0.0.1", bindings[0].HostIP.String())
+		require.NotEmpty(t, bindings, "port %s should be bound", port)
+		require.Equal(t, hostPort, bindings[0].HostPort)
+		require.Equal(t, "127.0.0.1", bindings[0].HostIP.String())
 	}
-	must.Empty(t, inspect.Container.HostConfig.PortBindings[network.MustParsePort("15355/tcp")],
+	require.Empty(t, inspect.Container.HostConfig.PortBindings[network.MustParsePort("15355/tcp")],
 		"an entry that names udp must not also publish tcp")
 }
 
@@ -658,22 +658,22 @@ port = "4566"
 expose_ports = ["8080:4566"]
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
-	must.Contains(t, stdout+stderr, "Ignoring expose_ports entry 8080:4566/tcp",
+	require.NoError(t, err, "lstk start failed: %s", stderr)
+	require.Contains(t, stdout+stderr, "Ignoring expose_ports entry 8080:4566/tcp",
 		"expected a warning explaining why the entry was dropped")
-	must.Contains(t, stdout+stderr, "already publishes container port 4566/tcp on host port 4566")
+	require.Contains(t, stdout+stderr, "already publishes container port 4566/tcp on host port 4566")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
+	require.NoError(t, err, "failed to inspect container")
 
 	edgeBindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort("4566/tcp")]
-	must.NotEmpty(t, edgeBindings, "the edge port must still be published")
-	must.Eq(t, "4566", edgeBindings[0].HostPort, "the edge port's host binding must be unchanged")
-	must.Empty(t, inspect.Container.HostConfig.PortBindings[network.MustParsePort("8080/tcp")],
+	require.NotEmpty(t, edgeBindings, "the edge port must still be published")
+	require.Equal(t, "4566", edgeBindings[0].HostPort, "the edge port's host binding must be unchanged")
+	require.Empty(t, inspect.Container.HostConfig.PortBindings[network.MustParsePort("8080/tcp")],
 		"the conflicting host port must not be published")
 }
 
@@ -699,23 +699,23 @@ port = "4566"
 expose_ports = ["4566/udp"]
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
-	must.NotContains(t, stdout+stderr, "Ignoring expose_ports entry",
+	require.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NotContains(t, stdout+stderr, "Ignoring expose_ports entry",
 		"a new protocol on the edge port does not collide with anything and needs no warning")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
+	require.NoError(t, err, "failed to inspect container")
 
 	udpBindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort("4566/udp")]
-	must.NotEmpty(t, udpBindings, "4566/udp should now be published")
-	must.Eq(t, "4566", udpBindings[0].HostPort)
+	require.NotEmpty(t, udpBindings, "4566/udp should now be published")
+	require.Equal(t, "4566", udpBindings[0].HostPort)
 	tcpBindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort("4566/tcp")]
-	must.NotEmpty(t, tcpBindings, "4566/tcp must remain published")
-	must.Eq(t, "4566", tcpBindings[0].HostPort)
+	require.NotEmpty(t, tcpBindings, "4566/tcp must remain published")
+	require.Equal(t, "4566", tcpBindings[0].HostPort)
 }
 
 // TestStartCommandFailsWhenExposedPortIsTaken covers a busy host port requested via
@@ -728,7 +728,7 @@ func TestStartCommandFailsWhenExposedPortIsTaken(t *testing.T) {
 	t.Cleanup(cleanup)
 
 	ln, err := net.Listen("tcp", ":15360")
-	must.NoError(t, err, "failed to bind port 15360 for test")
+	require.NoError(t, err, "failed to bind port 15360 for test")
 	defer func() { _ = ln.Close() }()
 
 	configContent := `
@@ -739,13 +739,13 @@ port = "4566"
 expose_ports = [15360]
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AuthToken, "fake-token"), "--config", configFile, "start")
-	must.Error(t, err, "expected lstk start to fail when a requested expose_ports port is in use")
+	require.Error(t, err, "expected lstk start to fail when a requested expose_ports port is in use")
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "Port 15360 is already in use")
-	must.Contains(t, stdout, "LocalStack requires this port. Free it before starting.")
+	require.Contains(t, stdout, "Port 15360 is already in use")
+	require.Contains(t, stdout, "LocalStack requires this port. Free it before starting.")
 }
 
 // TestStartCommandPublishesOnlyDefaultPortsWhenExposePortsUnset pins the no-op case:
@@ -763,10 +763,10 @@ func TestStartCommandPublishesOnlyDefaultPortsWhenExposePortsUnset(t *testing.T)
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
+	require.NoError(t, err, "failed to inspect container")
 
 	wantPublished := map[string]bool{"4566/tcp": true, "443/tcp": true}
 	for p := 4510; p <= 4559; p++ {
@@ -779,7 +779,7 @@ func TestStartCommandPublishesOnlyDefaultPortsWhenExposePortsUnset(t *testing.T)
 			gotPublished[port.String()] = true
 		}
 	}
-	must.Eq(t, wantPublished, gotPublished, "no expose_ports configured should publish exactly the default port set")
+	require.Equal(t, wantPublished, gotPublished, "no expose_ports configured should publish exactly the default port set")
 }
 
 // TestStartCommandRejectsInvalidExposePorts checks the config surface fails at load
@@ -795,11 +795,11 @@ port = "4566"
 expose_ports = ["53/sctp"]
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	_, stderr, err := runLstk(t, testContext(t), "", testEnvWithHome(t.TempDir(), ""), "--config", configFile, "status")
-	must.Error(t, err)
-	must.Contains(t, stderr, `protocol must be "tcp" or "udp"`)
+	require.Error(t, err)
+	require.Contains(t, stderr, `protocol must be "tcp" or "udp"`)
 }
 
 func TestStartCommandSetsUpContainerCorrectly(t *testing.T) {
@@ -814,18 +814,18 @@ func TestStartCommandSetsUpContainerCorrectly(t *testing.T) {
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
-	must.True(t, inspect.Container.State.Running)
+	require.NoError(t, err, "failed to inspect container")
+	require.True(t, inspect.Container.State.Running)
 
 	t.Run("environment variables", func(t *testing.T) {
 		envVars := containerEnvToMap(inspect.Container.Config.Env)
-		must.Eq(t, ":4566,:443", envVars["GATEWAY_LISTEN"])
-		must.Eq(t, containerName, envVars["MAIN_CONTAINER_NAME"])
-		must.Eq(t, "localhost.localstack.cloud:4566", envVars["LOCALSTACK_HOST"])
-		must.NotEmpty(t, envVars["LOCALSTACK_AUTH_TOKEN"])
+		require.Equal(t, ":4566,:443", envVars["GATEWAY_LISTEN"])
+		require.Equal(t, containerName, envVars["MAIN_CONTAINER_NAME"])
+		require.Equal(t, "localhost.localstack.cloud:4566", envVars["LOCALSTACK_HOST"])
+		require.NotEmpty(t, envVars["LOCALSTACK_AUTH_TOKEN"])
 	})
 
 	t.Run("docker socket mount", func(t *testing.T) {
@@ -833,51 +833,51 @@ func TestStartCommandSetsUpContainerCorrectly(t *testing.T) {
 			t.Skip("Docker daemon is not reachable via unix socket")
 		}
 
-		must.True(t, hasBindTarget(inspect.Container.HostConfig.Binds, "/var/run/docker.sock"),
+		require.True(t, hasBindTarget(inspect.Container.HostConfig.Binds, "/var/run/docker.sock"),
 			"expected Docker socket bind mount to /var/run/docker.sock, got: %v", inspect.Container.HostConfig.Binds)
-		must.True(t, hasBindSource(inspect.Container.HostConfig.Binds, "/var/run/docker.sock"),
+		require.True(t, hasBindSource(inspect.Container.HostConfig.Binds, "/var/run/docker.sock"),
 			"expected Docker socket bind mount from /var/run/docker.sock, got: %v", inspect.Container.HostConfig.Binds)
 
 		envVars := containerEnvToMap(inspect.Container.Config.Env)
-		must.Eq(t, "unix:///var/run/docker.sock", envVars["DOCKER_HOST"])
+		require.Equal(t, "unix:///var/run/docker.sock", envVars["DOCKER_HOST"])
 	})
 
 	t.Run("service port range", func(t *testing.T) {
 		for p := 4510; p <= 4559; p++ {
 			port := network.MustParsePort(fmt.Sprintf("%d/tcp", p))
 			bindings := inspect.Container.HostConfig.PortBindings[port]
-			must.NotEmpty(t, bindings, "port %d/tcp should be bound", p)
-			must.Eq(t, strconv.Itoa(p), bindings[0].HostPort)
+			require.NotEmpty(t, bindings, "port %d/tcp should be bound", p)
+			require.Equal(t, strconv.Itoa(p), bindings[0].HostPort)
 		}
 	})
 
 	t.Run("main port", func(t *testing.T) {
 		mainBindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort("4566/tcp")]
-		must.NotEmpty(t, mainBindings, "port 4566/tcp should be bound")
-		must.Eq(t, "4566", mainBindings[0].HostPort)
+		require.NotEmpty(t, mainBindings, "port 4566/tcp should be bound")
+		require.Equal(t, "4566", mainBindings[0].HostPort)
 	})
 
 	t.Run("https port", func(t *testing.T) {
 		httpsBindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort("443/tcp")]
-		must.NotEmpty(t, httpsBindings, "port 443/tcp should be bound")
-		must.Eq(t, "443", httpsBindings[0].HostPort)
+		require.NotEmpty(t, httpsBindings, "port 443/tcp should be bound")
+		require.Equal(t, "443", httpsBindings[0].HostPort)
 	})
 
 	t.Run("volume mount", func(t *testing.T) {
-		must.True(t, hasBindTarget(inspect.Container.HostConfig.Binds, "/var/lib/localstack"),
+		require.True(t, hasBindTarget(inspect.Container.HostConfig.Binds, "/var/lib/localstack"),
 			"expected volume bind mount to /var/lib/localstack, got: %v", inspect.Container.HostConfig.Binds)
 	})
 
 	t.Run("auto remove", func(t *testing.T) {
-		must.True(t, inspect.Container.HostConfig.AutoRemove,
+		require.True(t, inspect.Container.HostConfig.AutoRemove,
 			"expected container to be created with AutoRemove (--rm) so it does not linger after exit")
 	})
 
 	t.Run("http health endpoint", func(t *testing.T) {
 		resp, err := http.Get("http://localhost.localstack.cloud:4566/_localstack/health")
-		must.NoError(t, err)
+		require.NoError(t, err)
 		t.Cleanup(func() { _ = resp.Body.Close() })
-		must.Eq(t, http.StatusOK, resp.StatusCode)
+		require.Equal(t, http.StatusOK, resp.StatusCode)
 	})
 
 	t.Run("https health endpoint", func(t *testing.T) {
@@ -889,9 +889,9 @@ func TestStartCommandSetsUpContainerCorrectly(t *testing.T) {
 			},
 		}
 		resp, err := client.Get("https://localhost.localstack.cloud/_localstack/health")
-		must.NoError(t, err)
+		require.NoError(t, err)
 		t.Cleanup(func() { _ = resp.Body.Close() })
-		must.Eq(t, http.StatusOK, resp.StatusCode)
+		require.Equal(t, http.StatusOK, resp.StatusCode)
 	})
 }
 
@@ -919,43 +919,43 @@ port = "4566"
 container_name = %q
 `, customName)
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	testEnv := env.With(env.APIEndpoint, mockServer.URL)
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnv, "--config", configFile, "start")
-	must.NoError(t, err, "lstk start failed: %s%s", stdout, stderr)
+	require.NoError(t, err, "lstk start failed: %s%s", stdout, stderr)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, customName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "expected a container named %q", customName)
-	must.True(t, inspect.Container.State.Running)
+	require.NoError(t, err, "expected a container named %q", customName)
+	require.True(t, inspect.Container.State.Running)
 
 	// The name Docker gave the container and the name the emulator reports for itself
 	// (used to introspect itself and to name the containers it spawns) must agree.
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	must.Eq(t, customName, envVars["MAIN_CONTAINER_NAME"])
+	require.Equal(t, customName, envVars["MAIN_CONTAINER_NAME"])
 
 	_, err = dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.Error(t, err, "the derived name %q must not be used when 'name' is set", containerName)
+	require.Error(t, err, "the derived name %q must not be used when 'name' is set", containerName)
 
 	// The default persistence directory stays keyed to the derived name, so setting or
 	// changing 'name' never silently orphans existing state.
 	volumePath, stderr, err := runLstk(t, ctx, "", testEnv, "--config", configFile, "volume", "path")
-	must.NoError(t, err, "lstk volume path failed: %s", stderr)
-	must.Contains(t, volumePath, filepath.Join("lstk", "volume", containerName))
+	require.NoError(t, err, "lstk volume path failed: %s", stderr)
+	require.Contains(t, volumePath, filepath.Join("lstk", "volume", containerName))
 
 	// Discovery resolves the custom name for the downstream commands.
 	statusOut, stderr, err := runLstk(t, ctx, "", testEnv, "--config", configFile, "status")
-	must.NoError(t, err, "lstk status failed: %s", stderr)
-	must.Contains(t, statusOut, "Container: "+customName)
+	require.NoError(t, err, "lstk status failed: %s", stderr)
+	require.Contains(t, statusOut, "Container: "+customName)
 
 	_, stderr, err = runLstk(t, ctx, "", testEnv, "--config", configFile, "stop")
-	must.NoError(t, err, "lstk stop failed: %s", stderr)
+	require.NoError(t, err, "lstk stop failed: %s", stderr)
 
 	// Removal is asynchronous — the container is created with AutoRemove, so an inspect
 	// immediately after `stop` can still catch it mid-removal. Poll rather than assert once.
-	must.Eventually(t, func() bool {
+	require.Eventually(t, func() bool {
 		_, err := dockerClient.ContainerInspect(ctx, customName, client.ContainerInspectOptions{})
 		return err != nil
 	}, 30*time.Second, 200*time.Millisecond, "lstk stop should have removed %q", customName)
@@ -974,7 +974,7 @@ func TestStartCommandMountsExtraVolumes(t *testing.T) {
 	// A real init-hook script that lstk mounts as a file (it must already exist).
 	scriptDir := t.TempDir()
 	scriptPath := filepath.Join(scriptDir, "init.sf.sql")
-	must.NoError(t, os.WriteFile(scriptPath, []byte("SHOW DATABASES;\n"), 0644))
+	require.NoError(t, os.WriteFile(scriptPath, []byte("SHOW DATABASES;\n"), 0644))
 
 	configContent := `
 [[containers]]
@@ -984,22 +984,22 @@ port = "4566"
 volumes = ["` + escapeTomlPath(scriptPath) + `:/etc/localstack/init/ready.d/init.sf.sql:ro"]
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
-	must.True(t, inspect.Container.State.Running)
+	require.NoError(t, err, "failed to inspect container")
+	require.True(t, inspect.Container.State.Running)
 
 	binds := inspect.Container.HostConfig.Binds
-	must.True(t, hasBindTarget(binds, "/var/lib/localstack"),
+	require.True(t, hasBindTarget(binds, "/var/lib/localstack"),
 		"persistence mount must still be present, got: %v", binds)
-	must.True(t, hasBindTarget(binds, "/etc/localstack/init/ready.d/init.sf.sql"),
+	require.True(t, hasBindTarget(binds, "/etc/localstack/init/ready.d/init.sf.sql"),
 		"expected init-hook mount target, got: %v", binds)
-	must.True(t, hasBindSource(binds, scriptPath),
+	require.True(t, hasBindSource(binds, scriptPath),
 		"expected init-hook mount source %s, got: %v", scriptPath, binds)
 }
 
@@ -1017,7 +1017,7 @@ func TestStartCommandMountsMultipleVolumes(t *testing.T) {
 	// as files (they must already exist).
 	persistBase := t.TempDir()
 	persistDir := filepath.Join(persistBase, "persist")
-	must.NoError(t, os.MkdirAll(persistDir, 0755))
+	require.NoError(t, os.MkdirAll(persistDir, 0755))
 
 	// LocalStack runs as root inside the container and writes root-owned files
 	// (certs, state) into the persistence mount. On Linux CI (non-root user),
@@ -1032,9 +1032,9 @@ func TestStartCommandMountsMultipleVolumes(t *testing.T) {
 
 	scriptDir := t.TempDir()
 	bootScript := filepath.Join(scriptDir, "boot.sh")
-	must.NoError(t, os.WriteFile(bootScript, []byte("#!/bin/sh\necho boot\n"), 0644))
+	require.NoError(t, os.WriteFile(bootScript, []byte("#!/bin/sh\necho boot\n"), 0644))
 	readyScript := filepath.Join(scriptDir, "init.sf.sql")
-	must.NoError(t, os.WriteFile(readyScript, []byte("SHOW DATABASES;\n"), 0644))
+	require.NoError(t, os.WriteFile(readyScript, []byte("SHOW DATABASES;\n"), 0644))
 
 	configContent := `
 [[containers]]
@@ -1048,31 +1048,31 @@ volumes = [
 ]
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
-	must.True(t, inspect.Container.State.Running)
+	require.NoError(t, err, "failed to inspect container")
+	require.True(t, inspect.Container.State.Running)
 
 	binds := inspect.Container.HostConfig.Binds
 
-	must.True(t, hasBindTarget(binds, "/var/lib/localstack"),
+	require.True(t, hasBindTarget(binds, "/var/lib/localstack"),
 		"expected persistence mount target, got: %v", binds)
-	must.True(t, hasBindSource(binds, persistDir),
+	require.True(t, hasBindSource(binds, persistDir),
 		"expected persistence mount source %s, got: %v", persistDir, binds)
 
-	must.True(t, hasBindTarget(binds, "/etc/localstack/init/boot.d/boot.sh"),
+	require.True(t, hasBindTarget(binds, "/etc/localstack/init/boot.d/boot.sh"),
 		"expected boot init-hook mount target, got: %v", binds)
-	must.True(t, hasBindSource(binds, bootScript),
+	require.True(t, hasBindSource(binds, bootScript),
 		"expected boot init-hook mount source %s, got: %v", bootScript, binds)
 
-	must.True(t, hasBindTarget(binds, "/etc/localstack/init/ready.d/init.sf.sql"),
+	require.True(t, hasBindTarget(binds, "/etc/localstack/init/ready.d/init.sf.sql"),
 		"expected ready init-hook mount target, got: %v", binds)
-	must.True(t, hasBindSource(binds, readyScript),
+	require.True(t, hasBindSource(binds, readyScript),
 		"expected ready init-hook mount source %s, got: %v", readyScript, binds)
 }
 
@@ -1095,12 +1095,12 @@ port = "4566"
 volumes = ["` + escapeTomlPath(missing) + `:/etc/localstack/init/ready.d/x.sf.sql"]
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	_, stderr, err := runLstk(t, testContext(t), "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	must.Error(t, err)
+	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	must.Contains(t, stderr, "does not exist")
+	require.Contains(t, stderr, "does not exist")
 }
 
 func TestStartCommandPassesCIAndLocalStackEnvVars(t *testing.T) {
@@ -1123,20 +1123,20 @@ func TestStartCommandPassesCIAndLocalStackEnvVars(t *testing.T) {
 		With(env.DisableEvents, "1").
 		With("LOCALSTACK_PATH", "/home/user/repos/localstack"),
 		"start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdout+stderr, "Not forwarding LOCALSTACK_PATH",
+	require.Contains(t, stdout+stderr, "Not forwarding LOCALSTACK_PATH",
 		"dropping a critical-collision variable must be surfaced to the user")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
-	must.True(t, inspect.Container.State.Running)
+	require.NoError(t, err, "failed to inspect container")
+	require.True(t, inspect.Container.State.Running)
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	must.Eq(t, "true", envVars["CI"])
-	must.Eq(t, "1", envVars["LOCALSTACK_DISABLE_EVENTS"])
-	must.NotEmpty(t, envVars["LOCALSTACK_AUTH_TOKEN"])
-	must.NotContains(t, envVars, "LOCALSTACK_PATH")
+	require.Equal(t, "true", envVars["CI"])
+	require.Equal(t, "1", envVars["LOCALSTACK_DISABLE_EVENTS"])
+	require.NotEmpty(t, envVars["LOCALSTACK_AUTH_TOKEN"])
+	require.NotContains(t, envVars, "LOCALSTACK_PATH")
 }
 
 func TestStartCommandPersistFlagSetsPersistenceEnv(t *testing.T) {
@@ -1151,22 +1151,22 @@ func TestStartCommandPersistFlagSetsPersistenceEnv(t *testing.T) {
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start", "--persist")
-	must.NoError(t, err, "lstk start --persist failed: %s", stderr)
+	require.NoError(t, err, "lstk start --persist failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
-	must.True(t, inspect.Container.State.Running)
+	require.NoError(t, err, "failed to inspect container")
+	require.True(t, inspect.Container.State.Running)
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	must.Eq(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
+	require.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
 
-	must.Contains(t, stdout, "• Persistence: Enabled",
+	require.Contains(t, stdout, "• Persistence: Enabled",
 		"lstk start --persist should surface persistence state in the header")
 
 	statusStdout, statusStderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "status")
-	must.NoError(t, err, "lstk status failed: %s", statusStderr)
-	must.Contains(t, statusStdout, "• Persistence: Enabled",
+	require.NoError(t, err, "lstk status failed: %s", statusStderr)
+	require.Contains(t, statusStdout, "• Persistence: Enabled",
 		"lstk status should surface persistence state when the running container has it enabled")
 }
 
@@ -1184,17 +1184,17 @@ func TestStartCommandForwardsPersistenceEnvFromHost(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL).
 		With(env.Persistence, "1"),
 		"start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
-	must.True(t, inspect.Container.State.Running)
+	require.NoError(t, err, "failed to inspect container")
+	require.True(t, inspect.Container.State.Running)
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	must.Eq(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
+	require.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
 
-	must.Contains(t, stdout, "• Persistence: Enabled",
+	require.Contains(t, stdout, "• Persistence: Enabled",
 		"lstk start should surface persistence state when LOCALSTACK_PERSISTENCE=1 is set in the shell")
 }
 
@@ -1219,21 +1219,21 @@ port = "4566"
 env = ["persistence"]
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
-	must.True(t, inspect.Container.State.Running)
+	require.NoError(t, err, "failed to inspect container")
+	require.True(t, inspect.Container.State.Running)
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	must.Eq(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
+	require.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
 
-	must.Contains(t, stdout, "• Persistence: Enabled",
+	require.Contains(t, stdout, "• Persistence: Enabled",
 		"lstk start should surface persistence state when LOCALSTACK_PERSISTENCE=1 is set in the config profile")
 }
 
@@ -1285,7 +1285,7 @@ func TestStartHidesHeaderUntilAuthComplete(t *testing.T) {
 	// Wait for the login prompt — header must not be visible yet.
 	p.waitForOutput("Press any key when complete", "auth prompt should appear")
 
-	must.NotContains(t, p.output(), "lstk ", "header must be hidden while auth is pending")
+	require.NotContains(t, p.output(), "lstk ", "header must be hidden while auth is pending")
 
 	// Complete auth by pressing ENTER.
 	p.write("\r")
@@ -1316,17 +1316,17 @@ port = "4566"
 image = "lstk-nonexistent-custom-image"
 `
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	// A dummy token satisfies the up-front auth check (it is not validated here);
 	// the flow fails when the custom image cannot be pulled or found locally.
 	e := env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.AuthToken, "dummy-token")
 	stdout, stderr, err := runLstk(t, testContext(t), "", e, "--config", configFile, "--non-interactive", "start")
 
-	must.Error(t, err, "expected start to fail when the custom image is unavailable")
+	require.Error(t, err, "expected start to fail when the custom image is unavailable")
 	requireExitCode(t, 1, err)
 	combined := stdout + stderr
-	must.Contains(t, combined, "Failed to pull lstk-nonexistent-custom-image:latest")
+	require.Contains(t, combined, "Failed to pull lstk-nonexistent-custom-image:latest")
 }
 
 // TestStartTimesOutWhenEmulatorNeverBecomesHealthy verifies that --timeout bounds
@@ -1341,7 +1341,7 @@ func TestStartTimesOutWhenEmulatorNeverBecomesHealthy(t *testing.T) {
 	ctx := testContext(t)
 	imageRef := commitNeverHealthyImage(t, ctx)
 	imageName, imageTag, ok := strings.Cut(imageRef, ":")
-	must.True(t, ok, "never-healthy image reference must carry a pinned tag")
+	require.True(t, ok, "never-healthy image reference must carry a pinned tag")
 
 	// A non-interactive startup timeout deliberately leaves the container running
 	// for inspection, and the pinned tag names it "localstack-aws-<tag>" — a name
@@ -1355,7 +1355,7 @@ func TestStartTimesOutWhenEmulatorNeverBecomesHealthy(t *testing.T) {
 
 	home := t.TempDir()
 	configFile := filepath.Join(home, "config.toml")
-	must.NoError(t, os.WriteFile(configFile,
+	require.NoError(t, os.WriteFile(configFile,
 		[]byte(fmt.Sprintf("[[containers]]\ntype = \"aws\"\nport = \"4566\"\nimage = %q\ntag = %q\n", imageName, imageTag)), 0644))
 
 	// A pinned tag already present locally skips both the pull and the license
@@ -1364,9 +1364,9 @@ func TestStartTimesOutWhenEmulatorNeverBecomesHealthy(t *testing.T) {
 	e := append(testEnvWithHome(home, ""), string(env.AuthToken)+"=fake-token")
 	stdout, stderr, err := runLstk(t, ctx, "", e, "--config", configFile, "--non-interactive", "start", "--timeout", "3s")
 
-	must.Error(t, err, "expected start to fail when the emulator never becomes healthy")
+	require.Error(t, err, "expected start to fail when the emulator never becomes healthy")
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout+stderr, "LocalStack did not become ready within 3s")
+	require.Contains(t, stdout+stderr, "LocalStack did not become ready within 3s")
 }
 
 // TestStartFallsBackToLocalImageWhenPullFails verifies the offline degradation
@@ -1390,12 +1390,12 @@ func TestStartFallsBackToLocalImageWhenPullFails(t *testing.T) {
 	const sourceImage = "localstack/localstack-pro:latest"
 	const localImage = "lstk-offline-fallback-test"
 	reader, err := dockerClient.ImagePull(ctx, sourceImage, client.ImagePullOptions{})
-	must.NoError(t, err, "failed to pull source image")
+	require.NoError(t, err, "failed to pull source image")
 	_, _ = io.Copy(io.Discard, reader)
 	_ = reader.Close()
 
 	_, err = dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: sourceImage, Target: localImage + ":latest"})
-	must.NoError(t, err, "failed to tag local image")
+	require.NoError(t, err, "failed to tag local image")
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), localImage+":latest", client.ImageRemoveOptions{Force: true})
 	})
@@ -1404,7 +1404,7 @@ func TestStartFallsBackToLocalImageWhenPullFails(t *testing.T) {
 	// dir outside t.TempDir (whose cleanup runs as the unprivileged test user and
 	// would fail on root-owned files) so HOME can stay fully isolated below.
 	volumeDir, err := os.MkdirTemp("", "lstk-volume")
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() { _ = os.RemoveAll(volumeDir) }) // best-effort; root-owned files may remain
 
 	home := t.TempDir()
@@ -1417,7 +1417,7 @@ image = %q
 volume = %q
 `, localImage, volumeDir)
 	configFile := filepath.Join(home, "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	mockServer := createMockLicenseServer(true)
 	defer mockServer.Close()
@@ -1426,14 +1426,14 @@ volume = %q
 		With(env.APIEndpoint, mockServer.URL).
 		With(env.AuthToken, authToken)
 	stdout, stderr, err := runLstk(t, ctx, "", e, "--config", configFile, "--non-interactive", "start")
-	must.NoError(t, err, "lstk start should fall back to the local image: %s", stderr)
+	require.NoError(t, err, "lstk start should fall back to the local image: %s", stderr)
 	requireExitCode(t, 0, err)
 
-	must.Contains(t, stdout+stderr, "using the local image", "expected the local-image fallback warning")
+	require.Contains(t, stdout+stderr, "using the local image", "expected the local-image fallback warning")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
-	must.True(t, inspect.Container.State.Running, "container should be running from the local image")
+	require.NoError(t, err, "failed to inspect container")
+	require.True(t, inspect.Container.State.Running, "container should be running from the local image")
 }
 
 // TestStartContinuesWhenLicenseServerUnreachable verifies the offline degradation
@@ -1463,7 +1463,7 @@ func TestStartContinuesWhenLicenseServerUnreachable(t *testing.T) {
 	// dir outside t.TempDir (whose cleanup runs as the unprivileged test user and
 	// would fail on root-owned files) so HOME can stay fully isolated below.
 	volumeDir, err := os.MkdirTemp("", "lstk-volume")
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() { _ = os.RemoveAll(volumeDir) }) // best-effort; root-owned files may remain
 
 	home := t.TempDir()
@@ -1475,20 +1475,20 @@ port = "4566"
 volume = %q
 `, volumeDir)
 	configFile := filepath.Join(home, "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	e := env.Environ(testEnvWithHome(home, "")).
 		With(env.APIEndpoint, unreachableURL).
 		With(env.AuthToken, authToken)
 	stdout, stderr, err := runLstk(t, ctx, "", e, "--config", configFile, "--non-interactive", "start")
-	must.NoError(t, err, "lstk start should continue when the license server is unreachable: %s", stderr)
+	require.NoError(t, err, "lstk start should continue when the license server is unreachable: %s", stderr)
 	requireExitCode(t, 0, err)
 
-	must.Contains(t, stdout+stderr, "Could not reach the license server", "expected the license-unreachable warning")
+	require.Contains(t, stdout+stderr, "Could not reach the license server", "expected the license-unreachable warning")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect container")
-	must.True(t, inspect.Container.State.Running, "container should be running")
+	require.NoError(t, err, "failed to inspect container")
+	require.True(t, inspect.Container.State.Running, "container should be running")
 }
 
 // TestStartUsesLocalCustomImageWithoutPullOrLicenseCheck verifies the offline
@@ -1520,11 +1520,11 @@ func TestStartUsesLocalCustomImageWithoutPullOrLicenseCheck(t *testing.T) {
 	// Make the custom image present locally without a registry by tagging the
 	// lightweight test image under it.
 	reader, err := dockerClient.ImagePull(ctx, testImage, client.ImagePullOptions{})
-	must.NoError(t, err, "failed to pull test image")
+	require.NoError(t, err, "failed to pull test image")
 	_, _ = io.Copy(io.Discard, reader)
 	_ = reader.Close()
 	_, err = dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fullRef})
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fullRef, client.ImageRemoveOptions{Force: true})
 	})
@@ -1555,7 +1555,7 @@ tag = %q
 port = "4566"
 image = %q
 `, pinnedTag, customImage)
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	// A dummy token satisfies the up-front auth check; it is never validated
 	// because the license pre-flight is skipped for a local image.
@@ -1566,15 +1566,15 @@ image = %q
 	combined := stdout + stderr
 
 	// Found locally and used — nothing is pulled.
-	must.Contains(t, combined, "Using local image "+fullRef,
+	require.Contains(t, combined, "Using local image "+fullRef,
 		"the configured custom image, present locally, should be reused: %s", combined)
-	must.NotContains(t, combined, "Pulling",
+	require.NotContains(t, combined, "Pulling",
 		"lstk must not pull when the configured custom image is already present locally")
 
 	// No license check from the CLI for a local image.
-	must.Eq(t, int32(0), atomic.LoadInt32(&licenseHits),
+	require.Equal(t, int32(0), atomic.LoadInt32(&licenseHits),
 		"the CLI must not contact the license server for a local image")
-	must.NotContains(t, combined, "Checking license",
+	require.NotContains(t, combined, "Checking license",
 		"lstk must not run a pre-flight license check for a local image")
 
 	// Started from the configured local image: lstk created the container using it.
@@ -1583,7 +1583,7 @@ image = %q
 	// authoritative signal. When the container is still present, additionally
 	// confirm it was created from the configured image.
 	if inspect, err := dockerClient.ContainerInspect(ctx, wantContainer, client.ContainerInspectOptions{}); err == nil {
-		must.Eq(t, fullRef, inspect.Container.Config.Image,
+		require.Equal(t, fullRef, inspect.Container.Config.Image,
 			"the container should be created from the configured custom image")
 	}
 }
@@ -1610,7 +1610,7 @@ tag  = "latest"
 port = %q
 `, hostPort)
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(content), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(content), 0644))
 	return configFile
 }
 
@@ -1629,7 +1629,7 @@ func TestStartCommandForSnowflakeSkipsLicenseValidation(t *testing.T) {
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", writeSnowflakeConfig(t, "4566"), "start")
-	must.NoError(t, err, "lstk start should succeed for snowflake even when the license server rejects the request: %s", stderr)
+	require.NoError(t, err, "lstk start should succeed for snowflake even when the license server rejects the request: %s", stderr)
 	requireExitCode(t, 0, err)
 }
 
@@ -1650,25 +1650,25 @@ func TestStartCommandSucceedsForSnowflake(t *testing.T) {
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, snowflakeContainerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect snowflake container")
-	must.True(t, inspect.Container.State.Running, "snowflake container should be running")
-	must.Contains(t, inspect.Container.Config.Image, "localstack/snowflake",
+	require.NoError(t, err, "failed to inspect snowflake container")
+	require.True(t, inspect.Container.State.Running, "snowflake container should be running")
+	require.Contains(t, inspect.Container.Config.Image, "localstack/snowflake",
 		"expected localstack/snowflake image, got %s", inspect.Container.Config.Image)
 
 	resp, err := http.Get(fmt.Sprintf("http://localhost:%s/_localstack/health", hostPort))
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() { _ = resp.Body.Close() })
-	must.Eq(t, http.StatusOK, resp.StatusCode)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
 
-	must.Contains(t, stdout, "• Snowflake endpoint: http://snowflake.",
+	require.Contains(t, stdout, "• Snowflake endpoint: http://snowflake.",
 		"snowflake start should print the snowflake-prefixed endpoint hint")
-	must.NotContains(t, stdout, "• Endpoint: localhost.localstack.cloud",
+	require.NotContains(t, stdout, "• Endpoint: localhost.localstack.cloud",
 		"snowflake start should not print the bare AWS-style endpoint line")
-	must.Contains(t, stdout, "> Tip:",
+	require.Contains(t, stdout, "> Tip:",
 		"snowflake start should print a tip line like AWS does")
 }
 
@@ -1689,13 +1689,13 @@ func TestStartCommandSetsSnowflakeS3EndpointFromPort(t *testing.T) {
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, snowflakeContainerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect snowflake container")
+	require.NoError(t, err, "failed to inspect snowflake container")
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	must.Eq(t, "s3.localhost.localstack.cloud:"+hostPort, envVars["SF_S3_ENDPOINT"],
+	require.Equal(t, "s3.localhost.localstack.cloud:"+hostPort, envVars["SF_S3_ENDPOINT"],
 		"SF_S3_ENDPOINT should match the configured Snowflake port")
 }
 
@@ -1715,7 +1715,7 @@ tag  = "latest"
 port = %q
 `, hostPort)
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(content), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(content), 0644))
 	return configFile
 }
 
@@ -1736,21 +1736,21 @@ func TestStartCommandSucceedsForAzure(t *testing.T) {
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	inspect, err := dockerClient.ContainerInspect(ctx, azureContainerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "failed to inspect azure container")
-	must.True(t, inspect.Container.State.Running, "azure container should be running")
-	must.Contains(t, inspect.Container.Config.Image, "localstack/localstack-azure",
+	require.NoError(t, err, "failed to inspect azure container")
+	require.True(t, inspect.Container.State.Running, "azure container should be running")
+	require.Contains(t, inspect.Container.Config.Image, "localstack/localstack-azure",
 		"expected localstack/localstack-azure image, got %s", inspect.Container.Config.Image)
 
 	resp, err := http.Get(fmt.Sprintf("http://localhost:%s/_localstack/health", hostPort))
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() { _ = resp.Body.Close() })
-	must.Eq(t, http.StatusOK, resp.StatusCode)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
 
-	must.Contains(t, stdout, "> Tip:",
+	require.Contains(t, stdout, "> Tip:",
 		"azure start should print a tip line like AWS does")
 }
 
@@ -1767,7 +1767,7 @@ func TestStartCommandForAzureShowsPlanFromActivatedLicense(t *testing.T) {
 	// the license the container activated into its volume — not the license API.
 	const fakeImage = "localstack/localstack-azure:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -1775,8 +1775,8 @@ func TestStartCommandForAzureShowsPlanFromActivatedLicense(t *testing.T) {
 
 	home := t.TempDir()
 	volumeDir := filepath.Join(home, "volume")
-	must.NoError(t, os.MkdirAll(filepath.Join(volumeDir, "cache"), 0755))
-	must.NoError(t, os.WriteFile(filepath.Join(volumeDir, "cache", "license.json"),
+	require.NoError(t, os.MkdirAll(filepath.Join(volumeDir, "cache"), 0755))
+	require.NoError(t, os.WriteFile(filepath.Join(volumeDir, "cache", "license.json"),
 		[]byte(`{"license_type":"enterprise"}`), 0600))
 
 	configContent := fmt.Sprintf(`
@@ -1787,16 +1787,16 @@ port = "4566"
 volume = %q
 `, volumeDir)
 	configFile := filepath.Join(home, "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	// Fresh HOME = no cached plan_label, so the label must come from the volume license.
 	stdout, err := runLstkInPTY(t, ctx,
 		env.Environ(testEnvWithHome(home, "")).Without(env.AuthToken).With(env.AuthToken, "fake-token"),
 		"start", "--config", configFile,
 	)
-	must.NoError(t, err, "lstk start failed: %s", stdout)
-	must.Contains(t, stdout, "already running")
-	must.Contains(t, stdout, "LocalStack Enterprise",
+	require.NoError(t, err, "lstk start failed: %s", stdout)
+	require.Contains(t, stdout, "already running")
+	require.Contains(t, stdout, "LocalStack Enterprise",
 		"azure header should show the plan from the license the emulator activated into its volume")
 }
 
@@ -1816,6 +1816,6 @@ func TestStartCommandForAzureSkipsLicenseValidation(t *testing.T) {
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", writeAzureConfig(t, "4566"), "start")
-	must.NoError(t, err, "lstk start should succeed for azure even when the license server rejects the request: %s", stderr)
+	require.NoError(t, err, "lstk start should succeed for azure even when the license server rejects the request: %s", stderr)
 	requireExitCode(t, 0, err)
 }
diff --git a/test/integration/status_test.go b/test/integration/status_test.go
index d4ce641c..0158d03e 100644
--- a/test/integration/status_test.go
+++ b/test/integration/status_test.go
@@ -17,10 +17,10 @@ import (
 	"github.com/aws/aws-sdk-go-v2/credentials"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/aws/aws-sdk-go-v2/service/sqs"
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/require"
 )
 
 func TestStatusCommandFailsWhenNotRunning(t *testing.T) {
@@ -30,7 +30,7 @@ func TestStatusCommandFailsWhenNotRunning(t *testing.T) {
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "status")
-	must.Error(t, err, "expected lstk status to fail when emulator not running")
+	require.Error(t, err, "expected lstk status to fail when emulator not running")
 	requireExitCode(t, 1, err)
 	snap.Match(t, sanitizeOutput(stdout))
 	assertCommandTelemetry(t, events, "status", 1)
@@ -48,37 +48,37 @@ func TestStatusCommandShowsResourcesWhenRunning(t *testing.T) {
 	defer mockServer.Close()
 
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 
 	awsCfg, err := awsconfig.LoadDefaultConfig(ctx,
 		awsconfig.WithRegion("us-east-1"),
 		awsconfig.WithCredentialsProvider(credentials.NewStaticCredentialsProvider("test", "test", "")),
 		awsconfig.WithBaseEndpoint("http://localhost:4566"),
 	)
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	s3Client := s3.NewFromConfig(awsCfg, func(o *s3.Options) { o.UsePathStyle = true })
 	_, err = s3Client.CreateBucket(ctx, &s3.CreateBucketInput{Bucket: aws.String("my-test-bucket")})
-	must.NoError(t, err, "failed to create S3 bucket")
+	require.NoError(t, err, "failed to create S3 bucket")
 
 	sqsClient := sqs.NewFromConfig(awsCfg)
 	_, err = sqsClient.CreateQueue(ctx, &sqs.CreateQueueInput{QueueName: aws.String("my-test-queue")})
-	must.NoError(t, err, "failed to create SQS queue")
+	require.NoError(t, err, "failed to create SQS queue")
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "status")
-	must.NoError(t, err, "lstk status failed: %s", stderr)
+	require.NoError(t, err, "lstk status failed: %s", stderr)
 	requireExitCode(t, 0, err)
 	// Not a snapshot: this test needs a real auth token and a live emulator,
 	// so a committed snapshot could not be regenerated by most contributors
 	// (and the resources table layout varies with the emulator image).
-	must.Contains(t, stdout, "running")
-	must.Contains(t, stdout, "SERVICE")
-	must.Contains(t, stdout, "RESOURCE")
-	must.Contains(t, stdout, "S3")
-	must.Contains(t, stdout, "my-test-bucket")
-	must.Contains(t, stdout, "SQS")
-	must.Contains(t, stdout, "my-test-queue")
+	require.Contains(t, stdout, "running")
+	require.Contains(t, stdout, "SERVICE")
+	require.Contains(t, stdout, "RESOURCE")
+	require.Contains(t, stdout, "S3")
+	require.Contains(t, stdout, "my-test-bucket")
+	require.Contains(t, stdout, "SQS")
+	require.Contains(t, stdout, "my-test-queue")
 	assertCommandTelemetry(t, events, "status", 0)
 }
 
@@ -105,7 +105,7 @@ func TestStatusCommandWorksWithNonDefaultPort(t *testing.T) {
 
 	// Extract the port so we can bind it to the container.
 	_, mockPort, err := net.SplitHostPort(server.Listener.Addr().String())
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	// Simulates starting LocalStack on a non-default host port.
 	startTestContainer(t, ctx, mockPort)
@@ -114,11 +114,11 @@ func TestStatusCommandWorksWithNonDefaultPort(t *testing.T) {
 	// Simulates the user changing the config port after starting the container
 	configContent := "[[containers]]\ntype = \"aws\"\ntag = \"latest\"\nport = \"4566\"\n"
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "--config", configFile, "status")
-	must.NoError(t, err, "lstk status failed: %s", stderr)
-	must.Contains(t, stdout, "4.14.1")
+	require.NoError(t, err, "lstk status failed: %s", stderr)
+	require.Contains(t, stdout, "4.14.1")
 }
 
 func TestStatusCommandWorksWithExternalContainer(t *testing.T) {
@@ -130,7 +130,7 @@ func TestStatusCommandWorksWithExternalContainer(t *testing.T) {
 
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -151,9 +151,9 @@ func TestStatusCommandWorksWithExternalContainer(t *testing.T) {
 	defer server.Close()
 
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.LocalStackHost, lsHost(server)), "status")
-	must.NoError(t, err, "lstk status should work with external container: %s", stderr)
+	require.NoError(t, err, "lstk status should work with external container: %s", stderr)
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdout, "3.5.0")
+	require.Contains(t, stdout, "3.5.0")
 }
 
 func TestStatusCommandForSnowflakeShowsNoResources(t *testing.T) {
@@ -165,16 +165,16 @@ func TestStatusCommandForSnowflakeShowsNoResources(t *testing.T) {
 	startTestSnowflakeContainer(t, ctx)
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "--config", writeSnowflakeConfig(t, "4566"), "status")
-	must.NoError(t, err, "lstk status failed for snowflake: %s", stderr)
+	require.NoError(t, err, "lstk status failed for snowflake: %s", stderr)
 	requireExitCode(t, 0, err)
 
-	must.Contains(t, stdout, "Snowflake")
-	must.Contains(t, stdout, "running")
-	must.Contains(t, stdout, "snowflake.localhost.localstack.cloud:4566",
+	require.Contains(t, stdout, "Snowflake")
+	require.Contains(t, stdout, "running")
+	require.Contains(t, stdout, "snowflake.localhost.localstack.cloud:4566",
 		"snowflake status should display the snowflake-routed host clients use to connect")
 	// Snowflake does not expose AWS resources — no resource table or empty-state message.
-	must.NotContains(t, stdout, "SERVICE")
-	must.NotContains(t, stdout, "No resources deployed")
+	require.NotContains(t, stdout, "SERVICE")
+	require.NotContains(t, stdout, "No resources deployed")
 }
 
 func TestStatusCommandForSnowflakeShowsVersion(t *testing.T) {
@@ -194,16 +194,16 @@ func TestStatusCommandForSnowflakeShowsVersion(t *testing.T) {
 
 	ctx := testContext(t)
 	_, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	must.NoError(t, err, "lstk start failed: %s", stderr)
+	require.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	expectedVersion := fetchSnowflakeVersion(t, hostPort)
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "--config", configFile, "status")
-	must.NoError(t, err, "lstk status failed: %s", stderr)
+	require.NoError(t, err, "lstk status failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
-	must.Contains(t, stdout, "• Version: "+expectedVersion,
+	require.Contains(t, stdout, "• Version: "+expectedVersion,
 		"snowflake status should display the version reported by /_localstack/health")
 }
 
@@ -229,22 +229,22 @@ func TestStatusCommandShowsNoResourcesWhenEmpty(t *testing.T) {
 	defer server.Close()
 
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.LocalStackHost, lsHost(server)), "status")
-	must.NoError(t, err, "lstk status failed: %s", stderr)
+	require.NoError(t, err, "lstk status failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdout, "No resources deployed")
+	require.Contains(t, stdout, "No resources deployed")
 }
 
 func fetchSnowflakeVersion(t *testing.T, hostPort string) string {
 	t.Helper()
 	resp, err := http.Get(fmt.Sprintf("http://localhost:%s/_localstack/health", hostPort))
-	must.NoError(t, err, "failed to fetch snowflake health")
+	require.NoError(t, err, "failed to fetch snowflake health")
 	t.Cleanup(func() { _ = resp.Body.Close() })
 	body, err := io.ReadAll(resp.Body)
-	must.NoError(t, err, "failed to read snowflake health body")
+	require.NoError(t, err, "failed to read snowflake health body")
 	var h struct {
 		Version string `json:"version"`
 	}
-	must.NoError(t, json.Unmarshal(body, &h), "failed to decode snowflake health: %s", body)
-	must.NotEmpty(t, h.Version, "snowflake health response missing version field")
+	require.NoError(t, json.Unmarshal(body, &h), "failed to decode snowflake health: %s", body)
+	require.NotEmpty(t, h.Version, "snowflake health response missing version field")
 	return h.Version
 }
diff --git a/test/integration/stop_test.go b/test/integration/stop_test.go
index 2165a020..e29f2b38 100644
--- a/test/integration/stop_test.go
+++ b/test/integration/stop_test.go
@@ -5,9 +5,9 @@ import (
 	"encoding/json"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/require"
 )
 
 func TestStopCommandSucceeds(t *testing.T) {
@@ -20,18 +20,18 @@ func TestStopCommandSucceeds(t *testing.T) {
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "stop")
-	must.NoError(t, err, "lstk stop failed: %s", stderr)
+	require.NoError(t, err, "lstk stop failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdout, "Stopping", "should show stopping message")
-	must.Contains(t, stdout, "stopped", "should show stopped message")
+	require.Contains(t, stdout, "Stopping", "should show stopping message")
+	require.Contains(t, stdout, "stopped", "should show stopped message")
 
 	_, err = dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.Error(t, err, "container should not exist after stop")
+	require.Error(t, err, "container should not exist after stop")
 
 	// Both lstk_lifecycle (stop) and lstk_command events should be emitted.
 	byName := collectTelemetryByName(t, events, 2)
-	must.Contains(t, byName, "lstk_lifecycle")
-	must.Contains(t, byName, "lstk_command")
+	require.Contains(t, byName, "lstk_lifecycle")
+	require.Contains(t, byName, "lstk_command")
 }
 
 // TestStopCommandRejectsAmbientEndpointURLEvenWithLocalContainerRunning
@@ -49,13 +49,13 @@ func TestStopCommandRejectsAmbientEndpointURLEvenWithLocalContainerRunning(t *te
 	startTestContainer(t, ctx)
 
 	stdout, _, err := runLstk(t, ctx, "", env.With(env.DisableEvents, "1").With("LSTK_ENDPOINT_URL", "http://127.0.0.1:1"), "stop")
-	must.Error(t, err)
-	must.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
-	must.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
+	require.Error(t, err)
+	require.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	require.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.NoError(t, err, "container should still exist — stop must reject before ever touching it")
-	must.True(t, inspect.Container.State.Running, "container should still be running")
+	require.NoError(t, err, "container should still exist — stop must reject before ever touching it")
+	require.True(t, inspect.Container.State.Running, "container should still be running")
 }
 
 func TestStopCommandFailsWhenNotRunning(t *testing.T) {
@@ -65,9 +65,9 @@ func TestStopCommandFailsWhenNotRunning(t *testing.T) {
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "stop")
-	must.Error(t, err, "expected lstk stop to fail when container not running")
+	require.Error(t, err, "expected lstk stop to fail when container not running")
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "LocalStack AWS Emulator is not running")
+	require.Contains(t, stdout, "LocalStack AWS Emulator is not running")
 	assertCommandTelemetry(t, events, "stop", 1)
 }
 
@@ -81,9 +81,9 @@ func TestStopCommandReportsEmulatorSpecificNotRunningMessage(t *testing.T) {
 	analyticsSrv, events := mockAnalyticsServer(t)
 	e := env.Environ(testEnvWithHome(t.TempDir(), "")).With(env.AnalyticsEndpoint, analyticsSrv.URL)
 	stdout, _, err := runLstk(t, testContext(t), "", e, "--config", configFile, "stop")
-	must.Error(t, err, "expected lstk stop to fail when snowflake container not running")
+	require.Error(t, err, "expected lstk stop to fail when snowflake container not running")
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "LocalStack Snowflake Emulator is not running",
+	require.Contains(t, stdout, "LocalStack Snowflake Emulator is not running",
 		"stop should match status's emulator-specific message")
 	assertCommandTelemetry(t, events, "stop", 1)
 }
@@ -100,7 +100,7 @@ func TestStopCommandIgnoresForeignEmulatorOnPort(t *testing.T) {
 	// AWS image running on 4566 while config targets snowflake.
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -109,13 +109,13 @@ func TestStopCommandIgnoresForeignEmulatorOnPort(t *testing.T) {
 	configFile := writeSnowflakeConfig(t, "4566")
 
 	stdout, _, err := runLstk(t, testContext(t), "", testEnvWithHome(t.TempDir(), ""), "--config", configFile, "stop")
-	must.Error(t, err, "lstk stop should not match foreign emulator on configured port")
+	require.Error(t, err, "lstk stop should not match foreign emulator on configured port")
 	requireExitCode(t, 1, err)
-	must.Contains(t, stdout, "LocalStack Snowflake Emulator is not running")
-	must.NotContains(t, stdout, "stopped", "should not have stopped the AWS container")
+	require.Contains(t, stdout, "LocalStack Snowflake Emulator is not running")
+	require.NotContains(t, stdout, "stopped", "should not have stopped the AWS container")
 
 	_, inspectErr := dockerClient.ContainerInspect(ctx, "localstack-external-aws", client.ContainerInspectOptions{})
-	must.NoError(t, inspectErr, "AWS container should still exist after snowflake-targeted stop")
+	require.NoError(t, inspectErr, "AWS container should still exist after snowflake-targeted stop")
 }
 
 func TestStopCommandStopsExternalContainer(t *testing.T) {
@@ -127,7 +127,7 @@ func TestStopCommandStopsExternalContainer(t *testing.T) {
 
 	const fakeImage = "localstack/localstack-pro:test-fake"
 	_, err := dockerClient.ImageTag(ctx, client.ImageTagOptions{Source: testImage, Target: fakeImage})
-	must.NoError(t, err)
+	require.NoError(t, err)
 	t.Cleanup(func() {
 		_, _ = dockerClient.ImageRemove(context.Background(), fakeImage, client.ImageRemoveOptions{})
 	})
@@ -135,12 +135,12 @@ func TestStopCommandStopsExternalContainer(t *testing.T) {
 	startExternalContainer(t, ctx, fakeImage, "localstack-external", "4566")
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "stop")
-	must.NoError(t, err, "lstk stop should stop external container: %s", stderr)
+	require.NoError(t, err, "lstk stop should stop external container: %s", stderr)
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdout, "stopped")
+	require.Contains(t, stdout, "stopped")
 
 	_, err = dockerClient.ContainerInspect(ctx, "localstack-external", client.ContainerInspectOptions{})
-	must.Error(t, err, "external container should be gone after lstk stop")
+	require.Error(t, err, "external container should be gone after lstk stop")
 }
 
 func TestStopCommandIsIdempotent(t *testing.T) {
@@ -153,14 +153,14 @@ func TestStopCommandIsIdempotent(t *testing.T) {
 
 	e := testEnvWithHome(t.TempDir(), "")
 	_, stderr, err := runLstk(t, ctx, "", e, "stop")
-	must.NoError(t, err, "first lstk stop failed: %s", stderr)
+	require.NoError(t, err, "first lstk stop failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	_, err = dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	must.Error(t, err, "container should not exist after first stop")
+	require.Error(t, err, "container should not exist after first stop")
 
 	_, _, err = runLstk(t, ctx, "", e, "stop")
-	must.Error(t, err, "second lstk stop should fail since container already removed")
+	require.Error(t, err, "second lstk stop should fail since container already removed")
 	requireExitCode(t, 1, err)
 }
 
@@ -173,13 +173,13 @@ func TestStopCommandJSON(t *testing.T) {
 	startTestContainer(t, ctx)
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "stop", "--json")
-	must.NoError(t, err, "lstk stop --json failed: %s", stderr)
+	require.NoError(t, err, "lstk stop --json failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	envelope := decodeEnvelope(t, stdout)
-	must.Eq(t, "ok", envelope.Status)
-	must.Eq(t, "stop", envelope.Command)
-	must.Nil(t, envelope.Error)
+	require.Equal(t, "ok", envelope.Status)
+	require.Equal(t, "stop", envelope.Command)
+	require.Nil(t, envelope.Error)
 
 	var data struct {
 		Emulators []struct {
@@ -188,11 +188,11 @@ func TestStopCommandJSON(t *testing.T) {
 			WasRunning bool   `json:"wasRunning"`
 		} `json:"emulators"`
 	}
-	must.NoError(t, json.Unmarshal(envelope.Data, &data))
-	must.Len(t, data.Emulators, 1)
-	must.Eq(t, "aws", data.Emulators[0].Type)
-	must.Eq(t, "localstack-aws", data.Emulators[0].Name)
-	must.True(t, data.Emulators[0].WasRunning)
+	require.NoError(t, json.Unmarshal(envelope.Data, &data))
+	require.Len(t, data.Emulators, 1)
+	require.Equal(t, "aws", data.Emulators[0].Type)
+	require.Equal(t, "localstack-aws", data.Emulators[0].Name)
+	require.True(t, data.Emulators[0].WasRunning)
 }
 
 func TestStopCommandJSONNotRunning(t *testing.T) {
@@ -204,8 +204,8 @@ func TestStopCommandJSONNotRunning(t *testing.T) {
 	requireExitCode(t, 1, err)
 
 	envelope := decodeEnvelope(t, stdout)
-	must.Eq(t, "error", envelope.Status)
-	must.NotNil(t, envelope.Error)
-	must.Eq(t, "EMULATOR_NOT_RUNNING", envelope.Error.Code)
-	must.Eq(t, "EMULATOR", envelope.Error.Category)
+	require.Equal(t, "error", envelope.Status)
+	require.NotNil(t, envelope.Error)
+	require.Equal(t, "EMULATOR_NOT_RUNNING", envelope.Error.Code)
+	require.Equal(t, "EMULATOR", envelope.Error.Category)
 }
diff --git a/test/integration/telemetry_test.go b/test/integration/telemetry_test.go
index 478308a2..42fc4b09 100644
--- a/test/integration/telemetry_test.go
+++ b/test/integration/telemetry_test.go
@@ -17,8 +17,8 @@ import (
 	"time"
 
 	"github.com/google/uuid"
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // mockAnalyticsServer returns a test server that records received analytics events.
@@ -68,7 +68,7 @@ func TestStartCommandSendsTelemetryEvent(t *testing.T) {
 			With(env.AuthToken, "fake-token").
 			With(env.AnalyticsEndpoint, analyticsSrv.URL)
 		out, err := cmd.CombinedOutput()
-		must.NoError(t, err, "lstk %v failed: %s", args, out)
+		require.NoError(t, err, "lstk %v failed: %s", args, out)
 	}
 
 	t.Run("lstk start emits command=start", func(t *testing.T) {
@@ -76,33 +76,33 @@ func TestStartCommandSendsTelemetryEvent(t *testing.T) {
 
 		select {
 		case event := <-events:
-			must.Eq(t, "lstk_command", event["name"])
+			require.Equal(t, "lstk_command", event["name"])
 
 			metadata, ok := event["metadata"].(map[string]any)
-			must.True(t, ok)
+			require.True(t, ok)
 			_, err := uuid.Parse(metadata["session_id"].(string))
-			must.NoError(t, err, "session_id should be a valid UUID")
+			require.NoError(t, err, "session_id should be a valid UUID")
 			_, err = time.Parse("2006-01-02 15:04:05.000000", metadata["client_time"].(string))
-			must.NoError(t, err, "client_time should match expected format")
+			require.NoError(t, err, "client_time should match expected format")
 
 			payload, ok := event["payload"].(map[string]any)
-			must.True(t, ok)
-			must.NotEmpty(t, payload["machine_id"], "machine_id should be present")
-			must.Eq(t, os.Getenv("CI") != "", payload["is_ci"])
+			require.True(t, ok)
+			require.NotEmpty(t, payload["machine_id"], "machine_id should be present")
+			require.Equal(t, os.Getenv("CI") != "", payload["is_ci"])
 
 			environment, ok := payload["environment"].(map[string]any)
-			must.True(t, ok)
-			must.NotEmpty(t, environment["lstk_version"])
-			must.Eq[any](t, runtime.GOOS, environment["os"])
-			must.Eq[any](t, runtime.GOARCH, environment["arch"])
+			require.True(t, ok)
+			require.NotEmpty(t, environment["lstk_version"])
+			require.Equal(t, runtime.GOOS, environment["os"])
+			require.Equal(t, runtime.GOARCH, environment["arch"])
 
 			params, ok := payload["parameters"].(map[string]any)
-			must.True(t, ok)
-			must.Eq(t, "start", params["command"])
+			require.True(t, ok)
+			require.Equal(t, "start", params["command"])
 
 			result, ok := payload["result"].(map[string]any)
-			must.True(t, ok)
-			must.InDelta(t, 0, result["exit_code"], 0)
+			require.True(t, ok)
+			require.InDelta(t, 0, result["exit_code"], 0)
 		case <-time.After(3 * time.Second):
 			t.Fatal("timed out waiting for telemetry event")
 		}
@@ -127,7 +127,7 @@ func TestStopCommandSendsTelemetryEvents(t *testing.T) {
 	_, stderr, err := runLstk(t, ctx, "", env.Environ(testEnvWithHome(t.TempDir(), "")).
 		With(env.AuthToken, "fake-token").
 		With(env.AnalyticsEndpoint, analyticsSrv.URL), "stop")
-	must.NoError(t, err, "lstk stop failed: %s", stderr)
+	require.NoError(t, err, "lstk stop failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	// Collect both the lstk_lifecycle and lstk_command events (order not guaranteed).
@@ -144,20 +144,20 @@ func TestStopCommandSendsTelemetryEvents(t *testing.T) {
 	}
 
 	lifecycle, ok := byName["lstk_lifecycle"]
-	must.True(t, ok, "expected lstk_lifecycle event")
+	require.True(t, ok, "expected lstk_lifecycle event")
 	lp := lifecycle["payload"].(map[string]any)
-	must.Eq(t, "stop", lp["event_type"])
-	must.Eq(t, "aws", lp["emulator"])
+	require.Equal(t, "stop", lp["event_type"])
+	require.Equal(t, "aws", lp["emulator"])
 
 	command, ok := byName["lstk_command"]
-	must.True(t, ok, "expected lstk_command event")
+	require.True(t, ok, "expected lstk_command event")
 	cp := command["payload"].(map[string]any)
 	params, ok := cp["parameters"].(map[string]any)
-	must.True(t, ok)
-	must.Eq(t, "stop", params["command"])
+	require.True(t, ok)
+	require.Equal(t, "stop", params["command"])
 	result, ok := cp["result"].(map[string]any)
-	must.True(t, ok)
-	must.InDelta(t, 0, result["exit_code"], 0)
+	require.True(t, ok)
+	require.InDelta(t, 0, result["exit_code"], 0)
 }
 
 func TestStartCommandSucceedsWhenAnalyticsEndpointUnreachable(t *testing.T) {
@@ -176,7 +176,7 @@ func TestStartCommandSucceedsWhenAnalyticsEndpointUnreachable(t *testing.T) {
 		With(env.AnalyticsEndpoint, "http://127.0.0.1:1")
 	out, err := cmd.CombinedOutput()
 
-	must.NoError(t, err, "lstk start should succeed even when analytics endpoint is unreachable: %s", out)
+	require.NoError(t, err, "lstk start should succeed even when analytics endpoint is unreachable: %s", out)
 	requireExitCode(t, 0, err)
 }
 
@@ -198,7 +198,7 @@ func TestStartCommandDoesNotSendTelemetryWhenDisabled(t *testing.T) {
 		With(env.AnalyticsEndpoint, analyticsSrv.URL).
 		With(env.DisableEvents, "1")
 	out, err := cmd.CombinedOutput()
-	must.NoError(t, err, "lstk start failed: %s", out)
+	require.NoError(t, err, "lstk start failed: %s", out)
 	requireExitCode(t, 0, err)
 
 	// Wait long enough that a goroutine would have fired if enabled.
@@ -232,19 +232,19 @@ func TestAWSProxyTelemetryRecordsExitCodeAndSubcommand(t *testing.T) {
 
 	_, _, err := runLstk(t, testContext(t), "", environ,
 		"--endpoint-url", emulatorSrv.URL, "aws", "s3", "lss")
-	must.Error(t, err)
+	require.Error(t, err)
 	requireExitCode(t, 252, err)
 
 	event := receiveEventByName(t, events, "lstk_command")
 	payload, ok := event["payload"].(map[string]any)
-	must.True(t, ok)
+	require.True(t, ok)
 	params, ok := payload["parameters"].(map[string]any)
-	must.True(t, ok)
-	must.Eq(t, "aws", params["command"])
-	must.Eq(t, "s3 lss", params["subcommand"])
+	require.True(t, ok)
+	require.Equal(t, "aws", params["command"])
+	require.Equal(t, "s3 lss", params["subcommand"])
 	result, ok := payload["result"].(map[string]any)
-	must.True(t, ok)
-	must.InDelta(t, 252, result["exit_code"], 0)
+	require.True(t, ok)
+	require.InDelta(t, 252, result["exit_code"], 0)
 }
 
 // receiveEventByName waits up to 3s for an event with the given name.
@@ -271,9 +271,9 @@ func assertCommandTelemetry(t *testing.T, events <-chan map[string]any, command
 	event := receiveEventByName(t, events, "lstk_command")
 	payload, _ := event["payload"].(map[string]any)
 	params, _ := payload["parameters"].(map[string]any)
-	must.Eq[any](t, command, params["command"])
+	require.Equal(t, command, params["command"])
 	result, _ := payload["result"].(map[string]any)
-	must.InDelta(t, exitCode, result["exit_code"], 0)
+	require.InDelta(t, exitCode, result["exit_code"], 0)
 }
 
 // Regression test for FLC-648: a slow analytics endpoint must not add to
@@ -316,8 +316,8 @@ func TestStartCommand_DoesNotBlockOnSlowAnalyticsEndpoint(t *testing.T) {
 	out, err := cmd.CombinedOutput()
 	parentDuration := time.Since(start)
 
-	must.NoError(t, err, "lstk start failed: %s", out)
-	must.Less(t, parentDuration, maxParentDuration,
+	require.NoError(t, err, "lstk start failed: %s", out)
+	require.Less(t, parentDuration, maxParentDuration,
 		"parent process took %v, expected <%v — subprocess flush should not block parent", parentDuration, maxParentDuration)
 
 	// The detached subprocess should still deliver the event.
@@ -341,7 +341,7 @@ func TestCommandTelemetryIsDeliveredByDetachedFlusher(t *testing.T) {
 		With(env.AuthToken, "fake-token").
 		With(env.AnalyticsEndpoint, analyticsSrv.URL).
 		With(env.Key("DOCKER_HOST"), "tcp://127.0.0.1:1"), "start")
-	must.Error(t, err)
+	require.Error(t, err)
 	requireExitCode(t, 1, err)
 
 	assertCommandTelemetry(t, events, "start", 1)
@@ -365,7 +365,7 @@ func TestFlushTelemetrySubcommandDoesNotSpawnRecursively(t *testing.T) {
 		With(env.AnalyticsEndpoint, analyticsSrv.URL)
 	cmd.Stdin = strings.NewReader(input)
 	out, err := cmd.CombinedOutput()
-	must.NoError(t, err, "__flush-telemetry failed: %s", out)
+	require.NoError(t, err, "__flush-telemetry failed: %s", out)
 
 	got := map[string]bool{}
 	for i := 0; i < 2; i++ {
@@ -376,7 +376,7 @@ func TestFlushTelemetrySubcommandDoesNotSpawnRecursively(t *testing.T) {
 			t.Fatalf("expected 2 flushed events, got %d: %v", i, got)
 		}
 	}
-	must.True(t, got["first_event"] && got["second_event"], "expected both piped events, got: %v", got)
+	require.True(t, got["first_event"] && got["second_event"], "expected both piped events, got: %v", got)
 
 	// No further events may arrive: that would mean the flusher emitted telemetry about itself.
 	select {
@@ -402,7 +402,7 @@ func TestOtelFlushSpansJoinCommandTrace(t *testing.T) {
 		With(env.Otel, "1").
 		With(env.OtelEndpoint, otlpSrv.URL).
 		With(env.Key("DOCKER_HOST"), "tcp://127.0.0.1:1"), "start")
-	must.Error(t, err)
+	require.Error(t, err)
 	requireExitCode(t, 1, err)
 
 	// The flusher subprocess exports after the parent exits; allow for its
diff --git a/test/integration/terraform_cmd_test.go b/test/integration/terraform_cmd_test.go
index 578ed9a0..a81141a7 100644
--- a/test/integration/terraform_cmd_test.go
+++ b/test/integration/terraform_cmd_test.go
@@ -6,9 +6,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 const tfOverrideFile = "localstack_providers_override.tf"
@@ -62,8 +62,8 @@ func TestTerraformForwardsArgs(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "version")
-	must.NoError(t, err, "stderr: %s", stderr)
-	must.Contains(t, stdout, "ARGS:version")
+	require.NoError(t, err, "stderr: %s", stderr)
+	require.Contains(t, stdout, "ARGS:version")
 }
 
 func TestTerraformAliasTF(t *testing.T) {
@@ -72,8 +72,8 @@ func TestTerraformAliasTF(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "tf", "version")
-	must.NoError(t, err, "stderr: %s", stderr)
-	must.Contains(t, stdout, "ARGS:version")
+	require.NoError(t, err, "stderr: %s", stderr)
+	require.Contains(t, stdout, "ARGS:version")
 }
 
 // LSTK_TF_CMD selects the binary to invoke (e.g. OpenTofu). A stub named `tofu`
@@ -85,8 +85,8 @@ func TestTerraformHonorsLstkTfCmd(t *testing.T) {
 		With(env.Key("LSTK_TF_CMD"), "tofu")
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "version")
-	must.NoError(t, err, "stderr: %s", stderr)
-	must.Contains(t, stdout, "TOFU:version")
+	require.NoError(t, err, "stderr: %s", stderr)
+	require.Contains(t, stdout, "TOFU:version")
 }
 
 func TestTerraformPropagatesExitCode(t *testing.T) {
@@ -95,8 +95,8 @@ func TestTerraformPropagatesExitCode(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "validate")
-	must.Error(t, err)
-	must.Contains(t, stderr, "simulated failure")
+	require.Error(t, err)
+	require.Contains(t, stderr, "simulated failure")
 	requireExitCode(t, 5, err)
 }
 
@@ -106,7 +106,7 @@ func TestTerraformMissingBinary(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "version")
-	must.Error(t, err)
+	require.Error(t, err)
 	// The snapshot pins the full missing-binary error card, install hint
 	// included.
 	snap.Match(t, sanitizeOutput(stderr+"\n"+stdout))
@@ -126,14 +126,14 @@ func TestTerraformUnproxiedSkipsOverride(t *testing.T) {
 
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, e,
 				"terraform", "--region", "us-west-2", "--account", "111111111111", sub)
-			must.NoError(t, err, "stderr: %s", stderr)
+			require.NoError(t, err, "stderr: %s", stderr)
 
-			must.Contains(t, stdout, "ARGS:"+sub)
+			require.Contains(t, stdout, "ARGS:"+sub)
 			// lstk-specific flags must not be forwarded to terraform.
-			must.NotContains(t, stdout, "--region")
-			must.NotContains(t, stdout, "--account")
+			require.NotContains(t, stdout, "--region")
+			require.NotContains(t, stdout, "--account")
 			// No override file generated.
-			must.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
+			require.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 		})
 	}
 }
@@ -153,10 +153,10 @@ func TestTerraformHelpSkipsOverride(t *testing.T) {
 
 			cmdArgs := append([]string{"terraform"}, args...)
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, e, cmdArgs...)
-			must.NoError(t, err, "stderr: %s", stderr)
+			require.NoError(t, err, "stderr: %s", stderr)
 
-			must.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
-			must.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
+			require.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
+			require.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 		})
 	}
 }
@@ -170,8 +170,8 @@ func TestTerraformInvalidAccountRejected(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"terraform", "--account", "12345", "plan")
-	must.Error(t, err)
-	must.Contains(t, stderr+stdout, "12-digit")
+	require.Error(t, err)
+	require.Contains(t, stderr+stdout, "12-digit")
 }
 
 func TestTerraformMissingFlagValue(t *testing.T) {
@@ -180,8 +180,8 @@ func TestTerraformMissingFlagValue(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "--region")
-	must.Error(t, err)
-	must.Contains(t, stderr+stdout, "--region requires a value")
+	require.Error(t, err)
+	require.Contains(t, stderr+stdout, "--region requires a value")
 }
 
 // 7.7 — positional rules. Flags after the action are forwarded verbatim (use an
@@ -194,8 +194,8 @@ func TestTerraformFlagsAfterActionAreForwarded(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"terraform", "version", "--region", "us-west-2")
-	must.NoError(t, err, "stderr: %s", stderr)
-	must.Contains(t, stdout, "ARGS:version --region us-west-2")
+	require.NoError(t, err, "stderr: %s", stderr)
+	require.Contains(t, stdout, "ARGS:version --region us-west-2")
 }
 
 func TestTerraformFlagBeforeSubcommandRejected(t *testing.T) {
@@ -205,8 +205,8 @@ func TestTerraformFlagBeforeSubcommandRejected(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--account", "111111111111", "terraform", "version")
-	must.Error(t, err)
-	must.Contains(t, stderr+stdout, "must appear after the terraform subcommand")
+	require.Error(t, err)
+	require.Contains(t, stderr+stdout, "must appear after the terraform subcommand")
 }
 
 // 7.2 — proxied command with no running emulator fails with "not running" and
@@ -220,10 +220,10 @@ func TestTerraformFailsWhenEmulatorNotRunning(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "plan")
-	must.Error(t, err)
-	must.Contains(t, stdout, "is not running")
-	must.Contains(t, stdout, "Start LocalStack:")
-	must.NotContains(t, stdout, "ARGS:plan")
+	require.Error(t, err)
+	require.Contains(t, stdout, "is not running")
+	require.Contains(t, stdout, "Start LocalStack:")
+	require.NotContains(t, stdout, "ARGS:plan")
 }
 
 // 10.4 — lstk terraform only works with the AWS emulator. When a non-AWS
@@ -243,10 +243,10 @@ func TestTerraformRequiresAWSEmulator(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), e, "terraform", "plan")
-	must.Error(t, err)
-	must.Contains(t, stdout, "requires the")
-	must.Contains(t, stdout, "Snowflake")
-	must.NotContains(t, stdout, "ARGS:plan")
+	require.Error(t, err)
+	require.Contains(t, stdout, "requires the")
+	require.Contains(t, stdout, "Snowflake")
+	require.NotContains(t, stdout, "ARGS:plan")
 }
 
 // 7.4 + 7.6 (encoding) — LSTK_TF_DRY_RUN generates the override (with resolved
@@ -265,15 +265,15 @@ func TestTerraformDryRunGeneratesOverride(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, ctx, workDir, e,
 		"terraform", "--region", "us-west-2", "--account", "111111111111", "plan")
-	must.NoError(t, err, "stderr: %s", stderr)
+	require.NoError(t, err, "stderr: %s", stderr)
 
 	// terraform plan must NOT have run.
-	must.NotContains(t, stdout, "ARGS:plan")
+	require.NotContains(t, stdout, "ARGS:plan")
 
 	overridePath := filepath.Join(workDir, tfOverrideFile)
-	must.FileExists(t, overridePath)
+	require.FileExists(t, overridePath)
 	content, err := os.ReadFile(overridePath)
-	must.NoError(t, err)
+	require.NoError(t, err)
 	// The snapshot pins the full generated override: resolved region and
 	// account encoded, plus the complete endpoints block (host masked).
 	snap.Match(t, sanitizeOutput(string(content)))
@@ -291,17 +291,17 @@ func TestTerraformRefusesPreexistingOverride(t *testing.T) {
 	fakeDir := writeFakeTerraform(t)
 	workDir := t.TempDir()
 	overridePath := filepath.Join(workDir, tfOverrideFile)
-	must.NoError(t, os.WriteFile(overridePath, []byte("# my own override\n"), 0644))
+	require.NoError(t, os.WriteFile(overridePath, []byte("# my own override\n"), 0644))
 
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, ctx, workDir, e, "terraform", "plan")
-	must.Error(t, err)
-	must.Contains(t, stderr+stdout, "refusing to overwrite")
+	require.Error(t, err)
+	require.Contains(t, stderr+stdout, "refusing to overwrite")
 
 	content, err := os.ReadFile(overridePath)
-	must.NoError(t, err)
-	must.Eq(t, "# my own override\n", string(content), "user's file must be untouched")
+	require.NoError(t, err)
+	require.Equal(t, "# my own override\n", string(content), "user's file must be untouched")
 }
 
 // 7.8 — a proxied `plan` generates the override (with endpoint keys sourced from
@@ -321,14 +321,14 @@ func TestTerraformGeneratesAndRemovesOverride(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, ctx, workDir, e, "terraform", "plan")
-	must.NoError(t, err, "stderr: %s", stderr)
+	require.NoError(t, err, "stderr: %s", stderr)
 
 	// terraform ran and saw an override carrying the schema-derived s3 endpoint key.
-	must.Contains(t, stdout, "ARGS:plan")
-	must.Contains(t, stdout, "TF>")
-	must.Contains(t, stdout, "s3 =")
+	require.Contains(t, stdout, "ARGS:plan")
+	require.Contains(t, stdout, "TF>")
+	require.Contains(t, stdout, "s3 =")
 	// The override is removed once the run completes.
-	must.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
+	require.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 }
 
 // 11.4 — a proxied command run with `-chdir=DIR` anchors lstk's work to DIR.
@@ -348,35 +348,35 @@ func TestTerraformChdirAnchorsOverrideToDir(t *testing.T) {
 	t.Run("override generated inside chdir dir", func(t *testing.T) {
 		workDir := t.TempDir()
 		infra := filepath.Join(workDir, "infra")
-		must.NoError(t, os.Mkdir(infra, 0755))
+		require.NoError(t, os.Mkdir(infra, 0755))
 		e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir()).
 			With(env.Key("LSTK_TF_DRY_RUN"), "1")
 
 		_, stderr, err := runLstk(t, ctx, workDir, e, "terraform", "-chdir=infra", "plan")
-		must.NoError(t, err, "stderr: %s", stderr)
+		require.NoError(t, err, "stderr: %s", stderr)
 
 		overridePath := filepath.Join(infra, tfOverrideFile)
-		must.FileExists(t, overridePath)
+		require.FileExists(t, overridePath)
 		content, err := os.ReadFile(overridePath)
-		must.NoError(t, err)
-		must.Contains(t, string(content), "s3 =") // schema-derived endpoint key
+		require.NoError(t, err)
+		require.Contains(t, string(content), "s3 =") // schema-derived endpoint key
 		// Nothing was written at the top level.
-		must.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
+		require.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 	})
 
 	// A live run forwards -chdir to terraform and removes the override after.
 	t.Run("chdir forwarded and override cleaned up", func(t *testing.T) {
 		workDir := t.TempDir()
 		infra := filepath.Join(workDir, "infra")
-		must.NoError(t, os.Mkdir(infra, 0755))
+		require.NoError(t, os.Mkdir(infra, 0755))
 		e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 		stdout, stderr, err := runLstk(t, ctx, workDir, e, "terraform", "-chdir=infra", "plan")
-		must.NoError(t, err, "stderr: %s", stderr)
+		require.NoError(t, err, "stderr: %s", stderr)
 
-		must.Contains(t, stdout, "ARGS:-chdir=infra plan")
-		must.NoFileExists(t, filepath.Join(infra, tfOverrideFile))
-		must.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
+		require.Contains(t, stdout, "ARGS:-chdir=infra plan")
+		require.NoFileExists(t, filepath.Join(infra, tfOverrideFile))
+		require.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 	})
 }
 
@@ -394,10 +394,10 @@ func TestTerraformChdirMissingDirFails(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, _, err := runLstk(t, ctx, workDir, e, "terraform", "-chdir=does-not-exist", "plan")
-	must.Error(t, err)
-	must.Contains(t, stdout, "does not exist")
-	must.NotContains(t, stdout, "ARGS:")
-	must.NoFileExists(t, filepath.Join(workDir, "does-not-exist", tfOverrideFile))
+	require.Error(t, err)
+	require.Contains(t, stdout, "does not exist")
+	require.NotContains(t, stdout, "ARGS:")
+	require.NoFileExists(t, filepath.Join(workDir, "does-not-exist", tfOverrideFile))
 }
 
 // 7.9 — provider schema unavailable (before init) fails with the init-required
@@ -414,8 +414,8 @@ func TestTerraformSchemaUnavailableRequiresInit(t *testing.T) {
 	e := env.With(env.DisableEvents, "1").With("PATH", fakeDir).WithHome(t.TempDir())
 
 	stdout, stderr, err := runLstk(t, ctx, workDir, e, "terraform", "plan")
-	must.Error(t, err)
-	must.Contains(t, stderr+stdout, "terraform init")
-	must.NotContains(t, stdout, "ARGS:plan")
-	must.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
+	require.Error(t, err)
+	require.Contains(t, stderr+stdout, "terraform init")
+	require.NotContains(t, stdout, "ARGS:plan")
+	require.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 }
diff --git a/test/integration/terraform_e2e_test.go b/test/integration/terraform_e2e_test.go
index 04277a9a..8f3dd4af 100644
--- a/test/integration/terraform_e2e_test.go
+++ b/test/integration/terraform_e2e_test.go
@@ -9,8 +9,8 @@ import (
 	"sync"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // End-to-end tests for `lstk terraform` that exercise the real terraform/tofu
@@ -56,7 +56,7 @@ func tfPluginCacheDir(t *testing.T) string {
 	t.Helper()
 	tfCacheOnce.Do(func() {
 		d, err := os.MkdirTemp("", "lstk-tf-plugin-cache")
-		must.NoError(t, err)
+		require.NoError(t, err)
 		tfCacheDir = d
 	})
 	return tfCacheDir
@@ -79,7 +79,7 @@ func copySample(t *testing.T, name string) string {
 	t.Helper()
 	work := t.TempDir()
 	src := filepath.Join("test-samples", "iac", "terraform", name)
-	must.NoError(t, os.CopyFS(work, os.DirFS(src)))
+	require.NoError(t, os.CopyFS(work, os.DirFS(src)))
 	return work
 }
 
@@ -97,7 +97,7 @@ func runTerraform(t *testing.T, ctx context.Context, work string, e env.Environ,
 func tfInit(t *testing.T, ctx context.Context, work string, e env.Environ) {
 	t.Helper()
 	_, stderr, err := runTerraform(t, ctx, work, e, "init", "-no-color")
-	must.NoError(t, err, "terraform init failed: %s", stderr)
+	require.NoError(t, err, "terraform init failed: %s", stderr)
 }
 
 // 8.1 + 8.2 — top-level project: real init + apply against a real LocalStack,
@@ -118,10 +118,10 @@ func TestTerraformE2ETopLevelProject(t *testing.T) {
 	tfInit(t, ctx, work, e)
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
-	must.NoError(t, err, "apply stderr: %s", stderr)
+	require.NoError(t, err, "apply stderr: %s", stderr)
 
 	// The generated override is cleaned up after the run completes.
-	must.NoFileExists(t, filepath.Join(work, tfOverrideFile))
+	require.NoFileExists(t, filepath.Join(work, tfOverrideFile))
 }
 
 // 8.4 — single aws provider block (no alias): exactly one override block. We
@@ -141,10 +141,10 @@ func TestTerraformE2ESingleProvider(t *testing.T) {
 	tfInit(t, ctx, work, e)
 
 	override := captureOverride(t, ctx, work, e)
-	must.Eq(t, 1, countString(override, `provider "aws" {`), "exactly one provider block")
+	require.Equal(t, 1, countString(override, `provider "aws" {`), "exactly one provider block")
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
-	must.NoError(t, err, "apply stderr: %s", stderr)
+	require.NoError(t, err, "apply stderr: %s", stderr)
 }
 
 // 8.5 — multiple aliased providers plus the default: one override block per
@@ -163,11 +163,11 @@ func TestTerraformE2EMultipleAliases(t *testing.T) {
 	tfInit(t, ctx, work, e)
 
 	override := captureOverride(t, ctx, work, e)
-	must.Eq(t, 2, countString(override, `provider "aws" {`), "default + aliased provider blocks")
-	must.Contains(t, override, `alias = "west"`)
+	require.Equal(t, 2, countString(override, `provider "aws" {`), "default + aliased provider blocks")
+	require.Contains(t, override, `alias = "west"`)
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
-	must.NoError(t, err, "apply stderr: %s", stderr)
+	require.NoError(t, err, "apply stderr: %s", stderr)
 }
 
 // 8.3 — recursive discovery: a provider block in a sub-directory is represented
@@ -188,15 +188,15 @@ func TestTerraformE2ESubdirectoryDiscovery(t *testing.T) {
 	// ignored by discovery. It's created at runtime rather than committed,
 	// since a fake .terraform dir in the repo would be confusing.
 	cacheDir := filepath.Join(work, ".terraform", "extra")
-	must.NoError(t, os.MkdirAll(cacheDir, 0755))
-	must.NoError(t, os.WriteFile(filepath.Join(cacheDir, "cached.tf"),
+	require.NoError(t, os.MkdirAll(cacheDir, 0755))
+	require.NoError(t, os.WriteFile(filepath.Join(cacheDir, "cached.tf"),
 		[]byte("provider \"aws\" {\n  alias = \"should_be_ignored\"\n}\n"), 0644))
 	e := e2eEnv(t)
 	tfInit(t, ctx, work, e)
 
 	override := captureOverride(t, ctx, work, e)
-	must.Contains(t, override, `alias = "replica"`, "sub-directory provider discovered")
-	must.NotContains(t, override, "should_be_ignored", ".terraform provider ignored")
+	require.Contains(t, override, `alias = "replica"`, "sub-directory provider discovered")
+	require.NotContains(t, override, "should_be_ignored", ".terraform provider ignored")
 }
 
 // 8.6 — a provider block that explicitly sets an endpoint (e.g. FIPS) is
@@ -216,11 +216,11 @@ func TestTerraformE2EExplicitEndpointOverridden(t *testing.T) {
 	tfInit(t, ctx, work, e)
 
 	override := captureOverride(t, ctx, work, e)
-	must.NotContains(t, override, "s3-fips.us-east-1.amazonaws.com", "user FIPS endpoint must not survive")
-	must.Contains(t, override, "localstack", "override S3 endpoint targets LocalStack")
+	require.NotContains(t, override, "s3-fips.us-east-1.amazonaws.com", "user FIPS endpoint must not survive")
+	require.Contains(t, override, "localstack", "override S3 endpoint targets LocalStack")
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
-	must.NoError(t, err, "apply must route to LocalStack, not FIPS; stderr: %s", stderr)
+	require.NoError(t, err, "apply must route to LocalStack, not FIPS; stderr: %s", stderr)
 }
 
 // 8.7 — provider version coverage: schema-based endpoint discovery works for
@@ -251,7 +251,7 @@ func TestTerraformE2EProviderVersions(t *testing.T) {
 			// A successful apply requires schema discovery (endpoint keys) to
 			// have worked for this provider version.
 			_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
-			must.NoError(t, err, "apply stderr: %s", stderr)
+			require.NoError(t, err, "apply stderr: %s", stderr)
 		})
 	}
 }
@@ -271,12 +271,12 @@ func TestTerraformE2ETofu(t *testing.T) {
 	e := e2eEnv(t).With(env.Key("LSTK_TF_CMD"), "tofu")
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "init", "-no-color")
-	must.NoError(t, err, "tofu init stderr: %s", stderr)
+	require.NoError(t, err, "tofu init stderr: %s", stderr)
 
 	_, stderr, err = runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
-	must.NoError(t, err, "tofu apply stderr: %s", stderr)
+	require.NoError(t, err, "tofu apply stderr: %s", stderr)
 
-	must.NoFileExists(t, filepath.Join(work, tfOverrideFile))
+	require.NoFileExists(t, filepath.Join(work, tfOverrideFile))
 }
 
 // captureOverride runs the command with LSTK_TF_DRY_RUN=1 so the generated
@@ -285,10 +285,10 @@ func captureOverride(t *testing.T, ctx context.Context, work string, e env.Envir
 	t.Helper()
 	_, stderr, err := runTerraform(t, ctx, work, e.With(env.Key("LSTK_TF_DRY_RUN"), "1"),
 		"plan", "-no-color")
-	must.NoError(t, err, "dry-run stderr: %s", stderr)
+	require.NoError(t, err, "dry-run stderr: %s", stderr)
 	content, err := os.ReadFile(filepath.Join(work, tfOverrideFile))
-	must.NoError(t, err, "override file should exist after dry run")
+	require.NoError(t, err, "override file should exist after dry run")
 	// Remove it so a subsequent real run doesn't trip the pre-existing-file guard.
-	must.NoError(t, os.Remove(filepath.Join(work, tfOverrideFile)))
+	require.NoError(t, os.Remove(filepath.Join(work, tfOverrideFile)))
 	return string(content)
 }
diff --git a/test/integration/terraform_s3backend_e2e_test.go b/test/integration/terraform_s3backend_e2e_test.go
index d66c5078..9d0aee20 100644
--- a/test/integration/terraform_s3backend_e2e_test.go
+++ b/test/integration/terraform_s3backend_e2e_test.go
@@ -5,8 +5,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // End-to-end tests for the S3 state backend and terraform_remote_state support.
@@ -20,7 +20,7 @@ import (
 func tfStateList(t *testing.T, ctx context.Context, work string, e env.Environ) string {
 	t.Helper()
 	stdout, stderr, err := runTerraform(t, ctx, work, e, "state", "list")
-	must.NoError(t, err, "state list failed: %s", stderr)
+	require.NoError(t, err, "state list failed: %s", stderr)
 	return stdout
 }
 
@@ -44,12 +44,12 @@ func TestTerraformE2ES3Backend(t *testing.T) {
 	tfInit(t, ctx, work, e)
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
-	must.NoError(t, err, "apply stderr: %s", stderr)
+	require.NoError(t, err, "apply stderr: %s", stderr)
 
 	// State written to and read back from the LocalStack bucket.
-	must.Contains(t, tfStateList(t, ctx, work, e), "aws_s3_bucket.b")
+	require.Contains(t, tfStateList(t, ctx, work, e), "aws_s3_bucket.b")
 
-	must.NoFileExists(t, filepath.Join(work, tfOverrideFile))
+	require.NoFileExists(t, filepath.Join(work, tfOverrideFile))
 }
 
 // 10.2 — an S3 backend with DynamoDB locking: lstk creates the lock table, and
@@ -70,9 +70,9 @@ func TestTerraformE2ES3BackendLocking(t *testing.T) {
 	tfInit(t, ctx, work, e)
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
-	must.NoError(t, err, "apply with DynamoDB locking stderr: %s", stderr)
+	require.NoError(t, err, "apply with DynamoDB locking stderr: %s", stderr)
 
-	must.Contains(t, tfStateList(t, ctx, work, e), "aws_s3_bucket.b")
+	require.Contains(t, tfStateList(t, ctx, work, e), "aws_s3_bucket.b")
 }
 
 // 10.3 — terraform_remote_state: a producer stack writes state (with an output)
@@ -92,17 +92,17 @@ func TestTerraformE2ERemoteState(t *testing.T) {
 	e := e2eEnv(t)
 	tfInit(t, ctx, producer, e)
 	_, stderr, err := runTerraform(t, ctx, producer, e, "apply", "-auto-approve", "-no-color")
-	must.NoError(t, err, "producer apply stderr: %s", stderr)
+	require.NoError(t, err, "producer apply stderr: %s", stderr)
 
 	// Consumer: reads the producer's remote state from LocalStack.
 	consumer := copySample(t, "remote-state/consumer")
 	tfInit(t, ctx, consumer, e)
 	_, stderr, err = runTerraform(t, ctx, consumer, e, "apply", "-auto-approve", "-no-color")
-	must.NoError(t, err, "consumer apply stderr: %s", stderr)
+	require.NoError(t, err, "consumer apply stderr: %s", stderr)
 
 	stdout, stderr, err := runTerraform(t, ctx, consumer, e, "output", "-raw", "producer_bucket")
-	must.NoError(t, err, "consumer output stderr: %s", stderr)
-	must.Contains(t, stdout, "lstk-e2e-remote-producer", "consumer read the producer's output from LocalStack remote state")
+	require.NoError(t, err, "consumer output stderr: %s", stderr)
+	require.Contains(t, stdout, "lstk-e2e-remote-producer", "consumer read the producer's output from LocalStack remote state")
 }
 
 // 10.4 — the S3 backend flow under OpenTofu (LSTK_TF_CMD=tofu), covering the
@@ -122,9 +122,9 @@ func TestTerraformE2ES3BackendTofu(t *testing.T) {
 	tfInit(t, ctx, work, e)
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
-	must.NoError(t, err, "tofu apply stderr: %s", stderr)
+	require.NoError(t, err, "tofu apply stderr: %s", stderr)
 
-	must.Contains(t, tfStateList(t, ctx, work, e), "aws_s3_bucket.b")
+	require.Contains(t, tfStateList(t, ctx, work, e), "aws_s3_bucket.b")
 }
 
 // State-bucket provisioning must address the same LocalStack account as the
@@ -148,19 +148,19 @@ func TestTerraformE2ES3BackendProvisionsInSelectedAccount(t *testing.T) {
 	e := e2eEnv(t)
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "--account", account, "init", "-no-color")
-	must.NoError(t, err, "init with --account failed: %s", stderr)
+	require.NoError(t, err, "init with --account failed: %s", stderr)
 
 	_, stderr, err = runTerraform(t, ctx, work, e, "--account", account, "apply", "-auto-approve", "-no-color")
-	must.NoError(t, err, "apply stderr: %s", stderr)
+	require.NoError(t, err, "apply stderr: %s", stderr)
 
 	selected, stderr, err := runLstk(t, ctx, work, e, "aws", "--account", account, "s3", "ls")
-	must.NoError(t, err, "listing buckets in the selected account failed: %s", stderr)
-	must.Contains(t, selected, "lstk-tf-state", "the state bucket must exist in the selected account")
+	require.NoError(t, err, "listing buckets in the selected account failed: %s", stderr)
+	require.Contains(t, selected, "lstk-tf-state", "the state bucket must exist in the selected account")
 
 	// And not in the default account, which is where it landed before the fix.
 	deflt, stderr, err := runLstk(t, ctx, work, e, "aws", "s3", "ls")
-	must.NoError(t, err, "listing buckets in the default account failed: %s", stderr)
-	must.NotContains(t, deflt, "lstk-tf-state", "the state bucket must not be in the default account")
+	require.NoError(t, err, "listing buckets in the default account failed: %s", stderr)
+	require.NotContains(t, deflt, "lstk-tf-state", "the state bucket must not be in the default account")
 }
 
 // 10.5 — a configuration with no S3 backend still behaves as before: `init`
@@ -174,8 +174,8 @@ func TestTerraformE2EInitNoBackendNoEmulator(t *testing.T) {
 	e := e2eEnv(t)
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "init", "-no-color")
-	must.NoError(t, err, "backend-less init must not require an emulator; stderr: %s", stderr)
+	require.NoError(t, err, "backend-less init must not require an emulator; stderr: %s", stderr)
 
 	// No override is generated for a backend-less init.
-	must.NoFileExists(t, filepath.Join(work, tfOverrideFile))
+	require.NoFileExists(t, filepath.Join(work, tfOverrideFile))
 }
diff --git a/test/integration/update_test.go b/test/integration/update_test.go
index da337641..644c1fd0 100644
--- a/test/integration/update_test.go
+++ b/test/integration/update_test.go
@@ -21,9 +21,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 func TestUpdateCheckCommand(t *testing.T) {
@@ -32,11 +32,11 @@ func TestUpdateCheckCommand(t *testing.T) {
 
 	analyticsSrv, events := mockAnalyticsServer(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "update", "--check")
-	must.NoError(t, err, "lstk update --check failed: %s", stderr)
+	require.NoError(t, err, "lstk update --check failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	// Dev builds report a note about skipping update check
-	must.Contains(t, stdout, "Note:", "should show a note (dev build or up-to-date)")
+	require.Contains(t, stdout, "Note:", "should show a note (dev build or up-to-date)")
 	assertCommandTelemetry(t, events, "update", 0)
 }
 
@@ -45,9 +45,9 @@ func TestUpdateCheckCommandNonInteractive(t *testing.T) {
 	ctx := testContext(t)
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "update", "--check", "--non-interactive")
-	must.NoError(t, err, "lstk update --check --non-interactive failed: %s", stderr)
+	require.NoError(t, err, "lstk update --check --non-interactive failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdout, "Note:", "should show a note in non-interactive mode")
+	require.Contains(t, stdout, "Note:", "should show a note in non-interactive mode")
 }
 
 func TestUpdateCheckCommandJSON(t *testing.T) {
@@ -55,24 +55,24 @@ func TestUpdateCheckCommandJSON(t *testing.T) {
 	ctx := testContext(t)
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "update", "--check", "--json")
-	must.NoError(t, err, "lstk update --check --json failed: %s", stderr)
+	require.NoError(t, err, "lstk update --check --json failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
 	envelope := decodeEnvelope(t, stdout)
-	must.Eq(t, "ok", envelope.Status)
-	must.Eq(t, "update", envelope.Command)
+	require.Equal(t, "ok", envelope.Status)
+	require.Equal(t, "update", envelope.Command)
 
 	var data struct {
 		CurrentVersion  string `json:"currentVersion"`
 		LatestVersion   string `json:"latestVersion"`
 		UpdateAvailable bool   `json:"updateAvailable"`
 	}
-	must.NoError(t, json.Unmarshal(envelope.Data, &data))
+	require.NoError(t, json.Unmarshal(envelope.Data, &data))
 	// The integration test binary is a dev build, so Check short-circuits
 	// before any network call — this exercises the "checked, none applied"
 	// UpdateCheckedEvent shape without depending on network access.
-	must.Eq(t, "dev", data.CurrentVersion)
-	must.False(t, data.UpdateAvailable)
+	require.Equal(t, "dev", data.CurrentVersion)
+	require.False(t, data.UpdateAvailable)
 }
 
 func requireNPM(t *testing.T) {
@@ -99,8 +99,8 @@ func TestUpdateNPMInstall(t *testing.T) {
 	// On Windows, t.TempDir() may return a short 8.3 path (e.g. RUNNER~1)
 	// while the program resolves the long path. EvalSymlinks normalizes both.
 	projectDir, err := filepath.EvalSymlinks(t.TempDir())
-	must.NoError(t, err)
-	must.NoError(t, os.WriteFile(
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(
 		filepath.Join(projectDir, "package.json"),
 		[]byte(`{"name":"test-project","version":"1.0.0","dependencies":{"@localstack/lstk":"*"}}`),
 		0o644,
@@ -110,7 +110,7 @@ func TestUpdateNPMInstall(t *testing.T) {
 	npmInstall := exec.CommandContext(ctx, "npm", "install", "@localstack/lstk")
 	npmInstall.Dir = projectDir
 	out, err := npmInstall.CombinedOutput()
-	must.NoError(t, err, "npm install failed: %s", string(out))
+	require.NoError(t, err, "npm install failed: %s", string(out))
 
 	// Build a fake old version binary and replace the one in node_modules
 	platformPkg := npmPlatformPackage()
@@ -122,11 +122,11 @@ func TestUpdateNPMInstall(t *testing.T) {
 
 	// Verify the binary exists from npm install
 	_, err = os.Stat(nmBinaryPath)
-	must.NoError(t, err, "expected binary at %s after npm install", nmBinaryPath)
+	require.NoError(t, err, "expected binary at %s after npm install", nmBinaryPath)
 
 	// Build our dev binary with a fake old version into that location
 	repoRoot, err := filepath.Abs("../..")
-	must.NoError(t, err)
+	require.NoError(t, err)
 	buildCmd := exec.CommandContext(ctx, "go", "build",
 		"-ldflags", "-X github.com/localstack/lstk/internal/version.version=0.0.1",
 		"-o", nmBinaryPath,
@@ -134,7 +134,7 @@ func TestUpdateNPMInstall(t *testing.T) {
 	)
 	buildCmd.Dir = repoRoot
 	out, err = buildCmd.CombinedOutput()
-	must.NoError(t, err, "go build failed: %s", string(out))
+	require.NoError(t, err, "go build failed: %s", string(out))
 
 	// Run the binary directly (not through npx) so os.Executable() resolves to the node_modules path.
 	// The update should always use `npm install -g` regardless of local/global context.
@@ -143,10 +143,10 @@ func TestUpdateNPMInstall(t *testing.T) {
 	stdout, err := cmd.CombinedOutput()
 	stdoutStr := string(stdout)
 
-	must.NoError(t, err, "lstk update failed: %s", stdoutStr)
+	require.NoError(t, err, "lstk update failed: %s", stdoutStr)
 	requireExitCode(t, 0, err)
-	must.Contains(t, stdoutStr, "npm install -g", "should always use global install")
-	must.Contains(t, stdoutStr, "Updated to", "should complete the update")
+	require.Contains(t, stdoutStr, "npm install -g", "should always use global install")
+	require.Contains(t, stdoutStr, "Updated to", "should complete the update")
 }
 
 func TestUpdateBinaryInPlace(t *testing.T) {
@@ -160,7 +160,7 @@ func TestUpdateBinaryInPlace(t *testing.T) {
 	}
 	tmpBinary := filepath.Join(t.TempDir(), binaryName)
 	repoRoot, err := filepath.Abs("../..")
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	buildCmd := exec.CommandContext(ctx, "go", "build",
 		"-ldflags", "-X github.com/localstack/lstk/internal/version.version=0.0.1",
@@ -169,13 +169,13 @@ func TestUpdateBinaryInPlace(t *testing.T) {
 	)
 	buildCmd.Dir = repoRoot
 	out, err := buildCmd.CombinedOutput()
-	must.NoError(t, err, "go build failed: %s", string(out))
+	require.NoError(t, err, "go build failed: %s", string(out))
 
 	// Verify it reports the fake version
 	verCmd := exec.CommandContext(ctx, tmpBinary, "--version")
 	verOut, err := verCmd.CombinedOutput()
-	must.NoError(t, err)
-	must.Contains(t, string(verOut), "0.0.1")
+	require.NoError(t, err)
+	require.Contains(t, string(verOut), "0.0.1")
 
 	// Run update — should download the real latest release from GitHub and
 	// replace itself. HOME is a temp dir so config/log side effects stay
@@ -184,21 +184,21 @@ func TestUpdateBinaryInPlace(t *testing.T) {
 	updateCmd.Env = testEnvWithHome(t.TempDir(), "")
 	updateOut, err := updateCmd.CombinedOutput()
 	updateStr := string(updateOut)
-	must.NoError(t, err, "lstk update failed: %s", updateStr)
+	require.NoError(t, err, "lstk update failed: %s", updateStr)
 	requireExitCode(t, 0, err)
-	must.Contains(t, updateStr, "Update available: 0.0.1", "should detect update")
-	must.Contains(t, updateStr, "Downloading and verifying update", "should download and verify binary")
-	must.Contains(t, updateStr, "Updated to", "should complete the update")
+	require.Contains(t, updateStr, "Update available: 0.0.1", "should detect update")
+	require.Contains(t, updateStr, "Downloading and verifying update", "should download and verify binary")
+	require.Contains(t, updateStr, "Updated to", "should complete the update")
 
 	// Verify the binary was replaced with the release version the update
 	// reported, not just "anything other than 0.0.1".
 	m := regexp.MustCompile(`Updated to v?([0-9]+\.[0-9]+\.[0-9]+\S*)`).FindStringSubmatch(updateStr)
-	must.Len(t, m, 2, "update output should report the installed version: %s", updateStr)
+	require.Len(t, m, 2, "update output should report the installed version: %s", updateStr)
 	verCmd2 := exec.CommandContext(ctx, tmpBinary, "--version")
 	verOut2, err := verCmd2.CombinedOutput()
-	must.NoError(t, err)
-	must.Contains(t, string(verOut2), m[1], "replaced binary should print the downloaded release version")
-	must.NotContains(t, string(verOut2), "0.0.1", "binary should no longer be the old version")
+	require.NoError(t, err)
+	require.Contains(t, string(verOut2), m[1], "replaced binary should print the downloaded release version")
+	require.NotContains(t, string(verOut2), "0.0.1", "binary should no longer be the old version")
 }
 
 // TestUpdateBinaryInPlaceJSON exercises an actual applied update (not just
@@ -216,7 +216,7 @@ func TestUpdateBinaryInPlaceJSON(t *testing.T) {
 	}
 	tmpBinary := filepath.Join(t.TempDir(), binaryName)
 	repoRoot, err := filepath.Abs("../..")
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	buildCmd := exec.CommandContext(ctx, "go", "build",
 		"-ldflags", "-X github.com/localstack/lstk/internal/version.version=0.0.1",
@@ -225,28 +225,28 @@ func TestUpdateBinaryInPlaceJSON(t *testing.T) {
 	)
 	buildCmd.Dir = repoRoot
 	out, err := buildCmd.CombinedOutput()
-	must.NoError(t, err, "go build failed: %s", string(out))
+	require.NoError(t, err, "go build failed: %s", string(out))
 
 	updateCmd := exec.CommandContext(ctx, tmpBinary, "update", "--non-interactive", "--json")
 	updateCmd.Env = testEnvWithHome(t.TempDir(), "")
 	updateOut, err := updateCmd.CombinedOutput()
 	updateStr := string(updateOut)
-	must.NoError(t, err, "lstk update --json failed: %s", updateStr)
+	require.NoError(t, err, "lstk update --json failed: %s", updateStr)
 	requireExitCode(t, 0, err)
 
 	envelope := decodeEnvelope(t, strings.TrimSpace(updateStr))
-	must.Eq(t, "ok", envelope.Status)
+	require.Equal(t, "ok", envelope.Status)
 
 	var data map[string]any
-	must.NoError(t, json.Unmarshal(envelope.Data, &data))
-	must.Eq(t, "0.0.1", data["currentVersion"])
-	must.Eq(t, true, data["updated"])
-	must.Eq(t, "binary", data["method"])
-	must.NotEmpty(t, data["updatedVersion"])
+	require.NoError(t, json.Unmarshal(envelope.Data, &data))
+	require.Equal(t, "0.0.1", data["currentVersion"])
+	require.Equal(t, true, data["updated"])
+	require.Equal(t, "binary", data["method"])
+	require.NotEmpty(t, data["updatedVersion"])
 	_, hasLatestVersion := data["latestVersion"]
 	_, hasUpdateAvailable := data["updateAvailable"]
-	must.False(t, hasLatestVersion, "applied-update data should not carry a stale latestVersion key from the preceding check")
-	must.False(t, hasUpdateAvailable, "applied-update data should not carry a stale updateAvailable key from the preceding check")
+	require.False(t, hasLatestVersion, "applied-update data should not carry a stale latestVersion key from the preceding check")
+	require.False(t, hasUpdateAvailable, "applied-update data should not carry a stale updateAvailable key from the preceding check")
 }
 
 func requireHomebrew(t *testing.T) {
@@ -261,7 +261,7 @@ func homebrewLstkBinaryPath(t *testing.T) string {
 
 	// Find the Caskroom binary by resolving the brew symlink
 	brewBin, err := exec.Command("brew", "--prefix").Output()
-	must.NoError(t, err)
+	require.NoError(t, err)
 	prefix := strings.TrimSpace(string(brewBin))
 
 	// Look for lstk in the Caskroom
@@ -281,7 +281,7 @@ func TestUpdateHomebrew(t *testing.T) {
 
 	ctx := testContext(t)
 	repoRoot, err := filepath.Abs("../..")
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	// Build a fake old version into the Caskroom location
 	buildCmd := exec.CommandContext(ctx, "go", "build",
@@ -291,13 +291,13 @@ func TestUpdateHomebrew(t *testing.T) {
 	)
 	buildCmd.Dir = repoRoot
 	out, err := buildCmd.CombinedOutput()
-	must.NoError(t, err, "go build failed: %s", string(out))
+	require.NoError(t, err, "go build failed: %s", string(out))
 
 	// Verify it reports the fake version
 	verCmd := exec.CommandContext(ctx, caskBinary, "--version")
 	verOut, err := verCmd.CombinedOutput()
-	must.NoError(t, err)
-	must.Contains(t, string(verOut), "0.0.1")
+	require.NoError(t, err)
+	require.Contains(t, string(verOut), "0.0.1")
 
 	// Run update — should detect Homebrew and run brew upgrade
 	// Note: brew may consider lstk already up-to-date (its metadata tracks the
@@ -306,10 +306,10 @@ func TestUpdateHomebrew(t *testing.T) {
 	updateCmd := exec.CommandContext(ctx, caskBinary, "update", "--non-interactive")
 	updateOut, err := updateCmd.CombinedOutput()
 	updateStr := string(updateOut)
-	must.NoError(t, err, "lstk update failed: %s", updateStr)
+	require.NoError(t, err, "lstk update failed: %s", updateStr)
 	requireExitCode(t, 0, err)
-	must.Contains(t, updateStr, "Homebrew", "should detect Homebrew install")
-	must.Contains(t, updateStr, "brew upgrade", "should mention brew upgrade")
+	require.Contains(t, updateStr, "Homebrew", "should detect Homebrew install")
+	require.Contains(t, updateStr, "brew upgrade", "should mention brew upgrade")
 }
 
 func TestUpdateNotification(t *testing.T) {
@@ -320,7 +320,7 @@ func TestUpdateNotification(t *testing.T) {
 	// Build a fake old version to a temp location
 	tmpBinary := filepath.Join(t.TempDir(), execName("lstk"))
 	repoRoot, err := filepath.Abs("../..")
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	buildCmd := exec.CommandContext(ctx, "go", "build",
 		"-ldflags", "-X github.com/localstack/lstk/internal/version.version=0.0.1",
@@ -329,7 +329,7 @@ func TestUpdateNotification(t *testing.T) {
 	)
 	buildCmd.Dir = repoRoot
 	out, err := buildCmd.CombinedOutput()
-	must.NoError(t, err, "go build failed: %s", string(out))
+	require.NoError(t, err, "go build failed: %s", string(out))
 
 	// Mock API server so license validation fails fast after the notification
 	mockServer := createMockLicenseServer(false)
@@ -344,7 +344,7 @@ type = "aws"     # Emulator type
 tag  = "latest"  # Docker image tag
 port = "4566"    # Host port
 `
-		must.NoError(t, os.WriteFile(configFile, []byte(originalConfig), 0o644))
+		require.NoError(t, os.WriteFile(configFile, []byte(originalConfig), 0o644))
 
 		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 		defer cancel()
@@ -357,15 +357,15 @@ port = "4566"    # Host port
 		p.write("s")
 
 		out, _ := p.wait()
-		must.Contains(t, out, "New lstk version available")
+		require.Contains(t, out, "New lstk version available")
 
 		configData, err := os.ReadFile(configFile)
-		must.NoError(t, err)
+		require.NoError(t, err)
 		configStr := string(configData)
-		must.Contains(t, configStr, "update_skipped_version", "skipped version should be persisted")
-		must.Contains(t, configStr, "# User-maintained lstk config", "file header comment should be preserved")
-		must.Contains(t, configStr, "# Emulator type", "inline comments should be preserved")
-		must.Contains(t, configStr, `port = "4566"`, "existing config values should be preserved")
+		require.Contains(t, configStr, "update_skipped_version", "skipped version should be persisted")
+		require.Contains(t, configStr, "# User-maintained lstk config", "file header comment should be preserved")
+		require.Contains(t, configStr, "# Emulator type", "inline comments should be preserved")
+		require.Contains(t, configStr, `port = "4566"`, "existing config values should be preserved")
 	})
 
 	t.Run("update", func(t *testing.T) {
@@ -373,11 +373,11 @@ port = "4566"    # Host port
 		// Copy binary since it will be replaced during the update
 		updateBinary := filepath.Join(t.TempDir(), execName("lstk"))
 		data, err := os.ReadFile(tmpBinary)
-		must.NoError(t, err)
-		must.NoError(t, os.WriteFile(updateBinary, data, 0o755))
+		require.NoError(t, err)
+		require.NoError(t, os.WriteFile(updateBinary, data, 0o755))
 
 		configFile := filepath.Join(t.TempDir(), "config.toml")
-		must.NoError(t, os.WriteFile(configFile, []byte(""), 0o644))
+		require.NoError(t, os.WriteFile(configFile, []byte(""), 0o644))
 
 		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
 		defer cancel()
@@ -390,15 +390,15 @@ port = "4566"    # Host port
 		p.write("u")
 
 		out, err := p.wait()
-		must.NoError(t, err, "update should succeed: %s", out)
-		must.Contains(t, out, "New lstk version available")
-		must.Contains(t, out, "Updated to")
+		require.NoError(t, err, "update should succeed: %s", out)
+		require.Contains(t, out, "New lstk version available")
+		require.Contains(t, out, "Updated to")
 
 		// Verify the binary was actually replaced
 		verCmd := exec.CommandContext(ctx, updateBinary, "--version")
 		verOut, err := verCmd.CombinedOutput()
-		must.NoError(t, err)
-		must.NotContains(t, string(verOut), "0.0.1", "binary should no longer be the old version")
+		require.NoError(t, err)
+		require.NotContains(t, string(verOut), "0.0.1", "binary should no longer be the old version")
 	})
 }
 
@@ -411,7 +411,7 @@ func npmPlatformPackage() string {
 func buildLstkWithVersion(t *testing.T, ctx context.Context, version, outPath string) {
 	t.Helper()
 	repoRoot, err := filepath.Abs("../..")
-	must.NoError(t, err)
+	require.NoError(t, err)
 	buildCmd := exec.CommandContext(ctx, "go", "build",
 		"-ldflags", "-X github.com/localstack/lstk/internal/version.version="+version,
 		"-o", outPath,
@@ -419,7 +419,7 @@ func buildLstkWithVersion(t *testing.T, ctx context.Context, version, outPath st
 	)
 	buildCmd.Dir = repoRoot
 	out, err := buildCmd.CombinedOutput()
-	must.NoError(t, err, "go build failed: %s", string(out))
+	require.NoError(t, err, "go build failed: %s", string(out))
 }
 
 // releaseAssetName mirrors the goreleaser asset naming the updater expects:
@@ -442,24 +442,24 @@ func packageReleaseArchive(t *testing.T, binaryName string, binary []byte) []byt
 		hdr := &zip.FileHeader{Name: binaryName, Method: zip.Deflate}
 		hdr.SetMode(0o755)
 		w, err := zw.CreateHeader(hdr)
-		must.NoError(t, err)
+		require.NoError(t, err)
 		_, err = w.Write(binary)
-		must.NoError(t, err)
-		must.NoError(t, zw.Close())
+		require.NoError(t, err)
+		require.NoError(t, zw.Close())
 		return buf.Bytes()
 	}
 	gw := gzip.NewWriter(&buf)
 	tw := tar.NewWriter(gw)
-	must.NoError(t, tw.WriteHeader(&tar.Header{
+	require.NoError(t, tw.WriteHeader(&tar.Header{
 		Name:     binaryName,
 		Mode:     0o755,
 		Size:     int64(len(binary)),
 		Typeflag: tar.TypeReg,
 	}))
 	_, err := tw.Write(binary)
-	must.NoError(t, err)
-	must.NoError(t, tw.Close())
-	must.NoError(t, gw.Close())
+	require.NoError(t, err)
+	require.NoError(t, tw.Close())
+	require.NoError(t, gw.Close())
 	return buf.Bytes()
 }
 
@@ -519,7 +519,7 @@ func TestUpdateBinaryMockGitHubHappyPath(t *testing.T) {
 	newBinary := filepath.Join(t.TempDir(), binaryName)
 	buildLstkWithVersion(t, ctx, "0.0.2", newBinary)
 	newBytes, err := os.ReadFile(newBinary)
-	must.NoError(t, err)
+	require.NoError(t, err)
 
 	archive := packageReleaseArchive(t, binaryName, newBytes)
 	sum := sha256.Sum256(archive)
@@ -538,18 +538,18 @@ func TestUpdateBinaryMockGitHubHappyPath(t *testing.T) {
 	updateCmd.Env = append(mockGitHubEnv(t, srv), string(env.Path)+"="+t.TempDir())
 	out, err := updateCmd.CombinedOutput()
 	outStr := string(out)
-	must.NoError(t, err, "lstk update failed: %s", outStr)
+	require.NoError(t, err, "lstk update failed: %s", outStr)
 	requireExitCode(t, 0, err)
 	// The snapshot pins the full check → download/verify → updated sequence.
 	snap.Match(t, sanitizeOutput(outStr))
 
 	verOut, err := exec.CommandContext(ctx, oldBinary, "--version").CombinedOutput()
-	must.NoError(t, err)
-	must.Contains(t, string(verOut), "0.0.2", "binary should be replaced with the mock release")
+	require.NoError(t, err)
+	require.Contains(t, string(verOut), "0.0.2", "binary should be replaced with the mock release")
 
 	leftovers, err := filepath.Glob(filepath.Join(filepath.Dir(oldBinary), "lstk-update-*"))
-	must.NoError(t, err)
-	must.Empty(t, leftovers, "download temp files should be cleaned up")
+	require.NoError(t, err)
+	require.Empty(t, leftovers, "download temp files should be cleaned up")
 }
 
 // TestUpdateBinaryMockGitHubChecksumMismatch proves the checksum gate: when
@@ -589,7 +589,7 @@ func TestUpdateBinaryMockGitHubChecksumMismatch(t *testing.T) {
 	updateCmd.Stdout = &stdout
 	updateCmd.Stderr = &stderr
 	err := updateCmd.Run()
-	must.Error(t, err, "update must fail on checksum mismatch, output: %s%s", stdout.String(), stderr.String())
+	require.Error(t, err, "update must fail on checksum mismatch, output: %s%s", stdout.String(), stderr.String())
 	requireExitCode(t, 1, err)
 
 	wantStdout := "Checking for updates...\n" +
@@ -597,16 +597,16 @@ func TestUpdateBinaryMockGitHubChecksumMismatch(t *testing.T) {
 		"Downloading and verifying update...\n" +
 		fmt.Sprintf("Error: update failed: checksum mismatch for %s: expected %s, got %s — the downloaded archive may be corrupted or tampered with; update aborted\n",
 			assetName, hex.EncodeToString(wrongSum[:]), hex.EncodeToString(archiveSum[:]))
-	must.Eq(t, wantStdout, stdout.String(), "full stdout should be exactly the check/download/error sequence")
-	must.Empty(t, stderr.String(), "silent-error handling must not print anything to stderr")
+	require.Equal(t, wantStdout, stdout.String(), "full stdout should be exactly the check/download/error sequence")
+	require.Empty(t, stderr.String(), "silent-error handling must not print anything to stderr")
 
 	verOut, err := exec.CommandContext(ctx, oldBinary, "--version").CombinedOutput()
-	must.NoError(t, err, "original binary should still run")
-	must.Contains(t, string(verOut), "0.0.1", "binary must not be replaced on checksum mismatch")
+	require.NoError(t, err, "original binary should still run")
+	require.Contains(t, string(verOut), "0.0.1", "binary must not be replaced on checksum mismatch")
 
 	leftovers, err := filepath.Glob(filepath.Join(filepath.Dir(oldBinary), "lstk-update-*"))
-	must.NoError(t, err)
-	must.Empty(t, leftovers, "rejected download must not leave temp files behind")
+	require.NoError(t, err)
+	require.Empty(t, leftovers, "rejected download must not leave temp files behind")
 }
 
 // TestUpdateBinaryMockGitHubMissingChecksums proves the fail-closed contract:
@@ -633,16 +633,16 @@ func TestUpdateBinaryMockGitHubMissingChecksums(t *testing.T) {
 	updateCmd.Env = mockGitHubEnv(t, srv)
 	out, err := updateCmd.CombinedOutput()
 	outStr := string(out)
-	must.Error(t, err, "update must fail when checksums.txt is missing, output: %s", outStr)
+	require.Error(t, err, "update must fail when checksums.txt is missing, output: %s", outStr)
 	requireExitCode(t, 1, err)
-	must.Contains(t, outStr, "no checksums.txt asset", "should name the missing manifest")
-	must.Contains(t, outStr, "refusing to install an unverifiable binary", "should state the fail-closed policy")
+	require.Contains(t, outStr, "no checksums.txt asset", "should name the missing manifest")
+	require.Contains(t, outStr, "refusing to install an unverifiable binary", "should state the fail-closed policy")
 
 	verOut, err := exec.CommandContext(ctx, oldBinary, "--version").CombinedOutput()
-	must.NoError(t, err, "original binary should still run")
-	must.Contains(t, string(verOut), "0.0.1", "binary must not be replaced without a verifiable manifest")
+	require.NoError(t, err, "original binary should still run")
+	require.Contains(t, string(verOut), "0.0.1", "binary must not be replaced without a verifiable manifest")
 
 	leftovers, err := filepath.Glob(filepath.Join(filepath.Dir(oldBinary), "lstk-update-*"))
-	must.NoError(t, err)
-	must.Empty(t, leftovers, "aborted update must not leave temp files behind")
+	require.NoError(t, err)
+	require.Empty(t, leftovers, "aborted update must not leave temp files behind")
 }
diff --git a/test/integration/version_resolution_test.go b/test/integration/version_resolution_test.go
index 52357b3b..b1229bff 100644
--- a/test/integration/version_resolution_test.go
+++ b/test/integration/version_resolution_test.go
@@ -10,8 +10,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 // returns a mock license server that answers license requests with the given
@@ -56,14 +56,14 @@ func TestVersionResolvedViaImageInspection(t *testing.T) {
 
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start")
-	must.NoError(t, err, "lstk start failed:\nstdout: %s\nstderr: %s", stdout, stderr)
+	require.NoError(t, err, "lstk start failed:\nstdout: %s\nstderr: %s", stdout, stderr)
 
-	must.NotEmpty(t, *capturedVersion, "license request should carry a version resolved from image inspection")
-	must.NotEq(t, "latest", *capturedVersion, "resolved version should not be the unresolved 'latest' tag")
-	must.Contains(t, stdout, "Checking license")
+	require.NotEmpty(t, *capturedVersion, "license request should carry a version resolved from image inspection")
+	require.NotEqual(t, "latest", *capturedVersion, "resolved version should not be the unresolved 'latest' tag")
+	require.Contains(t, stdout, "Checking license")
 
 	semverLike := strings.Contains(*capturedVersion, ".") || strings.Contains(*capturedVersion, "-")
-	must.True(t, semverLike, "resolved version %q should look like a real version", *capturedVersion)
+	require.True(t, semverLike, "resolved version %q should look like a real version", *capturedVersion)
 }
 
 // Verifies that when the license check fails after image inspection, the command
@@ -80,8 +80,8 @@ func TestCommandFailsNicelyWhenLicenseCheckFails(t *testing.T) {
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "",
 		env.With(env.APIEndpoint, mockServer.URL), "start")
-	must.Error(t, err, "expected lstk start to fail when license check fails")
-	must.Contains(t, stdout, "License validation failed",
+	require.Error(t, err, "expected lstk start to fail when license check fails")
+	require.Contains(t, stdout, "License validation failed",
 		"stderr: %s", stderr)
 }
 
@@ -101,7 +101,7 @@ func TestUnsupportedTagSkipsPreflightValidation(t *testing.T) {
 	// multi-GB download). The pull failure is this test's expected exit path — the
 	// behavior under test is that the run gets *past* license validation.
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(`
+	require.NoError(t, os.WriteFile(configFile, []byte(`
 [[containers]]
 type  = "aws"
 tag   = "dev"
@@ -116,14 +116,14 @@ image = "127.0.0.1:1/localstack-pro"
 	stdout, stderr, err := runLstk(t, ctx, "", environ, "--config", configFile, "start")
 
 	out := stdout + "\n" + stderr
-	must.Eq(t, "dev", *capturedVersion, "the configured tag should be sent to the license API")
-	must.NotContains(t, out, "license validation failed",
+	require.Equal(t, "dev", *capturedVersion, "the configured tag should be sent to the license API")
+	require.NotContains(t, out, "license validation failed",
 		"an unparseable tag must not be treated as a license rejection")
-	must.Contains(t, out, `does not support tag "dev"`,
+	require.Contains(t, out, `does not support tag "dev"`,
 		"the skipped pre-flight should be surfaced as a warning")
-	must.Error(t, err, "the start should proceed to the pull and fail on the unreachable registry")
+	require.Error(t, err, "the start should proceed to the pull and fail on the unreachable registry")
 	requireExitCode(t, 1, err)
-	must.Contains(t, out, "Failed to pull")
+	require.Contains(t, out, "Failed to pull")
 }
 
 // Verifies that pinned tags are validated before pulling (fail-fast path).
@@ -138,7 +138,7 @@ func TestPinnedTagValidatedPrePull(t *testing.T) {
 	mockServer, capturedVersion := createLicenseMockServer(t, http.StatusForbidden, "")
 
 	configFile := filepath.Join(t.TempDir(), "config.toml")
-	must.NoError(t, os.WriteFile(configFile, []byte(`
+	require.NoError(t, os.WriteFile(configFile, []byte(`
 [[containers]]
 type = "aws"
 tag  = "4.0.0"
@@ -148,8 +148,8 @@ port = "4566"
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "",
 		env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
-	must.Error(t, err, "expected lstk start to fail when license check fails")
-	must.Contains(t, stdout, "License validation failed",
+	require.Error(t, err, "expected lstk start to fail when license check fails")
+	require.Contains(t, stdout, "License validation failed",
 		"stderr: %s", stderr)
-	must.Eq(t, "4.0.0", *capturedVersion, "pinned tag should be sent directly to the license API without image inspection")
+	require.Equal(t, "4.0.0", *capturedVersion, "pinned tag should be sent directly to the license API without image inspection")
 }
diff --git a/test/integration/volume_test.go b/test/integration/volume_test.go
index e875a1c5..0097ce01 100644
--- a/test/integration/volume_test.go
+++ b/test/integration/volume_test.go
@@ -8,8 +8,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/localstack/lstk/internal/must"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/require"
 )
 
 func TestVolumePathCommand(t *testing.T) {
@@ -23,10 +23,10 @@ func TestVolumePathCommand(t *testing.T) {
 
 		e := testEnvWithHome(tmpHome, xdgOverride)
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "volume", "path")
-		must.NoError(t, err, stderr)
+		require.NoError(t, err, stderr)
 		requireExitCode(t, 0, err)
 
-		must.Contains(t, stdout, filepath.Join("lstk", "volume", "localstack-aws"))
+		require.Contains(t, stdout, filepath.Join("lstk", "volume", "localstack-aws"))
 	})
 
 	t.Run("prints custom volume path from config", func(t *testing.T) {
@@ -40,10 +40,10 @@ port = "4566"
 volume = "` + escapeTomlPath(customVolume) + `"
 `
 		configFile := filepath.Join(t.TempDir(), "config.toml")
-		must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+		require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "volume", "path")
-		must.NoError(t, err, stderr)
+		require.NoError(t, err, stderr)
 		requireExitCode(t, 0, err)
 
 		assertSamePath(t, customVolume, stdout)
@@ -60,10 +60,10 @@ port = "4566"
 volumes = ["` + escapeTomlPath(persistDir) + `:/var/lib/localstack", "/abs/init.sf.sql:/etc/localstack/init/ready.d/init.sf.sql"]
 `
 		configFile := filepath.Join(t.TempDir(), "config.toml")
-		must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+		require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "volume", "path")
-		must.NoError(t, err, stderr)
+		require.NoError(t, err, stderr)
 		requireExitCode(t, 0, err)
 
 		assertSamePath(t, persistDir, stdout)
@@ -80,10 +80,10 @@ port = "4566"
 volumes = ["./persist:/var/lib/localstack"]
 `
 		configFile := filepath.Join(configDir, "config.toml")
-		must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+		require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "volume", "path")
-		must.NoError(t, err, stderr)
+		require.NoError(t, err, stderr)
 		requireExitCode(t, 0, err)
 
 		assertSamePath(t, filepath.Join(configDir, "persist"), stdout)
@@ -99,7 +99,7 @@ volumes = ["./persist:/var/lib/localstack"]
 		analyticsSrv, events := mockAnalyticsServer(t)
 		e := env.Environ(testEnvWithHome(tmpHome, xdgOverride)).With(env.AnalyticsEndpoint, analyticsSrv.URL)
 		_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "volume", "path")
-		must.NoError(t, err, stderr)
+		require.NoError(t, err, stderr)
 		requireExitCode(t, 0, err)
 
 		assertCommandTelemetry(t, events, "volume path", 0)
@@ -111,9 +111,9 @@ func TestVolumeClearCommand(t *testing.T) {
 	t.Run("clears volume with force flag", func(t *testing.T) {
 		t.Parallel()
 		volumeDir := t.TempDir()
-		must.NoError(t, os.MkdirAll(filepath.Join(volumeDir, "cache", "certs"), 0755))
-		must.NoError(t, os.WriteFile(filepath.Join(volumeDir, "cache", "certs", "cert.pem"), []byte("fake cert"), 0644))
-		must.NoError(t, os.WriteFile(filepath.Join(volumeDir, "cache", "machine.json"), []byte("{}"), 0644))
+		require.NoError(t, os.MkdirAll(filepath.Join(volumeDir, "cache", "certs"), 0755))
+		require.NoError(t, os.WriteFile(filepath.Join(volumeDir, "cache", "certs", "cert.pem"), []byte("fake cert"), 0644))
+		require.NoError(t, os.WriteFile(filepath.Join(volumeDir, "cache", "machine.json"), []byte("{}"), 0644))
 
 		configContent := `
 [[containers]]
@@ -123,22 +123,22 @@ port = "4566"
 volume = "` + escapeTomlPath(volumeDir) + `"
 `
 		configFile := filepath.Join(t.TempDir(), "config.toml")
-		must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+		require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "--non-interactive", "volume", "clear", "--force")
-		must.NoError(t, err, "lstk volume clear failed: %s\nstdout: %s", stderr, stdout)
+		require.NoError(t, err, "lstk volume clear failed: %s\nstdout: %s", stderr, stdout)
 		requireExitCode(t, 0, err)
 
-		must.Contains(t, stdout, "Volume data cleared")
+		require.Contains(t, stdout, "Volume data cleared")
 
 		// Directory itself should still exist
 		_, err = os.Stat(volumeDir)
-		must.NoError(t, err, "volume directory should still exist")
+		require.NoError(t, err, "volume directory should still exist")
 
 		// But contents should be gone
 		entries, err := os.ReadDir(volumeDir)
-		must.NoError(t, err)
-		must.Empty(t, entries, "volume directory should be empty")
+		require.NoError(t, err)
+		require.Empty(t, entries, "volume directory should be empty")
 	})
 
 	t.Run("fails without force in non-interactive mode", func(t *testing.T) {
@@ -150,10 +150,10 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 
 		e := testEnvWithHome(tmpHome, xdgOverride)
 		_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--non-interactive", "volume", "clear")
-		must.Error(t, err)
+		require.Error(t, err)
 		requireExitCode(t, 1, err)
 
-		must.Contains(t, stderr, "--force")
+		require.Contains(t, stderr, "--force")
 	})
 
 	t.Run("handles nonexistent volume directory", func(t *testing.T) {
@@ -168,19 +168,19 @@ port = "4566"
 volume = "` + escapeTomlPath(volumeDir) + `"
 `
 		configFile := filepath.Join(t.TempDir(), "config.toml")
-		must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+		require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "--non-interactive", "volume", "clear", "--force")
-		must.NoError(t, err, "lstk volume clear failed: %s\nstdout: %s", stderr, stdout)
+		require.NoError(t, err, "lstk volume clear failed: %s\nstdout: %s", stderr, stdout)
 		requireExitCode(t, 0, err)
 
-		must.Contains(t, stdout, "Volume data cleared")
+		require.Contains(t, stdout, "Volume data cleared")
 	})
 
 	t.Run("filters by emulator type", func(t *testing.T) {
 		t.Parallel()
 		volumeDir := t.TempDir()
-		must.NoError(t, os.WriteFile(filepath.Join(volumeDir, "data.json"), []byte("{}"), 0644))
+		require.NoError(t, os.WriteFile(filepath.Join(volumeDir, "data.json"), []byte("{}"), 0644))
 
 		configContent := `
 [[containers]]
@@ -190,22 +190,22 @@ port = "4566"
 volume = "` + escapeTomlPath(volumeDir) + `"
 `
 		configFile := filepath.Join(t.TempDir(), "config.toml")
-		must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+		require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 		// Wrong type should fail
 		_, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "--non-interactive", "volume", "clear", "--force", "--type", "snowflake")
-		must.Error(t, err)
+		require.Error(t, err)
 		requireExitCode(t, 1, err)
-		must.Contains(t, stderr, "not found")
+		require.Contains(t, stderr, "not found")
 
 		// Correct type should succeed
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "--non-interactive", "volume", "clear", "--force", "--type", "aws")
-		must.NoError(t, err, "lstk volume clear failed: %s\nstdout: %s", stderr, stdout)
+		require.NoError(t, err, "lstk volume clear failed: %s\nstdout: %s", stderr, stdout)
 		requireExitCode(t, 0, err)
 
 		entries, err := os.ReadDir(volumeDir)
-		must.NoError(t, err)
-		must.Empty(t, entries)
+		require.NoError(t, err)
+		require.Empty(t, entries)
 	})
 
 	t.Run("emits telemetry", func(t *testing.T) {
@@ -218,7 +218,7 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 		analyticsSrv, events := mockAnalyticsServer(t)
 		e := env.Environ(testEnvWithHome(tmpHome, xdgOverride)).With(env.AnalyticsEndpoint, analyticsSrv.URL)
 		_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--non-interactive", "volume", "clear", "--force")
-		must.NoError(t, err, stderr)
+		require.NoError(t, err, stderr)
 		requireExitCode(t, 0, err)
 
 		assertCommandTelemetry(t, events, "volume clear", 0)
@@ -240,7 +240,7 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 			"-v", volumeDir+":/vol",
 			"alpine", "sh", "-c", "mkdir /vol/cache && touch /vol/cache/cert.pem",
 		).CombinedOutput()
-		must.NoError(t, err, "docker setup failed: %s", out)
+		require.NoError(t, err, "docker setup failed: %s", out)
 		t.Cleanup(func() {
 			_ = exec.Command("docker", "run", "--rm",
 				"-v", volumeDir+":/vol",
@@ -256,7 +256,7 @@ port = "4566"
 volume = "` + escapeTomlPath(volumeDir) + `"
 `
 		configFile := filepath.Join(t.TempDir(), "config.toml")
-		must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+		require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 
 		_, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "--non-interactive", "volume", "clear", "--force")
 		if err == nil {
@@ -264,7 +264,7 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 		}
 
 		requireExitCode(t, 1, err)
-		must.Contains(t, stderr, "sudo")
+		require.Contains(t, stderr, "sudo")
 	})
 }
 
@@ -281,7 +281,7 @@ port = "4566"
 volume = "` + escapeTomlPath(volumeDir) + `"
 `
 		configFile := filepath.Join(t.TempDir(), "config.toml")
-		must.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
+		require.NoError(t, os.WriteFile(configFile, []byte(configContent), 0644))
 		return configFile
 	}
 
@@ -297,33 +297,33 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 	t.Run("clears volume when user confirms with y", func(t *testing.T) {
 		t.Parallel()
 		volumeDir := t.TempDir()
-		must.NoError(t, os.WriteFile(filepath.Join(volumeDir, "data.json"), []byte("{}"), 0644))
+		require.NoError(t, os.WriteFile(filepath.Join(volumeDir, "data.json"), []byte("{}"), 0644))
 
 		p := startVolumeClear(t, makeConfig(t, volumeDir))
 		p.write("y")
 		out, err := p.wait()
-		must.NoError(t, err)
+		require.NoError(t, err)
 
-		must.Contains(t, out, "Volume data cleared")
+		require.Contains(t, out, "Volume data cleared")
 		entries, err := os.ReadDir(volumeDir)
-		must.NoError(t, err)
-		must.Empty(t, entries, "volume directory should be empty after confirm")
+		require.NoError(t, err)
+		require.Empty(t, entries, "volume directory should be empty after confirm")
 	})
 
 	t.Run("cancels when user presses n", func(t *testing.T) {
 		t.Parallel()
 		volumeDir := t.TempDir()
-		must.NoError(t, os.WriteFile(filepath.Join(volumeDir, "data.json"), []byte("{}"), 0644))
+		require.NoError(t, os.WriteFile(filepath.Join(volumeDir, "data.json"), []byte("{}"), 0644))
 
 		p := startVolumeClear(t, makeConfig(t, volumeDir))
 		p.write("n")
 		out, err := p.wait()
-		must.NoError(t, err)
+		require.NoError(t, err)
 
-		must.Contains(t, out, "Cancelled")
+		require.Contains(t, out, "Cancelled")
 		entries, err := os.ReadDir(volumeDir)
-		must.NoError(t, err)
-		must.Len(t, entries, 1, "volume directory should be untouched after cancel")
+		require.NoError(t, err)
+		require.Len(t, entries, 1, "volume directory should be untouched after cancel")
 	})
 }
 

From 1ebf5bd16757b3e3ed027f5d622367c20d2a953a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Wed, 12 Aug 2026 12:56:57 +0200
Subject: [PATCH 12/21] Prototype txtar per-test-file snapshot archives

Co-Authored-By: Claude <noreply@anthropic.com>
---
 CLAUDE.md                                     |   2 +-
 go.mod                                        |   2 +-
 .../TestPlainSink_EmitsErrorEvent_1.snap      |   3 -
 ...ainSink_EmitsInstanceInfoEvent_full_1.snap |   6 -
 ...Sink_EmitsInstanceInfoEvent_minimal_1.snap |   2 -
 ...opeJSON_1.snap => envelope_sink_test.snap} |   4 +
 .../output/__snapshots__/plain_sink_test.snap |  17 ++
 internal/snap/snap.go                         | 259 ++++++++++++-----
 internal/snap/snap_test.go                    | 273 +++++++++++-------
 ...onfigLoadFailureRendersJSONEnvelope_1.snap |  13 -
 ...tensionEndpointOmittedWhenNoRuntime_1.snap |   8 -
 ...tExtensionReceivesJSONFlagInContext_1.snap |   8 -
 ...ssionIDOmittedWhenTelemetryDisabled_1.snap |   7 -
 ...stExtensionUnknownCommandDispatches_1.snap |   8 -
 ...before_the_command_name_is_rejected_1.snap |  13 -
 ...before_the_command_name_is_rejected_1.snap |  13 -
 ...after_the_wrapped_tool_s_own_action_1.snap |   2 -
 ...json_immediately_after_command_name_1.snap |   2 -
 ...after_the_wrapped_tool_s_own_action_1.snap |   2 -
 ...json_immediately_after_command_name_1.snap |   2 -
 ...after_the_wrapped_tool_s_own_action_1.snap |   2 -
 ...json_immediately_after_command_name_1.snap |   2 -
 ...after_the_wrapped_tool_s_own_action_1.snap |   2 -
 ...json_immediately_after_command_name_1.snap |   2 -
 ...after_the_wrapped_tool_s_own_action_1.snap |   2 -
 ...json_immediately_after_command_name_1.snap |   2 -
 ...CommandsRejectBeforeCommandName_aws_1.snap |  13 -
 ...yCommandsRejectBeforeCommandName_az_1.snap |  13 -
 ...CommandsRejectBeforeCommandName_cdk_1.snap |  13 -
 ...CommandsRejectBeforeCommandName_sam_1.snap |  13 -
 ...dsRejectBeforeCommandName_terraform_1.snap |  13 -
 ...otJSONCapableCommandRendersEnvelope_1.snap |  13 -
 ...estSnapshotListSuccessWithoutDocker_1.snap |   6 -
 .../TestSnapshotShowPinnedVersion_1.snap      |   9 -
 .../TestSnapshotShowVersionNotFound_1.snap    |   4 -
 ...pshotVersionsFiltersDeletedVersions_1.snap |   6 -
 .../TestSnapshotVersionsRejectsS3Ref_1.snap   |   1 -
 ...napshotVersionsSuccessWithoutDocker_1.snap |   7 -
 ...estStatusCommandFailsWhenNotRunning_1.snap |   3 -
 ...ndpointURLHTTPSRendersReducedOutput_1.snap |   5 -
 ...atusEndpointURLRendersReducedOutput_1.snap |   5 -
 .../TestTerraformMissingBinary_1.snap         |   3 -
 ...TestUpdateBinaryMockGitHubHappyPath_1.snap |   4 -
 ...tUsageErrorAfterJSONRendersEnvelope_1.snap |  13 -
 ...tsCleanAWSEnv_1.snap => cdk_cmd_test.snap} |   4 +
 .../endpoint_url_https_test.snap              |   9 +
 .../__snapshots__/endpoint_url_test.snap      |   9 +
 ...athNameOnly_1.snap => extension_test.snap} |  30 ++
 .../__snapshots__/json_envelope_test.snap     |  45 +++
 .../__snapshots__/json_flag_test.snap         | 140 +++++++++
 ...tsCleanAWSEnv_1.snap => sam_cmd_test.snap} |   4 +
 .../__snapshots__/snapshot_list_test.snap     |  10 +
 ...tDocker_1.snap => snapshot_show_test.snap} |   4 +
 .../__snapshots__/snapshot_versions_test.snap |  35 +++
 .../__snapshots__/status_test.snap            |   7 +
 ...verride_1.snap => terraform_cmd_test.snap} |   8 +
 .../__snapshots__/update_test.snap            |   8 +
 test/integration/go.mod                       |   1 +
 test/integration/go.sum                       |   2 +
 59 files changed, 697 insertions(+), 421 deletions(-)
 delete mode 100644 internal/output/__snapshots__/TestPlainSink_EmitsErrorEvent_1.snap
 delete mode 100644 internal/output/__snapshots__/TestPlainSink_EmitsInstanceInfoEvent_full_1.snap
 delete mode 100644 internal/output/__snapshots__/TestPlainSink_EmitsInstanceInfoEvent_minimal_1.snap
 rename internal/output/__snapshots__/{TestEnvelopeSink_UpdateCheckedEnvelopeJSON_1.snap => envelope_sink_test.snap} (52%)
 create mode 100644 internal/output/__snapshots__/plain_sink_test.snap
 delete mode 100644 test/integration/__snapshots__/TestConfigLoadFailureRendersJSONEnvelope_1.snap
 delete mode 100644 test/integration/__snapshots__/TestExtensionEndpointOmittedWhenNoRuntime_1.snap
 delete mode 100644 test/integration/__snapshots__/TestExtensionReceivesJSONFlagInContext_1.snap
 delete mode 100644 test/integration/__snapshots__/TestExtensionSessionIDOmittedWhenTelemetryDisabled_1.snap
 delete mode 100644 test/integration/__snapshots__/TestExtensionUnknownCommandDispatches_1.snap
 delete mode 100644 test/integration/__snapshots__/TestJSONFlagBeforeCommandNameBooleanValues_--json_true_before_the_command_name_is_rejected_1.snap
 delete mode 100644 test/integration/__snapshots__/TestJSONFlagBeforeCommandNameBooleanValues_a_malformed_value_before_the_command_name_is_rejected_1.snap
 delete mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_aws_json_after_the_wrapped_tool_s_own_action_1.snap
 delete mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_aws_json_immediately_after_command_name_1.snap
 delete mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_az_json_after_the_wrapped_tool_s_own_action_1.snap
 delete mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_az_json_immediately_after_command_name_1.snap
 delete mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_cdk_json_after_the_wrapped_tool_s_own_action_1.snap
 delete mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_cdk_json_immediately_after_command_name_1.snap
 delete mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_sam_json_after_the_wrapped_tool_s_own_action_1.snap
 delete mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_sam_json_immediately_after_command_name_1.snap
 delete mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_terraform_json_after_the_wrapped_tool_s_own_action_1.snap
 delete mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_terraform_json_immediately_after_command_name_1.snap
 delete mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_aws_1.snap
 delete mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_az_1.snap
 delete mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_cdk_1.snap
 delete mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_sam_1.snap
 delete mode 100644 test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_terraform_1.snap
 delete mode 100644 test/integration/__snapshots__/TestNotJSONCapableCommandRendersEnvelope_1.snap
 delete mode 100644 test/integration/__snapshots__/TestSnapshotListSuccessWithoutDocker_1.snap
 delete mode 100644 test/integration/__snapshots__/TestSnapshotShowPinnedVersion_1.snap
 delete mode 100644 test/integration/__snapshots__/TestSnapshotShowVersionNotFound_1.snap
 delete mode 100644 test/integration/__snapshots__/TestSnapshotVersionsFiltersDeletedVersions_1.snap
 delete mode 100644 test/integration/__snapshots__/TestSnapshotVersionsRejectsS3Ref_1.snap
 delete mode 100644 test/integration/__snapshots__/TestSnapshotVersionsSuccessWithoutDocker_1.snap
 delete mode 100644 test/integration/__snapshots__/TestStatusCommandFailsWhenNotRunning_1.snap
 delete mode 100644 test/integration/__snapshots__/TestStatusEndpointURLHTTPSRendersReducedOutput_1.snap
 delete mode 100644 test/integration/__snapshots__/TestStatusEndpointURLRendersReducedOutput_1.snap
 delete mode 100644 test/integration/__snapshots__/TestTerraformMissingBinary_1.snap
 delete mode 100644 test/integration/__snapshots__/TestUpdateBinaryMockGitHubHappyPath_1.snap
 delete mode 100644 test/integration/__snapshots__/TestUsageErrorAfterJSONRendersEnvelope_1.snap
 rename test/integration/__snapshots__/{TestCDKInjectsCleanAWSEnv_1.snap => cdk_cmd_test.snap} (61%)
 create mode 100644 test/integration/__snapshots__/endpoint_url_https_test.snap
 create mode 100644 test/integration/__snapshots__/endpoint_url_test.snap
 rename test/integration/__snapshots__/{TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly_1.snap => extension_test.snap} (73%)
 create mode 100644 test/integration/__snapshots__/json_envelope_test.snap
 create mode 100644 test/integration/__snapshots__/json_flag_test.snap
 rename test/integration/__snapshots__/{TestSAMInjectsCleanAWSEnv_1.snap => sam_cmd_test.snap} (63%)
 create mode 100644 test/integration/__snapshots__/snapshot_list_test.snap
 rename test/integration/__snapshots__/{TestSnapshotShowSuccessWithoutDocker_1.snap => snapshot_show_test.snap} (61%)
 create mode 100644 test/integration/__snapshots__/snapshot_versions_test.snap
 create mode 100644 test/integration/__snapshots__/status_test.snap
 rename test/integration/__snapshots__/{TestTerraformDryRunGeneratesOverride_1.snap => terraform_cmd_test.snap} (52%)
 create mode 100644 test/integration/__snapshots__/update_test.snap

diff --git a/CLAUDE.md b/CLAUDE.md
index f2316ef9..588b8a58 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -233,7 +233,7 @@ When drafting Slack messages, PR descriptions, review replies, release notes, or
 # Testing
 
 - Prefer integration tests to cover most cases. Use unit tests when integration tests are not practical.
-- Assertions use `github.com/stretchr/testify` (`require` for fatal checks). Snapshots use the in-house `internal/snap` helper. `snap.Match(t, s)` stores one file per snapshot under `__snapshots__/` next to the test; missing snapshots are created locally but fail in CI; `UPDATE_SNAPS=true go test ./...` rewrites them. `snap.MatchJSON(t, raw, "data.currentVersion", ...)` snapshots a JSON document in canonical pretty-printed form, masking the values at the given dotted paths with `<any>` (a path that doesn't resolve fails the test; objects only, no array indexing). A package using snapshots must wire `func TestMain(m *testing.M) { os.Exit(snap.Clean(m)) }` — obsolete snapshots then fail the run (or are deleted under `UPDATE_SNAPS=true`); cleanup is skipped on filtered (`-run`/`-skip`) or failed runs. Sanitize volatile values before matching with label-anchored regexes, not value-shaped ones (see `sanitizeSnapshot` in `internal/output`; RE2 has no lookahead, so a bare semver pattern corrupts IPv4 strings).
+- Assertions use `github.com/stretchr/testify` (`require` for fatal checks). Snapshots use the in-house `internal/snap` helper: `snap.Match(t, s)` stores snapshots in one txtar archive per test file (`__snapshots__/<test_file>.snap`, one `-- TestName_N --` section per Match call); missing snapshots are created locally but fail in CI; `UPDATE_SNAPS=true go test` rewrites them. txtar has no escaping, so a value containing a line that parses as a section separator is rejected (round-trip guard) — sanitize such values before matching. `snap.MatchJSON(t, raw, "data.currentVersion", ...)` snapshots a JSON document in canonical pretty-printed form, masking the values at the given dotted paths with `<any>` (a path that doesn't resolve fails the test; objects only, no array indexing). A package using snapshots must wire `func TestMain(m *testing.M) { os.Exit(snap.Clean(m)) }` — obsolete snapshots then fail the run (or are deleted under `UPDATE_SNAPS=true`); cleanup is skipped on filtered (`-run`/`-skip`) or failed runs. Sanitize volatile values before matching with label-anchored regexes, not value-shaped ones (see `sanitizeSnapshot` in `internal/output`; RE2 has no lookahead, so a bare semver pattern corrupts IPv4 strings).
 - **When fixing a bug, always add an integration test** that fails before the fix and passes after. This prevents regressions and documents the exact scenario that was broken.
 - Integration tests that run the CLI binary with Bubble Tea must use a PTY since Bubble Tea requires a terminal. Use the cross-platform helpers in `test/integration/pty_helpers_test.go` — `runLstkInPTY` for run-to-completion, or `startLstkInPTY`/`startCmdInPTY` returning a `ptyProc` with `waitForOutput`/`write`/`wait`/`kill` for interactive prompts — never `creack/pty` directly. The helpers wrap `charmbracelet/x/xpty` (Unix PTY on macOS/Linux, ConPTY on Windows), so PTY tests run on Windows too; output from `wait()`/`output()` is ANSI-stripped because ConPTY injects its own repaint sequences. `creack/pty` remains only in `signal_forwarding_test.go` (build-tagged `!windows`; POSIX signal semantics don't port).
 - Never fake an external CLI (`aws`, `az`, `terraform`, `cdk`, `sam`, `aws_completer`, browser openers) with a shell script — scripts don't run on Windows. Use `writeFakeTool`/`installFakeTool` (`test/integration/faketool_test.go`), which copy a compiled Go stand-in (`test-samples/faketool`) onto PATH configured via a JSON sidecar (echo lines with `{argN}`/`{args}`/`{env:NAME}` placeholders, arg-prefix cases like `--version`, sleep, exit codes, record-to-file).
diff --git a/go.mod b/go.mod
index 24a92fc0..7ab23795 100644
--- a/go.mod
+++ b/go.mod
@@ -35,6 +35,7 @@ require (
 	go.uber.org/mock v0.6.0
 	golang.org/x/sys v0.47.0
 	golang.org/x/term v0.45.0
+	golang.org/x/tools v0.47.0
 	gopkg.in/ini.v1 v1.67.3
 	gotest.tools/v3 v3.5.2
 )
@@ -97,7 +98,6 @@ require (
 	golang.org/x/net v0.57.0 // indirect
 	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/text v0.40.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
 	google.golang.org/grpc v1.83.0 // indirect
diff --git a/internal/output/__snapshots__/TestPlainSink_EmitsErrorEvent_1.snap b/internal/output/__snapshots__/TestPlainSink_EmitsErrorEvent_1.snap
deleted file mode 100644
index 6ba95312..00000000
--- a/internal/output/__snapshots__/TestPlainSink_EmitsErrorEvent_1.snap
+++ /dev/null
@@ -1,3 +0,0 @@
-Error: Connection failed
-  Cannot connect to Docker
-  ==> Start Docker: open -a Docker
diff --git a/internal/output/__snapshots__/TestPlainSink_EmitsInstanceInfoEvent_full_1.snap b/internal/output/__snapshots__/TestPlainSink_EmitsInstanceInfoEvent_full_1.snap
deleted file mode 100644
index 99846d9f..00000000
--- a/internal/output/__snapshots__/TestPlainSink_EmitsInstanceInfoEvent_full_1.snap
+++ /dev/null
@@ -1,6 +0,0 @@
-✔︎ LocalStack AWS Emulator is running
-• Endpoint: localhost.localstack.cloud:4566
-• Persistence: Enabled
-• Container: localstack-aws
-• Version: <version>
-• Uptime: <time>
diff --git a/internal/output/__snapshots__/TestPlainSink_EmitsInstanceInfoEvent_minimal_1.snap b/internal/output/__snapshots__/TestPlainSink_EmitsInstanceInfoEvent_minimal_1.snap
deleted file mode 100644
index 41de29b5..00000000
--- a/internal/output/__snapshots__/TestPlainSink_EmitsInstanceInfoEvent_minimal_1.snap
+++ /dev/null
@@ -1,2 +0,0 @@
-✔︎ LocalStack AWS Emulator is running
-• Endpoint: 127.0.0.1:4566
diff --git a/internal/output/__snapshots__/TestEnvelopeSink_UpdateCheckedEnvelopeJSON_1.snap b/internal/output/__snapshots__/envelope_sink_test.snap
similarity index 52%
rename from internal/output/__snapshots__/TestEnvelopeSink_UpdateCheckedEnvelopeJSON_1.snap
rename to internal/output/__snapshots__/envelope_sink_test.snap
index 18cb6cb4..b9ca3e2a 100644
--- a/internal/output/__snapshots__/TestEnvelopeSink_UpdateCheckedEnvelopeJSON_1.snap
+++ b/internal/output/__snapshots__/envelope_sink_test.snap
@@ -1,3 +1,7 @@
+Snapshots created by internal/snap. Values are compared with the trailing
+newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+
+-- TestEnvelopeSink_UpdateCheckedEnvelopeJSON_1 --
 {
   "command": "update",
   "data": {
diff --git a/internal/output/__snapshots__/plain_sink_test.snap b/internal/output/__snapshots__/plain_sink_test.snap
new file mode 100644
index 00000000..0412be43
--- /dev/null
+++ b/internal/output/__snapshots__/plain_sink_test.snap
@@ -0,0 +1,17 @@
+Snapshots created by internal/snap. Values are compared with the trailing
+newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+
+-- TestPlainSink_EmitsErrorEvent_1 --
+Error: Connection failed
+  Cannot connect to Docker
+  ==> Start Docker: open -a Docker
+-- TestPlainSink_EmitsInstanceInfoEvent_full_1 --
+✔︎ LocalStack AWS Emulator is running
+• Endpoint: localhost.localstack.cloud:4566
+• Persistence: Enabled
+• Container: localstack-aws
+• Version: <version>
+• Uptime: <time>
+-- TestPlainSink_EmitsInstanceInfoEvent_minimal_1 --
+✔︎ LocalStack AWS Emulator is running
+• Endpoint: 127.0.0.1:4566
diff --git a/internal/snap/snap.go b/internal/snap/snap.go
index 91771114..b1a62abb 100644
--- a/internal/snap/snap.go
+++ b/internal/snap/snap.go
@@ -8,9 +8,12 @@
 // UPDATE_SNAPS=true go test ./... rewrites snapshots and lets Clean delete
 // obsolete ones.
 //
-// One file per snapshot (TestName_N.snap, N = call number within the test),
-// so there is no snapshot-file format to parse and cleanup is a directory
-// listing.
+// Storage is one txtar archive per test file (__snapshots__/<test_file>.snap)
+// with one section per Match call, named TestName_N (N = call number within
+// the test). txtar has no escaping, so a snapshot value containing a line
+// that looks like a txtar section separator ("-- name --") cannot be stored;
+// write guards against that with a parse round-trip and fails with guidance
+// to sanitize the value instead.
 package snap
 
 import (
@@ -23,20 +26,26 @@ import (
 	"path/filepath"
 	"regexp"
 	"runtime"
+	"sort"
 	"strconv"
 	"strings"
 	"sync"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"golang.org/x/tools/txtar"
 )
 
+// header is the comment section of every archive, kept canonical on rewrite.
+const header = "Snapshots created by internal/snap. Values are compared with the trailing\nnewline stripped. UPDATE_SNAPS=true go test rewrites this file.\n\n"
+
 // Test-only helper state: the visited registry must span all tests in the
-// package so Clean can tell live snapshots from obsolete ones.
+// package so Clean can tell live snapshots from obsolete ones. The mutex also
+// serializes read-modify-write cycles on archives shared by parallel tests.
 var (
 	mu      sync.Mutex
-	visited = map[string]map[string]bool{} // snapshot dir -> filename -> seen
-	calls   = map[string]int{}             // dir + test name -> Match call count
+	visited = map[string]map[string]bool{} // archive path -> entry name -> seen
+	calls   = map[string]int{}             // archive path + test name -> Match call count
 )
 
 var unsafeChars = regexp.MustCompile(`[^A-Za-z0-9._-]+`)
@@ -46,7 +55,7 @@ var unsafeChars = regexp.MustCompile(`[^A-Za-z0-9._-]+`)
 // UPDATE_SNAPS=true.
 func Match(t testing.TB, got string) {
 	t.Helper()
-	match(t, got, callerSnapshotDir(t))
+	match(t, got, callerArchive(t))
 }
 
 // MatchJSON snapshots got (a JSON document) in canonical pretty-printed form
@@ -82,7 +91,7 @@ func MatchJSON(t testing.TB, got []byte, maskPaths ...string) {
 	if err := enc.Encode(v); err != nil {
 		t.Fatalf("snap: %v", err)
 	}
-	match(t, buf.String(), callerSnapshotDir(t))
+	match(t, buf.String(), callerArchive(t))
 }
 
 // mask walks nested JSON objects along path segments and replaces the final
@@ -102,67 +111,130 @@ func mask(v any, segs []string) bool {
 	return mask(m[segs[0]], segs[1:])
 }
 
-// callerSnapshotDir resolves the __snapshots__ directory next to the test
-// file that called the exported Match/MatchJSON function (two frames up).
-func callerSnapshotDir(t testing.TB) string {
+// callerArchive resolves the txtar archive for the test file that called the
+// exported Match/MatchJSON function (two frames up):
+// <dir>/__snapshots__/<test_file_without_.go>.snap.
+func callerArchive(t testing.TB) string {
 	t.Helper()
 	_, file, _, ok := runtime.Caller(2)
 	if !ok {
 		t.Fatal("snap: cannot resolve calling test file")
 	}
-	return filepath.Join(filepath.Dir(file), "__snapshots__")
+	base := strings.TrimSuffix(filepath.Base(file), ".go")
+	return filepath.Join(filepath.Dir(file), "__snapshots__", base+".snap")
+}
+
+// readArchive parses the archive at path. A missing file is an empty archive.
+func readArchive(path string) (*txtar.Archive, error) {
+	data, err := os.ReadFile(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return &txtar.Archive{}, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return txtar.Parse(data), nil
 }
 
-func match(t testing.TB, got, dir string) {
+// entryData returns the entry's value (trailing newline stripped) and whether
+// it exists.
+func entryData(a *txtar.Archive, name string) (string, bool) {
+	for _, f := range a.Files {
+		if f.Name == name {
+			return strings.TrimSuffix(string(f.Data), "\n"), true
+		}
+	}
+	return "", false
+}
+
+func match(t testing.TB, got, archive string) {
 	t.Helper()
 	if n := flagValue("test.count"); n != "" && n != "1" {
 		t.Fatalf("snap: -count > 1 is not supported (snapshot call numbering would repeat)")
 	}
+	// Values are compared with the trailing newline stripped: the stored form
+	// always ends with exactly one newline (txtar sections are line-based), so
+	// a snapshot cannot distinguish output ending with a newline from output
+	// that doesn't.
+	got = strings.TrimSuffix(got, "\n")
 
 	mu.Lock()
-	key := dir + "|" + t.Name()
+	defer mu.Unlock()
+
+	key := archive + "|" + t.Name()
 	calls[key]++
-	name := unsafeChars.ReplaceAllString(t.Name(), "_") + "_" + strconv.Itoa(calls[key]) + ".snap"
-	if visited[dir] == nil {
-		visited[dir] = map[string]bool{}
-	}
-	visited[dir][name] = true
-	mu.Unlock()
-
-	path := filepath.Join(dir, name)
-	raw, err := os.ReadFile(path)
-	// Snapshot files always end with exactly one newline (see write) so text
-	// tooling (git diffs, cat, EOF-fixing hooks) treats them as regular text
-	// files. Both sides are compared with that trailing newline stripped; the
-	// cost is that a snapshot cannot distinguish output ending with a newline
-	// from output that doesn't.
-	want := strings.TrimSuffix(string(raw), "\n")
-	got = strings.TrimSuffix(got, "\n")
+	entry := unsafeChars.ReplaceAllString(t.Name(), "_") + "_" + strconv.Itoa(calls[key])
+	if visited[archive] == nil {
+		visited[archive] = map[string]bool{}
+	}
+	visited[archive][entry] = true
+
+	a, err := readArchive(archive)
+	if err != nil {
+		t.Fatalf("snap: reading %s: %v", archive, err)
+		return
+	}
+	want, exists := entryData(a, entry)
 	update := os.Getenv("UPDATE_SNAPS") == "true"
 	switch {
-	case errors.Is(err, os.ErrNotExist):
+	case !exists:
 		if isCI() && !update {
-			t.Fatalf("snap: missing snapshot %s (snapshots are never created in CI; run the test locally and commit the file)", path)
+			t.Fatalf("snap: missing snapshot %q in %s (snapshots are never created in CI; run the test locally and commit the file)", entry, archive)
 			return
 		}
-		write(t, path, got)
-		t.Logf("snap: created %s", path)
-	case err != nil:
-		t.Fatalf("snap: reading %s: %v", path, err)
+		writeEntry(t, archive, a, entry, got)
+		t.Logf("snap: created %q in %s", entry, archive)
 	case want != got:
 		if update {
-			write(t, path, got)
-			t.Logf("snap: updated %s", path)
+			writeEntry(t, archive, a, entry, got)
+			t.Logf("snap: updated %q in %s", entry, archive)
 			return
 		}
-		t.Errorf("snapshot mismatch (-want +got):\n%s\nrun UPDATE_SNAPS=true go test to update %s", cmp.Diff(string(want), got), path)
+		t.Errorf("snapshot mismatch (-want +got):\n%s\nrun UPDATE_SNAPS=true go test to update %s", cmp.Diff(want, got), archive)
 	}
 }
 
-// Clean runs the package's tests and then handles obsolete snapshots: files
-// in visited __snapshots__ directories that no Match call used. They are
-// deleted when UPDATE_SNAPS=true, otherwise reported as an error (non-zero
-// exit) so stale snapshots can't linger unnoticed. Wire it in TestMain:
+// writeEntry upserts entry=value into the archive and saves it with a
+// canonical header and name-sorted sections. A parse round-trip guards
+// against values txtar cannot represent (a line matching the "-- name --"
+// section separator); such values must be sanitized by the caller instead.
+// Callers hold mu.
+func writeEntry(t testing.TB, path string, a *txtar.Archive, entry, value string) {
+	t.Helper()
+	data := []byte(value + "\n")
+	replaced := false
+	for i := range a.Files {
+		if a.Files[i].Name == entry {
+			a.Files[i].Data = data
+			replaced = true
+			break
+		}
+	}
+	if !replaced {
+		a.Files = append(a.Files, txtar.File{Name: entry, Data: data})
+	}
+	sort.Slice(a.Files, func(i, j int) bool { return a.Files[i].Name < a.Files[j].Name })
+	a.Comment = []byte(header)
+
+	out := txtar.Format(a)
+	back := txtar.Parse(out)
+	if got, ok := entryData(back, entry); !ok || got != value {
+		t.Fatalf("snap: value for %q does not survive the txtar round-trip (it likely contains a line matching the \"-- name --\" section separator); sanitize the value before snapshotting", entry)
+		return
+	}
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatalf("snap: %v", err)
+	}
+	if err := os.WriteFile(path, out, 0o644); err != nil {
+		t.Fatalf("snap: %v", err)
+	}
+}
+
+// Clean runs the package's tests and then handles obsolete snapshots: archive
+// entries no Match call used, and whole .snap archives in visited snapshot
+// directories that no test touched. They are deleted when UPDATE_SNAPS=true,
+// otherwise reported as an error (non-zero exit) so stale snapshots can't
+// linger unnoticed. Wire it in TestMain:
 //
 //	func TestMain(m *testing.M) { os.Exit(snap.Clean(m)) }
 //
@@ -176,62 +248,97 @@ func Clean(m *testing.M) int {
 	update := os.Getenv("UPDATE_SNAPS") == "true"
 	mu.Lock()
 	defer mu.Unlock()
-	for dir, seen := range visited {
-		if n, err := reportObsolete(dir, seen, update); err != nil {
-			fmt.Fprintf(os.Stderr, "snap: cleaning %s: %v\n", dir, err)
+
+	for archive, seen := range visited {
+		n, err := cleanEntries(archive, seen, update)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "snap: cleaning %s: %v\n", archive, err)
 			code = 1
 		} else if n > 0 && !update {
 			code = 1
 		}
 	}
+	if n, err := cleanOrphanArchives(update); err != nil {
+		fmt.Fprintf(os.Stderr, "snap: cleaning orphan archives: %v\n", err)
+		code = 1
+	} else if n > 0 && !update {
+		code = 1
+	}
 	return code
 }
 
-// reportObsolete deletes (update mode) or reports unvisited .snap files in
-// dir, returning how many it found.
-//
-// ponytail: only directories where at least one Match ran this process are
-// examined — deleting a whole test file orphans its snapshots until some
-// other test in the same directory runs Match. Acceptable: any later full
-// package run flags them.
-func reportObsolete(dir string, seen map[string]bool, update bool) (int, error) {
-	entries, err := os.ReadDir(dir)
-	if errors.Is(err, os.ErrNotExist) {
-		return 0, nil
-	}
+// cleanEntries deletes (update mode) or reports entries of archive that no
+// Match call visited, returning how many it found. An archive left with no
+// entries is removed entirely.
+func cleanEntries(archive string, seen map[string]bool, update bool) (int, error) {
+	a, err := readArchive(archive)
 	if err != nil {
 		return 0, err
 	}
+	var live []txtar.File
 	obsolete := 0
-	for _, e := range entries {
-		if e.IsDir() || !strings.HasSuffix(e.Name(), ".snap") || seen[e.Name()] {
+	for _, f := range a.Files {
+		if seen[f.Name] {
+			live = append(live, f)
 			continue
 		}
 		obsolete++
-		path := filepath.Join(dir, e.Name())
 		if update {
-			if err := os.Remove(path); err != nil {
-				return obsolete, err
-			}
-			fmt.Fprintf(os.Stderr, "snap: removed obsolete snapshot %s\n", path)
+			fmt.Fprintf(os.Stderr, "snap: removed obsolete snapshot %q from %s\n", f.Name, archive)
 		} else {
-			fmt.Fprintf(os.Stderr, "snap: obsolete snapshot %s (UPDATE_SNAPS=true go test to remove)\n", path)
+			fmt.Fprintf(os.Stderr, "snap: obsolete snapshot %q in %s (UPDATE_SNAPS=true go test to remove)\n", f.Name, archive)
 		}
 	}
-	return obsolete, nil
+	if obsolete == 0 || !update {
+		return obsolete, nil
+	}
+	if len(live) == 0 {
+		return obsolete, os.Remove(archive)
+	}
+	a.Files = live
+	a.Comment = []byte(header)
+	return obsolete, os.WriteFile(archive, txtar.Format(a), 0o644)
 }
 
-// write stores content with exactly one trailing newline, the invariant
-// match relies on when it strips it back off before comparing.
-func write(t testing.TB, path, content string) {
-	t.Helper()
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-		t.Fatalf("snap: %v", err)
+// cleanOrphanArchives deletes (update mode) or reports .snap files in visited
+// snapshot directories that no test visited — typically archives of deleted
+// or renamed test files.
+//
+// ponytail: only directories where at least one Match ran this process are
+// examined — deleting a whole test file orphans its archive until some other
+// test in the same directory runs Match. Acceptable: any later full package
+// run flags it.
+func cleanOrphanArchives(update bool) (int, error) {
+	dirs := map[string]bool{}
+	for archive := range visited {
+		dirs[filepath.Dir(archive)] = true
 	}
-	content = strings.TrimSuffix(content, "\n") + "\n"
-	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
-		t.Fatalf("snap: %v", err)
+	orphans := 0
+	for dir := range dirs {
+		entries, err := os.ReadDir(dir)
+		if errors.Is(err, os.ErrNotExist) {
+			continue
+		}
+		if err != nil {
+			return orphans, err
+		}
+		for _, e := range entries {
+			path := filepath.Join(dir, e.Name())
+			if e.IsDir() || !strings.HasSuffix(e.Name(), ".snap") || visited[path] != nil {
+				continue
+			}
+			orphans++
+			if update {
+				if err := os.Remove(path); err != nil {
+					return orphans, err
+				}
+				fmt.Fprintf(os.Stderr, "snap: removed orphan snapshot archive %s\n", path)
+			} else {
+				fmt.Fprintf(os.Stderr, "snap: orphan snapshot archive %s (UPDATE_SNAPS=true go test to remove)\n", path)
+			}
+		}
 	}
+	return orphans, nil
 }
 
 func isCI() bool {
diff --git a/internal/snap/snap_test.go b/internal/snap/snap_test.go
index 9de1bca7..7b3cfff1 100644
--- a/internal/snap/snap_test.go
+++ b/internal/snap/snap_test.go
@@ -5,6 +5,8 @@ import (
 	"path/filepath"
 	"strings"
 	"testing"
+
+	"golang.org/x/tools/txtar"
 )
 
 // fakeT records failures instead of failing the real test. Only the methods
@@ -37,57 +39,70 @@ func (f *fakeT) Logf(format string, args ...any) {
 	f.logs = append(f.logs, format)
 }
 
-// snapPath returns where Match will store snapshot n for the given fake test
-// name, and registers cleanup of the file and the registry entries so tests
-// stay independent.
-func snapPath(t *testing.T, fakeName string, n string) string {
+// testArchive returns the archive Match uses when called from this file
+// (snap_test.go) and registers cleanup of the file and the helper registry so
+// tests stay independent. These tests are sequential (t.Setenv forbids
+// t.Parallel), so resetting the whole registry is safe.
+func testArchive(t *testing.T) string {
 	t.Helper()
-	dir := filepath.Join(filepath.Dir(callerFile(t)), "__snapshots__")
-	path := filepath.Join(dir, fakeName+"_"+n+".snap")
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(wd, "__snapshots__", "snap_test.snap")
 	t.Cleanup(func() {
 		_ = os.Remove(path)
 		mu.Lock()
 		defer mu.Unlock()
-		delete(calls, dir+"|"+fakeName)
-		if visited[dir] != nil {
-			delete(visited[dir], filepath.Base(path))
-		}
+		visited = map[string]map[string]bool{}
+		calls = map[string]int{}
 	})
 	return path
 }
 
-func callerFile(t *testing.T) string {
+// entry reads the named entry from the archive, reporting whether it exists.
+func entry(t *testing.T, archive, name string) (string, bool) {
 	t.Helper()
-	// Match resolves the caller's file; in these tests that is snap_test.go,
-	// so snapshots land in this package's __snapshots__ directory.
-	wd, err := os.Getwd()
+	a, err := readArchive(archive)
 	if err != nil {
 		t.Fatal(err)
 	}
-	return filepath.Join(wd, "snap_test.go")
+	return entryData(a, name)
+}
+
+// seed writes the given entries into the archive directly.
+func seed(t *testing.T, archive string, entries map[string]string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(archive), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	a := &txtar.Archive{Comment: []byte(header)}
+	for name, value := range entries {
+		a.Files = append(a.Files, txtar.File{Name: name, Data: []byte(value + "\n")})
+	}
+	if err := os.WriteFile(archive, txtar.Format(a), 0o644); err != nil {
+		t.Fatal(err)
+	}
 }
 
 func TestMatchCreatesThenMatches(t *testing.T) {
 	t.Setenv("CI", "")
 	t.Setenv("UPDATE_SNAPS", "")
-	path := snapPath(t, "TestFakeCreate", "1")
+	archive := testArchive(t)
 
 	ft := &fakeT{name: "TestFakeCreate"}
 	Match(ft, "hello\nworld\n")
 	if ft.failed {
 		t.Fatalf("first Match should create, not fail: %q", ft.msg)
 	}
-	content, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatalf("snapshot not written: %v", err)
-	}
-	if string(content) != "hello\nworld\n" {
-		t.Fatalf("snapshot content %q", content)
+	got, ok := entry(t, archive, "TestFakeCreate_1")
+	if !ok || got != "hello\nworld" {
+		t.Fatalf("stored entry: %q ok=%v", got, ok)
 	}
 
 	// Same test name matches again on a fresh run (reset the call counter).
 	mu.Lock()
-	delete(calls, filepath.Dir(path)+"|TestFakeCreate")
+	delete(calls, archive+"|TestFakeCreate")
 	mu.Unlock()
 	ft = &fakeT{name: "TestFakeCreate"}
 	Match(ft, "hello\nworld\n")
@@ -99,13 +114,8 @@ func TestMatchCreatesThenMatches(t *testing.T) {
 func TestMatchFailsOnMismatch(t *testing.T) {
 	t.Setenv("CI", "")
 	t.Setenv("UPDATE_SNAPS", "")
-	path := snapPath(t, "TestFakeMismatch", "1")
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(path, []byte("old"), 0o644); err != nil {
-		t.Fatal(err)
-	}
+	archive := testArchive(t)
+	seed(t, archive, map[string]string{"TestFakeMismatch_1": "old"})
 
 	ft := &fakeT{name: "TestFakeMismatch"}
 	Match(ft, "new")
@@ -120,36 +130,36 @@ func TestMatchFailsOnMismatch(t *testing.T) {
 func TestMatchUpdatesOnEnv(t *testing.T) {
 	t.Setenv("CI", "")
 	t.Setenv("UPDATE_SNAPS", "true")
-	path := snapPath(t, "TestFakeUpdate", "1")
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(path, []byte("old"), 0o644); err != nil {
-		t.Fatal(err)
-	}
+	archive := testArchive(t)
+	seed(t, archive, map[string]string{
+		"TestFakeUpdate_1": "old",
+		"TestOther_1":      "untouched",
+	})
 
 	ft := &fakeT{name: "TestFakeUpdate"}
 	Match(ft, "new")
 	if ft.failed {
 		t.Fatalf("update mode should rewrite, not fail: %q", ft.msg)
 	}
-	content, _ := os.ReadFile(path)
-	if string(content) != "new\n" {
-		t.Fatalf("snapshot not updated: %q", content)
+	if got, ok := entry(t, archive, "TestFakeUpdate_1"); !ok || got != "new" {
+		t.Fatalf("entry not updated: %q ok=%v", got, ok)
+	}
+	if got, ok := entry(t, archive, "TestOther_1"); !ok || got != "untouched" {
+		t.Fatalf("sibling entry must survive an update: %q ok=%v", got, ok)
 	}
 }
 
 func TestMatchMissingSnapshotFailsInCI(t *testing.T) {
 	t.Setenv("CI", "true")
 	t.Setenv("UPDATE_SNAPS", "")
-	path := snapPath(t, "TestFakeCI", "1")
+	archive := testArchive(t)
 
 	ft := &fakeT{name: "TestFakeCI"}
 	Match(ft, "content")
 	if !ft.fatal {
 		t.Fatal("missing snapshot in CI must be fatal")
 	}
-	if _, err := os.Stat(path); err == nil {
+	if _, ok := entry(t, archive, "TestFakeCI_1"); ok {
 		t.Fatal("snapshot must not be created in CI")
 	}
 }
@@ -157,8 +167,7 @@ func TestMatchMissingSnapshotFailsInCI(t *testing.T) {
 func TestMatchCountsCallsWithinOneTest(t *testing.T) {
 	t.Setenv("CI", "")
 	t.Setenv("UPDATE_SNAPS", "")
-	path1 := snapPath(t, "TestFakeMulti", "1")
-	path2 := snapPath(t, "TestFakeMulti", "2")
+	archive := testArchive(t)
 
 	ft := &fakeT{name: "TestFakeMulti"}
 	Match(ft, "first")
@@ -166,10 +175,9 @@ func TestMatchCountsCallsWithinOneTest(t *testing.T) {
 	if ft.failed {
 		t.Fatalf("unexpected failure: %q", ft.msg)
 	}
-	for path, want := range map[string]string{path1: "first\n", path2: "second\n"} {
-		content, err := os.ReadFile(path)
-		if err != nil || string(content) != want {
-			t.Fatalf("%s: content=%q err=%v", path, content, err)
+	for name, want := range map[string]string{"TestFakeMulti_1": "first", "TestFakeMulti_2": "second"} {
+		if got, ok := entry(t, archive, name); !ok || got != want {
+			t.Fatalf("%s: got=%q ok=%v", name, got, ok)
 		}
 	}
 }
@@ -177,18 +185,17 @@ func TestMatchCountsCallsWithinOneTest(t *testing.T) {
 func TestMatchJSONMasksAndCanonicalizes(t *testing.T) {
 	t.Setenv("CI", "")
 	t.Setenv("UPDATE_SNAPS", "")
-	path := snapPath(t, "TestFakeJSON", "1")
+	archive := testArchive(t)
 
 	ft := &fakeT{name: "TestFakeJSON"}
 	MatchJSON(ft, []byte(`{"zebra":1,"data":{"version":"4.14.1","name":"aws"}}`), "data.version")
 	if ft.failed {
 		t.Fatalf("unexpected failure: %q", ft.msg)
 	}
-	content, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
+	got, ok := entry(t, archive, "TestFakeJSON_1")
+	if !ok {
+		t.Fatal("entry missing")
 	}
-	got := string(content)
 	if !strings.Contains(got, `"version": "<any>"`) {
 		t.Fatalf("masked value missing: %s", got)
 	}
@@ -218,74 +225,59 @@ func TestMatchJSONFailsOnInvalidJSON(t *testing.T) {
 	}
 }
 
-func TestReportObsolete(t *testing.T) {
-	dir := t.TempDir()
-	live := filepath.Join(dir, "TestLive_1.snap")
-	stale := filepath.Join(dir, "TestGone_1.snap")
-	other := filepath.Join(dir, "notes.txt")
-	for _, p := range []string{live, stale, other} {
-		if err := os.WriteFile(p, []byte("x"), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	seen := map[string]bool{"TestLive_1.snap": true}
-
-	// Report mode: counts but keeps files.
-	n, err := reportObsolete(dir, seen, false)
-	if err != nil || n != 1 {
-		t.Fatalf("report mode: n=%d err=%v", n, err)
-	}
-	if _, err := os.Stat(stale); err != nil {
-		t.Fatal("report mode must not delete")
-	}
-
-	// Update mode: deletes the stale snapshot only.
-	n, err = reportObsolete(dir, seen, true)
-	if err != nil || n != 1 {
-		t.Fatalf("update mode: n=%d err=%v", n, err)
-	}
-	if _, err := os.Stat(stale); !os.IsNotExist(err) {
-		t.Fatal("stale snapshot should be deleted")
-	}
-	for _, p := range []string{live, other} {
-		if _, err := os.Stat(p); err != nil {
-			t.Fatalf("%s should survive cleanup: %v", p, err)
-		}
-	}
-}
-
 func TestMatchJSONFatalPathsWriteNoSnapshot(t *testing.T) {
 	t.Setenv("CI", "")
-	dir := filepath.Join(filepath.Dir(callerFile(t)), "__snapshots__")
+	archive := testArchive(t)
 
 	MatchJSON(&fakeT{name: "TestFakeJSONInvalid"}, []byte(`not json`))
 	MatchJSON(&fakeT{name: "TestFakeJSONBadPath"}, []byte(`{"data":{}}`), "data.version")
 
-	for _, name := range []string{"TestFakeJSONInvalid_1.snap", "TestFakeJSONBadPath_1.snap"} {
-		if _, err := os.Stat(filepath.Join(dir, name)); !os.IsNotExist(err) {
+	for _, name := range []string{"TestFakeJSONInvalid_1", "TestFakeJSONBadPath_1"} {
+		if _, ok := entry(t, archive, name); ok {
 			t.Fatalf("fatal MatchJSON call must not write %s", name)
 		}
 	}
 }
 
-// TestMatchTrailingNewlineInvariant pins the EOF contract: stored files end
+// TestMatchRejectsSeparatorCollision pins the txtar limitation: a value
+// containing a line that parses as a section separator cannot be stored and
+// must fail loudly instead of corrupting the archive.
+func TestMatchRejectsSeparatorCollision(t *testing.T) {
+	t.Setenv("CI", "")
+	t.Setenv("UPDATE_SNAPS", "")
+	archive := testArchive(t)
+
+	ft := &fakeT{name: "TestFakeCollision"}
+	Match(ft, "before\n-- sneaky --\nafter")
+	if !ft.fatal {
+		t.Fatal("separator collision must be fatal")
+	}
+	if !strings.Contains(ft.msg, "round-trip") {
+		t.Fatalf("collision message should explain the round-trip guard, got %q", ft.msg)
+	}
+	if _, err := os.Stat(archive); !os.IsNotExist(err) {
+		t.Fatal("colliding value must not be written")
+	}
+}
+
+// TestMatchTrailingNewlineInvariant pins the EOF contract: stored entries end
 // with exactly one newline regardless of whether the value had one, and a
 // value matches its stored snapshot with or without a trailing newline.
 func TestMatchTrailingNewlineInvariant(t *testing.T) {
 	t.Setenv("CI", "")
 	t.Setenv("UPDATE_SNAPS", "")
-	path := snapPath(t, "TestFakeEOF", "1")
+	archive := testArchive(t)
 
 	ft := &fakeT{name: "TestFakeEOF"}
 	Match(ft, "line\n")
-	content, err := os.ReadFile(path)
-	if err != nil || string(content) != "line\n" {
-		t.Fatalf("stored snapshot should end with exactly one newline: %q err=%v", content, err)
+	raw, err := os.ReadFile(archive)
+	if err != nil || !strings.HasSuffix(string(raw), "line\n") || strings.HasSuffix(string(raw), "line\n\n") {
+		t.Fatalf("stored entry should end with exactly one newline: %q err=%v", raw, err)
 	}
 
 	for _, got := range []string{"line", "line\n"} {
 		mu.Lock()
-		delete(calls, filepath.Dir(path)+"|TestFakeEOF")
+		delete(calls, archive+"|TestFakeEOF")
 		mu.Unlock()
 		ft := &fakeT{name: "TestFakeEOF"}
 		Match(ft, got)
@@ -294,3 +286,88 @@ func TestMatchTrailingNewlineInvariant(t *testing.T) {
 		}
 	}
 }
+
+func TestCleanEntries(t *testing.T) {
+	dir := t.TempDir()
+	archive := filepath.Join(dir, "some_test.snap")
+	seed(t, archive, map[string]string{
+		"TestLive_1": "keep",
+		"TestGone_1": "stale",
+	})
+	seen := map[string]bool{"TestLive_1": true}
+
+	// Report mode: counts but keeps entries.
+	n, err := cleanEntries(archive, seen, false)
+	if err != nil || n != 1 {
+		t.Fatalf("report mode: n=%d err=%v", n, err)
+	}
+	if _, ok := entry(t, archive, "TestGone_1"); !ok {
+		t.Fatal("report mode must not delete entries")
+	}
+
+	// Update mode: drops the stale entry, keeps the live one.
+	n, err = cleanEntries(archive, seen, true)
+	if err != nil || n != 1 {
+		t.Fatalf("update mode: n=%d err=%v", n, err)
+	}
+	if _, ok := entry(t, archive, "TestGone_1"); ok {
+		t.Fatal("stale entry should be deleted")
+	}
+	if got, ok := entry(t, archive, "TestLive_1"); !ok || got != "keep" {
+		t.Fatalf("live entry should survive: %q ok=%v", got, ok)
+	}
+
+	// Dropping the last live entry removes the archive entirely.
+	n, err = cleanEntries(archive, map[string]bool{}, true)
+	if err != nil || n != 1 {
+		t.Fatalf("final update: n=%d err=%v", n, err)
+	}
+	if _, err := os.Stat(archive); !os.IsNotExist(err) {
+		t.Fatal("empty archive should be removed")
+	}
+}
+
+func TestCleanOrphanArchives(t *testing.T) {
+	dir := t.TempDir()
+	live := filepath.Join(dir, "live_test.snap")
+	orphan := filepath.Join(dir, "gone_test.snap")
+	other := filepath.Join(dir, "notes.txt")
+	for _, p := range []string{live, orphan, other} {
+		if err := os.WriteFile(p, []byte("x"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	mu.Lock()
+	visited = map[string]map[string]bool{live: {"TestX_1": true}}
+	mu.Unlock()
+	t.Cleanup(func() {
+		mu.Lock()
+		defer mu.Unlock()
+		visited = map[string]map[string]bool{}
+	})
+
+	mu.Lock()
+	n, err := cleanOrphanArchives(false)
+	mu.Unlock()
+	if err != nil || n != 1 {
+		t.Fatalf("report mode: n=%d err=%v", n, err)
+	}
+	if _, err := os.Stat(orphan); err != nil {
+		t.Fatal("report mode must not delete")
+	}
+
+	mu.Lock()
+	n, err = cleanOrphanArchives(true)
+	mu.Unlock()
+	if err != nil || n != 1 {
+		t.Fatalf("update mode: n=%d err=%v", n, err)
+	}
+	if _, err := os.Stat(orphan); !os.IsNotExist(err) {
+		t.Fatal("orphan archive should be deleted")
+	}
+	for _, p := range []string{live, other} {
+		if _, err := os.Stat(p); err != nil {
+			t.Fatalf("%s should survive cleanup: %v", p, err)
+		}
+	}
+}
diff --git a/test/integration/__snapshots__/TestConfigLoadFailureRendersJSONEnvelope_1.snap b/test/integration/__snapshots__/TestConfigLoadFailureRendersJSONEnvelope_1.snap
deleted file mode 100644
index e59c3cb6..00000000
--- a/test/integration/__snapshots__/TestConfigLoadFailureRendersJSONEnvelope_1.snap
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "command": "stop",
-  "data": null,
-  "error": {
-    "category": "CONFIG",
-    "code": "CONFIG_INVALID",
-    "message": "<any>",
-    "retryable": false
-  },
-  "schemaVersion": 1,
-  "status": "error",
-  "warnings": []
-}
diff --git a/test/integration/__snapshots__/TestExtensionEndpointOmittedWhenNoRuntime_1.snap b/test/integration/__snapshots__/TestExtensionEndpointOmittedWhenNoRuntime_1.snap
deleted file mode 100644
index 0d3e2957..00000000
--- a/test/integration/__snapshots__/TestExtensionEndpointOmittedWhenNoRuntime_1.snap
+++ /dev/null
@@ -1,8 +0,0 @@
-ARGS=[]
-SELF=<path>
-API_VERSION=1
-CONFIG_DIR=<path>
-NON_INTERACTIVE=true
-JSON=false
-SESSION_ID=<id>
-EMULATOR_COUNT=0
diff --git a/test/integration/__snapshots__/TestExtensionReceivesJSONFlagInContext_1.snap b/test/integration/__snapshots__/TestExtensionReceivesJSONFlagInContext_1.snap
deleted file mode 100644
index 02ba42a1..00000000
--- a/test/integration/__snapshots__/TestExtensionReceivesJSONFlagInContext_1.snap
+++ /dev/null
@@ -1,8 +0,0 @@
-ARGS=[--foo]
-SELF=<path>
-API_VERSION=1
-CONFIG_DIR=<path>
-NON_INTERACTIVE=true
-JSON=true
-SESSION_ID=<id>
-EMULATOR_COUNT=0
diff --git a/test/integration/__snapshots__/TestExtensionSessionIDOmittedWhenTelemetryDisabled_1.snap b/test/integration/__snapshots__/TestExtensionSessionIDOmittedWhenTelemetryDisabled_1.snap
deleted file mode 100644
index 5f1207f1..00000000
--- a/test/integration/__snapshots__/TestExtensionSessionIDOmittedWhenTelemetryDisabled_1.snap
+++ /dev/null
@@ -1,7 +0,0 @@
-ARGS=[exit 7]
-SELF=<path>
-API_VERSION=1
-CONFIG_DIR=<path>
-NON_INTERACTIVE=true
-JSON=false
-EMULATOR_COUNT=0
diff --git a/test/integration/__snapshots__/TestExtensionUnknownCommandDispatches_1.snap b/test/integration/__snapshots__/TestExtensionUnknownCommandDispatches_1.snap
deleted file mode 100644
index f15ac550..00000000
--- a/test/integration/__snapshots__/TestExtensionUnknownCommandDispatches_1.snap
+++ /dev/null
@@ -1,8 +0,0 @@
-ARGS=[world]
-SELF=<path>
-API_VERSION=1
-CONFIG_DIR=<path>
-NON_INTERACTIVE=true
-JSON=false
-SESSION_ID=<id>
-EMULATOR_COUNT=0
diff --git a/test/integration/__snapshots__/TestJSONFlagBeforeCommandNameBooleanValues_--json_true_before_the_command_name_is_rejected_1.snap b/test/integration/__snapshots__/TestJSONFlagBeforeCommandNameBooleanValues_--json_true_before_the_command_name_is_rejected_1.snap
deleted file mode 100644
index 31aee90d..00000000
--- a/test/integration/__snapshots__/TestJSONFlagBeforeCommandNameBooleanValues_--json_true_before_the_command_name_is_rejected_1.snap
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "command": "aws",
-  "data": null,
-  "error": {
-    "category": "USAGE",
-    "code": "NOT_JSON_CAPABLE",
-    "message": "\"aws\" is not able to provide output in JSON format",
-    "retryable": false
-  },
-  "schemaVersion": 1,
-  "status": "error",
-  "warnings": []
-}
diff --git a/test/integration/__snapshots__/TestJSONFlagBeforeCommandNameBooleanValues_a_malformed_value_before_the_command_name_is_rejected_1.snap b/test/integration/__snapshots__/TestJSONFlagBeforeCommandNameBooleanValues_a_malformed_value_before_the_command_name_is_rejected_1.snap
deleted file mode 100644
index 31aee90d..00000000
--- a/test/integration/__snapshots__/TestJSONFlagBeforeCommandNameBooleanValues_a_malformed_value_before_the_command_name_is_rejected_1.snap
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "command": "aws",
-  "data": null,
-  "error": {
-    "category": "USAGE",
-    "code": "NOT_JSON_CAPABLE",
-    "message": "\"aws\" is not able to provide output in JSON format",
-    "retryable": false
-  },
-  "schemaVersion": 1,
-  "status": "error",
-  "warnings": []
-}
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_aws_json_after_the_wrapped_tool_s_own_action_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_aws_json_after_the_wrapped_tool_s_own_action_1.snap
deleted file mode 100644
index 07c27422..00000000
--- a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_aws_json_after_the_wrapped_tool_s_own_action_1.snap
+++ /dev/null
@@ -1,2 +0,0 @@
-Error: aws CLI not found in PATH
-  ==> Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_aws_json_immediately_after_command_name_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_aws_json_immediately_after_command_name_1.snap
deleted file mode 100644
index 07c27422..00000000
--- a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_aws_json_immediately_after_command_name_1.snap
+++ /dev/null
@@ -1,2 +0,0 @@
-Error: aws CLI not found in PATH
-  ==> Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_az_json_after_the_wrapped_tool_s_own_action_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_az_json_after_the_wrapped_tool_s_own_action_1.snap
deleted file mode 100644
index 65851aeb..00000000
--- a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_az_json_after_the_wrapped_tool_s_own_action_1.snap
+++ /dev/null
@@ -1,2 +0,0 @@
-Error: az CLI not found in PATH
-  ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_az_json_immediately_after_command_name_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_az_json_immediately_after_command_name_1.snap
deleted file mode 100644
index 65851aeb..00000000
--- a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_az_json_immediately_after_command_name_1.snap
+++ /dev/null
@@ -1,2 +0,0 @@
-Error: az CLI not found in PATH
-  ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_cdk_json_after_the_wrapped_tool_s_own_action_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_cdk_json_after_the_wrapped_tool_s_own_action_1.snap
deleted file mode 100644
index f809a508..00000000
--- a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_cdk_json_after_the_wrapped_tool_s_own_action_1.snap
+++ /dev/null
@@ -1,2 +0,0 @@
-Error: cdk not found in PATH
-  ==> Install CDK CLI: npm install -g aws-cdk
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_cdk_json_immediately_after_command_name_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_cdk_json_immediately_after_command_name_1.snap
deleted file mode 100644
index f809a508..00000000
--- a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_cdk_json_immediately_after_command_name_1.snap
+++ /dev/null
@@ -1,2 +0,0 @@
-Error: cdk not found in PATH
-  ==> Install CDK CLI: npm install -g aws-cdk
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_sam_json_after_the_wrapped_tool_s_own_action_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_sam_json_after_the_wrapped_tool_s_own_action_1.snap
deleted file mode 100644
index 0ae1a435..00000000
--- a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_sam_json_after_the_wrapped_tool_s_own_action_1.snap
+++ /dev/null
@@ -1,2 +0,0 @@
-Error: sam not found in PATH
-  ==> Install AWS SAM CLI: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_sam_json_immediately_after_command_name_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_sam_json_immediately_after_command_name_1.snap
deleted file mode 100644
index 0ae1a435..00000000
--- a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_sam_json_immediately_after_command_name_1.snap
+++ /dev/null
@@ -1,2 +0,0 @@
-Error: sam not found in PATH
-  ==> Install AWS SAM CLI: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_terraform_json_after_the_wrapped_tool_s_own_action_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_terraform_json_after_the_wrapped_tool_s_own_action_1.snap
deleted file mode 100644
index 6f8ddc16..00000000
--- a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_terraform_json_after_the_wrapped_tool_s_own_action_1.snap
+++ /dev/null
@@ -1,2 +0,0 @@
-Error: terraform not found in PATH
-  ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_terraform_json_immediately_after_command_name_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_terraform_json_immediately_after_command_name_1.snap
deleted file mode 100644
index 6f8ddc16..00000000
--- a/test/integration/__snapshots__/TestJSONFlagProxyCommandsForwardJSON_terraform_json_immediately_after_command_name_1.snap
+++ /dev/null
@@ -1,2 +0,0 @@
-Error: terraform not found in PATH
-  ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_aws_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_aws_1.snap
deleted file mode 100644
index 31aee90d..00000000
--- a/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_aws_1.snap
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "command": "aws",
-  "data": null,
-  "error": {
-    "category": "USAGE",
-    "code": "NOT_JSON_CAPABLE",
-    "message": "\"aws\" is not able to provide output in JSON format",
-    "retryable": false
-  },
-  "schemaVersion": 1,
-  "status": "error",
-  "warnings": []
-}
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_az_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_az_1.snap
deleted file mode 100644
index 919d6aba..00000000
--- a/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_az_1.snap
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "command": "az",
-  "data": null,
-  "error": {
-    "category": "USAGE",
-    "code": "NOT_JSON_CAPABLE",
-    "message": "\"az\" is not able to provide output in JSON format",
-    "retryable": false
-  },
-  "schemaVersion": 1,
-  "status": "error",
-  "warnings": []
-}
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_cdk_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_cdk_1.snap
deleted file mode 100644
index dcd98f24..00000000
--- a/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_cdk_1.snap
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "command": "cdk",
-  "data": null,
-  "error": {
-    "category": "USAGE",
-    "code": "NOT_JSON_CAPABLE",
-    "message": "\"cdk\" is not able to provide output in JSON format",
-    "retryable": false
-  },
-  "schemaVersion": 1,
-  "status": "error",
-  "warnings": []
-}
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_sam_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_sam_1.snap
deleted file mode 100644
index 9a89fa28..00000000
--- a/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_sam_1.snap
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "command": "sam",
-  "data": null,
-  "error": {
-    "category": "USAGE",
-    "code": "NOT_JSON_CAPABLE",
-    "message": "\"sam\" is not able to provide output in JSON format",
-    "retryable": false
-  },
-  "schemaVersion": 1,
-  "status": "error",
-  "warnings": []
-}
diff --git a/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_terraform_1.snap b/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_terraform_1.snap
deleted file mode 100644
index 980add94..00000000
--- a/test/integration/__snapshots__/TestJSONFlagProxyCommandsRejectBeforeCommandName_terraform_1.snap
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "command": "terraform",
-  "data": null,
-  "error": {
-    "category": "USAGE",
-    "code": "NOT_JSON_CAPABLE",
-    "message": "\"terraform\" is not able to provide output in JSON format",
-    "retryable": false
-  },
-  "schemaVersion": 1,
-  "status": "error",
-  "warnings": []
-}
diff --git a/test/integration/__snapshots__/TestNotJSONCapableCommandRendersEnvelope_1.snap b/test/integration/__snapshots__/TestNotJSONCapableCommandRendersEnvelope_1.snap
deleted file mode 100644
index bb5043dc..00000000
--- a/test/integration/__snapshots__/TestNotJSONCapableCommandRendersEnvelope_1.snap
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "command": "login",
-  "data": null,
-  "error": {
-    "category": "USAGE",
-    "code": "NOT_JSON_CAPABLE",
-    "message": "\"login\" is not able to provide output in JSON format",
-    "retryable": false
-  },
-  "schemaVersion": 1,
-  "status": "error",
-  "warnings": []
-}
diff --git a/test/integration/__snapshots__/TestSnapshotListSuccessWithoutDocker_1.snap b/test/integration/__snapshots__/TestSnapshotListSuccessWithoutDocker_1.snap
deleted file mode 100644
index 17d4389b..00000000
--- a/test/integration/__snapshots__/TestSnapshotListSuccessWithoutDocker_1.snap
+++ /dev/null
@@ -1,6 +0,0 @@
-Fetching snapshots...
-~ 2 snapshots
-
-  NAME           VERSION  LAST CHANGED
-  baseline-q2    3        <date>              
-  infra-2026-04  1        -
diff --git a/test/integration/__snapshots__/TestSnapshotShowPinnedVersion_1.snap b/test/integration/__snapshots__/TestSnapshotShowPinnedVersion_1.snap
deleted file mode 100644
index 9e801ef1..00000000
--- a/test/integration/__snapshots__/TestSnapshotShowPinnedVersion_1.snap
+++ /dev/null
@@ -1,9 +0,0 @@
-Fetching snapshot version 1...
-Name            my-baseline
-Version         1
-Created         <date>              
-Size            <size>
-LocalStack      <calv> 
-Message         the first one
-
-Services        s3
diff --git a/test/integration/__snapshots__/TestSnapshotShowVersionNotFound_1.snap b/test/integration/__snapshots__/TestSnapshotShowVersionNotFound_1.snap
deleted file mode 100644
index eaad06de..00000000
--- a/test/integration/__snapshots__/TestSnapshotShowVersionNotFound_1.snap
+++ /dev/null
@@ -1,4 +0,0 @@
-Fetching snapshot version 99...
-Error: Version 99 of 'pod:my-baseline' not found
-  The highest available version is 3.
-  ==> List available versions: lstk snapshot versions pod:my-baseline
diff --git a/test/integration/__snapshots__/TestSnapshotVersionsFiltersDeletedVersions_1.snap b/test/integration/__snapshots__/TestSnapshotVersionsFiltersDeletedVersions_1.snap
deleted file mode 100644
index 8816fe6c..00000000
--- a/test/integration/__snapshots__/TestSnapshotVersionsFiltersDeletedVersions_1.snap
+++ /dev/null
@@ -1,6 +0,0 @@
-Fetching versions...
-~ 2 versions
-
-  VERSION  CREATED  LOCALSTACK  SERVICES
-  3        -        keep-three  -
-  1        -        keep-one    -
diff --git a/test/integration/__snapshots__/TestSnapshotVersionsRejectsS3Ref_1.snap b/test/integration/__snapshots__/TestSnapshotVersionsRejectsS3Ref_1.snap
deleted file mode 100644
index 8a4c22bd..00000000
--- a/test/integration/__snapshots__/TestSnapshotVersionsRejectsS3Ref_1.snap
+++ /dev/null
@@ -1 +0,0 @@
-Error: snapshot versions is only supported for Cloud Pods (pod: refs), not S3 remotes
diff --git a/test/integration/__snapshots__/TestSnapshotVersionsSuccessWithoutDocker_1.snap b/test/integration/__snapshots__/TestSnapshotVersionsSuccessWithoutDocker_1.snap
deleted file mode 100644
index 3dc60c25..00000000
--- a/test/integration/__snapshots__/TestSnapshotVersionsSuccessWithoutDocker_1.snap
+++ /dev/null
@@ -1,7 +0,0 @@
-Fetching versions...
-~ 3 versions
-
-  VERSION  CREATED               LOCALSTACK  SERVICES
-  3        <date>                <calv>      s3, lambda
-  2        <date>                <calv>      s3
-  1        <date>                <calv>      -
diff --git a/test/integration/__snapshots__/TestStatusCommandFailsWhenNotRunning_1.snap b/test/integration/__snapshots__/TestStatusCommandFailsWhenNotRunning_1.snap
deleted file mode 100644
index d64cbd44..00000000
--- a/test/integration/__snapshots__/TestStatusCommandFailsWhenNotRunning_1.snap
+++ /dev/null
@@ -1,3 +0,0 @@
-Error: LocalStack AWS Emulator is not running
-  ==> Start LocalStack: lstk
-  ==> See help: lstk -h
diff --git a/test/integration/__snapshots__/TestStatusEndpointURLHTTPSRendersReducedOutput_1.snap b/test/integration/__snapshots__/TestStatusEndpointURLHTTPSRendersReducedOutput_1.snap
deleted file mode 100644
index a9cb1138..00000000
--- a/test/integration/__snapshots__/TestStatusEndpointURLHTTPSRendersReducedOutput_1.snap
+++ /dev/null
@@ -1,5 +0,0 @@
-Fetching LocalStack status...
-✔︎ LocalStack AWS Emulator is running
-• Endpoint: https://127.0.0.1:<port>
-• Version: <version>
-> Note: No resources deployed
diff --git a/test/integration/__snapshots__/TestStatusEndpointURLRendersReducedOutput_1.snap b/test/integration/__snapshots__/TestStatusEndpointURLRendersReducedOutput_1.snap
deleted file mode 100644
index 9eca9e62..00000000
--- a/test/integration/__snapshots__/TestStatusEndpointURLRendersReducedOutput_1.snap
+++ /dev/null
@@ -1,5 +0,0 @@
-Fetching LocalStack status...
-✔︎ LocalStack AWS Emulator is running
-• Endpoint: http://127.0.0.1:<port>
-• Version: <version>
-> Note: No resources deployed
diff --git a/test/integration/__snapshots__/TestTerraformMissingBinary_1.snap b/test/integration/__snapshots__/TestTerraformMissingBinary_1.snap
deleted file mode 100644
index b3093cdc..00000000
--- a/test/integration/__snapshots__/TestTerraformMissingBinary_1.snap
+++ /dev/null
@@ -1,3 +0,0 @@
-
-Error: terraform not found in PATH
-  ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
diff --git a/test/integration/__snapshots__/TestUpdateBinaryMockGitHubHappyPath_1.snap b/test/integration/__snapshots__/TestUpdateBinaryMockGitHubHappyPath_1.snap
deleted file mode 100644
index a5df27b6..00000000
--- a/test/integration/__snapshots__/TestUpdateBinaryMockGitHubHappyPath_1.snap
+++ /dev/null
@@ -1,4 +0,0 @@
-Checking for updates...
-Update available: 0.0.1 → v0.0.2
-Downloading and verifying update...
-✔︎ Updated to v0.0.2
diff --git a/test/integration/__snapshots__/TestUsageErrorAfterJSONRendersEnvelope_1.snap b/test/integration/__snapshots__/TestUsageErrorAfterJSONRendersEnvelope_1.snap
deleted file mode 100644
index 281836cf..00000000
--- a/test/integration/__snapshots__/TestUsageErrorAfterJSONRendersEnvelope_1.snap
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "command": "stop",
-  "data": null,
-  "error": {
-    "category": "USAGE",
-    "code": "USAGE_ERROR",
-    "message": "unknown flag: --bogus-flag",
-    "retryable": false
-  },
-  "schemaVersion": 1,
-  "status": "error",
-  "warnings": []
-}
diff --git a/test/integration/__snapshots__/TestCDKInjectsCleanAWSEnv_1.snap b/test/integration/__snapshots__/cdk_cmd_test.snap
similarity index 61%
rename from test/integration/__snapshots__/TestCDKInjectsCleanAWSEnv_1.snap
rename to test/integration/__snapshots__/cdk_cmd_test.snap
index 1038a720..ecb13ec1 100644
--- a/test/integration/__snapshots__/TestCDKInjectsCleanAWSEnv_1.snap
+++ b/test/integration/__snapshots__/cdk_cmd_test.snap
@@ -1,3 +1,7 @@
+Snapshots created by internal/snap. Values are compared with the trailing
+newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+
+-- TestCDKInjectsCleanAWSEnv_1 --
 ARGS:synth
 ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
 ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
diff --git a/test/integration/__snapshots__/endpoint_url_https_test.snap b/test/integration/__snapshots__/endpoint_url_https_test.snap
new file mode 100644
index 00000000..1425d2ba
--- /dev/null
+++ b/test/integration/__snapshots__/endpoint_url_https_test.snap
@@ -0,0 +1,9 @@
+Snapshots created by internal/snap. Values are compared with the trailing
+newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+
+-- TestStatusEndpointURLHTTPSRendersReducedOutput_1 --
+Fetching LocalStack status...
+✔︎ LocalStack AWS Emulator is running
+• Endpoint: https://127.0.0.1:<port>
+• Version: <version>
+> Note: No resources deployed
diff --git a/test/integration/__snapshots__/endpoint_url_test.snap b/test/integration/__snapshots__/endpoint_url_test.snap
new file mode 100644
index 00000000..97877c22
--- /dev/null
+++ b/test/integration/__snapshots__/endpoint_url_test.snap
@@ -0,0 +1,9 @@
+Snapshots created by internal/snap. Values are compared with the trailing
+newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+
+-- TestStatusEndpointURLRendersReducedOutput_1 --
+Fetching LocalStack status...
+✔︎ LocalStack AWS Emulator is running
+• Endpoint: http://127.0.0.1:<port>
+• Version: <version>
+> Note: No resources deployed
diff --git a/test/integration/__snapshots__/TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly_1.snap b/test/integration/__snapshots__/extension_test.snap
similarity index 73%
rename from test/integration/__snapshots__/TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly_1.snap
rename to test/integration/__snapshots__/extension_test.snap
index 34c7c020..fa73973c 100644
--- a/test/integration/__snapshots__/TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly_1.snap
+++ b/test/integration/__snapshots__/extension_test.snap
@@ -1,3 +1,16 @@
+Snapshots created by internal/snap. Values are compared with the trailing
+newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+
+-- TestExtensionEndpointOmittedWhenNoRuntime_1 --
+ARGS=[]
+SELF=<path>
+API_VERSION=1
+CONFIG_DIR=<path>
+NON_INTERACTIVE=true
+JSON=false
+SESSION_ID=<id>
+EMULATOR_COUNT=0
+-- TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly_1 --
 Usage: lstk [options] [command]
 
 LSTK - LocalStack command-line interface
@@ -44,3 +57,20 @@ Options:
       --timeout duration      Maximum time to wait for the emulator to become ready (overrides LSTK_STARTUP_TIMEOUT; 0 uses the default)
   -t, --type string           Emulator type to start (aws, snowflake, azure)
   -v, --version               Show version
+-- TestExtensionSessionIDOmittedWhenTelemetryDisabled_1 --
+ARGS=[exit 7]
+SELF=<path>
+API_VERSION=1
+CONFIG_DIR=<path>
+NON_INTERACTIVE=true
+JSON=false
+EMULATOR_COUNT=0
+-- TestExtensionUnknownCommandDispatches_1 --
+ARGS=[world]
+SELF=<path>
+API_VERSION=1
+CONFIG_DIR=<path>
+NON_INTERACTIVE=true
+JSON=false
+SESSION_ID=<id>
+EMULATOR_COUNT=0
diff --git a/test/integration/__snapshots__/json_envelope_test.snap b/test/integration/__snapshots__/json_envelope_test.snap
new file mode 100644
index 00000000..dd84c0c5
--- /dev/null
+++ b/test/integration/__snapshots__/json_envelope_test.snap
@@ -0,0 +1,45 @@
+Snapshots created by internal/snap. Values are compared with the trailing
+newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+
+-- TestConfigLoadFailureRendersJSONEnvelope_1 --
+{
+  "command": "stop",
+  "data": null,
+  "error": {
+    "category": "CONFIG",
+    "code": "CONFIG_INVALID",
+    "message": "<any>",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+-- TestNotJSONCapableCommandRendersEnvelope_1 --
+{
+  "command": "login",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"login\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+-- TestUsageErrorAfterJSONRendersEnvelope_1 --
+{
+  "command": "stop",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "USAGE_ERROR",
+    "message": "unknown flag: --bogus-flag",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
diff --git a/test/integration/__snapshots__/json_flag_test.snap b/test/integration/__snapshots__/json_flag_test.snap
new file mode 100644
index 00000000..dad06361
--- /dev/null
+++ b/test/integration/__snapshots__/json_flag_test.snap
@@ -0,0 +1,140 @@
+Snapshots created by internal/snap. Values are compared with the trailing
+newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+
+-- TestExtensionReceivesJSONFlagInContext_1 --
+ARGS=[--foo]
+SELF=<path>
+API_VERSION=1
+CONFIG_DIR=<path>
+NON_INTERACTIVE=true
+JSON=true
+SESSION_ID=<id>
+EMULATOR_COUNT=0
+-- TestJSONFlagBeforeCommandNameBooleanValues_--json_true_before_the_command_name_is_rejected_1 --
+{
+  "command": "aws",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"aws\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+-- TestJSONFlagBeforeCommandNameBooleanValues_a_malformed_value_before_the_command_name_is_rejected_1 --
+{
+  "command": "aws",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"aws\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+-- TestJSONFlagProxyCommandsForwardJSON_aws_json_after_the_wrapped_tool_s_own_action_1 --
+Error: aws CLI not found in PATH
+  ==> Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
+-- TestJSONFlagProxyCommandsForwardJSON_aws_json_immediately_after_command_name_1 --
+Error: aws CLI not found in PATH
+  ==> Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
+-- TestJSONFlagProxyCommandsForwardJSON_az_json_after_the_wrapped_tool_s_own_action_1 --
+Error: az CLI not found in PATH
+  ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
+-- TestJSONFlagProxyCommandsForwardJSON_az_json_immediately_after_command_name_1 --
+Error: az CLI not found in PATH
+  ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
+-- TestJSONFlagProxyCommandsForwardJSON_cdk_json_after_the_wrapped_tool_s_own_action_1 --
+Error: cdk not found in PATH
+  ==> Install CDK CLI: npm install -g aws-cdk
+-- TestJSONFlagProxyCommandsForwardJSON_cdk_json_immediately_after_command_name_1 --
+Error: cdk not found in PATH
+  ==> Install CDK CLI: npm install -g aws-cdk
+-- TestJSONFlagProxyCommandsForwardJSON_sam_json_after_the_wrapped_tool_s_own_action_1 --
+Error: sam not found in PATH
+  ==> Install AWS SAM CLI: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html
+-- TestJSONFlagProxyCommandsForwardJSON_sam_json_immediately_after_command_name_1 --
+Error: sam not found in PATH
+  ==> Install AWS SAM CLI: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html
+-- TestJSONFlagProxyCommandsForwardJSON_terraform_json_after_the_wrapped_tool_s_own_action_1 --
+Error: terraform not found in PATH
+  ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
+-- TestJSONFlagProxyCommandsForwardJSON_terraform_json_immediately_after_command_name_1 --
+Error: terraform not found in PATH
+  ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
+-- TestJSONFlagProxyCommandsRejectBeforeCommandName_aws_1 --
+{
+  "command": "aws",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"aws\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+-- TestJSONFlagProxyCommandsRejectBeforeCommandName_az_1 --
+{
+  "command": "az",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"az\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+-- TestJSONFlagProxyCommandsRejectBeforeCommandName_cdk_1 --
+{
+  "command": "cdk",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"cdk\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+-- TestJSONFlagProxyCommandsRejectBeforeCommandName_sam_1 --
+{
+  "command": "sam",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"sam\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+-- TestJSONFlagProxyCommandsRejectBeforeCommandName_terraform_1 --
+{
+  "command": "terraform",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"terraform\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
diff --git a/test/integration/__snapshots__/TestSAMInjectsCleanAWSEnv_1.snap b/test/integration/__snapshots__/sam_cmd_test.snap
similarity index 63%
rename from test/integration/__snapshots__/TestSAMInjectsCleanAWSEnv_1.snap
rename to test/integration/__snapshots__/sam_cmd_test.snap
index 2e1ab842..a668baa5 100644
--- a/test/integration/__snapshots__/TestSAMInjectsCleanAWSEnv_1.snap
+++ b/test/integration/__snapshots__/sam_cmd_test.snap
@@ -1,3 +1,7 @@
+Snapshots created by internal/snap. Values are compared with the trailing
+newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+
+-- TestSAMInjectsCleanAWSEnv_1 --
 ARGS:build
 ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
 ENV_AWS_ENDPOINT_URL_S3=<unset>
diff --git a/test/integration/__snapshots__/snapshot_list_test.snap b/test/integration/__snapshots__/snapshot_list_test.snap
new file mode 100644
index 00000000..8e8d07d0
--- /dev/null
+++ b/test/integration/__snapshots__/snapshot_list_test.snap
@@ -0,0 +1,10 @@
+Snapshots created by internal/snap. Values are compared with the trailing
+newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+
+-- TestSnapshotListSuccessWithoutDocker_1 --
+Fetching snapshots...
+~ 2 snapshots
+
+  NAME           VERSION  LAST CHANGED
+  baseline-q2    3        <date>              
+  infra-2026-04  1        -
diff --git a/test/integration/__snapshots__/TestSnapshotShowSuccessWithoutDocker_1.snap b/test/integration/__snapshots__/snapshot_show_test.snap
similarity index 61%
rename from test/integration/__snapshots__/TestSnapshotShowSuccessWithoutDocker_1.snap
rename to test/integration/__snapshots__/snapshot_show_test.snap
index b68bb074..ce241f7e 100644
--- a/test/integration/__snapshots__/TestSnapshotShowSuccessWithoutDocker_1.snap
+++ b/test/integration/__snapshots__/snapshot_show_test.snap
@@ -1,3 +1,7 @@
+Snapshots created by internal/snap. Values are compared with the trailing
+newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+
+-- TestSnapshotShowSuccessWithoutDocker_1 --
 Fetching snapshot...
 Name            my-baseline
 Version         1
diff --git a/test/integration/__snapshots__/snapshot_versions_test.snap b/test/integration/__snapshots__/snapshot_versions_test.snap
new file mode 100644
index 00000000..4aec80c8
--- /dev/null
+++ b/test/integration/__snapshots__/snapshot_versions_test.snap
@@ -0,0 +1,35 @@
+Snapshots created by internal/snap. Values are compared with the trailing
+newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+
+-- TestSnapshotShowPinnedVersion_1 --
+Fetching snapshot version 1...
+Name            my-baseline
+Version         1
+Created         <date>              
+Size            <size>
+LocalStack      <calv> 
+Message         the first one
+
+Services        s3
+-- TestSnapshotShowVersionNotFound_1 --
+Fetching snapshot version 99...
+Error: Version 99 of 'pod:my-baseline' not found
+  The highest available version is 3.
+  ==> List available versions: lstk snapshot versions pod:my-baseline
+-- TestSnapshotVersionsFiltersDeletedVersions_1 --
+Fetching versions...
+~ 2 versions
+
+  VERSION  CREATED  LOCALSTACK  SERVICES
+  3        -        keep-three  -
+  1        -        keep-one    -
+-- TestSnapshotVersionsRejectsS3Ref_1 --
+Error: snapshot versions is only supported for Cloud Pods (pod: refs), not S3 remotes
+-- TestSnapshotVersionsSuccessWithoutDocker_1 --
+Fetching versions...
+~ 3 versions
+
+  VERSION  CREATED               LOCALSTACK  SERVICES
+  3        <date>                <calv>      s3, lambda
+  2        <date>                <calv>      s3
+  1        <date>                <calv>      -
diff --git a/test/integration/__snapshots__/status_test.snap b/test/integration/__snapshots__/status_test.snap
new file mode 100644
index 00000000..70450cb4
--- /dev/null
+++ b/test/integration/__snapshots__/status_test.snap
@@ -0,0 +1,7 @@
+Snapshots created by internal/snap. Values are compared with the trailing
+newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+
+-- TestStatusCommandFailsWhenNotRunning_1 --
+Error: LocalStack AWS Emulator is not running
+  ==> Start LocalStack: lstk
+  ==> See help: lstk -h
diff --git a/test/integration/__snapshots__/TestTerraformDryRunGeneratesOverride_1.snap b/test/integration/__snapshots__/terraform_cmd_test.snap
similarity index 52%
rename from test/integration/__snapshots__/TestTerraformDryRunGeneratesOverride_1.snap
rename to test/integration/__snapshots__/terraform_cmd_test.snap
index 54a3f342..afe1dc3c 100644
--- a/test/integration/__snapshots__/TestTerraformDryRunGeneratesOverride_1.snap
+++ b/test/integration/__snapshots__/terraform_cmd_test.snap
@@ -1,3 +1,7 @@
+Snapshots created by internal/snap. Values are compared with the trailing
+newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+
+-- TestTerraformDryRunGeneratesOverride_1 --
 # Generated by lstk - do not edit. This file is removed automatically.
 
 provider "aws" {
@@ -14,3 +18,7 @@ provider "aws" {
   }
 }
 
+-- TestTerraformMissingBinary_1 --
+
+Error: terraform not found in PATH
+  ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
diff --git a/test/integration/__snapshots__/update_test.snap b/test/integration/__snapshots__/update_test.snap
new file mode 100644
index 00000000..115a9bf4
--- /dev/null
+++ b/test/integration/__snapshots__/update_test.snap
@@ -0,0 +1,8 @@
+Snapshots created by internal/snap. Values are compared with the trailing
+newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+
+-- TestUpdateBinaryMockGitHubHappyPath_1 --
+Checking for updates...
+Update available: 0.0.1 → v0.0.2
+Downloading and verifying update...
+✔︎ Updated to v0.0.2
diff --git a/test/integration/go.mod b/test/integration/go.mod
index e5a083af..d663a772 100644
--- a/test/integration/go.mod
+++ b/test/integration/go.mod
@@ -23,6 +23,7 @@ require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 
diff --git a/test/integration/go.sum b/test/integration/go.sum
index 33ebe64e..8f55665e 100644
--- a/test/integration/go.sum
+++ b/test/integration/go.sum
@@ -119,6 +119,8 @@ go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOy
 go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

From 0ffc708a2d524528083322f828d4965f298c642d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Wed, 12 Aug 2026 13:09:06 +0200
Subject: [PATCH 13/21] Restore original assert vs require split from main

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../integration/auth_token_precedence_test.go |   7 +-
 test/integration/aws_cmd_test.go              | 141 +++++-----
 test/integration/aws_completion_test.go       |  25 +-
 .../aws_profile_precedence_test.go            |  11 +-
 test/integration/awsconfig_test.go            |  73 +++---
 test/integration/az_cmd_test.go               |  25 +-
 test/integration/az_e2e_test.go               |   9 +-
 test/integration/az_interception_test.go      |  33 +--
 test/integration/az_pty_test.go               |   9 +-
 test/integration/cdk_cmd_test.go              |  39 +--
 test/integration/completion_test.go           |  21 +-
 test/integration/config_test.go               |  17 +-
 test/integration/docker_unhealthy_test.go     |  23 +-
 test/integration/docker_windows_test.go       |   7 +-
 test/integration/docs_test.go                 |  15 +-
 test/integration/emulator_select_test.go      |  23 +-
 test/integration/emulator_type_test.go        |  45 ++--
 test/integration/endpoint_url_https_test.go   |  25 +-
 test/integration/endpoint_url_test.go         |  75 +++---
 test/integration/exit_code_test.go            |   5 +-
 test/integration/json_envelope_test.go        |  17 +-
 test/integration/json_flag_test.go            |  21 +-
 test/integration/license_test.go              |  31 +--
 test/integration/logging_test.go              |   9 +-
 test/integration/login_test.go                |  53 ++--
 test/integration/logout_test.go               |  15 +-
 test/integration/logs_test.go                 |  21 +-
 test/integration/non_interactive_test.go      |   7 +-
 test/integration/reset_test.go                |  45 ++--
 test/integration/restart_test.go              |  29 +--
 test/integration/sam_cmd_test.go              |  65 ++---
 test/integration/sam_e2e_test.go              |   3 +-
 test/integration/setup_azure_test.go          |  27 +-
 .../integration/snapshot_experimental_test.go |  11 +-
 test/integration/snapshot_list_test.go        |  21 +-
 test/integration/snapshot_load_test.go        |  69 ++---
 .../integration/snapshot_load_version_test.go |  47 ++--
 test/integration/snapshot_merge_e2e_test.go   |  13 +-
 test/integration/snapshot_remove_test.go      |  49 ++--
 test/integration/snapshot_save_test.go        |  89 +++----
 test/integration/snapshot_show_test.go        |  25 +-
 test/integration/snapshot_versions_test.go    |  29 ++-
 test/integration/start_snapshot_test.go       |  13 +-
 test/integration/start_test.go                | 245 +++++++++---------
 test/integration/status_test.go               |  33 +--
 test/integration/stop_test.go                 |  51 ++--
 test/integration/telemetry_test.go            |  41 +--
 test/integration/terraform_cmd_test.go        |  77 +++---
 test/integration/terraform_e2e_test.go        |  19 +-
 .../terraform_s3backend_e2e_test.go           |  17 +-
 test/integration/update_test.go               |  85 +++---
 test/integration/version_resolution_test.go   |  23 +-
 test/integration/volume_test.go               |  25 +-
 53 files changed, 1004 insertions(+), 949 deletions(-)

diff --git a/test/integration/auth_token_precedence_test.go b/test/integration/auth_token_precedence_test.go
index d8d40618..b56f9a3c 100644
--- a/test/integration/auth_token_precedence_test.go
+++ b/test/integration/auth_token_precedence_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -47,7 +48,7 @@ func TestEnvAuthTokenOverridesStoredToken(t *testing.T) {
 
 	called, _, auth := cap.get()
 	require.True(t, called, "the platform list endpoint should have been called")
-	require.Equal(t, basicAuthHeader("env-token"), auth, "LOCALSTACK_AUTH_TOKEN should override the stored token")
+	assert.Equal(t, basicAuthHeader("env-token"), auth, "LOCALSTACK_AUTH_TOKEN should override the stored token")
 }
 
 func TestStoredTokenUsedWithoutEnvAuthToken(t *testing.T) {
@@ -70,7 +71,7 @@ func TestStoredTokenUsedWithoutEnvAuthToken(t *testing.T) {
 
 	called, _, auth := cap.get()
 	require.True(t, called, "the platform list endpoint should have been called")
-	require.Equal(t, basicAuthHeader("stored-token"), auth, "the stored token should be used when no env token is set")
+	assert.Equal(t, basicAuthHeader("stored-token"), auth, "the stored token should be used when no env token is set")
 }
 
 func TestEnvAuthTokenOverridesStoredTokenForExternalEmulator(t *testing.T) {
@@ -105,7 +106,7 @@ func TestEnvAuthTokenOverridesStoredTokenForExternalEmulator(t *testing.T) {
 
 	select {
 	case auth := <-authHeader:
-		require.Equal(t, basicAuthHeader("env-token"), auth, "LOCALSTACK_AUTH_TOKEN should override the stored token")
+		assert.Equal(t, basicAuthHeader("env-token"), auth, "LOCALSTACK_AUTH_TOKEN should override the stored token")
 	default:
 		t.Fatal("the external emulator pod endpoint should have been called")
 	}
diff --git a/test/integration/aws_cmd_test.go b/test/integration/aws_cmd_test.go
index b097d151..e7cd0208 100644
--- a/test/integration/aws_cmd_test.go
+++ b/test/integration/aws_cmd_test.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -72,8 +73,8 @@ func TestAWSCommandInjectsEndpointAndArgs(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
 	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	require.Contains(t, stdout, "ENDPOINT:http://")
-	require.Contains(t, stdout, "ARGS:s3 ls")
+	assert.Contains(t, stdout, "ENDPOINT:http://")
+	assert.Contains(t, stdout, "ARGS:s3 ls")
 	assertCommandTelemetry(t, events, "aws", 0)
 }
 
@@ -97,9 +98,9 @@ func TestAWSCommandStripsGlobalFlagsFromPassthrough(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "--config", configPath, "--non-interactive", "aws", "s3", "ls")
 	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	require.Contains(t, stdout, "ARGS:s3 ls")
-	require.NotContains(t, stdout, "--config")
-	require.NotContains(t, stdout, "--non-interactive")
+	assert.Contains(t, stdout, "ARGS:s3 ls")
+	assert.NotContains(t, stdout, "--config")
+	assert.NotContains(t, stdout, "--non-interactive")
 }
 
 func TestAWSCommandInjectsCredentials(t *testing.T) {
@@ -116,9 +117,9 @@ func TestAWSCommandInjectsCredentials(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "sts", "get-caller-identity")
 	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=test")
-	require.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=test")
-	require.Contains(t, stdout, "AWS_DEFAULT_REGION=us-east-1")
+	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=test")
+	assert.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=test")
+	assert.Contains(t, stdout, "AWS_DEFAULT_REGION=us-east-1")
 }
 
 func TestAWSCommandRespectsExistingCredentials(t *testing.T) {
@@ -140,9 +141,9 @@ func TestAWSCommandRespectsExistingCredentials(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
 	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=custom-key")
-	require.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=custom-secret")
-	require.Contains(t, stdout, "AWS_DEFAULT_REGION=eu-west-1")
+	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=custom-key")
+	assert.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=custom-secret")
+	assert.Contains(t, stdout, "AWS_DEFAULT_REGION=eu-west-1")
 }
 
 // The profile is selected through AWS_PROFILE, never a --profile argument: an
@@ -164,15 +165,15 @@ func TestAWSCommandUsesProfileWhenAvailable(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
 	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	require.Contains(t, stdout, "AWS_PROFILE=localstack")
-	require.NotContains(t, stdout, "--profile")
+	assert.Contains(t, stdout, "AWS_PROFILE=localstack")
+	assert.NotContains(t, stdout, "--profile")
 	// The profile is the sole credentials source: lstk removes the variables
 	// rather than seeding over them (7.10).
-	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=<unset>")
-	require.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=<unset>")
-	require.Contains(t, stdout, "AWS_SESSION_TOKEN=<unset>")
+	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=<unset>")
+	assert.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=<unset>")
+	assert.Contains(t, stdout, "AWS_SESSION_TOKEN=<unset>")
 	// No default region is seeded over the profile's own (7.12).
-	require.Contains(t, stdout, "AWS_DEFAULT_REGION=<unset>")
+	assert.Contains(t, stdout, "AWS_DEFAULT_REGION=<unset>")
 }
 
 // 7.1 — the path that already worked: with no profile configured, a 12-digit
@@ -193,7 +194,7 @@ func TestAWSCommandAccountFromEnvWithoutProfile(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
 	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
+	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
 }
 
 // 7.2 — the silent failure this change fixes: the same command stopped working
@@ -218,10 +219,10 @@ func TestAWSCommandAccountFromEnvWithProfile(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
 	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
-	require.NotContains(t, stdout, "--profile")
+	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
+	assert.NotContains(t, stdout, "--profile")
 	// The profile is still selected, so its other settings keep applying.
-	require.Contains(t, stdout, "AWS_PROFILE=localstack")
+	assert.Contains(t, stdout, "AWS_PROFILE=localstack")
 }
 
 // 7.3 — the flag, with the profile present so the bypass path is exercised.
@@ -241,14 +242,14 @@ func TestAWSCommandAccountFlag(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "--account", "111111111111", "s3", "ls")
 	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
+	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
 	// The flag is lstk's: it must not reach the AWS CLI.
-	require.Contains(t, stdout, "ARGS:s3 ls")
+	assert.Contains(t, stdout, "ARGS:s3 ls")
 	// A secret is always supplied alongside the key — a lone access key id
 	// makes the AWS CLI fail with "Partial credentials found in env" (7.11).
-	require.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=test")
+	assert.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=test")
 	// No default region is seeded over the profile's own (7.12).
-	require.Contains(t, stdout, "AWS_DEFAULT_REGION=<unset>")
+	assert.Contains(t, stdout, "AWS_DEFAULT_REGION=<unset>")
 }
 
 // 7.4
@@ -268,8 +269,8 @@ func TestAWSCommandAccountFlagBeatsEnv(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "--account=222222222222", "s3", "ls")
 	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=222222222222")
-	require.NotContains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
+	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=222222222222")
+	assert.NotContains(t, stdout, "AWS_ACCESS_KEY_ID=111111111111")
 }
 
 // 7.9 — a real key in the environment is not an account selection: the profile
@@ -295,12 +296,12 @@ func TestAWSCommandRealAccessKeyDoesNotDisplaceProfile(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
 	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	require.Contains(t, stdout, "AWS_PROFILE=localstack")
-	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=<unset>")
-	require.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=<unset>")
-	require.Contains(t, stdout, "AWS_SESSION_TOKEN=<unset>")
-	require.NotContains(t, stdout, "AKIAIOSFODNN7EXAMPLE")
-	require.NotContains(t, stdout, "realsecret")
+	assert.Contains(t, stdout, "AWS_PROFILE=localstack")
+	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=<unset>")
+	assert.Contains(t, stdout, "AWS_SECRET_ACCESS_KEY=<unset>")
+	assert.Contains(t, stdout, "AWS_SESSION_TOKEN=<unset>")
+	assert.NotContains(t, stdout, "AKIAIOSFODNN7EXAMPLE")
+	assert.NotContains(t, stdout, "realsecret")
 }
 
 // 7.9 (no-profile half) — with nothing else to supply credentials the key is
@@ -322,9 +323,9 @@ func TestAWSCommandDeactivatesRealAccessKeyWithoutProfile(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
 	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=LKIAIOSFODNN7EXAMPLE")
-	require.NotContains(t, stdout, "AKIAIOSFODNN7EXAMPLE")
-	require.Contains(t, stdout, "AWS_SESSION_TOKEN=<unset>")
+	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=LKIAIOSFODNN7EXAMPLE")
+	assert.NotContains(t, stdout, "AKIAIOSFODNN7EXAMPLE")
+	assert.Contains(t, stdout, "AWS_SESSION_TOKEN=<unset>")
 }
 
 // 7.7 — a --account after the AWS service belongs to the AWS CLI
@@ -342,8 +343,8 @@ func TestAWSCommandForwardsNonLeadingAccountFlag(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls", "--account", "111111111111")
 	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	require.Contains(t, stdout, "ARGS:s3 ls --account 111111111111")
-	require.Contains(t, stdout, "AWS_ACCESS_KEY_ID=test")
+	assert.Contains(t, stdout, "ARGS:s3 ls --account 111111111111")
+	assert.Contains(t, stdout, "AWS_ACCESS_KEY_ID=test")
 }
 
 // 7.8 — --region is the AWS CLI's own flag and is never consumed by lstk, even
@@ -361,7 +362,7 @@ func TestAWSCommandForwardsRegionFlag(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "--region", "us-west-2", "s3", "ls")
 	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	require.Contains(t, stdout, "ARGS:--region us-west-2 s3 ls")
+	assert.Contains(t, stdout, "ARGS:--region us-west-2 s3 ls")
 }
 
 // 7.5 — rejected at the command boundary, before the AWS CLI is invoked. No
@@ -374,9 +375,9 @@ func TestAWSCommandRejectsInvalidAccount(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "--account", "12345", "s3", "ls")
 	require.Error(t, err)
-	require.Contains(t, stdout, "12-digit AWS account id")
+	assert.Contains(t, stdout, "12-digit AWS account id")
 	// The AWS CLI must not have run.
-	require.NotContains(t, stdout, "ARGS:")
+	assert.NotContains(t, stdout, "ARGS:")
 }
 
 // 7.5 (missing value)
@@ -388,8 +389,8 @@ func TestAWSCommandRejectsAccountWithoutValue(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "--account")
 	require.Error(t, err)
-	require.Contains(t, stdout, "--account requires a value")
-	require.NotContains(t, stdout, "ARGS:")
+	assert.Contains(t, stdout, "--account requires a value")
+	assert.NotContains(t, stdout, "ARGS:")
 }
 
 // 7.6 — a flag before the `aws` token would be eaten during Cobra's command
@@ -402,8 +403,8 @@ func TestAWSCommandRejectsPreSubcommandAccount(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "--account", "111111111111", "aws", "s3", "ls")
 	require.Error(t, err)
-	require.Contains(t, stdout, "must appear after the aws subcommand")
-	require.NotContains(t, stdout, "ARGS:")
+	assert.Contains(t, stdout, "must appear after the aws subcommand")
+	assert.NotContains(t, stdout, "ARGS:")
 }
 
 // The leading flag is consumed before the help short-circuit, so help still
@@ -417,7 +418,7 @@ func TestAWSCommandAccountWithHelp(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "--account", "111111111111", "help")
 	require.NoError(t, err, "lstk aws help failed: %s", stderr)
 
-	require.NotContains(t, stdout, "--account")
+	assert.NotContains(t, stdout, "--account")
 }
 
 func TestAWSCommandFailsWhenAWSCLINotInstalled(t *testing.T) {
@@ -426,9 +427,9 @@ func TestAWSCommandFailsWhenAWSCLINotInstalled(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "s3", "ls")
 	require.Error(t, err)
-	require.Contains(t, stdout, "aws CLI not found in PATH")
-	require.Contains(t, stdout, "Install AWS CLI:")
-	require.Contains(t, stdout, "https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html")
+	assert.Contains(t, stdout, "aws CLI not found in PATH")
+	assert.Contains(t, stdout, "Install AWS CLI:")
+	assert.Contains(t, stdout, "https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html")
 }
 
 func TestAWSCommandUsesDefaultPortWithoutConfig(t *testing.T) {
@@ -447,7 +448,7 @@ func TestAWSCommandUsesDefaultPortWithoutConfig(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, workDir, e, "aws", "s3", "ls")
 	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	require.Contains(t, stdout, ":4566")
+	assert.Contains(t, stdout, ":4566")
 }
 
 func TestAWSCommandUsesPortFromConfig(t *testing.T) {
@@ -475,7 +476,7 @@ port = "4599"
 	stdout, stderr, err := runLstk(t, ctx, workDir, e, "aws", "s3", "ls")
 	require.NoError(t, err, "lstk aws failed: %s", stderr)
 
-	require.Contains(t, stdout, ":4599")
+	assert.Contains(t, stdout, ":4599")
 }
 
 // writeFakeAWSFailing creates a fake `aws` that mimics a failing command.
@@ -500,7 +501,7 @@ func TestAWSCommandPropagatesExitCode(t *testing.T) {
 
 	_, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
 	require.Error(t, err, "lstk aws should fail when aws command fails")
-	require.Contains(t, stderr, "simulated failure")
+	assert.Contains(t, stderr, "simulated failure")
 	requireExitCode(t, 42, err)
 }
 
@@ -524,8 +525,8 @@ func TestAWSCommandHelpSkipsDockerAndEmulator(t *testing.T) {
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, cmdArgs...)
 			require.NoError(t, err, "stderr: %s", stderr)
 
-			require.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
-			require.NotContains(t, stdout, "--endpoint-url")
+			assert.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
+			assert.NotContains(t, stdout, "--endpoint-url")
 		})
 	}
 }
@@ -542,7 +543,7 @@ func TestAWSCommandFailsWhenDockerNotRunning(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "s3", "ls")
 	require.Error(t, err)
-	require.Contains(t, stdout, "Docker is not available")
+	assert.Contains(t, stdout, "Docker is not available")
 }
 
 func TestAWSCommandFailsWhenEmulatorNotRunning(t *testing.T) {
@@ -557,9 +558,9 @@ func TestAWSCommandFailsWhenEmulatorNotRunning(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "s3", "ls")
 	require.Error(t, err)
-	require.Contains(t, stdout, "is not running")
-	require.Contains(t, stdout, "Start LocalStack:")
-	require.Contains(t, stdout, "lstk")
+	assert.Contains(t, stdout, "is not running")
+	assert.Contains(t, stdout, "Start LocalStack:")
+	assert.Contains(t, stdout, "lstk")
 	assertCommandTelemetry(t, events, "aws", 1)
 }
 
@@ -575,7 +576,7 @@ func TestAWSCommandHintsSetupCommandWhenProfileMissing(t *testing.T) {
 
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
 	require.NoError(t, err)
-	require.Contains(t, stdout, "lstk setup aws")
+	assert.Contains(t, stdout, "lstk setup aws")
 }
 
 func TestAWSCommandWorksWithExternalContainer(t *testing.T) {
@@ -599,7 +600,7 @@ func TestAWSCommandWorksWithExternalContainer(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
 	require.NoError(t, err, "lstk aws should work with externally-named container: %s", stderr)
-	require.Contains(t, stdout, "ENDPOINT:http://")
+	assert.Contains(t, stdout, "ENDPOINT:http://")
 }
 
 // writeSlowFakeAWS creates a fake `aws` that sleeps for the given duration
@@ -629,10 +630,10 @@ func TestAWSCommandShowsSpinnerForSlowOperation(t *testing.T) {
 	out, err := runLstkInPTY(t, ctx, e, "aws", "s3", "ls")
 	require.NoError(t, err, "lstk aws failed: %s", out)
 
-	require.Contains(t, out, "Loading service")
-	require.Contains(t, out, "ARGS:s3 ls")
+	assert.Contains(t, out, "Loading service")
+	assert.Contains(t, out, "ARGS:s3 ls")
 	// lstk selects the profile via AWS_PROFILE, never a --profile argument.
-	require.NotContains(t, out, "--profile")
+	assert.NotContains(t, out, "--profile")
 }
 
 func TestAWSCommandSuppressesSpinnerInNonInteractiveMode(t *testing.T) {
@@ -653,10 +654,10 @@ func TestAWSCommandSuppressesSpinnerInNonInteractiveMode(t *testing.T) {
 	out, err := runLstkInPTY(t, ctx, e, "--non-interactive", "aws", "s3", "ls")
 	require.NoError(t, err, "lstk aws failed: %s", out)
 
-	require.NotContains(t, out, "Loading service")
-	require.Contains(t, out, "ARGS:s3 ls")
+	assert.NotContains(t, out, "Loading service")
+	assert.Contains(t, out, "ARGS:s3 ls")
 	// lstk selects the profile via AWS_PROFILE, never a --profile argument.
-	require.NotContains(t, out, "--profile")
+	assert.NotContains(t, out, "--profile")
 }
 
 func TestAWSCommandSuppressesSpinnerForFastOperation(t *testing.T) {
@@ -675,10 +676,10 @@ func TestAWSCommandSuppressesSpinnerForFastOperation(t *testing.T) {
 	out, err := runLstkInPTY(t, ctx, e, "aws", "s3", "ls")
 	require.NoError(t, err, "lstk aws failed: %s", out)
 
-	require.NotContains(t, out, "Loading service")
-	require.Contains(t, out, "ARGS:s3 ls")
+	assert.NotContains(t, out, "Loading service")
+	assert.Contains(t, out, "ARGS:s3 ls")
 	// lstk selects the profile via AWS_PROFILE, never a --profile argument.
-	require.NotContains(t, out, "--profile")
+	assert.NotContains(t, out, "--profile")
 }
 
 func TestAWSCommandSuppressesHintWhenProfileExists(t *testing.T) {
@@ -696,5 +697,5 @@ func TestAWSCommandSuppressesHintWhenProfileExists(t *testing.T) {
 
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), e, "aws", "s3", "ls")
 	require.NoError(t, err)
-	require.NotContains(t, stdout, "lstk setup aws")
+	assert.NotContains(t, stdout, "lstk setup aws")
 }
diff --git a/test/integration/aws_completion_test.go b/test/integration/aws_completion_test.go
index f944a213..c9e580f7 100644
--- a/test/integration/aws_completion_test.go
+++ b/test/integration/aws_completion_test.go
@@ -4,6 +4,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/localstack/lstk/test/integration/env"
@@ -36,12 +37,12 @@ func TestAWSCompletionDelegatesToAWSCompleter(t *testing.T) {
 
 	// The completer strips the first word of COMP_LINE and resolves the rest
 	// against the aws command tree, so lstk's own name must not be in it.
-	require.Contains(t, stdout, "compline=[aws s3 l]")
-	require.NotContains(t, stdout, "compline=[lstk")
+	assert.Contains(t, stdout, "compline=[aws s3 l]")
+	assert.NotContains(t, stdout, "compline=[lstk")
 
 	completions := strings.Fields(stdout)
-	require.Contains(t, completions, "ls")
-	require.Contains(t, completions, "list-buckets")
+	assert.Contains(t, completions, "ls")
+	assert.Contains(t, completions, "list-buckets")
 }
 
 // TestAWSCompletionAppendsTrailingSpaceForNewWord verifies the cursor position
@@ -56,7 +57,7 @@ func TestAWSCompletionAppendsTrailingSpaceForNewWord(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "__complete", "aws", "s3", "")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	require.Contains(t, stdout, "compline=[aws s3 ]")
+	assert.Contains(t, stdout, "compline=[aws s3 ]")
 }
 
 // TestAWSCompletionStripsGlobalFlags keeps lstk's own persistent flags out of
@@ -72,7 +73,7 @@ func TestAWSCompletionStripsGlobalFlags(t *testing.T) {
 		"__complete", "aws", "--non-interactive", "s3", "l")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	require.Contains(t, stdout, "compline=[aws s3 l]")
+	assert.Contains(t, stdout, "compline=[aws s3 l]")
 }
 
 // TestAWSCompletionNeedsNoDockerOrEmulator guards the property that makes this
@@ -90,8 +91,8 @@ func TestAWSCompletionNeedsNoDockerOrEmulator(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "__complete", "aws", "s3", "l")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	require.Contains(t, stdout, "ls")
-	require.NotContains(t, stdout, "Docker is not available")
+	assert.Contains(t, stdout, "ls")
+	assert.NotContains(t, stdout, "Docker is not available")
 }
 
 // TestAWSCompletionDegradesWhenCompleterMissing verifies a machine without
@@ -107,7 +108,7 @@ func TestAWSCompletionDegradesWhenCompleterMissing(t *testing.T) {
 
 	// ShellCompDirectiveDefault (0) — hand the word back to the shell's own
 	// file completion rather than offering nothing at all.
-	require.Equal(t, ":0", strings.TrimSpace(stdout))
+	assert.Equal(t, ":0", strings.TrimSpace(stdout))
 }
 
 // TestBashCompletionForAWSSubcommand drives the real generated bash script the
@@ -121,9 +122,9 @@ func TestBashCompletionForAWSSubcommand(t *testing.T) {
 
 	stdout, stderr, err := runBashCompletionDriver(t, driver, fakeDir)
 	require.NoError(t, err, "completion attempt failed\nstdout: %s\nstderr: %s", stdout, stderr)
-	require.NotContains(t, stderr, "command not found")
+	assert.NotContains(t, stderr, "command not found")
 
 	completions := strings.Fields(stdout)
-	require.Contains(t, completions, "ls")
-	require.Contains(t, completions, "list-buckets")
+	assert.Contains(t, completions, "ls")
+	assert.Contains(t, completions, "list-buckets")
 }
diff --git a/test/integration/aws_profile_precedence_test.go b/test/integration/aws_profile_precedence_test.go
index 0480be09..f53b3aca 100644
--- a/test/integration/aws_profile_precedence_test.go
+++ b/test/integration/aws_profile_precedence_test.go
@@ -7,6 +7,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -97,9 +98,9 @@ func TestAWSProfileEnvVarLetsEnvironmentCredentialsWin(t *testing.T) {
 	)
 	out := awsConfigureList(t, e...)
 
-	require.Regexp(t, `access_key\s*:\s*\**1111\s*:\s*env`, out,
+	assert.Regexp(t, `access_key\s*:\s*\**1111\s*:\s*env`, out,
 		"credentials must come from the environment under AWS_PROFILE")
-	require.Regexp(t, `region\s*:\s*eu-west-1\s*:\s*config-file`, out,
+	assert.Regexp(t, `region\s*:\s*eu-west-1\s*:\s*config-file`, out,
 		"the profile must still supply the region")
 }
 
@@ -122,7 +123,7 @@ func TestAWSProfileFlagSuppressesEnvironmentCredentials(t *testing.T) {
 	out, err := cmd.CombinedOutput()
 	require.NoError(t, err, "aws configure list failed: %s", out)
 
-	require.Regexp(t, `access_key\s*:\s*\**test\s*:\s*shared-credentials-file`, string(out),
+	assert.Regexp(t, `access_key\s*:\s*\**test\s*:\s*shared-credentials-file`, string(out),
 		"--profile must suppress the environment credentials (the behavior lstk avoids)")
 }
 
@@ -139,7 +140,7 @@ func TestAWSEnvironmentRegionOverridesProfileRegion(t *testing.T) {
 	)
 	out := awsConfigureList(t, e...)
 
-	require.Regexp(t, `region\s*:\s*us-east-1\s*:\s*env`, out,
+	assert.Regexp(t, `region\s*:\s*us-east-1\s*:\s*env`, out,
 		"an environment region outranks the profile's, so lstk must not seed one")
 }
 
@@ -155,5 +156,5 @@ func TestAWSProfileOutranksDefaultProfile(t *testing.T) {
 	)
 	out := awsConfigureList(t, e...)
 
-	require.Regexp(t, `region\s*:\s*eu-west-1\s*:\s*config-file`, out)
+	assert.Regexp(t, `region\s*:\s*eu-west-1\s*:\s*config-file`, out)
 }
diff --git a/test/integration/awsconfig_test.go b/test/integration/awsconfig_test.go
index 2fa7069a..bcf50ae4 100644
--- a/test/integration/awsconfig_test.go
+++ b/test/integration/awsconfig_test.go
@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -62,15 +63,15 @@ func TestStartPromptsWhenAWSProfileMissingEverywhere(t *testing.T) {
 
 	configContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "config"))
 	require.NoError(t, err, "~/.aws/config should have been created")
-	require.Contains(t, string(configContent), "[profile localstack]")
-	require.Contains(t, string(configContent), "endpoint_url")
+	assert.Contains(t, string(configContent), "[profile localstack]")
+	assert.Contains(t, string(configContent), "endpoint_url")
 
 	credsContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "credentials"))
 	require.NoError(t, err, "~/.aws/credentials should have been created")
 	normalizedCreds := strings.Join(strings.Fields(string(credsContent)), " ")
-	require.Contains(t, normalizedCreds, "[localstack]")
-	require.Contains(t, normalizedCreds, "aws_access_key_id = test")
-	require.Contains(t, normalizedCreds, "aws_secret_access_key = test")
+	assert.Contains(t, normalizedCreds, "[localstack]")
+	assert.Contains(t, normalizedCreds, "aws_access_key_id = test")
+	assert.Contains(t, normalizedCreds, "aws_secret_access_key = test")
 }
 
 func TestStartSkipsAWSProfilePromptWhenAlreadyConfigured(t *testing.T) {
@@ -102,7 +103,7 @@ func TestStartSkipsAWSProfilePromptWhenAlreadyConfigured(t *testing.T) {
 	_ = p.cmd.Process.Kill()
 	out, _ := p.wait()
 
-	require.NotContains(t, out, awsSetupPrompt,
+	assert.NotContains(t, out, awsSetupPrompt,
 		"profile prompt should not appear when profile is already correctly configured")
 }
 
@@ -124,7 +125,7 @@ func TestStartNonInteractiveEmitsNoteWhenAWSProfileMissing(t *testing.T) {
 	)
 	require.NoError(t, err)
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdout, "LocalStack AWS profile is incomplete. Run 'lstk setup aws'.")
+	assert.Contains(t, stdout, "LocalStack AWS profile is incomplete. Run 'lstk setup aws'.")
 }
 
 func TestStartEmitsNoteWhenAWSProfileIsPartial(t *testing.T) {
@@ -150,7 +151,7 @@ func TestStartEmitsNoteWhenAWSProfileIsPartial(t *testing.T) {
 	out, err := p.wait()
 	require.NoError(t, err, "lstk start should exit successfully")
 
-	require.NotContains(t, out, "Set up a LocalStack profile for AWS CLI and SDKs in ~/.aws?",
+	assert.NotContains(t, out, "Set up a LocalStack profile for AWS CLI and SDKs in ~/.aws?",
 		"profile prompt should not appear for a partial setup")
 }
 
@@ -170,18 +171,18 @@ func TestSetupAWSCreatesAWSProfileWhenConfirmed(t *testing.T) {
 
 	configContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "config"))
 	require.NoError(t, err, "~/.aws/config should have been created")
-	require.Contains(t, string(configContent), "[profile localstack]")
-	require.Contains(t, string(configContent), "endpoint_url")
+	assert.Contains(t, string(configContent), "[profile localstack]")
+	assert.Contains(t, string(configContent), "endpoint_url")
 
 	credsContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "credentials"))
 	require.NoError(t, err, "~/.aws/credentials should have been created")
 	normalizedCreds := strings.Join(strings.Fields(string(credsContent)), " ")
-	require.Contains(t, normalizedCreds, "[localstack]")
-	require.Contains(t, normalizedCreds, "aws_access_key_id = test")
-	require.Contains(t, normalizedCreds, "aws_secret_access_key = test")
+	assert.Contains(t, normalizedCreds, "[localstack]")
+	assert.Contains(t, normalizedCreds, "aws_access_key_id = test")
+	assert.Contains(t, normalizedCreds, "aws_secret_access_key = test")
 
-	require.Contains(t, out, "Created LocalStack profile in ~/.aws")
-	require.NotContains(t, out, "Skipped adding LocalStack AWS profile.")
+	assert.Contains(t, out, "Created LocalStack profile in ~/.aws")
+	assert.NotContains(t, out, "Skipped adding LocalStack AWS profile.")
 }
 
 // TestSetupAWSExitsNonZeroWhenProfileWriteFails guards DEVX-941. Writing the
@@ -216,8 +217,8 @@ func TestSetupAWSExitsNonZeroWhenProfileWriteFails(t *testing.T) {
 	out, err := p.wait()
 	requireExitCode(t, 1, err)
 
-	require.Contains(t, out, "Could not set up the LocalStack AWS profile")
-	require.NotContains(t, out, "Created LocalStack profile")
+	assert.Contains(t, out, "Could not set up the LocalStack AWS profile")
+	assert.NotContains(t, out, "Created LocalStack profile")
 }
 
 func TestSetupAWSDoesNotCreateAWSProfileWhenDeclined(t *testing.T) {
@@ -234,12 +235,12 @@ func TestSetupAWSDoesNotCreateAWSProfileWhenDeclined(t *testing.T) {
 	require.NoError(t, err)
 
 	_, err = os.Stat(filepath.Join(tmpHome, ".aws", "config"))
-	require.ErrorIs(t, err, os.ErrNotExist)
+	assert.ErrorIs(t, err, os.ErrNotExist)
 	_, err = os.Stat(filepath.Join(tmpHome, ".aws", "credentials"))
-	require.ErrorIs(t, err, os.ErrNotExist)
+	assert.ErrorIs(t, err, os.ErrNotExist)
 
-	require.Contains(t, out, "Skipped adding LocalStack AWS profile.")
-	require.NotContains(t, out, "Created LocalStack profile in ~/.aws/config")
+	assert.Contains(t, out, "Skipped adding LocalStack AWS profile.")
+	assert.NotContains(t, out, "Created LocalStack profile in ~/.aws/config")
 }
 
 func TestSetupAWSNonInteractiveCreatesProfile(t *testing.T) {
@@ -251,20 +252,20 @@ func TestSetupAWSNonInteractiveCreatesProfile(t *testing.T) {
 		"setup", "aws",
 	)
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdout, "Created LocalStack profile in ~/.aws")
-	require.NotContains(t, stdout, "requires an interactive terminal")
+	assert.Contains(t, stdout, "Created LocalStack profile in ~/.aws")
+	assert.NotContains(t, stdout, "requires an interactive terminal")
 
 	configContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "config"))
 	require.NoError(t, err, "~/.aws/config should have been created")
-	require.Contains(t, string(configContent), "[profile localstack]")
-	require.Contains(t, string(configContent), "endpoint_url")
+	assert.Contains(t, string(configContent), "[profile localstack]")
+	assert.Contains(t, string(configContent), "endpoint_url")
 
 	credsContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "credentials"))
 	require.NoError(t, err, "~/.aws/credentials should have been created")
 	normalizedCreds := strings.Join(strings.Fields(string(credsContent)), " ")
-	require.Contains(t, normalizedCreds, "[localstack]")
-	require.Contains(t, normalizedCreds, "aws_access_key_id = test")
-	require.Contains(t, normalizedCreds, "aws_secret_access_key = test")
+	assert.Contains(t, normalizedCreds, "[localstack]")
+	assert.Contains(t, normalizedCreds, "aws_access_key_id = test")
+	assert.Contains(t, normalizedCreds, "aws_secret_access_key = test")
 }
 
 func TestSetupAWSNonInteractiveIsIdempotent(t *testing.T) {
@@ -279,7 +280,7 @@ func TestSetupAWSNonInteractiveIsIdempotent(t *testing.T) {
 	// not be treated as an overwrite (no --force required).
 	stdout, _, err := runLstk(t, testContext(t), "", baseEnv, "setup", "aws")
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdout, "already configured")
+	assert.Contains(t, stdout, "already configured")
 }
 
 func TestSetupAWSNonInteractiveOverwriteRequiresForce(t *testing.T) {
@@ -296,15 +297,15 @@ func TestSetupAWSNonInteractiveOverwriteRequiresForce(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), "", baseEnv, "setup", "aws")
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "--force")
+	assert.Contains(t, stdout, "--force")
 
 	// The existing profile must be left untouched.
 	configContent, err := os.ReadFile(filepath.Join(awsDir, "config"))
 	require.NoError(t, err)
-	require.Contains(t, string(configContent), "example.com:9999", "config must not be overwritten without --force")
+	assert.Contains(t, string(configContent), "example.com:9999", "config must not be overwritten without --force")
 	credsContent, err := os.ReadFile(filepath.Join(awsDir, "credentials"))
 	require.NoError(t, err)
-	require.Contains(t, string(credsContent), "WRONG", "credentials must not be overwritten without --force")
+	assert.Contains(t, string(credsContent), "WRONG", "credentials must not be overwritten without --force")
 }
 
 func TestSetupAWSNonInteractiveForceOverwrites(t *testing.T) {
@@ -323,11 +324,11 @@ func TestSetupAWSNonInteractiveForceOverwrites(t *testing.T) {
 
 	configContent, err := os.ReadFile(filepath.Join(awsDir, "config"))
 	require.NoError(t, err)
-	require.NotContains(t, string(configContent), "example.com", "--force should overwrite the stale endpoint")
-	require.Contains(t, string(configContent), "endpoint_url")
+	assert.NotContains(t, string(configContent), "example.com", "--force should overwrite the stale endpoint")
+	assert.Contains(t, string(configContent), "endpoint_url")
 	credsContent, err := os.ReadFile(filepath.Join(awsDir, "credentials"))
 	require.NoError(t, err)
 	normalizedCreds := strings.Join(strings.Fields(string(credsContent)), " ")
-	require.NotContains(t, normalizedCreds, "WRONG", "--force should overwrite stale credentials")
-	require.Contains(t, normalizedCreds, "aws_access_key_id = test")
+	assert.NotContains(t, normalizedCreds, "WRONG", "--force should overwrite stale credentials")
+	assert.Contains(t, normalizedCreds, "aws_access_key_id = test")
 }
diff --git a/test/integration/az_cmd_test.go b/test/integration/az_cmd_test.go
index 411f4993..177bc6c3 100644
--- a/test/integration/az_cmd_test.go
+++ b/test/integration/az_cmd_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -21,9 +22,9 @@ func TestAzCommandFailsWhenAzureCLINotInstalled(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), workDir, e, "az", "group", "list")
 	require.Error(t, err)
-	require.Contains(t, stdout, "az CLI not found in PATH")
-	require.Contains(t, stdout, "Install Azure CLI:")
-	require.Contains(t, stdout, "https://learn.microsoft.com/en-us/cli/azure/")
+	assert.Contains(t, stdout, "az CLI not found in PATH")
+	assert.Contains(t, stdout, "Install Azure CLI:")
+	assert.Contains(t, stdout, "https://learn.microsoft.com/en-us/cli/azure/")
 }
 
 // azureHealthServer answers like an Azure-flavored emulator: /_localstack/health
@@ -118,9 +119,9 @@ func TestAzCommandStripsGlobalFlagsFromPassthrough(t *testing.T) {
 		"--endpoint-url", srv.URL, "--config", configPath, "--non-interactive", "az", "group", "list")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	require.Contains(t, stdout, "AZ_ARGS:group list")
-	require.NotContains(t, stdout, "--non-interactive")
-	require.NotContains(t, stdout, "--config")
+	assert.Contains(t, stdout, "AZ_ARGS:group list")
+	assert.NotContains(t, stdout, "--non-interactive")
+	assert.NotContains(t, stdout, "--config")
 }
 
 // --config must select the given config file for `lstk az` too: the Azure setup
@@ -136,12 +137,12 @@ func TestAzCommandConfigFlagSelectsConfigFile(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "--config", configPath, "az", "group", "list")
 	require.NoError(t, err, "stderr: %s", stderr)
-	require.Contains(t, stdout, "AZ_ARGS:group list")
+	assert.Contains(t, stdout, "AZ_ARGS:group list")
 
 	stdout, _, err = runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "az", "group", "list")
 	require.Error(t, err, "without --config the azure setup marker must not be found")
-	require.Contains(t, stdout, "Azure CLI integration is not set up")
+	assert.Contains(t, stdout, "Azure CLI integration is not set up")
 }
 
 func TestAzCommandShowsSpinnerForSlowOperation(t *testing.T) {
@@ -153,8 +154,8 @@ func TestAzCommandShowsSpinnerForSlowOperation(t *testing.T) {
 		"--endpoint-url", srv.URL, "az", "group", "list")
 	require.NoError(t, err, "lstk az failed: %s", out)
 
-	require.Contains(t, out, "Loading service")
-	require.Contains(t, out, "AZ_ARGS:group list")
+	assert.Contains(t, out, "Loading service")
+	assert.Contains(t, out, "AZ_ARGS:group list")
 }
 
 // --non-interactive must suppress the spinner: before the flag was stripped in
@@ -168,6 +169,6 @@ func TestAzCommandSuppressesSpinnerInNonInteractiveMode(t *testing.T) {
 		"--endpoint-url", srv.URL, "--non-interactive", "az", "group", "list")
 	require.NoError(t, err, "lstk az failed: %s", out)
 
-	require.NotContains(t, out, "Loading service")
-	require.Contains(t, out, "AZ_ARGS:group list")
+	assert.NotContains(t, out, "Loading service")
+	assert.Contains(t, out, "AZ_ARGS:group list")
 }
diff --git a/test/integration/az_e2e_test.go b/test/integration/az_e2e_test.go
index c8e73217..fb2c1e4b 100644
--- a/test/integration/az_e2e_test.go
+++ b/test/integration/az_e2e_test.go
@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -89,16 +90,16 @@ func TestAzE2ERealCLIOnPTYPreservesOutput(t *testing.T) {
 	// Pipe path: no PTY, so no CR at all, and the JSON is byte-clean.
 	pipedOut, stderr, err := runLstk(t, ctx, workDir, baseEnv, "az", "cloud", "show", "-o", "json")
 	require.NoError(t, err, "lstk az cloud show failed: %s", stderr)
-	require.NotContains(t, pipedOut, "\r", "a redirected stdout must stay a pipe, so the Azure CLI emits bare LFs")
-	require.Equal(t, "LocalStack", cloudNameFromJSON(t, pipedOut))
+	assert.NotContains(t, pipedOut, "\r", "a redirected stdout must stay a pipe, so the Azure CLI emits bare LFs")
+	assert.Equal(t, "LocalStack", cloudNameFromJSON(t, pipedOut))
 
 	// PTY path: the real az ran on a terminal, and its output is still valid JSON
 	// once the PTY's CRs are stripped — the property a `lstk az ... -o json`
 	// consumer depends on.
 	ptyOut := runLstkAzInPTY(t, ctx, workDir, baseEnv, "az", "cloud", "show", "-o", "json")
-	require.True(t, hasInnerPTYLineEndings(ptyOut),
+	assert.True(t, hasInnerPTYLineEndings(ptyOut),
 		"the real Azure CLI must run on a PTY when lstk's stdout and stderr are terminals (DEVX-1028); got:\n%q", ptyOut)
-	require.Equal(t, "LocalStack", cloudNameFromJSON(t, ptyOut))
+	assert.Equal(t, "LocalStack", cloudNameFromJSON(t, ptyOut))
 }
 
 // cloudNameFromJSON extracts .name from an `az cloud show -o json` payload,
diff --git a/test/integration/az_interception_test.go b/test/integration/az_interception_test.go
index 0170419b..f9224ded 100644
--- a/test/integration/az_interception_test.go
+++ b/test/integration/az_interception_test.go
@@ -10,6 +10,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -42,8 +43,8 @@ func TestAzStartInterceptionRoutesToSubcommand(t *testing.T) {
 		"az", "start-interception",
 	)
 	require.Error(t, err)
-	require.Contains(t, stdout, "az CLI not found in PATH")
-	require.NotContains(t, stdout, "not set up")
+	assert.Contains(t, stdout, "az CLI not found in PATH")
+	assert.NotContains(t, stdout, "not set up")
 }
 
 // stop-interception is a safe no-op when LocalStack is not the active cloud — e.g.
@@ -61,12 +62,12 @@ func TestAzStopInterceptionNoOpWhenNotIntercepting(t *testing.T) {
 		"az", "stop-interception",
 	)
 	require.NoError(t, err, "stop-interception must not fail when LocalStack is not active")
-	require.Contains(t, stdout, "not the active Azure cloud")
+	assert.Contains(t, stdout, "not the active Azure cloud")
 
 	// It must not have switched the active cloud to anything.
 	active, azErr := runAzRaw(t, testContext(t), env.WithHome(home), "cloud", "show", "--query", "name", "-o", "tsv")
 	require.NoError(t, azErr)
-	require.Equal(t, "AzureCloud", active)
+	assert.Equal(t, "AzureCloud", active)
 }
 
 func TestAzStopInterceptionFailsWhenAzureCLINotInstalled(t *testing.T) {
@@ -78,8 +79,8 @@ func TestAzStopInterceptionFailsWhenAzureCLINotInstalled(t *testing.T) {
 		"az", "stop-interception",
 	)
 	require.Error(t, err)
-	require.Contains(t, stdout, "az CLI not found in PATH")
-	require.Contains(t, stdout, "Install Azure CLI:")
+	assert.Contains(t, stdout, "az CLI not found in PATH")
+	assert.Contains(t, stdout, "Install Azure CLI:")
 }
 
 // TestAzInterception exercises the full start/stop-interception lifecycle against a real
@@ -127,21 +128,21 @@ func TestAzInterception(t *testing.T) {
 	// start-interception: global `az` now points at LocalStack.
 	stdout, stderr, err := runLstk(t, ctx, workDir, baseEnv, "az", "start-interception")
 	require.NoError(t, err, "start-interception failed: stdout=%s stderr=%s", stdout, stderr)
-	require.Contains(t, stdout, "Interception active")
-	require.Contains(t, stdout, "stop-interception")
-	require.Equal(t, "LocalStack", activeCloud(), "LocalStack should be the active global cloud after start-interception")
+	assert.Contains(t, stdout, "Interception active")
+	assert.Contains(t, stdout, "stop-interception")
+	assert.Equal(t, "LocalStack", activeCloud(), "LocalStack should be the active global cloud after start-interception")
 
 	// stop-interception (default): back to AzureCloud.
 	stdout, stderr, err = runLstk(t, ctx, workDir, baseEnv, "az", "stop-interception")
 	require.NoError(t, err, "stop-interception failed: stdout=%s stderr=%s", stdout, stderr)
-	require.Contains(t, stdout, "Interception stopped")
-	require.Equal(t, "AzureCloud", activeCloud())
+	assert.Contains(t, stdout, "Interception stopped")
+	assert.Equal(t, "AzureCloud", activeCloud())
 
 	// no-op guard: LocalStack is no longer active, so stop must not clobber AzureCloud.
 	stdout, _, err = runLstk(t, ctx, workDir, baseEnv, "az", "stop-interception")
 	require.NoError(t, err)
-	require.Contains(t, stdout, "not the active Azure cloud")
-	require.Equal(t, "AzureCloud", activeCloud())
+	assert.Contains(t, stdout, "not the active Azure cloud")
+	assert.Equal(t, "AzureCloud", activeCloud())
 
 	// unknown --cloud is rejected (only reached because LocalStack is active again).
 	_, _, err = runLstk(t, ctx, workDir, baseEnv, "az", "start-interception")
@@ -149,11 +150,11 @@ func TestAzInterception(t *testing.T) {
 	require.Equal(t, "LocalStack", activeCloud())
 	_, stderr, err = runLstk(t, ctx, workDir, baseEnv, "az", "stop-interception", "--cloud", "NotARealCloud")
 	require.Error(t, err)
-	require.Contains(t, stderr, "unknown Azure cloud 'NotARealCloud'")
-	require.Equal(t, "LocalStack", activeCloud(), "rejected --cloud must not change the active cloud")
+	assert.Contains(t, stderr, "unknown Azure cloud 'NotARealCloud'")
+	assert.Equal(t, "LocalStack", activeCloud(), "rejected --cloud must not change the active cloud")
 
 	// --cloud override switches to the requested registered cloud.
 	stdout, stderr, err = runLstk(t, ctx, workDir, baseEnv, "az", "stop-interception", "--cloud", "AzureChinaCloud")
 	require.NoError(t, err, "stop-interception --cloud failed: stdout=%s stderr=%s", stdout, stderr)
-	require.Equal(t, "AzureChinaCloud", activeCloud())
+	assert.Equal(t, "AzureChinaCloud", activeCloud())
 }
diff --git a/test/integration/az_pty_test.go b/test/integration/az_pty_test.go
index 04efdaea..2a000933 100644
--- a/test/integration/az_pty_test.go
+++ b/test/integration/az_pty_test.go
@@ -14,6 +14,7 @@ import (
 	"time"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -120,8 +121,8 @@ func TestAzStreamsInPTY(t *testing.T) {
 
 	// The two mechanisms that keep the symptom above from returning, asserted
 	// separately so a regression in either one is named rather than inferred.
-	require.Contains(t, p.output(), "STDOUT_TTY:yes", "the Azure CLI must be handed a terminal, not a pipe (DEVX-1028)")
-	require.Contains(t, p.output(), "PYTHONUNBUFFERED:1")
+	assert.Contains(t, p.output(), "STDOUT_TTY:yes", "the Azure CLI must be handed a terminal, not a pipe (DEVX-1028)")
+	assert.Contains(t, p.output(), "PYTHONUNBUFFERED:1")
 
 	// Ctrl-C via the PTY reaches the whole foreground process group (lstk and
 	// the az child), matching how a user stops a streaming command.
@@ -152,6 +153,6 @@ func TestAzWithPipedStdoutKeepsPipe(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), workDir, e, "--endpoint-url", srv.URL, "az", "group", "list")
 	require.NoError(t, err, "stderr: %s", stderr)
-	require.Contains(t, stdout, "STDOUT_TTY:no")
-	require.Contains(t, stdout, "piped")
+	assert.Contains(t, stdout, "STDOUT_TTY:no")
+	assert.Contains(t, stdout, "piped")
 }
diff --git a/test/integration/cdk_cmd_test.go b/test/integration/cdk_cmd_test.go
index b586b754..c229c5fa 100644
--- a/test/integration/cdk_cmd_test.go
+++ b/test/integration/cdk_cmd_test.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -49,7 +50,7 @@ func TestCDKForwardsArgs(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
 	require.NoError(t, err, "stderr: %s", stderr)
-	require.Contains(t, stdout, "ARGS:synth")
+	assert.Contains(t, stdout, "ARGS:synth")
 }
 
 // 7.1 — propagates the cdk exit code.
@@ -60,7 +61,7 @@ func TestCDKPropagatesExitCode(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
 	require.Error(t, err)
-	require.Contains(t, stderr, "simulated failure")
+	assert.Contains(t, stderr, "simulated failure")
 	requireExitCode(t, 7, err)
 }
 
@@ -104,8 +105,8 @@ func TestCDKOfflineCommandsNoEmulator(t *testing.T) {
 				"cdk", "--region", "us-west-2", sub)
 			require.NoError(t, err, "stderr: %s", stderr)
 
-			require.Contains(t, stdout, "ARGS:"+sub)
-			require.NotContains(t, stdout, "--region")
+			assert.Contains(t, stdout, "ARGS:"+sub)
+			assert.NotContains(t, stdout, "--region")
 		})
 	}
 }
@@ -125,7 +126,7 @@ func TestCDKHelpNoEmulator(t *testing.T) {
 			cmdArgs := append([]string{"cdk"}, args...)
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, cmdArgs...)
 			require.NoError(t, err, "stderr: %s", stderr)
-			require.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
+			assert.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
 		})
 	}
 }
@@ -138,9 +139,9 @@ func TestCDKVersionTooOld(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
 	require.Error(t, err)
-	require.Contains(t, stderr+stdout, "2.177.0")
+	assert.Contains(t, stderr+stdout, "2.177.0")
 	// cdk was never run for real.
-	require.NotContains(t, stdout, "ARGS:synth")
+	assert.NotContains(t, stdout, "ARGS:synth")
 }
 
 // 7.5 — a missing cdk binary yields the install error.
@@ -150,7 +151,7 @@ func TestCDKMissingBinary(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
 	require.Error(t, err)
-	require.Contains(t, stderr+stdout, "not found in PATH")
+	assert.Contains(t, stderr+stdout, "not found in PATH")
 }
 
 // 7.6 — --account is not supported for cdk and is rejected at the command
@@ -167,8 +168,8 @@ func TestCDKAccountRejected(t *testing.T) {
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 				"cdk", "--account", value, "synth")
 			require.Error(t, err)
-			require.Contains(t, stderr+stdout, "not supported")
-			require.NotContains(t, stdout, "ARGS:synth")
+			assert.Contains(t, stderr+stdout, "not supported")
+			assert.NotContains(t, stdout, "ARGS:synth")
 		})
 	}
 }
@@ -182,7 +183,7 @@ func TestCDKFlagsAfterActionAreForwarded(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"cdk", "synth", "--region", "us-west-2")
 	require.NoError(t, err, "stderr: %s", stderr)
-	require.Contains(t, stdout, "ARGS:synth --region us-west-2")
+	assert.Contains(t, stdout, "ARGS:synth --region us-west-2")
 }
 
 // 7.6 — a flag before the subcommand is rejected with a clear message.
@@ -194,7 +195,7 @@ func TestCDKFlagBeforeSubcommandRejected(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--account", "111111111111", "cdk", "synth")
 	require.Error(t, err)
-	require.Contains(t, stderr+stdout, "must appear after the cdk subcommand")
+	assert.Contains(t, stderr+stdout, "must appear after the cdk subcommand")
 }
 
 // 7.7 — LSTK_CDK_CMD selects the binary to invoke.
@@ -209,7 +210,7 @@ func TestCDKHonorsLstkCdkCmd(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
 	require.NoError(t, err, "stderr: %s", stderr)
-	require.Contains(t, stdout, "MYCDK:synth")
+	assert.Contains(t, stdout, "MYCDK:synth")
 }
 
 // 7.3 — an AWS-contacting command with no running emulator fails with "not
@@ -224,9 +225,9 @@ func TestCDKFailsWhenEmulatorNotRunning(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "deploy")
 	require.Error(t, err)
-	require.Contains(t, stdout, "is not running")
-	require.Contains(t, stdout, "Start LocalStack:")
-	require.NotContains(t, stdout, "ARGS:deploy")
+	assert.Contains(t, stdout, "is not running")
+	assert.Contains(t, stdout, "Start LocalStack:")
+	assert.NotContains(t, stdout, "ARGS:deploy")
 }
 
 // 7.3 — an AWS-contacting command fails with an AWS-specific error naming the
@@ -246,7 +247,7 @@ func TestCDKRequiresAWSEmulator(t *testing.T) {
 
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), e, "cdk", "deploy")
 	require.Error(t, err)
-	require.Contains(t, stdout, "requires the")
-	require.Contains(t, stdout, "Snowflake")
-	require.NotContains(t, stdout, "ARGS:deploy")
+	assert.Contains(t, stdout, "requires the")
+	assert.Contains(t, stdout, "Snowflake")
+	assert.NotContains(t, stdout, "ARGS:deploy")
 }
diff --git a/test/integration/completion_test.go b/test/integration/completion_test.go
index 4d5951c6..948eb114 100644
--- a/test/integration/completion_test.go
+++ b/test/integration/completion_test.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/localstack/lstk/test/integration/env"
@@ -102,12 +103,12 @@ func TestBashCompletionWorksWithoutBashCompletionPackage(t *testing.T) {
 
 	stdout, stderr, err := runBashCompletionDriver(t, completeInDriver("lstk st", 1, "lstk st"))
 	require.NoError(t, err, "completion attempt failed\nstdout: %s\nstderr: %s", stdout, stderr)
-	require.NotContains(t, stderr, "command not found")
+	assert.NotContains(t, stderr, "command not found")
 
 	completions := strings.Fields(stdout)
-	require.Contains(t, completions, "start")
-	require.Contains(t, completions, "status")
-	require.Contains(t, completions, "stop")
+	assert.Contains(t, completions, "start")
+	assert.Contains(t, completions, "status")
+	assert.Contains(t, completions, "stop")
 }
 
 // TestBashCompletionAfterWhitespaceSeparatedFlagValue covers the shape that
@@ -122,9 +123,9 @@ func TestBashCompletionAfterWhitespaceSeparatedFlagValue(t *testing.T) {
 	require.NoError(t, err, "completion attempt failed\nstdout: %s\nstderr: %s", stdout, stderr)
 
 	completions := strings.Fields(stdout)
-	require.Contains(t, completions, "start")
-	require.Contains(t, completions, "status")
-	require.Contains(t, completions, "stop")
+	assert.Contains(t, completions, "start")
+	assert.Contains(t, completions, "status")
+	assert.Contains(t, completions, "stop")
 }
 
 // TestBashCompletionReassemblesWordbreakSplits verifies the self-contained
@@ -194,10 +195,10 @@ run_reassembly
 
 			stdout, stderr, err := runBashCompletionDriver(t, driver)
 			require.NoError(t, err, "driver failed\nstdout: %s\nstderr: %s", stdout, stderr)
-			require.NotContains(t, stderr, "command not found")
+			assert.NotContains(t, stderr, "command not found")
 
 			lines := strings.Split(strings.TrimRight(stdout, "\n"), "\n")
-			require.Equal(t, tc.expect, lines)
+			assert.Equal(t, tc.expect, lines)
 		})
 	}
 }
@@ -214,5 +215,5 @@ _get_comp_words_by_ref
 `
 	stdout, stderr, err := runBashCompletionDriver(t, driver)
 	require.NoError(t, err, "driver failed\nstdout: %s\nstderr: %s", stdout, stderr)
-	require.Contains(t, stdout, "package version")
+	assert.Contains(t, stdout, "package version")
 }
diff --git a/test/integration/config_test.go b/test/integration/config_test.go
index bc794e4a..f1fbbb41 100644
--- a/test/integration/config_test.go
+++ b/test/integration/config_test.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -42,7 +43,7 @@ IAM_SOFT_MODE = "1"
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
 	require.NoError(t, err, "failed to inspect container")
-	require.Contains(t, inspect.Container.Config.Env, "IAM_SOFT_MODE=1")
+	assert.Contains(t, inspect.Container.Config.Env, "IAM_SOFT_MODE=1")
 }
 
 func TestConfigFlagOverridesConfigPath(t *testing.T) {
@@ -127,7 +128,7 @@ func TestConfigPathCommandDoesNotCreateConfig(t *testing.T) {
 	requireExitCode(t, 0, err)
 
 	assertSamePath(t, expectedConfigFile, stdout)
-	require.NoFileExists(t, expectedConfigFile)
+	assert.NoFileExists(t, expectedConfigFile)
 }
 
 func TestConfigWithUnknownFieldsIsAccepted(t *testing.T) {
@@ -162,7 +163,7 @@ tag = "latest"
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "stop")
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "port is required")
+	assert.Contains(t, stderr, "port is required")
 }
 
 func TestConfigWithInvalidContainerNameFails(t *testing.T) {
@@ -181,7 +182,7 @@ container_name = "my emulator"
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "stop")
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout+stderr, `invalid container name "my emulator"`)
+	assert.Contains(t, stdout+stderr, `invalid container name "my emulator"`)
 }
 
 func TestStartWithMultipleContainersFailsFast(t *testing.T) {
@@ -203,7 +204,7 @@ port = "4567"
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "start")
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout+stderr, "only one is supported at a time")
+	assert.Contains(t, stdout+stderr, "only one is supported at a time")
 }
 
 func TestLegacyYAMLConfigGivesHelpfulError(t *testing.T) {
@@ -224,8 +225,8 @@ func TestLegacyYAMLConfigGivesHelpfulError(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), workDir, e, "logout")
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "config.yaml")
-	require.Contains(t, stderr, "TOML")
+	assert.Contains(t, stderr, "config.yaml")
+	assert.Contains(t, stderr, "TOML")
 }
 
 func TestConfigWithMissingOptionalTagSucceeds(t *testing.T) {
@@ -282,7 +283,7 @@ func writeConfigFile(t *testing.T, path string) {
 
 func assertSamePath(t *testing.T, expectedPath, actualPath string) {
 	t.Helper()
-	require.Equal(
+	assert.Equal(
 		t,
 		normalizedPath(expectedPath),
 		normalizedPath(actualPath),
diff --git a/test/integration/docker_unhealthy_test.go b/test/integration/docker_unhealthy_test.go
index fd33fe3b..e925d18c 100644
--- a/test/integration/docker_unhealthy_test.go
+++ b/test/integration/docker_unhealthy_test.go
@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -23,8 +24,8 @@ func TestStartShowsDockerErrorWhenUnhealthy(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), "", unhealthyDockerEnv(), "start")
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "Docker is not available")
-	require.Contains(t, stdout, "Install Docker:")
+	assert.Contains(t, stdout, "Docker is not available")
+	assert.Contains(t, stdout, "Install Docker:")
 }
 
 func TestStopShowsDockerErrorWhenUnhealthy(t *testing.T) {
@@ -36,8 +37,8 @@ func TestStopShowsDockerErrorWhenUnhealthy(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), "", unhealthyDockerEnv(), "stop")
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "Docker is not available")
-	require.Contains(t, stdout, "Install Docker:")
+	assert.Contains(t, stdout, "Docker is not available")
+	assert.Contains(t, stdout, "Install Docker:")
 }
 
 // TestStopJSONIncludesDockerErrorDetail covers PR #374's report that --json
@@ -55,10 +56,10 @@ func TestStopJSONIncludesDockerErrorDetail(t *testing.T) {
 
 	envelope := decodeEnvelope(t, stdout)
 	require.NotNil(t, envelope.Error)
-	require.Equal(t, "RUNTIME_UNAVAILABLE", envelope.Error.Code)
-	require.Equal(t, "Docker is not available", envelope.Error.Message)
+	assert.Equal(t, "RUNTIME_UNAVAILABLE", envelope.Error.Code)
+	assert.Equal(t, "Docker is not available", envelope.Error.Message)
 	summary, _ := envelope.Error.Details["summary"].(string)
-	require.Contains(t, summary, "cannot connect to Docker daemon")
+	assert.Contains(t, summary, "cannot connect to Docker daemon")
 }
 
 func TestStatusShowsDockerErrorWhenUnhealthy(t *testing.T) {
@@ -70,8 +71,8 @@ func TestStatusShowsDockerErrorWhenUnhealthy(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), "", unhealthyDockerEnv(), "status")
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "Docker is not available")
-	require.Contains(t, stdout, "Install Docker:")
+	assert.Contains(t, stdout, "Docker is not available")
+	assert.Contains(t, stdout, "Install Docker:")
 }
 
 func TestLogsShowsDockerErrorWhenUnhealthy(t *testing.T) {
@@ -83,6 +84,6 @@ func TestLogsShowsDockerErrorWhenUnhealthy(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), "", unhealthyDockerEnv(), "logs")
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "Docker is not available")
-	require.Contains(t, stdout, "Install Docker:")
+	assert.Contains(t, stdout, "Docker is not available")
+	assert.Contains(t, stdout, "Install Docker:")
 }
diff --git a/test/integration/docker_windows_test.go b/test/integration/docker_windows_test.go
index a24fd50a..01f314f0 100644
--- a/test/integration/docker_windows_test.go
+++ b/test/integration/docker_windows_test.go
@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -25,7 +26,7 @@ func TestWindowsDockerErrorShowsDockerCLICommand(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), "", windowsDockerErrorEnv(), "start")
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "docker desktop start")
+	assert.Contains(t, stdout, "docker desktop start")
 }
 
 // Verifies that the verbose Docker error message is suppressed on Windows.
@@ -38,6 +39,6 @@ func TestWindowsDockerErrorOmitsVerboseSummary(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), "", windowsDockerErrorEnv(), "start")
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "Docker is not available")
-	require.NotContains(t, stdout, "cannot connect to Docker daemon")
+	assert.Contains(t, stdout, "Docker is not available")
+	assert.NotContains(t, stdout, "cannot connect to Docker daemon")
 }
diff --git a/test/integration/docs_test.go b/test/integration/docs_test.go
index d9e8f3ce..00d3e37b 100644
--- a/test/integration/docs_test.go
+++ b/test/integration/docs_test.go
@@ -4,6 +4,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -15,9 +16,9 @@ func TestDocsCommandGeneratesManPages(t *testing.T) {
 	require.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 
-	require.FileExists(t, filepath.Join(dir, "lstk.1"))
-	require.FileExists(t, filepath.Join(dir, "lstk-start.1"))
-	require.FileExists(t, filepath.Join(dir, "lstk-stop.1"))
+	assert.FileExists(t, filepath.Join(dir, "lstk.1"))
+	assert.FileExists(t, filepath.Join(dir, "lstk-start.1"))
+	assert.FileExists(t, filepath.Join(dir, "lstk-stop.1"))
 }
 
 func TestDocsCommandGeneratesMarkdown(t *testing.T) {
@@ -28,9 +29,9 @@ func TestDocsCommandGeneratesMarkdown(t *testing.T) {
 	require.NoError(t, err, stderr)
 	requireExitCode(t, 0, err)
 
-	require.FileExists(t, filepath.Join(dir, "lstk.md"))
-	require.FileExists(t, filepath.Join(dir, "lstk_start.md"))
-	require.FileExists(t, filepath.Join(dir, "lstk_stop.md"))
+	assert.FileExists(t, filepath.Join(dir, "lstk.md"))
+	assert.FileExists(t, filepath.Join(dir, "lstk_start.md"))
+	assert.FileExists(t, filepath.Join(dir, "lstk_stop.md"))
 }
 
 func TestDocsCommandRejectsInvalidFormat(t *testing.T) {
@@ -47,5 +48,5 @@ func TestDocsCommandIsHidden(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--help")
 	require.NoError(t, err, stderr)
 
-	require.NotContains(t, stdout, "docs")
+	assert.NotContains(t, stdout, "docs")
 }
diff --git a/test/integration/emulator_select_test.go b/test/integration/emulator_select_test.go
index bc26af74..8dead502 100644
--- a/test/integration/emulator_select_test.go
+++ b/test/integration/emulator_select_test.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -31,7 +32,7 @@ func TestNoEmulatorSelectionWhenConfigExists(t *testing.T) {
 
 	p := startLstkInPTY(t, ctx, e, "start")
 
-	require.Never(t, func() bool {
+	assert.Never(t, func() bool {
 		return strings.Contains(p.output(), "Which emulator would you like to use?")
 	}, 2*time.Second, 100*time.Millisecond, "emulator selection prompt should not appear when config already exists")
 
@@ -68,7 +69,7 @@ func TestFirstRunShowsEmulatorSelectionPrompt(t *testing.T) {
 	// so the file is guaranteed to exist and contain the selection by this point.
 	configData, err := os.ReadFile(configPath)
 	require.NoError(t, err)
-	require.Contains(t, string(configData), `type = "aws"`)
+	assert.Contains(t, string(configData), `type = "aws"`)
 
 	p.kill()
 }
@@ -130,7 +131,7 @@ func TestFirstRunCanSelectAzureEmulator(t *testing.T) {
 
 	p.waitForOutput("Which emulator would you like to use?", "emulator selection prompt should appear on first run")
 
-	require.Contains(t, p.output(), "Azure", "Azure should be offered as a selectable emulator")
+	assert.Contains(t, p.output(), "Azure", "Azure should be offered as a selectable emulator")
 
 	// Press the Azure selection key ('z') instead of the default-highlighted AWS.
 	p.write("z")
@@ -139,7 +140,7 @@ func TestFirstRunCanSelectAzureEmulator(t *testing.T) {
 
 	configData, err := os.ReadFile(configPath)
 	require.NoError(t, err)
-	require.Contains(t, string(configData), `type = "azure"`)
+	assert.Contains(t, string(configData), `type = "azure"`)
 
 	p.kill()
 }
@@ -170,7 +171,7 @@ func TestFirstRunPromptsForLoginBeforeEmulatorSelection(t *testing.T) {
 
 	p.waitForOutput("Press any key when complete", "auth prompt should appear on first run when no token is set")
 
-	require.NotContains(t, p.output(), "Which emulator would you like to use?",
+	assert.NotContains(t, p.output(), "Which emulator would you like to use?",
 		"emulator selection prompt must not appear before auth completes")
 
 	p.write("\r")
@@ -193,8 +194,8 @@ func TestFirstRunNonInteractiveEmitsDefaultEmulatorNote(t *testing.T) {
 
 	// Process fails at container.Start (no Docker), but the note is emitted before that.
 	stdout, _, runErr := runLstk(t, testContext(t), "", e.With(env.AuthToken, "test-token"), "--non-interactive")
-	require.Error(t, runErr, "expected failure: no Docker available")
-	require.Contains(t, stdout, "Configured with default emulator", "non-interactive first run should note the default emulator")
+	assert.Error(t, runErr, "expected failure: no Docker available")
+	assert.Contains(t, stdout, "Configured with default emulator", "non-interactive first run should note the default emulator")
 }
 
 // A first run that fails before doing any work (no Docker) leaves no config, so
@@ -214,7 +215,7 @@ func TestEmulatorSelectionReappearsAfterFailedFirstRun(t *testing.T) {
 	noDocker := base.With(env.Key("DOCKER_HOST"), "tcp://localhost:1")
 	stdout, _, runErr := runLstk(t, testContext(t), "", noDocker, "--non-interactive")
 	require.Error(t, runErr, "first run should fail when Docker is unavailable")
-	require.Contains(t, stdout, "Docker is not available")
+	assert.Contains(t, stdout, "Docker is not available")
 	require.NoFileExists(t, configPath, "a run that fails before doing any work must not create a config")
 
 	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
@@ -285,9 +286,9 @@ func TestFirstRunChecksDockerBeforeAuthAndSelection(t *testing.T) {
 	out, err := runLstkInPTY(t, ctx, e, "start")
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	require.Contains(t, out, "Docker is not available")
-	require.NotContains(t, out, "Press any key when complete",
+	assert.Contains(t, out, "Docker is not available")
+	assert.NotContains(t, out, "Press any key when complete",
 		"login prompt must not appear when the runtime is unavailable")
-	require.NotContains(t, out, "Which emulator would you like to use?",
+	assert.NotContains(t, out, "Which emulator would you like to use?",
 		"emulator selection must not appear when the runtime is unavailable")
 }
diff --git a/test/integration/emulator_type_test.go b/test/integration/emulator_type_test.go
index 13478854..e11109ea 100644
--- a/test/integration/emulator_type_test.go
+++ b/test/integration/emulator_type_test.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -57,10 +58,10 @@ func TestStartTypeFlagFirstRunCreatesConfig(t *testing.T) {
 
 	stdout, _, _ := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "snowflake", "--non-interactive")
 
-	require.Contains(t, stdout, "Snowflake emulator selected.")
+	assert.Contains(t, stdout, "Snowflake emulator selected.")
 	data, err := os.ReadFile(configPath)
 	require.NoError(t, err)
-	require.Contains(t, string(data), `type = "snowflake"`)
+	assert.Contains(t, string(data), `type = "snowflake"`)
 }
 
 // TestBareRootTypeFlagCreatesConfig covers the bare-root form (no "start"
@@ -75,10 +76,10 @@ func TestBareRootTypeFlagCreatesConfig(t *testing.T) {
 
 	stdout, _, _ := runLstk(t, testContext(t), t.TempDir(), e, "--type", "azure", "--non-interactive")
 
-	require.Contains(t, stdout, "Azure emulator selected.")
+	assert.Contains(t, stdout, "Azure emulator selected.")
 	data, err := os.ReadFile(configPath)
 	require.NoError(t, err)
-	require.Contains(t, string(data), `type = "azure"`)
+	assert.Contains(t, string(data), `type = "azure"`)
 }
 
 func TestStartTypeFlagSwitchesInPlace(t *testing.T) {
@@ -90,13 +91,13 @@ func TestStartTypeFlagSwitchesInPlace(t *testing.T) {
 
 	stdout, _, _ := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "azure", "--non-interactive")
 
-	require.Contains(t, stdout, "Switched configured emulator to Azure")
+	assert.Contains(t, stdout, "Switched configured emulator to Azure")
 	data, err := os.ReadFile(configPath)
 	require.NoError(t, err)
-	require.Contains(t, string(data), `type = "azure"`)
+	assert.Contains(t, string(data), `type = "azure"`)
 	// The surgical rewrite preserves the inline comment and other fields.
-	require.Contains(t, string(data), "# keep me")
-	require.Contains(t, string(data), `port = "4566"`)
+	assert.Contains(t, string(data), "# keep me")
+	assert.Contains(t, string(data), `port = "4566"`)
 }
 
 func TestStartTypeFlagNoOpWhenMatching(t *testing.T) {
@@ -109,10 +110,10 @@ func TestStartTypeFlagNoOpWhenMatching(t *testing.T) {
 
 	stdout, _, _ := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "aws", "--non-interactive")
 
-	require.NotContains(t, stdout, "Switched configured emulator")
+	assert.NotContains(t, stdout, "Switched configured emulator")
 	data, err := os.ReadFile(configPath)
 	require.NoError(t, err)
-	require.Equal(t, content, string(data))
+	assert.Equal(t, content, string(data))
 }
 
 func TestStartTypeFlagErrorsWhenImageSet(t *testing.T) {
@@ -126,11 +127,11 @@ func TestStartTypeFlagErrorsWhenImageSet(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "snowflake", "--non-interactive")
 
 	require.Error(t, err)
-	require.Contains(t, stdout, "Cannot switch emulator to Snowflake while a custom image is set")
+	assert.Contains(t, stdout, "Cannot switch emulator to Snowflake while a custom image is set")
 	// Config must be left untouched.
 	data, readErr := os.ReadFile(configPath)
 	require.NoError(t, readErr)
-	require.Equal(t, content, string(data))
+	assert.Equal(t, content, string(data))
 }
 
 // TestStartTypeErrorsOnMultipleBlocks verifies the switch refuses a config with
@@ -147,11 +148,11 @@ func TestStartTypeErrorsOnMultipleBlocks(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "azure", "--non-interactive")
 
 	require.Error(t, err)
-	require.Contains(t, stdout, "Unsupported configuration")
+	assert.Contains(t, stdout, "Unsupported configuration")
 	// Config must be left untouched — neither block's type is rewritten.
 	data, readErr := os.ReadFile(configPath)
 	require.NoError(t, readErr)
-	require.Equal(t, content, string(data))
+	assert.Equal(t, content, string(data))
 }
 
 // TestStartTypePositionalRejected pins that the emulator is a flag only: a
@@ -167,7 +168,7 @@ func TestStartTypePositionalRejected(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "azure", "--non-interactive")
 
 	require.Error(t, err)
-	require.Contains(t, stderr, "select the emulator with --type")
+	assert.Contains(t, stderr, "select the emulator with --type")
 	require.NoFileExists(t, configPath)
 }
 
@@ -186,11 +187,11 @@ func TestStartTypeErrorsWhenNoContainersBlock(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "azure", "--non-interactive")
 
 	require.Error(t, err)
-	require.Contains(t, stderr, "[[containers]] block")
+	assert.Contains(t, stderr, "[[containers]] block")
 	// The env table's type key must be left untouched, not corrupted to "azure".
 	data, readErr := os.ReadFile(configPath)
 	require.NoError(t, readErr)
-	require.Equal(t, content, string(data))
+	assert.Equal(t, content, string(data))
 }
 
 func TestStartTypeInvalidValue(t *testing.T) {
@@ -200,7 +201,7 @@ func TestStartTypeInvalidValue(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "bogus", "--non-interactive")
 
 	require.Error(t, err)
-	require.Contains(t, stderr, `invalid emulator type "bogus"`)
+	assert.Contains(t, stderr, `invalid emulator type "bogus"`)
 }
 
 // TestStartTypeFlagRefusesSwitchWhenDifferentEmulatorRunning is the end-to-end
@@ -238,12 +239,12 @@ func TestStartTypeFlagRefusesSwitchWhenDifferentEmulatorRunning(t *testing.T) {
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), e, "start", "--type", "snowflake", "--non-interactive")
 
 	require.Error(t, err)
-	require.Contains(t, stdout, "LocalStack Azure Emulator is running on port 4566")
-	require.Contains(t, stdout, "config was not changed")
-	require.Contains(t, stdout, "docker stop localstack-external-azure")
+	assert.Contains(t, stdout, "LocalStack Azure Emulator is running on port 4566")
+	assert.Contains(t, stdout, "config was not changed")
+	assert.Contains(t, stdout, "docker stop localstack-external-azure")
 
 	// Config must be left untouched: still Azure, not rewritten to Snowflake.
 	data, readErr := os.ReadFile(configPath)
 	require.NoError(t, readErr)
-	require.Equal(t, content, string(data))
+	assert.Equal(t, content, string(data))
 }
diff --git a/test/integration/endpoint_url_https_test.go b/test/integration/endpoint_url_https_test.go
index 90d680de..2b4732a6 100644
--- a/test/integration/endpoint_url_https_test.go
+++ b/test/integration/endpoint_url_https_test.go
@@ -15,6 +15,7 @@ import (
 
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -84,8 +85,8 @@ func TestAWSCommandEndpointURLHTTPSNoDockerRequired(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "aws", "s3", "ls")
 	require.NoError(t, err, "stderr: %s", stderr)
-	require.Contains(t, stdout, "ENDPOINT:"+srv.URL)
-	require.Contains(t, stdout, "ARGS:s3 ls")
+	assert.Contains(t, stdout, "ENDPOINT:"+srv.URL)
+	assert.Contains(t, stdout, "ARGS:s3 ls")
 }
 
 // TestCDKCommandEndpointURLHTTPSNoDockerRequired mirrors
@@ -106,7 +107,7 @@ func TestCDKCommandEndpointURLHTTPSNoDockerRequired(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "cdk", "deploy", "MyStack")
 	require.NoError(t, err, "stderr: %s", stderr)
-	require.Contains(t, stdout, "ENV_AWS_ENDPOINT_URL="+srv.URL)
+	assert.Contains(t, stdout, "ENV_AWS_ENDPOINT_URL="+srv.URL)
 }
 
 // TestSnapshotSaveEndpointURLHTTPSNoDockerRequired proves the emulator-client
@@ -143,8 +144,8 @@ func TestSnapshotSaveEndpointURLHTTPSNoDockerRequired(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), dir, e, "--endpoint-url", srv.URL, "snapshot", "save")
 	require.NoError(t, err, "stderr: %s", stderr)
-	require.Contains(t, stdout, "Snapshot saved")
-	require.Equal(t, "/_localstack/pods/state", gotPath)
+	assert.Contains(t, stdout, "Snapshot saved")
+	assert.Equal(t, "/_localstack/pods/state", gotPath)
 }
 
 // TestStatusEndpointURLHTTPSchemeMismatchSuggestsHTTPS covers the confusing
@@ -165,10 +166,10 @@ func TestStatusEndpointURLHTTPSchemeMismatchSuggestsHTTPS(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", httpURL, "status")
 	require.Error(t, err)
-	require.Contains(t, stderr, "could not reach LocalStack emulator at "+httpURL)
-	require.Contains(t, stderr, srv.URL+" responded")
-	require.Contains(t, stderr, "retry with that URL")
-	require.NotContains(t, stderr, "lstk start")
+	assert.Contains(t, stderr, "could not reach LocalStack emulator at "+httpURL)
+	assert.Contains(t, stderr, srv.URL+" responded")
+	assert.Contains(t, stderr, "retry with that URL")
+	assert.NotContains(t, stderr, "lstk start")
 }
 
 // TestStatusEndpointURLHTTPSSchemeMismatchSuggestsHTTP is the mirror image:
@@ -187,9 +188,9 @@ func TestStatusEndpointURLHTTPSSchemeMismatchSuggestsHTTP(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", httpsURL, "status")
 	require.Error(t, err)
-	require.Contains(t, stderr, "could not reach LocalStack emulator at "+httpsURL)
-	require.Contains(t, stderr, srv.URL+" responded")
-	require.Contains(t, stderr, "retry with that URL")
+	assert.Contains(t, stderr, "could not reach LocalStack emulator at "+httpsURL)
+	assert.Contains(t, stderr, srv.URL+" responded")
+	assert.Contains(t, stderr, "retry with that URL")
 }
 
 // TestStatusEndpointURLHTTPSRendersReducedOutput is the https counterpart of
diff --git a/test/integration/endpoint_url_test.go b/test/integration/endpoint_url_test.go
index fc48ab5a..0f6e6fd3 100644
--- a/test/integration/endpoint_url_test.go
+++ b/test/integration/endpoint_url_test.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -75,8 +76,8 @@ func TestAWSCommandEndpointURLNoDockerRequired(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "aws", "s3", "ls")
 	require.NoError(t, err, "stderr: %s", stderr)
-	require.Contains(t, stdout, "ENDPOINT:"+srv.URL)
-	require.Contains(t, stdout, "ARGS:s3 ls")
+	assert.Contains(t, stdout, "ENDPOINT:"+srv.URL)
+	assert.Contains(t, stdout, "ARGS:s3 ls")
 }
 
 // TestAWSCommandEndpointURLAfterSubcommandPassesThrough proves the aws-CLI
@@ -101,10 +102,10 @@ func TestAWSCommandEndpointURLAfterSubcommandPassesThrough(t *testing.T) {
 	require.NoError(t, err, "stderr: %s", stderr)
 	// lstk's own resolution used the pre-command mock — proven by succeeding
 	// at all with DOCKER_HOST broken.
-	require.Contains(t, stdout, "ENDPOINT:"+srv.URL)
+	assert.Contains(t, stdout, "ENDPOINT:"+srv.URL)
 	// The user's own post-command --endpoint-url reached the wrapped aws
 	// binary untouched, appearing in its forwarded args.
-	require.Contains(t, stdout, "ARGS:--endpoint-url http://127.0.0.1:9 s3 ls")
+	assert.Contains(t, stdout, "ARGS:--endpoint-url http://127.0.0.1:9 s3 ls")
 }
 
 // TestLogsRejectsExplicitEndpointURL proves logs (a Docker-lifecycle command
@@ -120,8 +121,8 @@ func TestLogsRejectsExplicitEndpointURL(t *testing.T) {
 	// print a second copy to stderr.
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "logs", "--endpoint-url", "http://localhost:4566")
 	require.Error(t, err)
-	require.Contains(t, stdout, "logs")
-	require.Contains(t, stdout, "does not support --endpoint-url")
+	assert.Contains(t, stdout, "logs")
+	assert.Contains(t, stdout, "does not support --endpoint-url")
 }
 
 // TestVolumePathRejectsExplicitEndpointURL mirrors the logs case for the
@@ -132,7 +133,7 @@ func TestVolumePathRejectsExplicitEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "volume", "path", "--endpoint-url", "http://localhost:4566")
 	require.Error(t, err)
-	require.Contains(t, stdout, "does not support --endpoint-url")
+	assert.Contains(t, stdout, "does not support --endpoint-url")
 }
 
 // TestStartRejectsExplicitEndpointURL proves `start` (previously missing from
@@ -145,8 +146,8 @@ func TestStartRejectsExplicitEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--endpoint-url", "http://localhost:4566")
 	require.Error(t, err)
-	require.Contains(t, stdout, "start")
-	require.Contains(t, stdout, "does not support --endpoint-url")
+	assert.Contains(t, stdout, "start")
+	assert.Contains(t, stdout, "does not support --endpoint-url")
 }
 
 // The following tests prove the corrected behavior from design.md's Decision
@@ -163,9 +164,9 @@ func TestLogsRejectsAmbientEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "logs")
 	require.Error(t, err)
-	require.Contains(t, stdout, "logs")
-	require.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
-	require.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
+	assert.Contains(t, stdout, "logs")
+	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	assert.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
 }
 
 func TestStopRejectsAmbientEndpointURL(t *testing.T) {
@@ -175,7 +176,7 @@ func TestStopRejectsAmbientEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "stop")
 	require.Error(t, err)
-	require.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
 }
 
 func TestRestartRejectsAmbientEndpointURL(t *testing.T) {
@@ -185,8 +186,8 @@ func TestRestartRejectsAmbientEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "restart")
 	require.Error(t, err)
-	require.Contains(t, stdout, "does not support AWS_ENDPOINT_URL")
-	require.Contains(t, stdout, "AWS_ENDPOINT_URL is set")
+	assert.Contains(t, stdout, "does not support AWS_ENDPOINT_URL")
+	assert.Contains(t, stdout, "AWS_ENDPOINT_URL is set")
 }
 
 func TestVolumePathRejectsAmbientEndpointURL(t *testing.T) {
@@ -195,7 +196,7 @@ func TestVolumePathRejectsAmbientEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "volume", "path")
 	require.Error(t, err)
-	require.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
 }
 
 func TestVolumeClearRejectsAmbientEndpointURL(t *testing.T) {
@@ -204,7 +205,7 @@ func TestVolumeClearRejectsAmbientEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "volume", "clear")
 	require.Error(t, err)
-	require.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
 }
 
 func TestStartRejectsAmbientEndpointURL(t *testing.T) {
@@ -214,8 +215,8 @@ func TestStartRejectsAmbientEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "start")
 	require.Error(t, err)
-	require.Contains(t, stdout, "start")
-	require.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	assert.Contains(t, stdout, "start")
+	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
 }
 
 // TestSnapshotShowIgnoresEndpointURL proves `snapshot show` silently ignores
@@ -229,8 +230,8 @@ func TestSnapshotShowIgnoresEndpointURL(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "snapshot", "show", "pod:my-baseline", "--endpoint-url", "http://localhost:4566")
 	require.Error(t, err)
-	require.NotContains(t, stdout, "does not support --endpoint-url")
-	require.NotContains(t, stderr, "does not support --endpoint-url")
+	assert.NotContains(t, stdout, "does not support --endpoint-url")
+	assert.NotContains(t, stderr, "does not support --endpoint-url")
 }
 
 // TestSnapshotListBareIgnoresEndpointURL mirrors the show case for `snapshot
@@ -241,8 +242,8 @@ func TestSnapshotListBareIgnoresEndpointURL(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "snapshot", "list", "--endpoint-url", "http://localhost:4566")
 	require.Error(t, err)
-	require.NotContains(t, stdout, "does not support --endpoint-url")
-	require.NotContains(t, stderr, "does not support --endpoint-url")
+	assert.NotContains(t, stdout, "does not support --endpoint-url")
+	assert.NotContains(t, stderr, "does not support --endpoint-url")
 }
 
 // TestStatusEndpointURLRendersReducedOutput proves `status` skips Docker
@@ -293,10 +294,10 @@ func TestStatusEndpointURLShowsResources(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "status")
 	require.NoError(t, err, "stderr: %s", stderr)
-	require.Contains(t, stdout, "SERVICE")
-	require.Contains(t, stdout, "RESOURCE")
-	require.Contains(t, stdout, "S3")
-	require.Contains(t, stdout, "my-test-bucket")
+	assert.Contains(t, stdout, "SERVICE")
+	assert.Contains(t, stdout, "RESOURCE")
+	assert.Contains(t, stdout, "S3")
+	assert.Contains(t, stdout, "my-test-bucket")
 }
 
 // TestStatusEndpointURLInteractiveRendersTUI proves `status` against an
@@ -339,13 +340,13 @@ func TestStatusEndpointURLInteractiveRendersTUI(t *testing.T) {
 	}
 	require.NotEqual(t, -1, summary, "resource summary should be rendered, got:\n%s", strings.Join(lines, "\n"))
 	require.Greater(t, summary, 0)
-	require.Empty(t, lines[summary-1], "TUI puts a blank line before the resource summary")
-	require.Empty(t, lines[summary+1], "TUI puts a blank line after the resource summary")
+	assert.Empty(t, lines[summary-1], "TUI puts a blank line before the resource summary")
+	assert.Empty(t, lines[summary+1], "TUI puts a blank line after the resource summary")
 
 	joined := strings.Join(lines, "\n")
-	require.Contains(t, joined, "my-test-bucket")
-	require.NotContains(t, joined, "Container:")
-	require.NotContains(t, joined, "Uptime:")
+	assert.Contains(t, joined, "my-test-bucket")
+	assert.NotContains(t, joined, "Container:")
+	assert.NotContains(t, joined, "Uptime:")
 }
 
 // TestStatusUnreachableEndpointURLFailsClosed proves an endpoint that
@@ -363,8 +364,8 @@ func TestStatusUnreachableEndpointURLFailsClosed(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", notLocalStack.URL, "status")
 	require.Error(t, err)
-	require.Contains(t, stderr, "could not reach")
-	require.NotContains(t, stderr, "lstk start")
+	assert.Contains(t, stderr, "could not reach")
+	assert.NotContains(t, stderr, "lstk start")
 }
 
 // TestCDKAWSEndpointURLBypassesDockerCheck proves the BREAKING change:
@@ -383,7 +384,7 @@ func TestCDKAWSEndpointURLBypassesDockerCheck(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "deploy", "MyStack")
 	require.NoError(t, err, "stderr: %s", stderr)
-	require.Contains(t, stdout, fmt.Sprintf("ENV_AWS_ENDPOINT_URL=%s", srv.URL))
+	assert.Contains(t, stdout, fmt.Sprintf("ENV_AWS_ENDPOINT_URL=%s", srv.URL))
 }
 
 // TestCDKAWSEndpointURLWrongTypeFails proves the type-detection gate: an
@@ -409,6 +410,6 @@ func TestCDKAWSEndpointURLWrongTypeFails(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", azureLike.URL, "cdk", "deploy", "MyStack")
 	require.Error(t, err)
-	require.Contains(t, stdout, "requires the AWS emulator")
-	require.Contains(t, stdout, "Azure")
+	assert.Contains(t, stdout, "requires the AWS emulator")
+	assert.Contains(t, stdout, "Azure")
 }
diff --git a/test/integration/exit_code_test.go b/test/integration/exit_code_test.go
index dda90495..afbd0ba4 100644
--- a/test/integration/exit_code_test.go
+++ b/test/integration/exit_code_test.go
@@ -3,6 +3,7 @@ package integration_test
 import (
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -40,7 +41,7 @@ func TestInvalidUsageExitsNonZero(t *testing.T) {
 			_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, tc.args...)
 			require.Error(t, err, "expected %v to fail", tc.args)
 			requireExitCode(t, 1, err)
-			require.Contains(t, stderr, tc.wantText)
+			assert.Contains(t, stderr, tc.wantText)
 		})
 	}
 }
@@ -59,7 +60,7 @@ func TestBareParentCommandExitsZero(t *testing.T) {
 			stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, parent)
 			require.NoError(t, err)
 			requireExitCode(t, 0, err)
-			require.Contains(t, stdout, "Usage:")
+			assert.Contains(t, stdout, "Usage:")
 		})
 	}
 }
diff --git a/test/integration/json_envelope_test.go b/test/integration/json_envelope_test.go
index 7f9132a9..3b7a92c4 100644
--- a/test/integration/json_envelope_test.go
+++ b/test/integration/json_envelope_test.go
@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/internal/snap"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -83,8 +84,8 @@ func TestUsageErrorBeforeJSONFallsBackToPlainText(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, t.TempDir(), testEnvWithHome(t.TempDir(), ""), "stop", "--bogus-flag", "--json")
 	requireExitCode(t, 1, err)
 
-	require.Empty(t, stdout, "no JSON should be attempted when --json wasn't parsed yet")
-	require.Contains(t, stderr, "bogus-flag")
+	assert.Empty(t, stdout, "no JSON should be attempted when --json wasn't parsed yet")
+	assert.Contains(t, stderr, "bogus-flag")
 }
 
 // TestConfigLoadFailureRendersJSONEnvelope covers PR #374's review comment:
@@ -104,7 +105,7 @@ func TestConfigLoadFailureRendersJSONEnvelope(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, ctx, workDir, testEnvWithHome(t.TempDir(), ""), "stop", "--json")
 	requireExitCode(t, 1, err)
-	require.Empty(t, stderr, "the plain-text fallback in Execute() must not also fire alongside the envelope")
+	assert.Empty(t, stderr, "the plain-text fallback in Execute() must not also fire alongside the envelope")
 
 	decodeEnvelope(t, stdout)
 	// error.message embeds the temp-dir config path, so it is masked.
@@ -122,12 +123,12 @@ func TestConfigNotFoundRendersJSONEnvelope(t *testing.T) {
 		"--config", missingConfig, "reset", "--force", "--json",
 	)
 	requireExitCode(t, 1, err)
-	require.Empty(t, stderr, "the plain-text fallback in Execute() must not also fire alongside the envelope")
+	assert.Empty(t, stderr, "the plain-text fallback in Execute() must not also fire alongside the envelope")
 
 	envelope := decodeEnvelope(t, stdout)
-	require.Equal(t, "error", envelope.Status)
-	require.Equal(t, "reset", envelope.Command)
+	assert.Equal(t, "error", envelope.Status)
+	assert.Equal(t, "reset", envelope.Command)
 	require.NotNil(t, envelope.Error)
-	require.Equal(t, "CONFIG_NOT_FOUND", envelope.Error.Code)
-	require.Equal(t, "CONFIG", envelope.Error.Category)
+	assert.Equal(t, "CONFIG_NOT_FOUND", envelope.Error.Code)
+	assert.Equal(t, "CONFIG", envelope.Error.Category)
 }
diff --git a/test/integration/json_flag_test.go b/test/integration/json_flag_test.go
index 36f9cac3..fb8838de 100644
--- a/test/integration/json_flag_test.go
+++ b/test/integration/json_flag_test.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -19,12 +20,12 @@ func TestJSONFlagRejectsUnannotatedBuiltinCommand(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "status", "--json")
 	requireExitCode(t, 1, err)
 	envelope := decodeEnvelope(t, stdout)
-	require.Equal(t, "status", envelope.Command)
-	require.Equal(t, "error", envelope.Status)
+	assert.Equal(t, "status", envelope.Command)
+	assert.Equal(t, "error", envelope.Status)
 	require.NotNil(t, envelope.Error)
-	require.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
-	require.Contains(t, envelope.Error.Message, "status")
-	require.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
+	assert.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
+	assert.Contains(t, envelope.Error.Message, "status")
+	assert.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
 }
 
 func TestJSONFlagRejectsDefaultStartBehavior(t *testing.T) {
@@ -32,11 +33,11 @@ func TestJSONFlagRejectsDefaultStartBehavior(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--json")
 	requireExitCode(t, 1, err)
 	envelope := decodeEnvelope(t, stdout)
-	require.Equal(t, "start", envelope.Command)
-	require.Equal(t, "error", envelope.Status)
+	assert.Equal(t, "start", envelope.Command)
+	assert.Equal(t, "error", envelope.Status)
 	require.NotNil(t, envelope.Error)
-	require.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
-	require.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
+	assert.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
+	assert.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
 }
 
 func TestJSONFlagDoesNotLaunchTUIOnPTY(t *testing.T) {
@@ -137,7 +138,7 @@ func TestJSONFlagProxyCommandsRejectBeforeCommandName(t *testing.T) {
 			requireExitCode(t, 1, err)
 			decodeEnvelope(t, stdout)
 			snap.MatchJSON(t, []byte(stdout))
-			require.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
+			assert.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
 		})
 	}
 }
diff --git a/test/integration/license_test.go b/test/integration/license_test.go
index 711d9ad7..535f59d0 100644
--- a/test/integration/license_test.go
+++ b/test/integration/license_test.go
@@ -20,6 +20,7 @@ import (
 	"github.com/creack/pty"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -80,7 +81,7 @@ func TestLicenseValidationSuccess(t *testing.T) {
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
 	require.NoError(t, err, "failed to inspect container")
-	require.True(t, inspect.Container.State.Running, "container should be running")
+	assert.True(t, inspect.Container.State.Running, "container should be running")
 }
 
 func TestLicenseValidationFailure(t *testing.T) {
@@ -97,13 +98,13 @@ func TestLicenseValidationFailure(t *testing.T) {
 	requireExitCode(t, 1, err)
 	// Not a snapshot: the output embeds pull-progress lines that depend on
 	// the runner's image cache and the live emulator image version.
-	require.Contains(t, stdout, "License validation failed")
-	require.Contains(t, stdout, "invalid, inactive, or expired")
-	require.Contains(t, stdout, "lstk logout", "the error should point at re-authentication")
-	require.NotContains(t, stderr, "license validation failed", "the error event replaces the raw stderr error")
+	assert.Contains(t, stdout, "License validation failed")
+	assert.Contains(t, stdout, "invalid, inactive, or expired")
+	assert.Contains(t, stdout, "lstk logout", "the error should point at re-authentication")
+	assert.NotContains(t, stderr, "license validation failed", "the error event replaces the raw stderr error")
 
 	_, err = dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.Error(t, err, "container should not exist after license failure")
+	assert.Error(t, err, "container should not exist after license failure")
 }
 
 // TestLicenseRejectionOffersReloginAndRetries covers DEVX-658: a definitively
@@ -223,12 +224,12 @@ func TestLicenseRejectionOffersReloginAndRetries(t *testing.T) {
 		}
 	}
 	require.NoError(t, err, "start should succeed after re-login: %s", out)
-	require.True(t, staleRejected.Load(), "the stale token must have been rejected by the license server first")
-	require.Contains(t, out, "Valid license")
+	assert.True(t, staleRejected.Load(), "the stale token must have been rejected by the license server first")
+	assert.Contains(t, out, "Valid license")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
 	require.NoError(t, err, "failed to inspect container")
-	require.True(t, inspect.Container.State.Running, "container should be running after the retried start")
+	assert.True(t, inspect.Container.State.Running, "container should be running after the retried start")
 
 	// lstk's file-keyring fallback stores the token next to the active config
 	// file (ConfigDir follows --config), so on headless CI runners the token
@@ -243,7 +244,7 @@ func TestLicenseRejectionOffersReloginAndRetries(t *testing.T) {
 		storedToken, err = GetAuthTokenFromKeyring()
 		require.NoError(t, err, "the re-logged-in token should be stored in the system keyring")
 	}
-	require.Equal(t, realToken, storedToken, "the fresh token must replace the rejected one")
+	assert.Equal(t, realToken, storedToken, "the fresh token must replace the rejected one")
 }
 
 // TestLicenseRejectionEscDeclineShowsManualSteps covers DEVX-1045: the re-login
@@ -315,9 +316,9 @@ func TestLicenseRejectionEscDeclineShowsManualSteps(t *testing.T) {
 	err = cmd.Wait()
 	<-outputCh
 	requireExitCode(t, 1, err)
-	require.Contains(t, out.String(), "License validation failed", "declining must render the failure")
-	require.Contains(t, out.String(), "lstk logout", "declining must point at the manual recovery")
-	require.Contains(t, out.String(), "LOCALSTACK_AUTH_TOKEN", "declining must mention the env var alternative")
+	assert.Contains(t, out.String(), "License validation failed", "declining must render the failure")
+	assert.Contains(t, out.String(), "lstk logout", "declining must point at the manual recovery")
+	assert.Contains(t, out.String(), "LOCALSTACK_AUTH_TOKEN", "declining must mention the env var alternative")
 }
 
 func licenseFilePath(t *testing.T) string {
@@ -352,7 +353,7 @@ func TestLicenseCacheAndMount(t *testing.T) {
 
 	data, err := os.ReadFile(licenseFilePath(t))
 	require.NoError(t, err, "license cache file should exist after successful start")
-	require.Equal(t, licenseBody, string(data))
+	assert.Equal(t, licenseBody, string(data))
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
 	require.NoError(t, err, "failed to inspect container")
@@ -364,5 +365,5 @@ func TestLicenseCacheAndMount(t *testing.T) {
 			break
 		}
 	}
-	require.True(t, mounted, "license file should be mounted into container at /etc/localstack/conf.d/license.json")
+	assert.True(t, mounted, "license file should be mounted into container at /etc/localstack/conf.d/license.json")
 }
diff --git a/test/integration/logging_test.go b/test/integration/logging_test.go
index c8babecc..ae6997bf 100644
--- a/test/integration/logging_test.go
+++ b/test/integration/logging_test.go
@@ -6,6 +6,7 @@ import (
 	"runtime"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -28,8 +29,8 @@ func TestLogging_NonTTY_WritesToLogFile(t *testing.T) {
 
 	logContents, err := os.ReadFile(logPath)
 	require.NoError(t, err, "expected lstk.log to be created at %s", logPath)
-	require.Contains(t, string(logContents), "[INFO] lstk")
-	require.Contains(t, string(logContents), "starting")
+	assert.Contains(t, string(logContents), "[INFO] lstk")
+	assert.Contains(t, string(logContents), "starting")
 }
 
 func TestLogging_TTY_WritesToLogFile(t *testing.T) {
@@ -46,6 +47,6 @@ func TestLogging_TTY_WritesToLogFile(t *testing.T) {
 
 	logContents, err := os.ReadFile(logPath)
 	require.NoError(t, err, "expected lstk.log to be created at %s", logPath)
-	require.Contains(t, string(logContents), "[INFO] lstk")
-	require.Contains(t, string(logContents), "starting")
+	assert.Contains(t, string(logContents), "[INFO] lstk")
+	assert.Contains(t, string(logContents), "starting")
 }
diff --git a/test/integration/login_test.go b/test/integration/login_test.go
index dc55e4f9..88ad5271 100644
--- a/test/integration/login_test.go
+++ b/test/integration/login_test.go
@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -29,8 +30,8 @@ func createMockAPIServer(t *testing.T, licenseToken string, confirmed bool) *htt
 			var payload map[string]string
 			err := json.NewDecoder(r.Body).Decode(&payload)
 			require.NoError(t, err, "failed to decode auth request payload")
-			require.Equal(t, "lstk", payload["actor"], "actor should be lstk")
-			require.NotEmpty(t, payload["version"], "version should not be empty")
+			assert.Equal(t, "lstk", payload["actor"], "actor should be lstk")
+			assert.NotEmpty(t, payload["version"], "version should not be empty")
 
 			w.WriteHeader(http.StatusCreated)
 			err = json.NewEncoder(w).Encode(map[string]string{
@@ -125,20 +126,20 @@ func TestDeviceFlowSuccess(t *testing.T) {
 	out, err := p.wait()
 	require.NoError(t, err, "login should succeed: %s", out)
 	requireExitCode(t, 0, err)
-	require.Equal(t, mockServer.URL+"/auth/request/test-auth-req-id?code=TEST123", openedURL(), "login should open the auth URL in a browser")
-	require.Contains(t, out, "Opening browser to login...")
-	require.Contains(t, out, "Browser didn't open? Visit")
-	require.Contains(t, out, "/auth/request/test-auth-req-id?code=TEST123")
-	require.Contains(t, out, "Waiting for authorization")
-	require.Contains(t, out, "Checking if auth request is confirmed")
-	require.Contains(t, out, "Auth request confirmed")
-	require.Contains(t, out, "Fetching license token")
-	require.Contains(t, out, "Login successful")
+	assert.Equal(t, mockServer.URL+"/auth/request/test-auth-req-id?code=TEST123", openedURL(), "login should open the auth URL in a browser")
+	assert.Contains(t, out, "Opening browser to login...")
+	assert.Contains(t, out, "Browser didn't open? Visit")
+	assert.Contains(t, out, "/auth/request/test-auth-req-id?code=TEST123")
+	assert.Contains(t, out, "Waiting for authorization")
+	assert.Contains(t, out, "Checking if auth request is confirmed")
+	assert.Contains(t, out, "Auth request confirmed")
+	assert.Contains(t, out, "Fetching license token")
+	assert.Contains(t, out, "Login successful")
 
 	// Verify token was stored in keyring
 	storedToken, err := GetAuthTokenFromKeyring()
 	require.NoError(t, err)
-	require.Equal(t, licenseToken, storedToken)
+	assert.Equal(t, licenseToken, storedToken)
 	assertCommandTelemetry(t, events, "login", 0)
 }
 
@@ -165,17 +166,17 @@ func TestDeviceFlowFailure_RequestNotConfirmed(t *testing.T) {
 	out, err := p.wait()
 	require.Error(t, err, "expected login to fail when request not confirmed")
 	requireExitCode(t, 1, err)
-	require.Equal(t, mockServer.URL+"/auth/request/test-auth-req-id?code=TEST123", openedURL(), "login should open the auth URL in a browser")
-	require.Contains(t, out, "Opening browser to login...")
-	require.Contains(t, out, "Browser didn't open? Visit")
-	require.Contains(t, out, "/auth/request/test-auth-req-id?code=TEST123")
-	require.Contains(t, out, "Waiting for authorization")
-	require.Contains(t, out, "Checking if auth request is confirmed")
-	require.Contains(t, out, "auth request not confirmed")
+	assert.Equal(t, mockServer.URL+"/auth/request/test-auth-req-id?code=TEST123", openedURL(), "login should open the auth URL in a browser")
+	assert.Contains(t, out, "Opening browser to login...")
+	assert.Contains(t, out, "Browser didn't open? Visit")
+	assert.Contains(t, out, "/auth/request/test-auth-req-id?code=TEST123")
+	assert.Contains(t, out, "Waiting for authorization")
+	assert.Contains(t, out, "Checking if auth request is confirmed")
+	assert.Contains(t, out, "auth request not confirmed")
 
 	// Verify no token was stored in keyring
 	_, err = GetAuthTokenFromKeyring()
-	require.Error(t, err, "no token should be stored when login fails")
+	assert.Error(t, err, "no token should be stored when login fails")
 	assertCommandTelemetry(t, events, "login", 1)
 }
 
@@ -187,9 +188,9 @@ func TestLoginShortCircuitsWhenEnvTokenSet(t *testing.T) {
 	out, err := runLstkInPTY(t, testContext(t), environ, "login")
 	require.NoError(t, err, "login should succeed when env token is set: %s", out)
 	requireExitCode(t, 0, err)
-	require.Contains(t, out, "You're already logged in")
-	require.NotContains(t, out, "Opening browser")
-	require.NotContains(t, out, "Waiting for authorization")
+	assert.Contains(t, out, "You're already logged in")
+	assert.NotContains(t, out, "Opening browser")
+	assert.NotContains(t, out, "Waiting for authorization")
 }
 
 func TestLoginShortCircuitsWhenStoredTokenExists(t *testing.T) {
@@ -205,7 +206,7 @@ func TestLoginShortCircuitsWhenStoredTokenExists(t *testing.T) {
 	out, err := runLstkInPTY(t, testContext(t), environ, "login")
 	require.NoError(t, err, "login should succeed when stored token exists: %s", out)
 	requireExitCode(t, 0, err)
-	require.Contains(t, out, "You're already logged in")
-	require.NotContains(t, out, "Opening browser")
-	require.NotContains(t, out, "Waiting for authorization")
+	assert.Contains(t, out, "You're already logged in")
+	assert.NotContains(t, out, "Opening browser")
+	assert.NotContains(t, out, "Waiting for authorization")
 }
diff --git a/test/integration/logout_test.go b/test/integration/logout_test.go
index 65ad699b..2fde824f 100644
--- a/test/integration/logout_test.go
+++ b/test/integration/logout_test.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -24,10 +25,10 @@ func TestLogoutCommandRemovesToken(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "logout")
 	require.NoError(t, err, "lstk logout failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdout, "Logged out successfully")
+	assert.Contains(t, stdout, "Logged out successfully")
 
 	_, err = GetAuthTokenFromKeyring()
-	require.Error(t, err, "token should be removed from keyring")
+	assert.Error(t, err, "token should be removed from keyring")
 	assertCommandTelemetry(t, events, "logout", 0)
 }
 
@@ -38,7 +39,7 @@ func TestLogoutCommandSucceedsWhenNoToken(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), "", env.Without(env.AuthToken).With(env.AnalyticsEndpoint, analyticsSrv.URL), "logout")
 	require.NoError(t, err, "lstk logout should succeed even with no token: %s", stderr)
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdout, "Not currently logged in")
+	assert.Contains(t, stdout, "Not currently logged in")
 	assertCommandTelemetry(t, events, "logout", 0)
 }
 
@@ -48,7 +49,7 @@ func TestLogoutCommandWithEnvVarToken(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), "", env.Without(env.AuthToken).With(env.AuthToken, "test-env-token"), "logout")
 	require.NoError(t, err, "lstk logout should succeed: %s", stderr)
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdout, "LOCALSTACK_AUTH_TOKEN")
+	assert.Contains(t, stdout, "LOCALSTACK_AUTH_TOKEN")
 }
 
 func TestLogoutCommandNotesWhenEmulatorStillRunning(t *testing.T) {
@@ -68,7 +69,7 @@ func TestLogoutCommandNotesWhenEmulatorStillRunning(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "logout")
 	require.NoError(t, err, "lstk logout failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdout, "LocalStack AWS Emulator is still running in the background")
+	assert.Contains(t, stdout, "LocalStack AWS Emulator is still running in the background")
 }
 
 func TestLogoutCommandReportsBothEmulatorsWhenMultipleRunning(t *testing.T) {
@@ -114,7 +115,7 @@ port = "4567"
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "--config", configFile, "logout")
 	require.NoError(t, err, "lstk logout failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdout, "LocalStack AWS Emulator, LocalStack Snowflake Emulator are still running in the background")
+	assert.Contains(t, stdout, "LocalStack AWS Emulator, LocalStack Snowflake Emulator are still running in the background")
 }
 
 func TestLogoutCommandDoesNotReportForeignEmulatorAsRunning(t *testing.T) {
@@ -145,6 +146,6 @@ func TestLogoutCommandDoesNotReportForeignEmulatorAsRunning(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "--config", configFile, "logout")
 	require.NoError(t, err, "lstk logout failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	require.NotContains(t, stdout, "still running",
+	assert.NotContains(t, stdout, "still running",
 		"snowflake-targeted logout should not detect the AWS container as the configured emulator")
 }
diff --git a/test/integration/logs_test.go b/test/integration/logs_test.go
index 5f627bcf..6f40d04e 100644
--- a/test/integration/logs_test.go
+++ b/test/integration/logs_test.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -58,7 +59,7 @@ func TestLogsCommandFailsWhenNotRunning(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "--config", configFile, "logs", "--follow")
 	require.Error(t, err, "expected lstk logs --follow to fail when container not running")
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "LocalStack AWS Emulator is not running")
+	assert.Contains(t, stdout, "LocalStack AWS Emulator is not running")
 	assertCommandTelemetry(t, events, "logs", 1)
 }
 
@@ -159,8 +160,8 @@ func TestLogsTailCountsVisibleLinesNotFilteredOnes(t *testing.T) {
 	configFile := writeAwsConfig(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.Without(), "--config", configFile, "logs", "--tail", "1")
 	require.NoError(t, err, "lstk logs --tail 1 should exit cleanly, stderr: %s", stderr)
-	require.Contains(t, stdout, "tail-visible-marker", "--tail 1 must show the newest visible line, not an empty result")
-	require.NotContains(t, stdout, "tail-filtered-marker", "filtered request logs must stay hidden")
+	assert.Contains(t, stdout, "tail-visible-marker", "--tail 1 must show the newest visible line, not an empty result")
+	assert.NotContains(t, stdout, "tail-filtered-marker", "filtered request logs must stay hidden")
 }
 
 func TestLogsTailLimitsOutput(t *testing.T) {
@@ -179,10 +180,10 @@ func TestLogsTailLimitsOutput(t *testing.T) {
 		stdout, stderr, err := runLstk(t, ctx, "", env.Without(), args...)
 		require.NoError(t, err, "lstk logs %s should exit cleanly, stderr: %s", strings.Join(flags, " "), stderr)
 		for i := 8; i <= 10; i++ {
-			require.Contains(t, stdout, fmt.Sprintf("tail-marker-%d", i), "last 3 lines should be shown with %s", strings.Join(flags, " "))
+			assert.Contains(t, stdout, fmt.Sprintf("tail-marker-%d", i), "last 3 lines should be shown with %s", strings.Join(flags, " "))
 		}
 		for i := 1; i <= 7; i++ {
-			require.NotContains(t, stdout, fmt.Sprintf("tail-marker-%d\n", i), "older lines should be cut off with %s", strings.Join(flags, " "))
+			assert.NotContains(t, stdout, fmt.Sprintf("tail-marker-%d\n", i), "older lines should be cut off with %s", strings.Join(flags, " "))
 		}
 	}
 }
@@ -200,7 +201,7 @@ func TestLogsWithoutTailShowsAllLines(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, "", env.Without(), "--config", configFile, "logs")
 	require.NoError(t, err, "lstk logs should exit cleanly, stderr: %s", stderr)
 	for i := 1; i <= 10; i++ {
-		require.Contains(t, stdout, fmt.Sprintf("tail-marker-%d", i), "all lines should be shown without --tail")
+		assert.Contains(t, stdout, fmt.Sprintf("tail-marker-%d", i), "all lines should be shown without --tail")
 	}
 }
 
@@ -211,8 +212,8 @@ func TestLogsTailRejectsInvalidValue(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), "", env.Without(), "--config", configFile, "logs", "--tail", "bogus")
 	require.Error(t, err, "expected lstk logs --tail bogus to fail")
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "bogus", "error should name the invalid value")
-	require.Contains(t, stderr, "--tail", "error should name the flag")
+	assert.Contains(t, stderr, "bogus", "error should name the invalid value")
+	assert.Contains(t, stderr, "--tail", "error should name the flag")
 }
 
 func TestLogsTailWithFollowStartsFromTail(t *testing.T) {
@@ -251,7 +252,7 @@ func TestLogsTailWithFollowStartsFromTail(t *testing.T) {
 
 	select {
 	case line := <-firstLine:
-		require.Contains(t, line, "tail-marker-8", "follow should start from the last 3 lines")
+		assert.Contains(t, line, "tail-marker-8", "follow should start from the last 3 lines")
 	case <-ctx.Done():
 		t.Fatal("no marker appeared in lstk logs --follow --tail output within timeout")
 	}
@@ -276,7 +277,7 @@ func TestLogsInteractivePreservesFullScrollback(t *testing.T) {
 	require.NoError(t, err, "lstk logs should exit cleanly in interactive mode, output: %s", out)
 
 	for i := 1; i <= lineCount; i++ {
-		require.Contains(t, out, fmt.Sprintf("tail-marker-%d", i), "expected tail-marker-%d to survive scrollback", i)
+		assert.Contains(t, out, fmt.Sprintf("tail-marker-%d", i), "expected tail-marker-%d to survive scrollback", i)
 	}
 }
 
diff --git a/test/integration/non_interactive_test.go b/test/integration/non_interactive_test.go
index 09c11915..138750f5 100644
--- a/test/integration/non_interactive_test.go
+++ b/test/integration/non_interactive_test.go
@@ -4,6 +4,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -12,7 +13,7 @@ func TestNonInteractiveFlagBlocksLogin(t *testing.T) {
 	out, err := runLstkInPTY(t, testContext(t), testEnvWithHome(t.TempDir(), ""), "login", "--non-interactive")
 	require.Error(t, err, "expected login --non-interactive to fail")
 	requireExitCode(t, 1, err)
-	require.Contains(t, out, "login requires an interactive terminal")
+	assert.Contains(t, out, "login requires an interactive terminal")
 }
 
 func TestNonInteractiveFlagFailsWithoutToken(t *testing.T) {
@@ -26,7 +27,7 @@ func TestNonInteractiveFlagFailsWithoutToken(t *testing.T) {
 	out, err := runLstkInPTY(t, testContext(t), env.Without(env.AuthToken).With(env.APIEndpoint, mockServer.URL), "start", "--non-interactive")
 	require.Error(t, err, "expected start --non-interactive to fail with no auth token")
 	requireExitCode(t, 1, err)
-	require.Contains(t, out, "authentication required: set LOCALSTACK_AUTH_TOKEN or run in interactive mode")
+	assert.Contains(t, out, "authentication required: set LOCALSTACK_AUTH_TOKEN or run in interactive mode")
 }
 
 func TestRootNonInteractiveFlagFailsWithoutToken(t *testing.T) {
@@ -40,5 +41,5 @@ func TestRootNonInteractiveFlagFailsWithoutToken(t *testing.T) {
 	out, err := runLstkInPTY(t, testContext(t), env.Without(env.AuthToken).With(env.APIEndpoint, mockServer.URL), "--non-interactive")
 	require.Error(t, err, "expected lstk --non-interactive to fail with no auth token")
 	requireExitCode(t, 1, err)
-	require.Contains(t, out, "authentication required: set LOCALSTACK_AUTH_TOKEN or run in interactive mode")
+	assert.Contains(t, out, "authentication required: set LOCALSTACK_AUTH_TOKEN or run in interactive mode")
 }
diff --git a/test/integration/reset_test.go b/test/integration/reset_test.go
index f839a3f8..c17e13cc 100644
--- a/test/integration/reset_test.go
+++ b/test/integration/reset_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -41,8 +42,8 @@ func TestResetSucceedsWithForce(t *testing.T) {
 		"--non-interactive", "reset", "--force",
 	)
 	require.NoError(t, err, "lstk reset failed: %s", stderr)
-	require.Contains(t, stdout, "Emulator state reset")
-	require.Equal(t, int32(1), calls.Load(), "reset endpoint should be called exactly once")
+	assert.Contains(t, stdout, "Emulator state reset")
+	assert.Equal(t, int32(1), calls.Load(), "reset endpoint should be called exactly once")
 }
 
 func TestResetFailsWithoutForceInNonInteractive(t *testing.T) {
@@ -61,8 +62,8 @@ func TestResetFailsWithoutForceInNonInteractive(t *testing.T) {
 		"--non-interactive", "reset",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "--force")
-	require.Equal(t, int32(0), calls.Load(), "reset endpoint should not be called when confirmation is required")
+	assert.Contains(t, stderr, "--force")
+	assert.Equal(t, int32(0), calls.Load(), "reset endpoint should not be called when confirmation is required")
 }
 
 func TestResetLocalStackNotRunning(t *testing.T) {
@@ -77,7 +78,7 @@ func TestResetLocalStackNotRunning(t *testing.T) {
 		"--non-interactive", "reset", "--force",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "not running")
+	assert.Contains(t, stdout, "not running")
 }
 
 func TestResetReturnsErrorOnAPIFailure(t *testing.T) {
@@ -94,7 +95,7 @@ func TestResetReturnsErrorOnAPIFailure(t *testing.T) {
 		"--non-interactive", "reset", "--force",
 	)
 	requireExitCode(t, 1, err)
-	require.NotEmpty(t, stderr)
+	assert.NotEmpty(t, stderr)
 }
 
 func TestResetTelemetryEmitted(t *testing.T) {
@@ -156,8 +157,8 @@ func TestResetInteractive(t *testing.T) {
 		out, err := p.wait()
 		require.NoError(t, err)
 
-		require.Contains(t, out, "Emulator state reset")
-		require.Equal(t, int32(1), calls.Load(), "reset endpoint should be called after confirmation")
+		assert.Contains(t, out, "Emulator state reset")
+		assert.Equal(t, int32(1), calls.Load(), "reset endpoint should be called after confirmation")
 	})
 
 	t.Run("cancels with n", func(t *testing.T) {
@@ -167,8 +168,8 @@ func TestResetInteractive(t *testing.T) {
 		out, err := p.wait()
 		require.NoError(t, err)
 
-		require.Contains(t, out, "Cancelled")
-		require.Equal(t, int32(0), calls.Load(), "reset endpoint must not be called when user cancels")
+		assert.Contains(t, out, "Cancelled")
+		assert.Equal(t, int32(0), calls.Load(), "reset endpoint must not be called when user cancels")
 	})
 }
 
@@ -187,11 +188,11 @@ func TestResetJSONSucceeds(t *testing.T) {
 	)
 	require.NoError(t, err, "lstk reset --json failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	require.Equal(t, int32(1), calls.Load(), "reset endpoint should be called exactly once")
+	assert.Equal(t, int32(1), calls.Load(), "reset endpoint should be called exactly once")
 
 	envelope := decodeEnvelope(t, stdout)
-	require.Equal(t, "ok", envelope.Status)
-	require.Equal(t, "reset", envelope.Command)
+	assert.Equal(t, "ok", envelope.Status)
+	assert.Equal(t, "reset", envelope.Command)
 
 	var data struct {
 		Emulator struct {
@@ -201,8 +202,8 @@ func TestResetJSONSucceeds(t *testing.T) {
 		Reset bool `json:"reset"`
 	}
 	require.NoError(t, json.Unmarshal(envelope.Data, &data))
-	require.Equal(t, "aws", data.Emulator.Type)
-	require.True(t, data.Reset)
+	assert.Equal(t, "aws", data.Emulator.Type)
+	assert.True(t, data.Reset)
 }
 
 func TestResetJSONRequiresConfirmation(t *testing.T) {
@@ -219,11 +220,11 @@ func TestResetJSONRequiresConfirmation(t *testing.T) {
 	requireExitCode(t, 3, err)
 
 	envelope := decodeEnvelope(t, stdout)
-	require.Equal(t, "error", envelope.Status)
+	assert.Equal(t, "error", envelope.Status)
 	require.NotNil(t, envelope.Error)
-	require.Equal(t, "CONFIRMATION_REQUIRED", envelope.Error.Code)
-	require.Equal(t, "USAGE", envelope.Error.Category)
-	require.False(t, envelope.Error.Retryable)
+	assert.Equal(t, "CONFIRMATION_REQUIRED", envelope.Error.Code)
+	assert.Equal(t, "USAGE", envelope.Error.Category)
+	assert.False(t, envelope.Error.Retryable)
 }
 
 func TestResetJSONNotConfigured(t *testing.T) {
@@ -238,8 +239,8 @@ func TestResetJSONNotConfigured(t *testing.T) {
 	requireExitCode(t, 1, err)
 
 	envelope := decodeEnvelope(t, stdout)
-	require.Equal(t, "error", envelope.Status)
+	assert.Equal(t, "error", envelope.Status)
 	require.NotNil(t, envelope.Error)
-	require.Equal(t, "EMULATOR_NOT_CONFIGURED", envelope.Error.Code)
-	require.Equal(t, "EMULATOR", envelope.Error.Category)
+	assert.Equal(t, "EMULATOR_NOT_CONFIGURED", envelope.Error.Code)
+	assert.Equal(t, "EMULATOR", envelope.Error.Category)
 }
diff --git a/test/integration/restart_test.go b/test/integration/restart_test.go
index 14c89ccf..5b00744b 100644
--- a/test/integration/restart_test.go
+++ b/test/integration/restart_test.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -26,24 +27,22 @@ func TestRestartCommandSucceeds(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL).With(env.AnalyticsEndpoint, analyticsSrv.URL), "restart")
 	require.NoError(t, err, "lstk restart failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdout, "stopped")
-	require.Contains(t, stdout, "LocalStack")
+	assert.Contains(t, stdout, "stopped")
+	assert.Contains(t, stdout, "LocalStack")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
 	require.NoError(t, err, "failed to inspect container after restart")
-	require.True(t, inspect.Container.State.Running, "container should be running after restart")
+	assert.True(t, inspect.Container.State.Running, "container should be running after restart")
 
 	// Both lstk_lifecycle (stop + start) and lstk_command events should be emitted.
 	byName := collectTelemetryByName(t, events, 2)
-	require.Contains(t, byName, "lstk_lifecycle")
-	cmdEvent, ok := byName["lstk_command"]
-	require.True(t, ok, "lstk_command event not received")
-	{
+	assert.Contains(t, byName, "lstk_lifecycle")
+	if cmdEvent, ok := byName["lstk_command"]; assert.True(t, ok, "lstk_command event not received") {
 		payload, _ := cmdEvent["payload"].(map[string]any)
 		params, _ := payload["parameters"].(map[string]any)
-		require.Equal(t, "restart", params["command"])
+		assert.Equal(t, "restart", params["command"])
 		result, _ := payload["result"].(map[string]any)
-		require.InDelta(t, 0, result["exit_code"], 0)
+		assert.InDelta(t, 0, result["exit_code"], 0)
 	}
 }
 
@@ -65,12 +64,12 @@ func TestRestartCommandRejectsAmbientEndpointURLEvenWithLocalContainerRunning(t
 
 	stdout, _, err := runLstk(t, ctx, "", env.With(env.DisableEvents, "1").With("LSTK_ENDPOINT_URL", "http://127.0.0.1:1"), "restart")
 	require.Error(t, err)
-	require.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
-	require.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
+	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	assert.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
 	require.NoError(t, err, "container should still exist — restart must reject before stopping/restarting it")
-	require.True(t, inspect.Container.State.Running, "container should still be running, untouched")
+	assert.True(t, inspect.Container.State.Running, "container should still be running, untouched")
 }
 
 func TestRestartCommandPersistFlagSetsPersistenceEnv(t *testing.T) {
@@ -96,7 +95,7 @@ func TestRestartCommandPersistFlagSetsPersistenceEnv(t *testing.T) {
 	require.True(t, inspect.Container.State.Running)
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	require.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
+	assert.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
 }
 
 func TestRestartCommandPreservesPersistenceWithoutFlag(t *testing.T) {
@@ -123,7 +122,7 @@ func TestRestartCommandPreservesPersistenceWithoutFlag(t *testing.T) {
 	require.True(t, inspect.Container.State.Running)
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	require.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
+	assert.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
 }
 
 func TestRestartCommandFailsWhenNotRunning(t *testing.T) {
@@ -135,6 +134,6 @@ func TestRestartCommandFailsWhenNotRunning(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "restart")
 	require.Error(t, err, "expected lstk restart to fail when emulator is not running")
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "LocalStack AWS Emulator is not running")
+	assert.Contains(t, stdout, "LocalStack AWS Emulator is not running")
 	assertCommandTelemetry(t, events, "restart", 1)
 }
diff --git a/test/integration/sam_cmd_test.go b/test/integration/sam_cmd_test.go
index 43affdc0..943d6c2f 100644
--- a/test/integration/sam_cmd_test.go
+++ b/test/integration/sam_cmd_test.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -50,7 +51,7 @@ func TestSAMForwardsArgs(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
 	require.NoError(t, err, "stderr: %s", stderr)
-	require.Contains(t, stdout, "ARGS:build")
+	assert.Contains(t, stdout, "ARGS:build")
 }
 
 // propagates the sam exit code.
@@ -61,7 +62,7 @@ func TestSAMPropagatesExitCode(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
 	require.Error(t, err)
-	require.Contains(t, stderr, "simulated failure")
+	assert.Contains(t, stderr, "simulated failure")
 	requireExitCode(t, 7, err)
 }
 
@@ -102,8 +103,8 @@ func TestSAMOfflineCommandsNoEmulator(t *testing.T) {
 				"sam", "--region", "us-west-2", sub)
 			require.NoError(t, err, "stderr: %s", stderr)
 
-			require.Contains(t, stdout, "ARGS:"+sub)
-			require.NotContains(t, stdout, "--region")
+			assert.Contains(t, stdout, "ARGS:"+sub)
+			assert.NotContains(t, stdout, "--region")
 		})
 	}
 }
@@ -122,7 +123,7 @@ func TestSAMHelpNoEmulator(t *testing.T) {
 			cmdArgs := append([]string{"sam"}, args...)
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, cmdArgs...)
 			require.NoError(t, err, "stderr: %s", stderr)
-			require.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
+			assert.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
 		})
 	}
 }
@@ -135,9 +136,9 @@ func TestSAMVersionTooOld(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
 	require.Error(t, err)
-	require.Contains(t, stderr+stdout, "1.95.0")
+	assert.Contains(t, stderr+stdout, "1.95.0")
 	// sam was never run for real.
-	require.NotContains(t, stdout, "ARGS:build")
+	assert.NotContains(t, stdout, "ARGS:build")
 }
 
 // a missing sam binary yields the install error.
@@ -147,7 +148,7 @@ func TestSAMMissingBinary(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
 	require.Error(t, err)
-	require.Contains(t, stderr+stdout, "not found in PATH")
+	assert.Contains(t, stderr+stdout, "not found in PATH")
 }
 
 // --account is supported for sam (unlike cdk): a valid 12-digit value is
@@ -160,7 +161,7 @@ func TestSAMAccountSupported(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"sam", "--account", "123456789012", "build")
 	require.NoError(t, err, "stderr: %s", stderr)
-	require.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=123456789012")
+	assert.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=123456789012")
 }
 
 // an invalid --account value is rejected at the command boundary before sam runs.
@@ -172,8 +173,8 @@ func TestSAMInvalidAccountRejected(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"sam", "--account", "12345", "build")
 	require.Error(t, err)
-	require.Contains(t, stderr+stdout, "12-digit")
-	require.NotContains(t, stdout, "ARGS:build")
+	assert.Contains(t, stderr+stdout, "12-digit")
+	assert.NotContains(t, stdout, "ARGS:build")
 }
 
 // flags after the subcommand are forwarded to sam unchanged.
@@ -185,7 +186,7 @@ func TestSAMFlagsAfterActionAreForwarded(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"sam", "build", "--region", "us-west-2")
 	require.NoError(t, err, "stderr: %s", stderr)
-	require.Contains(t, stdout, "ARGS:build --region us-west-2")
+	assert.Contains(t, stdout, "ARGS:build --region us-west-2")
 }
 
 // a flag before the subcommand is rejected with a clear message.
@@ -197,7 +198,7 @@ func TestSAMFlagBeforeSubcommandRejected(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--account", "111111111111", "sam", "build")
 	require.Error(t, err)
-	require.Contains(t, stderr+stdout, "must appear after the sam subcommand")
+	assert.Contains(t, stderr+stdout, "must appear after the sam subcommand")
 }
 
 // LSTK_SAM_CMD selects the binary to invoke.
@@ -212,7 +213,7 @@ func TestSAMHonorsLstkSamCmd(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
 	require.NoError(t, err, "stderr: %s", stderr)
-	require.Contains(t, stdout, "MYSAM:build")
+	assert.Contains(t, stdout, "MYSAM:build")
 }
 
 // an AWS-contacting command with no running emulator fails with "not running"
@@ -227,9 +228,9 @@ func TestSAMFailsWhenEmulatorNotRunning(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "deploy")
 	require.Error(t, err)
-	require.Contains(t, stdout, "is not running")
-	require.Contains(t, stdout, "Start LocalStack:")
-	require.NotContains(t, stdout, "ARGS:deploy")
+	assert.Contains(t, stdout, "is not running")
+	assert.Contains(t, stdout, "Start LocalStack:")
+	assert.NotContains(t, stdout, "ARGS:deploy")
 }
 
 // an AWS-contacting command fails with an AWS-specific error naming the running
@@ -249,9 +250,9 @@ func TestSAMRequiresAWSEmulator(t *testing.T) {
 
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), e, "sam", "deploy")
 	require.Error(t, err)
-	require.Contains(t, stdout, "requires the")
-	require.Contains(t, stdout, "Snowflake")
-	require.NotContains(t, stdout, "ARGS:deploy")
+	assert.Contains(t, stdout, "requires the")
+	assert.Contains(t, stdout, "Snowflake")
+	assert.NotContains(t, stdout, "ARGS:deploy")
 }
 
 // The region must reach SAM on its command line, not only through AWS_REGION.
@@ -269,9 +270,9 @@ func TestSAMPutsSelectedRegionOnTheCommandLine(t *testing.T) {
 		"--endpoint-url", srv.URL, "sam", "--region", "ap-northeast-1", "--account", "121212122323", "deploy")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	require.Contains(t, stdout, "--region ap-northeast-1", "the region must be on sam's command line")
-	require.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
-	require.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=121212122323")
+	assert.Contains(t, stdout, "--region ap-northeast-1", "the region must be on sam's command line")
+	assert.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
+	assert.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=121212122323")
 }
 
 // Without lstk's --region there is nothing to assert over samconfig.toml, so
@@ -287,9 +288,9 @@ func TestSAMDoesNotInjectRegionWhenNotSelected(t *testing.T) {
 		"--endpoint-url", srv.URL, "sam", "deploy")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	require.NotContains(t, stdout, "--region")
+	assert.NotContains(t, stdout, "--region")
 	// The environment still carries the default, as before.
-	require.Contains(t, stdout, "ENV_AWS_REGION=us-east-1")
+	assert.Contains(t, stdout, "ENV_AWS_REGION=us-east-1")
 }
 
 // An ambient AWS_REGION is used but is not a selection: it is commonly exported
@@ -305,8 +306,8 @@ func TestSAMDoesNotInjectAmbientRegion(t *testing.T) {
 		"--endpoint-url", srv.URL, "sam", "deploy")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	require.NotContains(t, stdout, "--region")
-	require.Contains(t, stdout, "ENV_AWS_REGION=eu-west-1")
+	assert.NotContains(t, stdout, "--region")
+	assert.Contains(t, stdout, "ENV_AWS_REGION=eu-west-1")
 }
 
 // Offline subcommands never get the flag: `init` and `docs` reject --region
@@ -320,9 +321,9 @@ func TestSAMDoesNotInjectRegionForOfflineSubcommand(t *testing.T) {
 		"sam", "--region", "ap-northeast-1", "build")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	require.Contains(t, stdout, "ARGS:build")
-	require.NotContains(t, stdout, "--region")
-	require.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
+	assert.Contains(t, stdout, "ARGS:build")
+	assert.NotContains(t, stdout, "--region")
+	assert.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
 }
 
 // A --region the user addressed to sam directly wins: appending lstk's after it
@@ -338,8 +339,8 @@ func TestSAMLeavesUserSuppliedRegionFlagAlone(t *testing.T) {
 	require.NoError(t, err, "stderr: %s", stderr)
 
 	// Pinned to the whole ARGS line: lstk must not append a second --region.
-	require.Contains(t, stdout, "ARGS:deploy --region us-west-1\n")
+	assert.Contains(t, stdout, "ARGS:deploy --region us-west-1\n")
 	// The environment still carries lstk's resolved region, as it always has;
 	// sam's own command-line flag is what outranks it.
-	require.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
+	assert.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
 }
diff --git a/test/integration/sam_e2e_test.go b/test/integration/sam_e2e_test.go
index dd836de0..8ecefe46 100644
--- a/test/integration/sam_e2e_test.go
+++ b/test/integration/sam_e2e_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -117,7 +118,7 @@ func TestSAME2EDeployCustomAccount(t *testing.T) {
 	stdout, stderr, err := runSAM(t, ctx, work, e, "--account", account, "list", "stack-outputs",
 		"--stack-name", stack, "--output", "json", "--region", "us-east-1")
 	require.NoError(t, err, "sam list stack-outputs stderr: %s", stderr)
-	require.Contains(t, stdout, account, "function ARN should carry the custom account id")
+	assert.Contains(t, stdout, account, "function ARN should carry the custom account id")
 
 	_, stderr, err = runSAM(t, ctx, work, e, "--account", account, "delete",
 		"--stack-name", stack, "--no-prompts", "--region", "us-east-1")
diff --git a/test/integration/setup_azure_test.go b/test/integration/setup_azure_test.go
index 293dafd0..cbc73ed1 100644
--- a/test/integration/setup_azure_test.go
+++ b/test/integration/setup_azure_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -68,8 +69,8 @@ func TestAzCommandErrorsWhenNotSetUp(t *testing.T) {
 	)
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "Azure CLI integration is not set up")
-	require.Contains(t, stdout, "lstk setup azure")
+	assert.Contains(t, stdout, "Azure CLI integration is not set up")
+	assert.Contains(t, stdout, "lstk setup azure")
 }
 
 // Non-interactive mode must not be rejected upfront (CI use case): with no
@@ -83,8 +84,8 @@ func TestSetupAzureNonInteractiveRunsWithoutTerminal(t *testing.T) {
 		"setup", "azure",
 	)
 	require.Error(t, err)
-	require.Contains(t, stderr, "no azure emulator configured")
-	require.NotContains(t, stderr, "interactive terminal")
+	assert.Contains(t, stderr, "no azure emulator configured")
+	assert.NotContains(t, stderr, "interactive terminal")
 }
 
 // `lstk setup az` must resolve to `setup azure`: the Azure tool-proxy command
@@ -99,8 +100,8 @@ func TestSetupAzureAliasAz(t *testing.T) {
 		"setup", "az",
 	)
 	require.Error(t, err)
-	require.NotContains(t, stderr, "unknown command")
-	require.Contains(t, stderr, "no azure emulator configured")
+	assert.NotContains(t, stderr, "unknown command")
+	assert.Contains(t, stderr, "no azure emulator configured")
 }
 
 // When the az CLI is missing, the error must be reported exactly once —
@@ -114,9 +115,9 @@ func TestSetupAzureReportsMissingAzCLIOnce(t *testing.T) {
 		"setup", "azure",
 	)
 	require.Error(t, err)
-	require.Contains(t, stderr, "az CLI not found in PATH")
+	assert.Contains(t, stderr, "az CLI not found in PATH")
 	combined := stdout + stderr
-	require.Equal(t, 1, strings.Count(combined, "az CLI not found in PATH"),
+	assert.Equal(t, 1, strings.Count(combined, "az CLI not found in PATH"),
 		"missing az CLI must be reported exactly once, got:\n%s", combined)
 }
 
@@ -137,8 +138,8 @@ func TestAzCommandErrorsWhenEmulatorNotRunning(t *testing.T) {
 	)
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "is not running")
-	require.Contains(t, stdout, "Start LocalStack")
+	assert.Contains(t, stdout, "is not running")
+	assert.Contains(t, stdout, "Start LocalStack")
 }
 
 // TestSetupAzureAndAzCommandSucceed requires Docker, the Azure CLI, and LOCALSTACK_AUTH_TOKEN.
@@ -183,7 +184,7 @@ func TestSetupAzureAndAzCommandSucceed(t *testing.T) {
 	p := startCmdInPTY(t, ctx, cmd)
 	out, err := p.wait()
 	require.NoError(t, err, "setup azure should succeed; output:\n%s", out)
-	require.Contains(t, out, "Azure CLI integration ready")
+	assert.Contains(t, out, "Azure CLI integration ready")
 
 	markerPath := filepath.Join(workDir, ".lstk", "azure", ".lstk-setup-complete")
 	_, err = os.Stat(markerPath)
@@ -196,7 +197,7 @@ func TestSetupAzureAndAzCommandSucceed(t *testing.T) {
 		"az", "cloud", "show", "--name", "LocalStack",
 	)
 	require.NoError(t, err, "lstk az cloud show failed: %s", stderr2)
-	require.Contains(t, stdout, "azure.localhost.localstack.cloud:4566",
+	assert.Contains(t, stdout, "azure.localhost.localstack.cloud:4566",
 		"registered cloud should expose the LocalStack Azure endpoint")
 
 	// Setup must also work without a terminal (CI use case): runLstk uses
@@ -207,5 +208,5 @@ func TestSetupAzureAndAzCommandSucceed(t *testing.T) {
 		"setup", "azure",
 	)
 	require.NoError(t, err, "non-interactive setup azure failed: stdout=%s stderr=%s", stdoutNI, stderrNI)
-	require.Contains(t, stdoutNI, "Azure CLI integration ready")
+	assert.Contains(t, stdoutNI, "Azure CLI integration ready")
 }
diff --git a/test/integration/snapshot_experimental_test.go b/test/integration/snapshot_experimental_test.go
index d15e3e7d..45b1db5f 100644
--- a/test/integration/snapshot_experimental_test.go
+++ b/test/integration/snapshot_experimental_test.go
@@ -6,6 +6,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -112,9 +113,9 @@ func TestSnapshotNonAWSShowsExperimentalWarning(t *testing.T) {
 				args := append([]string{"--config", em.writeConfig(t, "4566"), "--non-interactive"}, subArgs...)
 				stdout, stderr, err := runLstk(t, ctx, dir, environ, args...)
 				require.NoError(t, err, "lstk snapshot %s failed: %s", op.name, stderr)
-				require.Contains(t, stdout, op.successText)
-				require.Contains(t, stdout, experimentalWarningFragment)
-				require.Contains(t, stdout, em.name)
+				assert.Contains(t, stdout, op.successText)
+				assert.Contains(t, stdout, experimentalWarningFragment)
+				assert.Contains(t, stdout, em.name)
 			})
 		}
 	}
@@ -137,6 +138,6 @@ func TestSnapshotSaveAWSNoExperimentalWarning(t *testing.T) {
 		"--non-interactive", "snapshot", "save",
 	)
 	require.NoError(t, err, "lstk snapshot save failed: %s", stderr)
-	require.Contains(t, stdout, "Snapshot saved")
-	require.NotContains(t, stdout, experimentalWarningFragment)
+	assert.Contains(t, stdout, "Snapshot saved")
+	assert.NotContains(t, stdout, experimentalWarningFragment)
 }
diff --git a/test/integration/snapshot_list_test.go b/test/integration/snapshot_list_test.go
index 19609e1d..186a0969 100644
--- a/test/integration/snapshot_list_test.go
+++ b/test/integration/snapshot_list_test.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -81,7 +82,7 @@ func TestSnapshotListSuccessWithoutDocker(t *testing.T) {
 	require.NoError(t, err, "lstk snapshot list failed: %s", stderr)
 	called, creator, _ := cap.get()
 	require.True(t, called, "the platform list endpoint should have been called")
-	require.Equal(t, "me", creator, "default list should send ?creator=me")
+	assert.Equal(t, "me", creator, "default list should send ?creator=me")
 	snap.Match(t, sanitizeOutput(stdout))
 }
 
@@ -100,9 +101,9 @@ func TestSnapshotListAllFlag(t *testing.T) {
 	require.NoError(t, err, "lstk snapshot list --all failed: %s", stderr)
 	called, creator, _ := cap.get()
 	require.True(t, called, "the platform list endpoint should have been called")
-	require.Equal(t, "", creator, "--all should omit the ?creator param")
-	require.Contains(t, stdout, "~ 1 snapshot")
-	require.Contains(t, stdout, "org-pod")
+	assert.Equal(t, "", creator, "--all should omit the ?creator param")
+	assert.Contains(t, stdout, "~ 1 snapshot")
+	assert.Contains(t, stdout, "org-pod")
 }
 
 func TestSnapshotListEmpty(t *testing.T) {
@@ -115,7 +116,7 @@ func TestSnapshotListEmpty(t *testing.T) {
 		"--non-interactive", "snapshot", "list",
 	)
 	require.NoError(t, err, "lstk snapshot list failed: %s", stderr)
-	require.Contains(t, stdout, "No snapshots found")
+	assert.Contains(t, stdout, "No snapshots found")
 }
 
 func TestSnapshotListSendsBasicAuthHeader(t *testing.T) {
@@ -131,7 +132,7 @@ func TestSnapshotListSendsBasicAuthHeader(t *testing.T) {
 	require.NoError(t, err, "lstk snapshot list failed: %s", stderr)
 	_, _, auth := cap.get()
 	expected := "Basic " + base64.StdEncoding.EncodeToString([]byte(":test-token"))
-	require.Equal(t, expected, auth, "list should authenticate to the platform with Basic base64(\":\"+token)")
+	assert.Equal(t, expected, auth, "list should authenticate to the platform with Basic base64(\":\"+token)")
 }
 
 func TestSnapshotListRequiresAuthToken(t *testing.T) {
@@ -152,8 +153,8 @@ func TestSnapshotListRequiresAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "list",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "Authentication required")
-	require.Contains(t, stdout, "lstk login")
+	assert.Contains(t, stdout, "Authentication required")
+	assert.Contains(t, stdout, "lstk login")
 }
 
 func TestSnapshotListServerError(t *testing.T) {
@@ -172,7 +173,7 @@ func TestSnapshotListServerError(t *testing.T) {
 		"--non-interactive", "snapshot", "list",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, strings.ToLower(stderr), "error")
+	assert.Contains(t, strings.ToLower(stderr), "error")
 }
 
 func TestSnapshotListInteractive(t *testing.T) {
@@ -187,5 +188,5 @@ func TestSnapshotListInteractive(t *testing.T) {
 		"snapshot", "list",
 	)
 	require.NoError(t, err, "interactive lstk snapshot list failed")
-	require.Contains(t, out, "my-pod")
+	assert.Contains(t, out, "my-pod")
 }
diff --git a/test/integration/snapshot_load_test.go b/test/integration/snapshot_load_test.go
index 81288db5..c954fb28 100644
--- a/test/integration/snapshot_load_test.go
+++ b/test/integration/snapshot_load_test.go
@@ -10,6 +10,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -156,7 +157,7 @@ func TestSnapshotLoadRemoteRejected(t *testing.T) {
 				"--non-interactive", "snapshot", "load", ref,
 			)
 			requireExitCode(t, 1, err)
-			require.Contains(t, stderr, "not yet supported")
+			assert.Contains(t, stderr, "not yet supported")
 		})
 	}
 }
@@ -171,7 +172,7 @@ func TestSnapshotLoadS3RequiresPodName(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "s3://bucket/key",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "pod name is required")
+	assert.Contains(t, stderr, "pod name is required")
 }
 
 func TestSnapshotLoadPodNoAuthToken(t *testing.T) {
@@ -183,7 +184,7 @@ func TestSnapshotLoadPodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "authentication")
+	assert.Contains(t, stderr, "authentication")
 }
 
 func TestSnapshotLoadPodInvalidName(t *testing.T) {
@@ -197,7 +198,7 @@ func TestSnapshotLoadPodInvalidName(t *testing.T) {
 				"--non-interactive", "snapshot", "load", ref,
 			)
 			requireExitCode(t, 1, err)
-			require.Contains(t, stderr, "invalid pod name")
+			assert.Contains(t, stderr, "invalid pod name")
 		})
 	}
 }
@@ -211,7 +212,7 @@ func TestSnapshotLoadFileNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "/no/such/snapshot.snapshot",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "snapshot file not found")
+	assert.Contains(t, stderr, "snapshot file not found")
 }
 
 // TestSnapshotLoadPathIsDirectory ensures passing a directory instead of a
@@ -230,7 +231,7 @@ func TestSnapshotLoadPathIsDirectory(t *testing.T) {
 		"--non-interactive", "snapshot", "load", target,
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "is a directory")
+	assert.Contains(t, stderr, "is a directory")
 }
 
 // --- Docker required ---
@@ -252,7 +253,7 @@ func TestSnapshotLoadLocalSuccess(t *testing.T) {
 		"--non-interactive", "snapshot", "load", snapPath,
 	)
 	require.NoError(t, err, "lstk snapshot load failed: %s", stderr)
-	require.Contains(t, stdout, "Snapshot loaded")
+	assert.Contains(t, stdout, "Snapshot loaded")
 }
 
 func TestSnapshotLoadLocalBareNameFallback(t *testing.T) {
@@ -273,7 +274,7 @@ func TestSnapshotLoadLocalBareNameFallback(t *testing.T) {
 		"--non-interactive", "snapshot", "load", filepath.Join(dir, "snap"),
 	)
 	require.NoError(t, err, "bare name fallback failed: %s", stderr)
-	require.Contains(t, stdout, "Snapshot loaded")
+	assert.Contains(t, stdout, "Snapshot loaded")
 }
 
 // TestSnapshotLoadLocalLegacyZipFallback verifies that snapshots saved as .zip by
@@ -296,7 +297,7 @@ func TestSnapshotLoadLocalLegacyZipFallback(t *testing.T) {
 		"--non-interactive", "snapshot", "load", filepath.Join(dir, "snap"),
 	)
 	require.NoError(t, err, "legacy .zip fallback failed: %s", stderr)
-	require.Contains(t, stdout, "Snapshot loaded")
+	assert.Contains(t, stdout, "Snapshot loaded")
 }
 
 func TestSnapshotLoadLocalInvalidFile(t *testing.T) {
@@ -318,8 +319,8 @@ func TestSnapshotLoadLocalInvalidFile(t *testing.T) {
 	requireExitCode(t, 1, err)
 	// The user-facing error is emitted through the sink (stdout); the underlying
 	// "zip archive" detail must not leak to the user.
-	require.Contains(t, stdout, "not a valid snapshot")
-	require.NotContains(t, strings.ToLower(stdout+stderr), "zip")
+	assert.Contains(t, stdout, "not a valid snapshot")
+	assert.NotContains(t, strings.ToLower(stdout+stderr), "zip")
 }
 
 func TestSnapshotLoadLocalOverwriteStrategy(t *testing.T) {
@@ -339,7 +340,7 @@ func TestSnapshotLoadLocalOverwriteStrategy(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "--merge=overwrite", snapPath,
 	)
 	require.NoError(t, err, "lstk snapshot load --merge=overwrite failed: %s", stderr)
-	require.True(t, wasReset(), "/_localstack/state/reset should have been called for overwrite strategy")
+	assert.True(t, wasReset(), "/_localstack/state/reset should have been called for overwrite strategy")
 }
 
 func TestSnapshotLoadPodSuccess(t *testing.T) {
@@ -358,10 +359,10 @@ func TestSnapshotLoadPodSuccess(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "pod:my-baseline",
 	)
 	require.NoError(t, err, "lstk snapshot load pod:my-baseline failed: %s", stderr)
-	require.Contains(t, stdout, "Snapshot loaded")
-	require.Contains(t, stdout, "my-baseline")
-	require.Contains(t, stdout, "s3")
-	require.Contains(t, stdout, "dynamodb")
+	assert.Contains(t, stdout, "Snapshot loaded")
+	assert.Contains(t, stdout, "my-baseline")
+	assert.Contains(t, stdout, "s3")
+	assert.Contains(t, stdout, "dynamodb")
 }
 
 func TestSnapshotLoadPodServerError(t *testing.T) {
@@ -380,7 +381,7 @@ func TestSnapshotLoadPodServerError(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "platform unavailable")
+	assert.Contains(t, stderr, "platform unavailable")
 }
 
 // TestSnapshotLoadPodNotFound covers a non-existent cloud snapshot. The emulator
@@ -405,8 +406,8 @@ func TestSnapshotLoadPodNotFound(t *testing.T) {
 	requireExitCode(t, 1, err)
 	// The user-facing error is emitted through the sink (stdout); the raw
 	// platform diagnostic must not leak to the user.
-	require.Contains(t, stdout, "not found on the LocalStack platform")
-	require.NotContains(t, strings.ToLower(stdout+stderr), "version information")
+	assert.Contains(t, stdout, "not found on the LocalStack platform")
+	assert.NotContains(t, strings.ToLower(stdout+stderr), "version information")
 }
 
 func TestSnapshotLoadTelemetryEmitted(t *testing.T) {
@@ -449,7 +450,7 @@ func TestSnapshotLoadInteractive(t *testing.T) {
 		"snapshot", "load", snapPath,
 	)
 	require.NoError(t, err, "interactive lstk snapshot load failed")
-	require.Contains(t, out, "Snapshot loaded")
+	assert.Contains(t, out, "Snapshot loaded")
 }
 
 func TestLoadAliasMatchesSnapshotLoad(t *testing.T) {
@@ -472,7 +473,7 @@ func TestLoadAliasMatchesSnapshotLoad(t *testing.T) {
 		"--non-interactive", "load", snapPath,
 	)
 	require.NoError(t, err, "lstk load failed: %s", stderr)
-	require.Contains(t, stdout, "Snapshot loaded")
+	assert.Contains(t, stdout, "Snapshot loaded")
 
 	// Alias must emit telemetry under the canonical name so usage isn't
 	// split across "load" and "snapshot load" labels.
@@ -492,7 +493,7 @@ func TestSnapshotLoadDryRunOnLocalRef(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "--dry-run", snapPath,
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "pod refs")
+	assert.Contains(t, stderr, "pod refs")
 }
 
 func TestSnapshotLoadDryRunPodNoAuthToken(t *testing.T) {
@@ -504,7 +505,7 @@ func TestSnapshotLoadDryRunPodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "--dry-run", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "authentication")
+	assert.Contains(t, stderr, "authentication")
 }
 
 func TestSnapshotLoadDryRunPodSuccess(t *testing.T) {
@@ -523,9 +524,9 @@ func TestSnapshotLoadDryRunPodSuccess(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "--dry-run", "pod:my-baseline",
 	)
 	require.NoError(t, err, "lstk snapshot load --dry-run failed: %s", stderr)
-	require.Contains(t, stdout, "Dry-run results")
-	require.Contains(t, stdout, "my-baseline")
-	require.Contains(t, stdout, "No state was modified.")
+	assert.Contains(t, stdout, "Dry-run results")
+	assert.Contains(t, stdout, "my-baseline")
+	assert.Contains(t, stdout, "No state was modified.")
 }
 
 // TestSnapshotLoadDryRunPodNotFound covers a non-existent cloud snapshot, mirroring
@@ -549,8 +550,8 @@ func TestSnapshotLoadDryRunPodNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "--dry-run", "pod:does-not-exist",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "not found on the LocalStack platform")
-	require.NotContains(t, strings.ToLower(stdout+stderr), "version information")
+	assert.Contains(t, stdout, "not found on the LocalStack platform")
+	assert.NotContains(t, strings.ToLower(stdout+stderr), "version information")
 }
 
 // mockUnlicensedPodsServer mimics an emulator whose license does not include
@@ -587,9 +588,9 @@ func TestSnapshotLoadFeatureUnavailable(t *testing.T) {
 	)
 	requireExitCode(t, 1, err)
 	// The user-facing error is emitted through the sink (stdout).
-	require.Contains(t, stdout, "Snapshots require a paid LocalStack plan")
-	require.Contains(t, stdout, "https://www.localstack.cloud/pricing")
-	require.NotContains(t, stdout+stderr, "status 404", "the raw HTTP status must not leak to the user")
+	assert.Contains(t, stdout, "Snapshots require a paid LocalStack plan")
+	assert.Contains(t, stdout, "https://www.localstack.cloud/pricing")
+	assert.NotContains(t, stdout+stderr, "status 404", "the raw HTTP status must not leak to the user")
 }
 
 // The save path funnels through a different shared helper than load, so it needs
@@ -610,7 +611,7 @@ func TestSnapshotSaveFeatureUnavailable(t *testing.T) {
 		"--non-interactive", "snapshot", "save", filepath.Join(dir, "out.snapshot"),
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "Snapshots require a paid LocalStack plan")
-	require.Contains(t, stdout, "https://www.localstack.cloud/pricing")
-	require.NotContains(t, stdout+stderr, "status 404")
+	assert.Contains(t, stdout, "Snapshots require a paid LocalStack plan")
+	assert.Contains(t, stdout, "https://www.localstack.cloud/pricing")
+	assert.NotContains(t, stdout+stderr, "status 404")
 }
diff --git a/test/integration/snapshot_load_version_test.go b/test/integration/snapshot_load_version_test.go
index f1062903..a6d77b58 100644
--- a/test/integration/snapshot_load_version_test.go
+++ b/test/integration/snapshot_load_version_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -95,11 +96,11 @@ func TestSnapshotLoadPodVersionReachesWire(t *testing.T) {
 
 	called, path, query := cap.get()
 	require.True(t, called, "the pod load endpoint should have been called")
-	require.Equal(t, "/_localstack/pods/my-baseline", path)
-	require.Equal(t, "3", query.Get("version"))
-	require.Equal(t, "account-region-merge", query.Get("merge"), "the default merge strategy still applies")
+	assert.Equal(t, "/_localstack/pods/my-baseline", path)
+	assert.Equal(t, "3", query.Get("version"))
+	assert.Equal(t, "account-region-merge", query.Get("merge"), "the default merge strategy still applies")
 
-	require.Contains(t, stdout, "pod:my-baseline:3", "the loaded source should name the pinned version")
+	assert.Contains(t, stdout, "pod:my-baseline:3", "the loaded source should name the pinned version")
 }
 
 // TestSnapshotLoadPodWithoutVersionOmitsParam: an unpinned ref must not send
@@ -117,10 +118,10 @@ func TestSnapshotLoadPodWithoutVersionOmitsParam(t *testing.T) {
 
 	called, _, query := cap.get()
 	require.True(t, called, "the pod load endpoint should have been called")
-	require.False(t, query.Has("version"), "an unpinned load must not send a version parameter")
+	assert.False(t, query.Has("version"), "an unpinned load must not send a version parameter")
 
-	require.Contains(t, stdout, "pod:my-baseline")
-	require.NotContains(t, stdout, "pod:my-baseline:")
+	assert.Contains(t, stdout, "pod:my-baseline")
+	assert.NotContains(t, stdout, "pod:my-baseline:")
 }
 
 // TestLoadAliasAcceptsPodVersion: the root `lstk load` alias shares the REF
@@ -138,7 +139,7 @@ func TestLoadAliasAcceptsPodVersion(t *testing.T) {
 
 	called, _, query := cap.get()
 	require.True(t, called, "the pod load endpoint should have been called")
-	require.Equal(t, "2", query.Get("version"))
+	assert.Equal(t, "2", query.Get("version"))
 }
 
 // TestSnapshotLoadPodVersionDryRun: --dry-run previews the same version the load
@@ -156,11 +157,11 @@ func TestSnapshotLoadPodVersionDryRun(t *testing.T) {
 
 	called, path, query := cap.get()
 	require.True(t, called, "the diff endpoint should have been called")
-	require.Equal(t, "/_localstack/pods/my-baseline/diff", path)
-	require.Equal(t, "3", query.Get("version"))
+	assert.Equal(t, "/_localstack/pods/my-baseline/diff", path)
+	assert.Equal(t, "3", query.Get("version"))
 
-	require.Contains(t, stdout, "Dry-run results for pod:my-baseline:3")
-	require.Contains(t, stdout, "No state was modified")
+	assert.Contains(t, stdout, "Dry-run results for pod:my-baseline:3")
+	assert.Contains(t, stdout, "No state was modified")
 }
 
 // TestSnapshotLoadPodVersionNotFound: the emulator's own message already names
@@ -179,10 +180,10 @@ func TestSnapshotLoadPodVersionNotFound(t *testing.T) {
 	requireExitCode(t, 1, err)
 
 	_, _, query := cap.get()
-	require.Equal(t, "99", query.Get("version"))
+	assert.Equal(t, "99", query.Get("version"))
 
-	require.Contains(t, stdout, "maximum version available in the remote storage is 3")
-	require.Contains(t, stdout, "lstk snapshot versions pod:my-baseline")
+	assert.Contains(t, stdout, "maximum version available in the remote storage is 3")
+	assert.Contains(t, stdout, "lstk snapshot versions pod:my-baseline")
 }
 
 // TestSnapshotLoadRejectsMalformedVersion: a colon in a ref is unambiguously a
@@ -204,8 +205,8 @@ func TestSnapshotLoadRejectsMalformedVersion(t *testing.T) {
 				"--non-interactive", "--endpoint-url", srv.URL, "snapshot", "load", ref,
 			)
 			requireExitCode(t, 1, err)
-			require.Contains(t, stderr, "invalid version")
-			require.NotContains(t, stderr, "invalid pod name")
+			assert.Contains(t, stderr, "invalid version")
+			assert.NotContains(t, stderr, "invalid pod name")
 		})
 	}
 }
@@ -220,7 +221,7 @@ func TestSnapshotLoadS3RejectsPodVersion(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "my-pod:3", "s3://bucket/prefix",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "S3 remotes do not support snapshot versions")
+	assert.Contains(t, stderr, "S3 remotes do not support snapshot versions")
 }
 
 // TestSnapshotSaveRejectsPodVersion: the platform assigns a version on every
@@ -234,8 +235,8 @@ func TestSnapshotSaveRejectsPodVersion(t *testing.T) {
 			"--non-interactive", "snapshot", "save", "pod:my-baseline:3",
 		)
 		requireExitCode(t, 1, err)
-		require.Contains(t, stderr, "the platform assigns the version on each save")
-		require.NotContains(t, stderr, "invalid pod name")
+		assert.Contains(t, stderr, "the platform assigns the version on each save")
+		assert.NotContains(t, stderr, "invalid pod name")
 	})
 
 	t.Run("s3 remote", func(t *testing.T) {
@@ -244,7 +245,7 @@ func TestSnapshotSaveRejectsPodVersion(t *testing.T) {
 			"--non-interactive", "snapshot", "save", "my-pod:3", "s3://bucket/prefix",
 		)
 		requireExitCode(t, 1, err)
-		require.Contains(t, stderr, "S3 remotes do not support snapshot versions")
+		assert.Contains(t, stderr, "S3 remotes do not support snapshot versions")
 	})
 }
 
@@ -258,7 +259,7 @@ func TestSnapshotRemoveRejectsPodVersion(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline:3", "--force",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "drop the ':3'")
+	assert.Contains(t, stderr, "drop the ':3'")
 }
 
 // TestStartSnapshotFlagAcceptsPodVersion: --snapshot goes through the same REF
@@ -271,5 +272,5 @@ func TestStartSnapshotFlagAcceptsPodVersion(t *testing.T) {
 		"--non-interactive", "start", "--snapshot", "pod:my-baseline:abc",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "invalid version")
+	assert.Contains(t, stderr, "invalid version")
 }
diff --git a/test/integration/snapshot_merge_e2e_test.go b/test/integration/snapshot_merge_e2e_test.go
index bf9e19b0..ebfc6e20 100644
--- a/test/integration/snapshot_merge_e2e_test.go
+++ b/test/integration/snapshot_merge_e2e_test.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -274,27 +275,27 @@ func TestSnapshotLoadMergeStrategies(t *testing.T) {
 			_, stderr, err = runLstk(t, ctx, "", e, "snapshot", "load", snap2, "--merge="+tc.strategy)
 			require.NoError(t, err, "loading snapshot2 (merge=%s) failed: %s", tc.strategy, stderr)
 
-			require.ElementsMatch(t, tc.wantUSEastSNS, snsTopicNames(t, ctx, e, "us-east-1"), "us-east-1 SNS topics")
-			require.ElementsMatch(t, tc.wantUSEastS3, s3BucketNames(t, ctx, e), "S3 buckets")
-			require.ElementsMatch(t, tc.wantAPSoutheast2["sns"], snsTopicNames(t, ctx, e, "ap-southeast-2"), "ap-southeast-2 SNS topics")
+			assert.ElementsMatch(t, tc.wantUSEastSNS, snsTopicNames(t, ctx, e, "us-east-1"), "us-east-1 SNS topics")
+			assert.ElementsMatch(t, tc.wantUSEastS3, s3BucketNames(t, ctx, e), "S3 buckets")
+			assert.ElementsMatch(t, tc.wantAPSoutheast2["sns"], snsTopicNames(t, ctx, e, "ap-southeast-2"), "ap-southeast-2 SNS topics")
 
 			usEastQueues := sqsQueueURLsByName(t, ctx, e, "us-east-1")
 			gotUSEastSQS := make([]string, 0, len(usEastQueues))
 			for name := range usEastQueues {
 				gotUSEastSQS = append(gotUSEastSQS, name)
 			}
-			require.ElementsMatch(t, tc.wantUSEastSQS, gotUSEastSQS, "us-east-1 SQS queues")
+			assert.ElementsMatch(t, tc.wantUSEastSQS, gotUSEastSQS, "us-east-1 SQS queues")
 
 			apSoutheastQueues := sqsQueueURLsByName(t, ctx, e, "ap-southeast-2")
 			gotAPSoutheastSQS := make([]string, 0, len(apSoutheastQueues))
 			for name := range apSoutheastQueues {
 				gotAPSoutheastSQS = append(gotAPSoutheastSQS, name)
 			}
-			require.ElementsMatch(t, tc.wantAPSoutheast2["sqs"], gotAPSoutheastSQS, "ap-southeast-2 SQS queues")
+			assert.ElementsMatch(t, tc.wantAPSoutheast2["sqs"], gotAPSoutheastSQS, "ap-southeast-2 SQS queues")
 
 			queueToReplaceURL, ok := usEastQueues["queue-to-replace"]
 			require.True(t, ok, "queue-to-replace should exist in us-east-1 after merge=%s", tc.strategy)
-			require.Equal(t, tc.wantVisibility, sqsQueueVisibilityTimeout(t, ctx, e, "us-east-1", queueToReplaceURL),
+			assert.Equal(t, tc.wantVisibility, sqsQueueVisibilityTimeout(t, ctx, e, "us-east-1", queueToReplaceURL),
 				"queue-to-replace VisibilityTimeout after merge=%s", tc.strategy)
 		})
 	}
diff --git a/test/integration/snapshot_remove_test.go b/test/integration/snapshot_remove_test.go
index ae71ddd5..e6469f36 100644
--- a/test/integration/snapshot_remove_test.go
+++ b/test/integration/snapshot_remove_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -40,8 +41,8 @@ func TestSnapshotRemoveLocalRefRejected(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "./my-baseline.zip",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "resolves to a local file")
-	require.Contains(t, stderr, "CLI cannot delete local files")
+	assert.Contains(t, stderr, "resolves to a local file")
+	assert.Contains(t, stderr, "CLI cannot delete local files")
 }
 
 func TestSnapshotRemoveLocalBareNameRejected(t *testing.T) {
@@ -53,8 +54,8 @@ func TestSnapshotRemoveLocalBareNameRejected(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "resolves to a local file")
-	require.Contains(t, stderr, "CLI cannot delete local files")
+	assert.Contains(t, stderr, "resolves to a local file")
+	assert.Contains(t, stderr, "CLI cannot delete local files")
 }
 
 func TestSnapshotRemovePodNoAuthToken(t *testing.T) {
@@ -66,7 +67,7 @@ func TestSnapshotRemovePodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline", "--force",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "authentication")
+	assert.Contains(t, stderr, "authentication")
 }
 
 func TestSnapshotRemovePodInvalidName(t *testing.T) {
@@ -81,7 +82,7 @@ func TestSnapshotRemovePodInvalidName(t *testing.T) {
 				"--non-interactive", "snapshot", "remove", ref,
 			)
 			requireExitCode(t, 1, err)
-			require.Contains(t, stderr, "invalid pod name")
+			assert.Contains(t, stderr, "invalid pod name")
 		})
 	}
 }
@@ -95,7 +96,7 @@ func TestSnapshotRemoveNonInteractiveRequiresForce(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "--force")
+	assert.Contains(t, stderr, "--force")
 }
 
 func TestSnapshotRemoteSchemeRejected(t *testing.T) {
@@ -110,7 +111,7 @@ func TestSnapshotRemoteSchemeRejected(t *testing.T) {
 				"--non-interactive", "snapshot", "remove", ref,
 			)
 			requireExitCode(t, 1, err)
-			require.Contains(t, stderr, "not yet supported")
+			assert.Contains(t, stderr, "not yet supported")
 		})
 	}
 }
@@ -133,9 +134,9 @@ func TestSnapshotRemovePodSuccess(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline", "--force",
 	)
 	require.NoError(t, err, "lstk snapshot remove pod:my-baseline failed: %s", stderr)
-	require.Contains(t, stdout, "my-baseline")
-	require.Contains(t, stdout, "deleted")
-	require.Equal(t, int32(1), calls(), "DELETE endpoint should be called exactly once")
+	assert.Contains(t, stdout, "my-baseline")
+	assert.Contains(t, stdout, "deleted")
+	assert.Equal(t, int32(1), calls(), "DELETE endpoint should be called exactly once")
 }
 
 func TestSnapshotRemovePodServerError(t *testing.T) {
@@ -154,8 +155,8 @@ func TestSnapshotRemovePodServerError(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline", "--force",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "pod remove failed")
-	require.Equal(t, int32(1), calls(), "DELETE endpoint should be called even when server errors")
+	assert.Contains(t, stderr, "pod remove failed")
+	assert.Equal(t, int32(1), calls(), "DELETE endpoint should be called even when server errors")
 }
 
 func TestSnapshotRemovePodNotFound(t *testing.T) {
@@ -183,10 +184,10 @@ func TestSnapshotRemovePodNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-snapshot", "--force",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, `"my-snapshot"`)
-	require.Contains(t, stderr, "not found")
-	require.NotContains(t, stderr, "HTTP 500")
-	require.NotContains(t, stderr, "pod remove failed")
+	assert.Contains(t, stderr, `"my-snapshot"`)
+	assert.Contains(t, stderr, "not found")
+	assert.NotContains(t, stderr, "HTTP 500")
+	assert.NotContains(t, stderr, "pod remove failed")
 }
 
 func TestSnapshotRemoveInteractive(t *testing.T) {
@@ -217,8 +218,8 @@ func TestSnapshotRemoveInteractive(t *testing.T) {
 		out, err := p.wait()
 		require.NoError(t, err)
 
-		require.Contains(t, out, "deleted")
-		require.Equal(t, int32(1), calls(), "DELETE endpoint should be called after confirmation")
+		assert.Contains(t, out, "deleted")
+		assert.Equal(t, int32(1), calls(), "DELETE endpoint should be called after confirmation")
 	})
 
 	t.Run("cancels with n", func(t *testing.T) {
@@ -228,8 +229,8 @@ func TestSnapshotRemoveInteractive(t *testing.T) {
 		out, err := p.wait()
 		require.NoError(t, err)
 
-		require.Contains(t, out, "Cancelled")
-		require.Equal(t, int32(0), calls(), "DELETE endpoint must not be called when user cancels")
+		assert.Contains(t, out, "Cancelled")
+		assert.Equal(t, int32(0), calls(), "DELETE endpoint must not be called when user cancels")
 	})
 
 	t.Run("force skips confirmation prompt", func(t *testing.T) {
@@ -243,8 +244,8 @@ func TestSnapshotRemoveInteractive(t *testing.T) {
 		out, err := p.wait()
 		require.NoError(t, err)
 
-		require.NotContains(t, out, "Delete cloud snapshot", "confirmation prompt must not appear with --force")
-		require.Contains(t, out, "deleted")
-		require.Equal(t, int32(1), calls(), "DELETE endpoint should be called without confirmation")
+		assert.NotContains(t, out, "Delete cloud snapshot", "confirmation prompt must not appear with --force")
+		assert.Contains(t, out, "deleted")
+		assert.Equal(t, int32(1), calls(), "DELETE endpoint should be called without confirmation")
 	})
 }
diff --git a/test/integration/snapshot_save_test.go b/test/integration/snapshot_save_test.go
index d1e56a69..77975785 100644
--- a/test/integration/snapshot_save_test.go
+++ b/test/integration/snapshot_save_test.go
@@ -15,6 +15,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -109,7 +110,7 @@ func TestSnapshotSaveDefaultDestination(t *testing.T) {
 		"--non-interactive", "snapshot", "save",
 	)
 	require.NoError(t, err, "lstk snapshot save failed: %s", stderr)
-	require.Contains(t, stdout, "Snapshot saved")
+	assert.Contains(t, stdout, "Snapshot saved")
 
 	entries, readErr := os.ReadDir(dir)
 	require.NoError(t, readErr)
@@ -120,7 +121,7 @@ func TestSnapshotSaveDefaultDestination(t *testing.T) {
 			break
 		}
 	}
-	require.True(t, found, "default snapshot file (snapshot-*.snapshot) should exist in %s", dir)
+	assert.True(t, found, "default snapshot file (snapshot-*.snapshot) should exist in %s", dir)
 }
 
 func TestSnapshotSaveCustomPath(t *testing.T) {
@@ -139,16 +140,16 @@ func TestSnapshotSaveCustomPath(t *testing.T) {
 		"--non-interactive", "snapshot", "save", outPath,
 	)
 	require.NoError(t, err, "lstk snapshot save failed: %s", stderr)
-	require.Contains(t, stdout, "Snapshot saved")
-	require.Contains(t, stdout, "./my-snap.snapshot")
+	assert.Contains(t, stdout, "Snapshot saved")
+	assert.Contains(t, stdout, "./my-snap.snapshot")
 
 	data, err := os.ReadFile(outPath)
 	require.NoError(t, err, "output file should exist")
-	require.True(t, len(data) > 0, "output file should be non-empty")
+	assert.True(t, len(data) > 0, "output file should be non-empty")
 
 	r, err := zip.NewReader(bytes.NewReader(data), int64(len(data)))
 	require.NoError(t, err, "output file should be a valid ZIP")
-	require.NotEmpty(t, r.File)
+	assert.NotEmpty(t, r.File)
 }
 
 func TestSnapshotSaveRelativePath(t *testing.T) {
@@ -166,10 +167,10 @@ func TestSnapshotSaveRelativePath(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "./my-state",
 	)
 	require.NoError(t, err, "lstk snapshot save failed: %s", stderr)
-	require.Contains(t, stdout, "Snapshot saved")
+	assert.Contains(t, stdout, "Snapshot saved")
 
 	_, statErr := os.Stat(filepath.Join(dir, "my-state.snapshot"))
-	require.NoError(t, statErr, "relative output file should exist")
+	assert.NoError(t, statErr, "relative output file should exist")
 }
 
 // TestSnapshotSaveForcesSnapshotExtension verifies that a user-supplied extension
@@ -189,12 +190,12 @@ func TestSnapshotSaveForcesSnapshotExtension(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "./x.zip",
 	)
 	require.NoError(t, err, "lstk snapshot save failed: %s", stderr)
-	require.Contains(t, stdout, "./x.snapshot")
+	assert.Contains(t, stdout, "./x.snapshot")
 
 	_, statErr := os.Stat(filepath.Join(dir, "x.snapshot"))
-	require.NoError(t, statErr, "extension should be forced to .snapshot")
+	assert.NoError(t, statErr, "extension should be forced to .snapshot")
 	_, zipErr := os.Stat(filepath.Join(dir, "x.zip"))
-	require.True(t, os.IsNotExist(zipErr), "the user-supplied .zip path should not be created")
+	assert.True(t, os.IsNotExist(zipErr), "the user-supplied .zip path should not be created")
 }
 
 func TestSnapshotSaveOverwritesExistingFile(t *testing.T) {
@@ -217,7 +218,7 @@ func TestSnapshotSaveOverwritesExistingFile(t *testing.T) {
 
 	data, err := os.ReadFile(outPath)
 	require.NoError(t, err)
-	require.NotEqual(t, "OLD", string(data), "file should have been overwritten")
+	assert.NotEqual(t, "OLD", string(data), "file should have been overwritten")
 }
 
 func TestSnapshotSaveRemoteRejected(t *testing.T) {
@@ -231,7 +232,7 @@ func TestSnapshotSaveRemoteRejected(t *testing.T) {
 
 			_, stderr, err := runLstk(t, ctx, t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--non-interactive", "snapshot", "save", dest)
 			requireExitCode(t, 1, err)
-			require.Contains(t, stderr, "not yet supported")
+			assert.Contains(t, stderr, "not yet supported")
 		})
 	}
 }
@@ -247,7 +248,7 @@ func TestSnapshotSaveS3MissingCredentials(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "my-pod", "s3://my-bucket/prefix",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "AWS credentials required")
+	assert.Contains(t, stderr, "AWS credentials required")
 }
 
 func TestSnapshotSaveS3CredentialsInURLRejected(t *testing.T) {
@@ -261,7 +262,7 @@ func TestSnapshotSaveS3CredentialsInURLRejected(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "my-pod", "s3://my-bucket/prefix?access_key_id=AKIA&secret_access_key=secret",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "do not put credentials")
+	assert.Contains(t, stderr, "do not put credentials")
 }
 
 // mockPodS3Server handles the remote registration plus pod save against an S3
@@ -327,17 +328,17 @@ func TestSnapshotSaveS3Success(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "my-pod", s3URL,
 	)
 	require.NoError(t, err, "lstk snapshot save to s3 failed: %s", stderr)
-	require.Contains(t, stdout, "Snapshot saved to "+s3URL)
-	require.Contains(t, stdout, "my-pod")
+	assert.Contains(t, stdout, "Snapshot saved to "+s3URL)
+	assert.Contains(t, stdout, "my-pod")
 
 	remoteURL, saveBody := captured()
 	// The registered URL carries placeholders, never the secret values.
-	require.Contains(t, remoteURL, "{access_key_id}")
-	require.NotContains(t, remoteURL, "topsecret")
-	require.NotContains(t, remoteURL, "AKIAEXAMPLE")
+	assert.Contains(t, remoteURL, "{access_key_id}")
+	assert.NotContains(t, remoteURL, "topsecret")
+	assert.NotContains(t, remoteURL, "AKIAEXAMPLE")
 	// The secrets travel only in the ephemeral save params.
-	require.Contains(t, string(saveBody), "topsecret")
-	require.Contains(t, string(saveBody), "remote_params")
+	assert.Contains(t, string(saveBody), "topsecret")
+	assert.Contains(t, string(saveBody), "remote_params")
 }
 
 // mockPodSaveServer returns a test server that handles POST /_localstack/pods/{name}
@@ -378,10 +379,10 @@ func TestSnapshotSavePodSuccess(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "pod:my-baseline",
 	)
 	require.NoError(t, err, "lstk snapshot save pod:my-baseline failed: %s", stderr)
-	require.Contains(t, stdout, "Snapshot saved")
-	require.Contains(t, stdout, "my-baseline")
-	require.Contains(t, stdout, "Version: 1")
-	require.Contains(t, stdout, "dynamodb, s3")
+	assert.Contains(t, stdout, "Snapshot saved")
+	assert.Contains(t, stdout, "my-baseline")
+	assert.Contains(t, stdout, "Version: 1")
+	assert.Contains(t, stdout, "dynamodb, s3")
 }
 
 func TestSnapshotSavePodServerError(t *testing.T) {
@@ -400,7 +401,7 @@ func TestSnapshotSavePodServerError(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "platform error")
+	assert.Contains(t, stderr, "platform error")
 }
 
 func TestSnapshotSavePodNoAuthToken(t *testing.T) {
@@ -412,7 +413,7 @@ func TestSnapshotSavePodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "authentication")
+	assert.Contains(t, stderr, "authentication")
 }
 
 func TestSnapshotSavePodInvalidName(t *testing.T) {
@@ -428,7 +429,7 @@ func TestSnapshotSavePodInvalidName(t *testing.T) {
 
 			_, stderr, err := runLstk(t, ctx, t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--non-interactive", "snapshot", "save", dest)
 			requireExitCode(t, 1, err)
-			require.Contains(t, stderr, "invalid pod name")
+			assert.Contains(t, stderr, "invalid pod name")
 		})
 	}
 }
@@ -509,10 +510,10 @@ func TestSnapshotSavePodWithServices(t *testing.T) {
 		} `json:"attributes"`
 	}
 	require.NoError(t, json.Unmarshal(capturedBody(), &parsed))
-	require.Equal(t, []string{"s3", "dynamodb"}, parsed.Attributes.Services, "request body must carry exactly the requested services")
+	assert.Equal(t, []string{"s3", "dynamodb"}, parsed.Attributes.Services, "request body must carry exactly the requested services")
 
-	require.Contains(t, stdout, "Snapshot saved")
-	require.Contains(t, stdout, "Services: s3, dynamodb")
+	assert.Contains(t, stdout, "Snapshot saved")
+	assert.Contains(t, stdout, "Services: s3, dynamodb")
 }
 
 func TestSnapshotSavePodServicesSingleValue(t *testing.T) {
@@ -538,7 +539,7 @@ func TestSnapshotSavePodServicesSingleValue(t *testing.T) {
 		} `json:"attributes"`
 	}
 	require.NoError(t, json.Unmarshal(capturedBody(), &parsed))
-	require.Equal(t, []string{"s3"}, parsed.Attributes.Services)
+	assert.Equal(t, []string{"s3"}, parsed.Attributes.Services)
 }
 
 func TestSnapshotSavePodServicesInvalidFormat(t *testing.T) {
@@ -558,7 +559,7 @@ func TestSnapshotSavePodServicesInvalidFormat(t *testing.T) {
 				"--non-interactive", "snapshot", "save", "pod:my-baseline", "--services", value,
 			)
 			requireExitCode(t, 1, err)
-			require.Contains(t, stderr, "comma-separated list of service names")
+			assert.Contains(t, stderr, "comma-separated list of service names")
 		})
 	}
 }
@@ -580,9 +581,9 @@ func TestSnapshotSaveLocalWithServices(t *testing.T) {
 	)
 	require.NoError(t, err, "lstk snapshot save --services failed: %s", stderr)
 
-	require.Equal(t, "services=s3,dynamodb", capturedQuery(), "request must carry exactly the requested services")
-	require.Contains(t, stdout, "Snapshot saved")
-	require.Contains(t, stdout, "Services: s3, dynamodb")
+	assert.Equal(t, "services=s3,dynamodb", capturedQuery(), "request must carry exactly the requested services")
+	assert.Contains(t, stdout, "Snapshot saved")
+	assert.Contains(t, stdout, "Services: s3, dynamodb")
 
 	_, statErr := os.Stat(dest)
 	require.NoError(t, statErr, "snapshot file should have been created")
@@ -614,7 +615,7 @@ func TestSnapshotSaveS3WithServices(t *testing.T) {
 		} `json:"attributes"`
 	}
 	require.NoError(t, json.Unmarshal(saveBody, &parsed))
-	require.Equal(t, []string{"s3", "lambda"}, parsed.Attributes.Services)
+	assert.Equal(t, []string{"s3", "lambda"}, parsed.Attributes.Services)
 }
 
 func TestSnapshotSaveEmulatorNotRunning(t *testing.T) {
@@ -648,7 +649,7 @@ func TestSnapshotSaveEmulatorNotRunning(t *testing.T) {
 			}
 			stdout, _, err := runLstk(t, ctx, t.TempDir(), e, tc.args...)
 			requireExitCode(t, 1, err)
-			require.Contains(t, stdout, "not running")
+			assert.Contains(t, stdout, "not running")
 		})
 	}
 }
@@ -667,7 +668,7 @@ func TestSnapshotSaveInvalidParentDir(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "/no/such/dir/state",
 	)
 	requireExitCode(t, 1, err)
-	require.NotEmpty(t, stderr)
+	assert.NotEmpty(t, stderr)
 }
 
 func TestSnapshotSaveTelemetryEmitted(t *testing.T) {
@@ -722,15 +723,15 @@ func TestSaveAliasMatchesSnapshotSave(t *testing.T) {
 		"--non-interactive", "save", outPath,
 	)
 	require.NoError(t, err, "lstk save failed: %s", stderr)
-	require.Contains(t, stdout, "Snapshot saved")
+	assert.Contains(t, stdout, "Snapshot saved")
 
 	data, err := os.ReadFile(outPath)
 	require.NoError(t, err, "output file should exist")
-	require.True(t, len(data) > 0, "output file should be non-empty")
+	assert.True(t, len(data) > 0, "output file should be non-empty")
 
 	r, err := zip.NewReader(bytes.NewReader(data), int64(len(data)))
 	require.NoError(t, err, "output file should be a valid ZIP")
-	require.NotEmpty(t, r.File)
+	assert.NotEmpty(t, r.File)
 
 	// Alias must emit telemetry under the canonical name so usage isn't
 	// split across "save" and "snapshot save" labels.
@@ -752,5 +753,5 @@ func TestSnapshotSaveInteractive(t *testing.T) {
 		"snapshot", "save", filepath.Join(dir, "snap"),
 	)
 	require.NoError(t, err, "interactive lstk snapshot save failed")
-	require.Contains(t, out, "Snapshot saved")
+	assert.Contains(t, out, "Snapshot saved")
 }
diff --git a/test/integration/snapshot_show_test.go b/test/integration/snapshot_show_test.go
index 0018d0fb..a240bf94 100644
--- a/test/integration/snapshot_show_test.go
+++ b/test/integration/snapshot_show_test.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -81,7 +82,7 @@ func TestSnapshotShowSuccessWithoutDocker(t *testing.T) {
 
 	called, path, _ := cap.get()
 	require.True(t, called, "the single-pod endpoint should have been called")
-	require.Equal(t, "/v1/cloudpods/my-baseline", path)
+	assert.Equal(t, "/v1/cloudpods/my-baseline", path)
 
 	snap.Match(t, sanitizeOutput(stdout))
 }
@@ -98,8 +99,8 @@ func TestSnapshotShowWithoutResources(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "pod:bare",
 	)
 	require.NoError(t, err, "lstk snapshot show failed: %s", stderr)
-	require.Contains(t, stdout, "s3, sqs")
-	require.NotContains(t, stdout, "Resources", "Resources section must be omitted when no counts are available")
+	assert.Contains(t, stdout, "s3, sqs")
+	assert.NotContains(t, stdout, "Resources", "Resources section must be omitted when no counts are available")
 }
 
 // TestSnapshotShowPodNameLeadingUnderscore covers a name the platform's
@@ -121,7 +122,7 @@ func TestSnapshotShowPodNameLeadingUnderscore(t *testing.T) {
 
 	called, path, _ := cap.get()
 	require.True(t, called, "the single-pod endpoint should have been called")
-	require.Equal(t, "/v1/cloudpods/"+name, path)
+	assert.Equal(t, "/v1/cloudpods/"+name, path)
 }
 
 // TestSnapshotShowRejectsPodNameWithPeriod: dots are outside the platform's
@@ -138,10 +139,10 @@ func TestSnapshotShowRejectsPodNameWithPeriod(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "pod:release.v1",
 	)
 	require.Error(t, err, "a dotted pod name must be rejected client-side")
-	require.Contains(t, stderr, "invalid pod name")
+	assert.Contains(t, stderr, "invalid pod name")
 
 	called, _, _ := cap.get()
-	require.False(t, called, "the platform endpoint must not be called for an invalid name")
+	assert.False(t, called, "the platform endpoint must not be called for an invalid name")
 }
 
 func TestSnapshotShowSendsBasicAuthHeader(t *testing.T) {
@@ -158,7 +159,7 @@ func TestSnapshotShowSendsBasicAuthHeader(t *testing.T) {
 	require.NoError(t, err, "lstk snapshot show failed: %s", stderr)
 	_, _, auth := cap.get()
 	expected := "Basic " + base64.StdEncoding.EncodeToString([]byte(":test-token"))
-	require.Equal(t, expected, auth)
+	assert.Equal(t, expected, auth)
 }
 
 func TestSnapshotShowRejectsLocalPath(t *testing.T) {
@@ -175,7 +176,7 @@ func TestSnapshotShowRejectsLocalPath(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "./my-snapshot",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, strings.ToLower(stderr), "local")
+	assert.Contains(t, strings.ToLower(stderr), "local")
 }
 
 func TestSnapshotShowNotFound(t *testing.T) {
@@ -191,8 +192,8 @@ func TestSnapshotShowNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "pod:missing",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "not found")
-	require.Contains(t, stdout, "lstk snapshot list")
+	assert.Contains(t, stdout, "not found")
+	assert.Contains(t, stdout, "lstk snapshot list")
 }
 
 func TestSnapshotShowRequiresAuthToken(t *testing.T) {
@@ -213,6 +214,6 @@ func TestSnapshotShowRequiresAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "Authentication required")
-	require.Contains(t, stdout, "lstk login")
+	assert.Contains(t, stdout, "Authentication required")
+	assert.Contains(t, stdout, "lstk login")
 }
diff --git a/test/integration/snapshot_versions_test.go b/test/integration/snapshot_versions_test.go
index d1ba1ecb..c89c636f 100644
--- a/test/integration/snapshot_versions_test.go
+++ b/test/integration/snapshot_versions_test.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -51,7 +52,7 @@ func TestSnapshotVersionsSuccessWithoutDocker(t *testing.T) {
 
 	called, path, _ := cap.get()
 	require.True(t, called, "the single-pod endpoint should have been called")
-	require.Equal(t, "/v1/cloudpods/my-baseline", path)
+	assert.Equal(t, "/v1/cloudpods/my-baseline", path)
 
 	// The snapshot pins column set (no DESCRIPTION), newest-first ordering,
 	// and that descriptions are no longer rendered.
@@ -91,7 +92,7 @@ func TestSnapshotVersionsSingleVersionUsesSingularNoun(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:solo",
 	)
 	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
-	require.Contains(t, stdout, "~ 1 version\n")
+	assert.Contains(t, stdout, "~ 1 version\n")
 }
 
 func TestSnapshotVersionsEmptyHistory(t *testing.T) {
@@ -104,8 +105,8 @@ func TestSnapshotVersionsEmptyHistory(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:blank",
 	)
 	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
-	require.Contains(t, stdout, "No versions found for 'pod:blank'")
-	require.NotContains(t, stdout, "VERSION", "no table should be rendered")
+	assert.Contains(t, stdout, "No versions found for 'pod:blank'")
+	assert.NotContains(t, stdout, "VERSION", "no table should be rendered")
 }
 
 // TestSnapshotVersionsNoDockerRequired proves the command reads the platform API
@@ -121,7 +122,7 @@ func TestSnapshotVersionsNoDockerRequired(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:my-baseline",
 	)
 	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
-	require.Contains(t, stdout, "~ 3 versions")
+	assert.Contains(t, stdout, "~ 3 versions")
 }
 
 func TestSnapshotVersionsRejectsLocalPath(t *testing.T) {
@@ -134,8 +135,8 @@ func TestSnapshotVersionsRejectsLocalPath(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "./my-snapshot",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, strings.ToLower(stderr), "local")
-	require.Contains(t, stderr, "list versions of local snapshots")
+	assert.Contains(t, strings.ToLower(stderr), "local")
+	assert.Contains(t, stderr, "list versions of local snapshots")
 }
 
 // TestSnapshotVersionsRejectsS3Ref: S3 remotes are fully supported by
@@ -168,7 +169,7 @@ func TestSnapshotVersionsOrasKeepsComingSoon(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "oras://registry/image",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "coming soon")
+	assert.Contains(t, stderr, "coming soon")
 }
 
 // TestSnapshotShowPinnedVersion: show is read-only and the platform returns every
@@ -226,7 +227,7 @@ func TestSnapshotVersionsRejectsVersionSuffix(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:my-baseline:3",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "drop the ':3'")
+	assert.Contains(t, stderr, "drop the ':3'")
 }
 
 func TestSnapshotVersionsRejectsInvalidPodName(t *testing.T) {
@@ -239,7 +240,7 @@ func TestSnapshotVersionsRejectsInvalidPodName(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:release.v1",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "invalid pod name")
+	assert.Contains(t, stderr, "invalid pod name")
 }
 
 func TestSnapshotVersionsNotFound(t *testing.T) {
@@ -255,8 +256,8 @@ func TestSnapshotVersionsNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:missing",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "not found")
-	require.Contains(t, stdout, "lstk snapshot list")
+	assert.Contains(t, stdout, "not found")
+	assert.Contains(t, stdout, "lstk snapshot list")
 }
 
 func TestSnapshotVersionsRequiresAuthToken(t *testing.T) {
@@ -271,6 +272,6 @@ func TestSnapshotVersionsRequiresAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "Authentication required")
-	require.Contains(t, stdout, "lstk login")
+	assert.Contains(t, stdout, "Authentication required")
+	assert.Contains(t, stdout, "lstk login")
 }
diff --git a/test/integration/start_snapshot_test.go b/test/integration/start_snapshot_test.go
index 1221b111..26bc6986 100644
--- a/test/integration/start_snapshot_test.go
+++ b/test/integration/start_snapshot_test.go
@@ -6,6 +6,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -20,7 +21,7 @@ func TestStartSnapshotConflictingFlags(t *testing.T) {
 		"--non-interactive", "start", "--snapshot", "pod:my-baseline", "--no-snapshot",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "cannot be used together")
+	assert.Contains(t, stderr, "cannot be used together")
 }
 
 func TestStartSnapshotInvalidPodName(t *testing.T) {
@@ -32,7 +33,7 @@ func TestStartSnapshotInvalidPodName(t *testing.T) {
 		"--non-interactive", "start", "--snapshot", "pod:bad.name",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "invalid pod name")
+	assert.Contains(t, stderr, "invalid pod name")
 }
 
 func TestStartSnapshotLocalFileNotFound(t *testing.T) {
@@ -44,7 +45,7 @@ func TestStartSnapshotLocalFileNotFound(t *testing.T) {
 		"--non-interactive", "start", "--snapshot", "/no/such/snapshot.snapshot",
 	)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "snapshot file not found")
+	assert.Contains(t, stderr, "snapshot file not found")
 }
 
 // --- Docker required ---
@@ -81,8 +82,8 @@ snapshot = "pod:my-baseline"
 	)
 	require.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdout, "Snapshot loaded", "configured snapshot should auto-load after start")
-	require.Contains(t, stdout, "my-baseline")
+	assert.Contains(t, stdout, "Snapshot loaded", "configured snapshot should auto-load after start")
+	assert.Contains(t, stdout, "my-baseline")
 }
 
 // TestStartNoSnapshotSkipsAutoLoad verifies that --no-snapshot skips auto-loading
@@ -114,5 +115,5 @@ snapshot = "pod:my-baseline"
 	)
 	require.NoError(t, err, "lstk start --no-snapshot failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	require.NotContains(t, stdout, "Snapshot loaded", "--no-snapshot should skip auto-loading")
+	assert.NotContains(t, stdout, "Snapshot loaded", "--no-snapshot should skip auto-loading")
 }
diff --git a/test/integration/start_test.go b/test/integration/start_test.go
index 63104907..49ea60d4 100644
--- a/test/integration/start_test.go
+++ b/test/integration/start_test.go
@@ -21,6 +21,7 @@ import (
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/api/types/network"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -43,9 +44,9 @@ func TestStartCommandSucceedsWithValidToken(t *testing.T) {
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
 	require.NoError(t, err, "failed to inspect container")
-	require.True(t, inspect.Container.State.Running, "container should be running")
+	assert.True(t, inspect.Container.State.Running, "container should be running")
 
-	require.NotContains(t, stdout, "• Persistence:",
+	assert.NotContains(t, stdout, "• Persistence:",
 		"persistence bullet must be omitted when --persist is not set")
 }
 
@@ -88,8 +89,8 @@ func TestStartCommandReusesLocalImageWhenPresent(t *testing.T) {
 		string(env.AuthToken)+"=fake-token")
 	stdout, _, _ := runLstk(t, ctx, "", e, "--config", configFile, "start")
 
-	require.Contains(t, stdout, "Using local image "+pinnedImage, "a pinned image present locally should be reused")
-	require.NotContains(t, stdout, "Pulling", "lstk must not re-pull an image that is already present")
+	assert.Contains(t, stdout, "Using local image "+pinnedImage, "a pinned image present locally should be reused")
+	assert.NotContains(t, stdout, "Pulling", "lstk must not re-pull an image that is already present")
 }
 
 // A container that exits during startup must fail with a styled
@@ -137,8 +138,8 @@ func TestStartFailsWhenContainerExitsDuringStartup(t *testing.T) {
 	require.Error(t, err, "expected start to fail when the container exits during startup")
 	requireExitCode(t, 1, err)
 	combined := stdout + stderr
-	require.Contains(t, combined, "exited unexpectedly", "the failure must be surfaced as a styled error")
-	require.Contains(t, combined, "exit code 0", "the captured exit code must be reported")
+	assert.Contains(t, combined, "exited unexpectedly", "the failure must be surfaced as a styled error")
+	assert.Contains(t, combined, "exit code 0", "the captured exit code must be reported")
 }
 
 // A container that stays running but never serves /_localstack/health must not wait forever.
@@ -190,9 +191,9 @@ func TestStartFailsWhenContainerNeverBecomesHealthy(t *testing.T) {
 	require.Error(t, err, "expected start to fail when the container never becomes healthy")
 	requireExitCode(t, 1, err)
 	combined := stdout + stderr
-	require.Contains(t, combined, "did not become ready within 5s", "the bounded timeout must be surfaced")
-	require.Contains(t, combined, "lstk logs", "the guidance must point at lstk logs")
-	require.Contains(t, combined, "lstk stop", "the guidance must point at lstk stop")
+	assert.Contains(t, combined, "did not become ready within 5s", "the bounded timeout must be surfaced")
+	assert.Contains(t, combined, "lstk logs", "the guidance must point at lstk logs")
+	assert.Contains(t, combined, "lstk stop", "the guidance must point at lstk stop")
 }
 
 // Interrupting a start while it awaits readiness (Ctrl+C / SIGINT) renders no
@@ -266,10 +267,10 @@ func TestStartEmitsTelemetryWhenInterruptedDuringStartup(t *testing.T) {
 	lifecycle, ok := byName["lstk_lifecycle"]
 	require.True(t, ok, "an interrupted start must still emit a lifecycle telemetry event")
 	lifePayload, _ := lifecycle["payload"].(map[string]any)
-	require.Equal(t, "start_error", lifePayload["event_type"])
-	require.Equal(t, "start_failed", lifePayload["error_code"])
-	require.Contains(t, lifePayload["error_msg"], "context canceled")
-	require.Contains(t, byName, "lstk_command")
+	assert.Equal(t, "start_error", lifePayload["event_type"])
+	assert.Equal(t, "start_failed", lifePayload["error_code"])
+	assert.Contains(t, lifePayload["error_msg"], "context canceled")
+	assert.Contains(t, byName, "lstk_command")
 }
 
 func TestStartCommandSucceedsWithKeyringToken(t *testing.T) {
@@ -293,7 +294,7 @@ func TestStartCommandSucceedsWithKeyringToken(t *testing.T) {
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
 	require.NoError(t, err, "failed to inspect container")
-	require.True(t, inspect.Container.State.Running, "container should be running")
+	assert.True(t, inspect.Container.State.Running, "container should be running")
 }
 
 func TestStartCommandFailsWithInvalidToken(t *testing.T) {
@@ -307,7 +308,7 @@ func TestStartCommandFailsWithInvalidToken(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AuthToken, "invalid-token").With(env.APIEndpoint, mockServer.URL), "start")
 	require.Error(t, err, "expected lstk start to fail with invalid token")
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "License validation failed")
+	assert.Contains(t, stdout, "License validation failed")
 }
 
 func TestStartCommandDoesNothingWhenAlreadyRunning(t *testing.T) {
@@ -322,7 +323,7 @@ func TestStartCommandDoesNothingWhenAlreadyRunning(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.AuthToken, "fake-token").With(env.AnalyticsEndpoint, analyticsSrv.URL), "start")
 	require.NoError(t, err, "lstk start should succeed when container is already running: %s", stderr)
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdout, "already running")
+	assert.Contains(t, stdout, "already running")
 	assertCommandTelemetry(t, events, "start", 0)
 }
 
@@ -340,14 +341,14 @@ func TestStartCommandFailsWhenPortInUse(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AuthToken, "fake-token").With(env.AnalyticsEndpoint, analyticsSrv.URL), "start")
 	require.Error(t, err, "expected lstk start to fail when port is in use")
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "Port 4566 already in use")
-	require.Contains(t, stdout, "Free the port or configure a different one.")
-	require.Contains(t, stdout, "Use another port in the configuration:")
+	assert.Contains(t, stdout, "Port 4566 already in use")
+	assert.Contains(t, stdout, "Free the port or configure a different one.")
+	assert.Contains(t, stdout, "Use another port in the configuration:")
 
 	// Both lstk_lifecycle (start_error) and lstk_command events should be emitted.
 	byName := collectTelemetryByName(t, events, 2)
-	require.Contains(t, byName, "lstk_lifecycle")
-	require.Contains(t, byName, "lstk_command")
+	assert.Contains(t, byName, "lstk_lifecycle")
+	assert.Contains(t, byName, "lstk_command")
 }
 
 func TestStartDoesNotHangWithExternalContainerAndNoCachedLabel(t *testing.T) {
@@ -377,7 +378,7 @@ func TestStartDoesNotHangWithExternalContainerAndNoCachedLabel(t *testing.T) {
 		"start", "--config", configFile,
 	)
 	require.NoError(t, err, "lstk start hung: TUI did not exit when external container was running and no plan label was cached")
-	require.Contains(t, stdout, "already running")
+	assert.Contains(t, stdout, "already running")
 }
 
 func TestStartCommandAttachesToExternalContainer(t *testing.T) {
@@ -401,7 +402,7 @@ func TestStartCommandAttachesToExternalContainer(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.AuthToken, "fake-token").With(env.AnalyticsEndpoint, analyticsSrv.URL), "start")
 	require.NoError(t, err, "lstk start should succeed when external container is running: %s", stderr)
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdout, "already running")
+	assert.Contains(t, stdout, "already running")
 	assertCommandTelemetry(t, events, "start", 0)
 }
 
@@ -428,8 +429,8 @@ func TestStartCommandAttachesWhenLocalStackRespondingOnPort(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), "", env.With(env.AuthToken, "fake-token"), "start")
 	require.NoError(t, err, "lstk start should succeed when LocalStack is already running: %s", stderr)
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdout, "3.4.0")
-	require.Contains(t, stdout, "already running")
+	assert.Contains(t, stdout, "3.4.0")
+	assert.Contains(t, stdout, "already running")
 }
 
 func TestStartCommandFailsWhenLocalStackRunningOnDifferentPort(t *testing.T) {
@@ -462,7 +463,7 @@ port = "4567"
 	stdout, _, err := runLstk(t, ctx, "", env.With(env.AuthToken, "fake-token").With(env.AnalyticsEndpoint, analyticsSrv.URL), "--config", configFile, "start")
 	require.Error(t, err, "expected lstk start to fail when LS is already running on a different port")
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "already running")
+	assert.Contains(t, stdout, "already running")
 	assertCommandTelemetry(t, events, "start", 1)
 }
 
@@ -492,24 +493,24 @@ func TestStartCommandFailsOnEmulatorTypeMismatch(t *testing.T) {
 	stdout, _, err := runLstk(t, ctx, "", env.With(env.AuthToken, "fake-token").With(env.AnalyticsEndpoint, analyticsSrv.URL), "--config", configFile, "start")
 	require.Error(t, err, "lstk start should fail on emulator type mismatch")
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "LocalStack AWS Emulator is running on port 4566")
-	require.Contains(t, stdout, "Your config specifies the LocalStack Snowflake Emulator")
-	require.Contains(t, stdout, "docker stop localstack-external-aws")
+	assert.Contains(t, stdout, "LocalStack AWS Emulator is running on port 4566")
+	assert.Contains(t, stdout, "Your config specifies the LocalStack Snowflake Emulator")
+	assert.Contains(t, stdout, "docker stop localstack-external-aws")
 
 	byName := collectTelemetryByName(t, events, 2)
 	cmdPayload, _ := byName["lstk_command"]["payload"].(map[string]any)
 	cmdParams, _ := cmdPayload["parameters"].(map[string]any)
 	cmdResult, _ := cmdPayload["result"].(map[string]any)
-	require.Equal(t, "start", cmdParams["command"])
-	require.InDelta(t, 1, cmdResult["exit_code"], 0)
+	assert.Equal(t, "start", cmdParams["command"])
+	assert.InDelta(t, 1, cmdResult["exit_code"], 0)
 
 	lifecycle, ok := byName["lstk_lifecycle"]
 	require.True(t, ok, "expected lstk_lifecycle telemetry event")
 	lifePayload, _ := lifecycle["payload"].(map[string]any)
-	require.Equal(t, "start_error", lifePayload["event_type"])
-	require.Equal(t, "emulator_mismatch", lifePayload["error_code"])
-	require.Equal(t, "snowflake", lifePayload["emulator"])
-	require.Contains(t, lifePayload["error_msg"], "running aws on port 4566, configured snowflake")
+	assert.Equal(t, "start_error", lifePayload["event_type"])
+	assert.Equal(t, "emulator_mismatch", lifePayload["error_code"])
+	assert.Equal(t, "snowflake", lifePayload["emulator"])
+	assert.Contains(t, lifePayload["error_msg"], "running aws on port 4566, configured snowflake")
 }
 
 func TestStartCommandSucceedsWithNonDefaultPort(t *testing.T) {
@@ -538,7 +539,7 @@ port = "4567"
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
 	require.NoError(t, err, "failed to inspect container")
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	require.Equal(t, "localhost.localstack.cloud:4567", envVars["LOCALSTACK_HOST"],
+	assert.Equal(t, "localhost.localstack.cloud:4567", envVars["LOCALSTACK_HOST"],
 		"LOCALSTACK_HOST must reflect configured host port so LocalStack accepts requests on it")
 }
 
@@ -576,14 +577,15 @@ GATEWAY_LISTEN = "0.0.0.0:4566,0.0.0.0:443,0.0.0.0:8443"
 	require.NoError(t, err, "failed to inspect container")
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	require.Equal(t, "0.0.0.0:4566,0.0.0.0:443,0.0.0.0:8443", envVars["GATEWAY_LISTEN"],
+	assert.Equal(t, "0.0.0.0:4566,0.0.0.0:443,0.0.0.0:8443", envVars["GATEWAY_LISTEN"],
 		"configured GATEWAY_LISTEN must be passed to the container")
 
 	for _, p := range []string{"4566/tcp", "443/tcp", "8443/tcp", "4510/tcp"} {
 		bindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort(p)]
-		require.NotEmpty(t, bindings, "port %s should be bound", p)
-		require.Equal(t, "0.0.0.0", bindings[0].HostIP.String(),
-			"port %s should bind to the host IP from GATEWAY_LISTEN", p)
+		if assert.NotEmpty(t, bindings, "port %s should be bound", p) {
+			assert.Equal(t, "0.0.0.0", bindings[0].HostIP.String(),
+				"port %s should bind to the host IP from GATEWAY_LISTEN", p)
+		}
 	}
 }
 
@@ -627,11 +629,12 @@ expose_ports = [15353, "15354:15355/udp"]
 	}
 	for port, hostPort := range expected {
 		bindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort(port)]
-		require.NotEmpty(t, bindings, "port %s should be bound", port)
-		require.Equal(t, hostPort, bindings[0].HostPort)
-		require.Equal(t, "127.0.0.1", bindings[0].HostIP.String())
+		if assert.NotEmpty(t, bindings, "port %s should be bound", port) {
+			assert.Equal(t, hostPort, bindings[0].HostPort)
+			assert.Equal(t, "127.0.0.1", bindings[0].HostIP.String())
+		}
 	}
-	require.Empty(t, inspect.Container.HostConfig.PortBindings[network.MustParsePort("15355/tcp")],
+	assert.Empty(t, inspect.Container.HostConfig.PortBindings[network.MustParsePort("15355/tcp")],
 		"an entry that names udp must not also publish tcp")
 }
 
@@ -663,17 +666,17 @@ expose_ports = ["8080:4566"]
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
 	require.NoError(t, err, "lstk start failed: %s", stderr)
-	require.Contains(t, stdout+stderr, "Ignoring expose_ports entry 8080:4566/tcp",
+	assert.Contains(t, stdout+stderr, "Ignoring expose_ports entry 8080:4566/tcp",
 		"expected a warning explaining why the entry was dropped")
-	require.Contains(t, stdout+stderr, "already publishes container port 4566/tcp on host port 4566")
+	assert.Contains(t, stdout+stderr, "already publishes container port 4566/tcp on host port 4566")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
 	require.NoError(t, err, "failed to inspect container")
 
 	edgeBindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort("4566/tcp")]
 	require.NotEmpty(t, edgeBindings, "the edge port must still be published")
-	require.Equal(t, "4566", edgeBindings[0].HostPort, "the edge port's host binding must be unchanged")
-	require.Empty(t, inspect.Container.HostConfig.PortBindings[network.MustParsePort("8080/tcp")],
+	assert.Equal(t, "4566", edgeBindings[0].HostPort, "the edge port's host binding must be unchanged")
+	assert.Empty(t, inspect.Container.HostConfig.PortBindings[network.MustParsePort("8080/tcp")],
 		"the conflicting host port must not be published")
 }
 
@@ -704,18 +707,19 @@ expose_ports = ["4566/udp"]
 	ctx := testContext(t)
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
 	require.NoError(t, err, "lstk start failed: %s", stderr)
-	require.NotContains(t, stdout+stderr, "Ignoring expose_ports entry",
+	assert.NotContains(t, stdout+stderr, "Ignoring expose_ports entry",
 		"a new protocol on the edge port does not collide with anything and needs no warning")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
 	require.NoError(t, err, "failed to inspect container")
 
 	udpBindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort("4566/udp")]
-	require.NotEmpty(t, udpBindings, "4566/udp should now be published")
-	require.Equal(t, "4566", udpBindings[0].HostPort)
+	if assert.NotEmpty(t, udpBindings, "4566/udp should now be published") {
+		assert.Equal(t, "4566", udpBindings[0].HostPort)
+	}
 	tcpBindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort("4566/tcp")]
 	require.NotEmpty(t, tcpBindings, "4566/tcp must remain published")
-	require.Equal(t, "4566", tcpBindings[0].HostPort)
+	assert.Equal(t, "4566", tcpBindings[0].HostPort)
 }
 
 // TestStartCommandFailsWhenExposedPortIsTaken covers a busy host port requested via
@@ -744,8 +748,8 @@ expose_ports = [15360]
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AuthToken, "fake-token"), "--config", configFile, "start")
 	require.Error(t, err, "expected lstk start to fail when a requested expose_ports port is in use")
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "Port 15360 is already in use")
-	require.Contains(t, stdout, "LocalStack requires this port. Free it before starting.")
+	assert.Contains(t, stdout, "Port 15360 is already in use")
+	assert.Contains(t, stdout, "LocalStack requires this port. Free it before starting.")
 }
 
 // TestStartCommandPublishesOnlyDefaultPortsWhenExposePortsUnset pins the no-op case:
@@ -779,7 +783,7 @@ func TestStartCommandPublishesOnlyDefaultPortsWhenExposePortsUnset(t *testing.T)
 			gotPublished[port.String()] = true
 		}
 	}
-	require.Equal(t, wantPublished, gotPublished, "no expose_ports configured should publish exactly the default port set")
+	assert.Equal(t, wantPublished, gotPublished, "no expose_ports configured should publish exactly the default port set")
 }
 
 // TestStartCommandRejectsInvalidExposePorts checks the config surface fails at load
@@ -799,7 +803,7 @@ expose_ports = ["53/sctp"]
 
 	_, stderr, err := runLstk(t, testContext(t), "", testEnvWithHome(t.TempDir(), ""), "--config", configFile, "status")
 	require.Error(t, err)
-	require.Contains(t, stderr, `protocol must be "tcp" or "udp"`)
+	assert.Contains(t, stderr, `protocol must be "tcp" or "udp"`)
 }
 
 func TestStartCommandSetsUpContainerCorrectly(t *testing.T) {
@@ -822,10 +826,10 @@ func TestStartCommandSetsUpContainerCorrectly(t *testing.T) {
 
 	t.Run("environment variables", func(t *testing.T) {
 		envVars := containerEnvToMap(inspect.Container.Config.Env)
-		require.Equal(t, ":4566,:443", envVars["GATEWAY_LISTEN"])
-		require.Equal(t, containerName, envVars["MAIN_CONTAINER_NAME"])
-		require.Equal(t, "localhost.localstack.cloud:4566", envVars["LOCALSTACK_HOST"])
-		require.NotEmpty(t, envVars["LOCALSTACK_AUTH_TOKEN"])
+		assert.Equal(t, ":4566,:443", envVars["GATEWAY_LISTEN"])
+		assert.Equal(t, containerName, envVars["MAIN_CONTAINER_NAME"])
+		assert.Equal(t, "localhost.localstack.cloud:4566", envVars["LOCALSTACK_HOST"])
+		assert.NotEmpty(t, envVars["LOCALSTACK_AUTH_TOKEN"])
 	})
 
 	t.Run("docker socket mount", func(t *testing.T) {
@@ -833,43 +837,44 @@ func TestStartCommandSetsUpContainerCorrectly(t *testing.T) {
 			t.Skip("Docker daemon is not reachable via unix socket")
 		}
 
-		require.True(t, hasBindTarget(inspect.Container.HostConfig.Binds, "/var/run/docker.sock"),
+		assert.True(t, hasBindTarget(inspect.Container.HostConfig.Binds, "/var/run/docker.sock"),
 			"expected Docker socket bind mount to /var/run/docker.sock, got: %v", inspect.Container.HostConfig.Binds)
-		require.True(t, hasBindSource(inspect.Container.HostConfig.Binds, "/var/run/docker.sock"),
+		assert.True(t, hasBindSource(inspect.Container.HostConfig.Binds, "/var/run/docker.sock"),
 			"expected Docker socket bind mount from /var/run/docker.sock, got: %v", inspect.Container.HostConfig.Binds)
 
 		envVars := containerEnvToMap(inspect.Container.Config.Env)
-		require.Equal(t, "unix:///var/run/docker.sock", envVars["DOCKER_HOST"])
+		assert.Equal(t, "unix:///var/run/docker.sock", envVars["DOCKER_HOST"])
 	})
 
 	t.Run("service port range", func(t *testing.T) {
 		for p := 4510; p <= 4559; p++ {
 			port := network.MustParsePort(fmt.Sprintf("%d/tcp", p))
 			bindings := inspect.Container.HostConfig.PortBindings[port]
-			require.NotEmpty(t, bindings, "port %d/tcp should be bound", p)
-			require.Equal(t, strconv.Itoa(p), bindings[0].HostPort)
+			if assert.NotEmpty(t, bindings, "port %d/tcp should be bound", p) {
+				assert.Equal(t, strconv.Itoa(p), bindings[0].HostPort)
+			}
 		}
 	})
 
 	t.Run("main port", func(t *testing.T) {
 		mainBindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort("4566/tcp")]
 		require.NotEmpty(t, mainBindings, "port 4566/tcp should be bound")
-		require.Equal(t, "4566", mainBindings[0].HostPort)
+		assert.Equal(t, "4566", mainBindings[0].HostPort)
 	})
 
 	t.Run("https port", func(t *testing.T) {
 		httpsBindings := inspect.Container.HostConfig.PortBindings[network.MustParsePort("443/tcp")]
 		require.NotEmpty(t, httpsBindings, "port 443/tcp should be bound")
-		require.Equal(t, "443", httpsBindings[0].HostPort)
+		assert.Equal(t, "443", httpsBindings[0].HostPort)
 	})
 
 	t.Run("volume mount", func(t *testing.T) {
-		require.True(t, hasBindTarget(inspect.Container.HostConfig.Binds, "/var/lib/localstack"),
+		assert.True(t, hasBindTarget(inspect.Container.HostConfig.Binds, "/var/lib/localstack"),
 			"expected volume bind mount to /var/lib/localstack, got: %v", inspect.Container.HostConfig.Binds)
 	})
 
 	t.Run("auto remove", func(t *testing.T) {
-		require.True(t, inspect.Container.HostConfig.AutoRemove,
+		assert.True(t, inspect.Container.HostConfig.AutoRemove,
 			"expected container to be created with AutoRemove (--rm) so it does not linger after exit")
 	})
 
@@ -877,7 +882,7 @@ func TestStartCommandSetsUpContainerCorrectly(t *testing.T) {
 		resp, err := http.Get("http://localhost.localstack.cloud:4566/_localstack/health")
 		require.NoError(t, err)
 		t.Cleanup(func() { _ = resp.Body.Close() })
-		require.Equal(t, http.StatusOK, resp.StatusCode)
+		assert.Equal(t, http.StatusOK, resp.StatusCode)
 	})
 
 	t.Run("https health endpoint", func(t *testing.T) {
@@ -891,7 +896,7 @@ func TestStartCommandSetsUpContainerCorrectly(t *testing.T) {
 		resp, err := client.Get("https://localhost.localstack.cloud/_localstack/health")
 		require.NoError(t, err)
 		t.Cleanup(func() { _ = resp.Body.Close() })
-		require.Equal(t, http.StatusOK, resp.StatusCode)
+		assert.Equal(t, http.StatusOK, resp.StatusCode)
 	})
 }
 
@@ -934,21 +939,21 @@ container_name = %q
 	// The name Docker gave the container and the name the emulator reports for itself
 	// (used to introspect itself and to name the containers it spawns) must agree.
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	require.Equal(t, customName, envVars["MAIN_CONTAINER_NAME"])
+	assert.Equal(t, customName, envVars["MAIN_CONTAINER_NAME"])
 
 	_, err = dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.Error(t, err, "the derived name %q must not be used when 'name' is set", containerName)
+	assert.Error(t, err, "the derived name %q must not be used when 'name' is set", containerName)
 
 	// The default persistence directory stays keyed to the derived name, so setting or
 	// changing 'name' never silently orphans existing state.
 	volumePath, stderr, err := runLstk(t, ctx, "", testEnv, "--config", configFile, "volume", "path")
 	require.NoError(t, err, "lstk volume path failed: %s", stderr)
-	require.Contains(t, volumePath, filepath.Join("lstk", "volume", containerName))
+	assert.Contains(t, volumePath, filepath.Join("lstk", "volume", containerName))
 
 	// Discovery resolves the custom name for the downstream commands.
 	statusOut, stderr, err := runLstk(t, ctx, "", testEnv, "--config", configFile, "status")
 	require.NoError(t, err, "lstk status failed: %s", stderr)
-	require.Contains(t, statusOut, "Container: "+customName)
+	assert.Contains(t, statusOut, "Container: "+customName)
 
 	_, stderr, err = runLstk(t, ctx, "", testEnv, "--config", configFile, "stop")
 	require.NoError(t, err, "lstk stop failed: %s", stderr)
@@ -995,11 +1000,11 @@ volumes = ["` + escapeTomlPath(scriptPath) + `:/etc/localstack/init/ready.d/init
 	require.True(t, inspect.Container.State.Running)
 
 	binds := inspect.Container.HostConfig.Binds
-	require.True(t, hasBindTarget(binds, "/var/lib/localstack"),
+	assert.True(t, hasBindTarget(binds, "/var/lib/localstack"),
 		"persistence mount must still be present, got: %v", binds)
-	require.True(t, hasBindTarget(binds, "/etc/localstack/init/ready.d/init.sf.sql"),
+	assert.True(t, hasBindTarget(binds, "/etc/localstack/init/ready.d/init.sf.sql"),
 		"expected init-hook mount target, got: %v", binds)
-	require.True(t, hasBindSource(binds, scriptPath),
+	assert.True(t, hasBindSource(binds, scriptPath),
 		"expected init-hook mount source %s, got: %v", scriptPath, binds)
 }
 
@@ -1060,19 +1065,19 @@ volumes = [
 
 	binds := inspect.Container.HostConfig.Binds
 
-	require.True(t, hasBindTarget(binds, "/var/lib/localstack"),
+	assert.True(t, hasBindTarget(binds, "/var/lib/localstack"),
 		"expected persistence mount target, got: %v", binds)
-	require.True(t, hasBindSource(binds, persistDir),
+	assert.True(t, hasBindSource(binds, persistDir),
 		"expected persistence mount source %s, got: %v", persistDir, binds)
 
-	require.True(t, hasBindTarget(binds, "/etc/localstack/init/boot.d/boot.sh"),
+	assert.True(t, hasBindTarget(binds, "/etc/localstack/init/boot.d/boot.sh"),
 		"expected boot init-hook mount target, got: %v", binds)
-	require.True(t, hasBindSource(binds, bootScript),
+	assert.True(t, hasBindSource(binds, bootScript),
 		"expected boot init-hook mount source %s, got: %v", bootScript, binds)
 
-	require.True(t, hasBindTarget(binds, "/etc/localstack/init/ready.d/init.sf.sql"),
+	assert.True(t, hasBindTarget(binds, "/etc/localstack/init/ready.d/init.sf.sql"),
 		"expected ready init-hook mount target, got: %v", binds)
-	require.True(t, hasBindSource(binds, readyScript),
+	assert.True(t, hasBindSource(binds, readyScript),
 		"expected ready init-hook mount source %s, got: %v", readyScript, binds)
 }
 
@@ -1100,7 +1105,7 @@ volumes = ["` + escapeTomlPath(missing) + `:/etc/localstack/init/ready.d/x.sf.sq
 	_, stderr, err := runLstk(t, testContext(t), "", env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "does not exist")
+	assert.Contains(t, stderr, "does not exist")
 }
 
 func TestStartCommandPassesCIAndLocalStackEnvVars(t *testing.T) {
@@ -1125,7 +1130,7 @@ func TestStartCommandPassesCIAndLocalStackEnvVars(t *testing.T) {
 		"start")
 	require.NoError(t, err, "lstk start failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdout+stderr, "Not forwarding LOCALSTACK_PATH",
+	assert.Contains(t, stdout+stderr, "Not forwarding LOCALSTACK_PATH",
 		"dropping a critical-collision variable must be surfaced to the user")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
@@ -1133,10 +1138,10 @@ func TestStartCommandPassesCIAndLocalStackEnvVars(t *testing.T) {
 	require.True(t, inspect.Container.State.Running)
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	require.Equal(t, "true", envVars["CI"])
-	require.Equal(t, "1", envVars["LOCALSTACK_DISABLE_EVENTS"])
-	require.NotEmpty(t, envVars["LOCALSTACK_AUTH_TOKEN"])
-	require.NotContains(t, envVars, "LOCALSTACK_PATH")
+	assert.Equal(t, "true", envVars["CI"])
+	assert.Equal(t, "1", envVars["LOCALSTACK_DISABLE_EVENTS"])
+	assert.NotEmpty(t, envVars["LOCALSTACK_AUTH_TOKEN"])
+	assert.NotContains(t, envVars, "LOCALSTACK_PATH")
 }
 
 func TestStartCommandPersistFlagSetsPersistenceEnv(t *testing.T) {
@@ -1159,14 +1164,14 @@ func TestStartCommandPersistFlagSetsPersistenceEnv(t *testing.T) {
 	require.True(t, inspect.Container.State.Running)
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	require.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
+	assert.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
 
-	require.Contains(t, stdout, "• Persistence: Enabled",
+	assert.Contains(t, stdout, "• Persistence: Enabled",
 		"lstk start --persist should surface persistence state in the header")
 
 	statusStdout, statusStderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "status")
 	require.NoError(t, err, "lstk status failed: %s", statusStderr)
-	require.Contains(t, statusStdout, "• Persistence: Enabled",
+	assert.Contains(t, statusStdout, "• Persistence: Enabled",
 		"lstk status should surface persistence state when the running container has it enabled")
 }
 
@@ -1192,9 +1197,9 @@ func TestStartCommandForwardsPersistenceEnvFromHost(t *testing.T) {
 	require.True(t, inspect.Container.State.Running)
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	require.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
+	assert.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
 
-	require.Contains(t, stdout, "• Persistence: Enabled",
+	assert.Contains(t, stdout, "• Persistence: Enabled",
 		"lstk start should surface persistence state when LOCALSTACK_PERSISTENCE=1 is set in the shell")
 }
 
@@ -1231,9 +1236,9 @@ env = ["persistence"]
 	require.True(t, inspect.Container.State.Running)
 
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	require.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
+	assert.Equal(t, "1", envVars["LOCALSTACK_PERSISTENCE"])
 
-	require.Contains(t, stdout, "• Persistence: Enabled",
+	assert.Contains(t, stdout, "• Persistence: Enabled",
 		"lstk start should surface persistence state when LOCALSTACK_PERSISTENCE=1 is set in the config profile")
 }
 
@@ -1285,7 +1290,7 @@ func TestStartHidesHeaderUntilAuthComplete(t *testing.T) {
 	// Wait for the login prompt — header must not be visible yet.
 	p.waitForOutput("Press any key when complete", "auth prompt should appear")
 
-	require.NotContains(t, p.output(), "lstk ", "header must be hidden while auth is pending")
+	assert.NotContains(t, p.output(), "lstk ", "header must be hidden while auth is pending")
 
 	// Complete auth by pressing ENTER.
 	p.write("\r")
@@ -1326,7 +1331,7 @@ image = "lstk-nonexistent-custom-image"
 	require.Error(t, err, "expected start to fail when the custom image is unavailable")
 	requireExitCode(t, 1, err)
 	combined := stdout + stderr
-	require.Contains(t, combined, "Failed to pull lstk-nonexistent-custom-image:latest")
+	assert.Contains(t, combined, "Failed to pull lstk-nonexistent-custom-image:latest")
 }
 
 // TestStartTimesOutWhenEmulatorNeverBecomesHealthy verifies that --timeout bounds
@@ -1366,7 +1371,7 @@ func TestStartTimesOutWhenEmulatorNeverBecomesHealthy(t *testing.T) {
 
 	require.Error(t, err, "expected start to fail when the emulator never becomes healthy")
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout+stderr, "LocalStack did not become ready within 3s")
+	assert.Contains(t, stdout+stderr, "LocalStack did not become ready within 3s")
 }
 
 // TestStartFallsBackToLocalImageWhenPullFails verifies the offline degradation
@@ -1429,11 +1434,11 @@ volume = %q
 	require.NoError(t, err, "lstk start should fall back to the local image: %s", stderr)
 	requireExitCode(t, 0, err)
 
-	require.Contains(t, stdout+stderr, "using the local image", "expected the local-image fallback warning")
+	assert.Contains(t, stdout+stderr, "using the local image", "expected the local-image fallback warning")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
 	require.NoError(t, err, "failed to inspect container")
-	require.True(t, inspect.Container.State.Running, "container should be running from the local image")
+	assert.True(t, inspect.Container.State.Running, "container should be running from the local image")
 }
 
 // TestStartContinuesWhenLicenseServerUnreachable verifies the offline degradation
@@ -1484,11 +1489,11 @@ volume = %q
 	require.NoError(t, err, "lstk start should continue when the license server is unreachable: %s", stderr)
 	requireExitCode(t, 0, err)
 
-	require.Contains(t, stdout+stderr, "Could not reach the license server", "expected the license-unreachable warning")
+	assert.Contains(t, stdout+stderr, "Could not reach the license server", "expected the license-unreachable warning")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
 	require.NoError(t, err, "failed to inspect container")
-	require.True(t, inspect.Container.State.Running, "container should be running")
+	assert.True(t, inspect.Container.State.Running, "container should be running")
 }
 
 // TestStartUsesLocalCustomImageWithoutPullOrLicenseCheck verifies the offline
@@ -1566,15 +1571,15 @@ image = %q
 	combined := stdout + stderr
 
 	// Found locally and used — nothing is pulled.
-	require.Contains(t, combined, "Using local image "+fullRef,
+	assert.Contains(t, combined, "Using local image "+fullRef,
 		"the configured custom image, present locally, should be reused: %s", combined)
-	require.NotContains(t, combined, "Pulling",
+	assert.NotContains(t, combined, "Pulling",
 		"lstk must not pull when the configured custom image is already present locally")
 
 	// No license check from the CLI for a local image.
-	require.Equal(t, int32(0), atomic.LoadInt32(&licenseHits),
+	assert.Equal(t, int32(0), atomic.LoadInt32(&licenseHits),
 		"the CLI must not contact the license server for a local image")
-	require.NotContains(t, combined, "Checking license",
+	assert.NotContains(t, combined, "Checking license",
 		"lstk must not run a pre-flight license check for a local image")
 
 	// Started from the configured local image: lstk created the container using it.
@@ -1583,7 +1588,7 @@ image = %q
 	// authoritative signal. When the container is still present, additionally
 	// confirm it was created from the configured image.
 	if inspect, err := dockerClient.ContainerInspect(ctx, wantContainer, client.ContainerInspectOptions{}); err == nil {
-		require.Equal(t, fullRef, inspect.Container.Config.Image,
+		assert.Equal(t, fullRef, inspect.Container.Config.Image,
 			"the container should be created from the configured custom image")
 	}
 }
@@ -1656,19 +1661,19 @@ func TestStartCommandSucceedsForSnowflake(t *testing.T) {
 	inspect, err := dockerClient.ContainerInspect(ctx, snowflakeContainerName, client.ContainerInspectOptions{})
 	require.NoError(t, err, "failed to inspect snowflake container")
 	require.True(t, inspect.Container.State.Running, "snowflake container should be running")
-	require.Contains(t, inspect.Container.Config.Image, "localstack/snowflake",
+	assert.Contains(t, inspect.Container.Config.Image, "localstack/snowflake",
 		"expected localstack/snowflake image, got %s", inspect.Container.Config.Image)
 
 	resp, err := http.Get(fmt.Sprintf("http://localhost:%s/_localstack/health", hostPort))
 	require.NoError(t, err)
 	t.Cleanup(func() { _ = resp.Body.Close() })
-	require.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
 
-	require.Contains(t, stdout, "• Snowflake endpoint: http://snowflake.",
+	assert.Contains(t, stdout, "• Snowflake endpoint: http://snowflake.",
 		"snowflake start should print the snowflake-prefixed endpoint hint")
-	require.NotContains(t, stdout, "• Endpoint: localhost.localstack.cloud",
+	assert.NotContains(t, stdout, "• Endpoint: localhost.localstack.cloud",
 		"snowflake start should not print the bare AWS-style endpoint line")
-	require.Contains(t, stdout, "> Tip:",
+	assert.Contains(t, stdout, "> Tip:",
 		"snowflake start should print a tip line like AWS does")
 }
 
@@ -1695,7 +1700,7 @@ func TestStartCommandSetsSnowflakeS3EndpointFromPort(t *testing.T) {
 	inspect, err := dockerClient.ContainerInspect(ctx, snowflakeContainerName, client.ContainerInspectOptions{})
 	require.NoError(t, err, "failed to inspect snowflake container")
 	envVars := containerEnvToMap(inspect.Container.Config.Env)
-	require.Equal(t, "s3.localhost.localstack.cloud:"+hostPort, envVars["SF_S3_ENDPOINT"],
+	assert.Equal(t, "s3.localhost.localstack.cloud:"+hostPort, envVars["SF_S3_ENDPOINT"],
 		"SF_S3_ENDPOINT should match the configured Snowflake port")
 }
 
@@ -1742,15 +1747,15 @@ func TestStartCommandSucceedsForAzure(t *testing.T) {
 	inspect, err := dockerClient.ContainerInspect(ctx, azureContainerName, client.ContainerInspectOptions{})
 	require.NoError(t, err, "failed to inspect azure container")
 	require.True(t, inspect.Container.State.Running, "azure container should be running")
-	require.Contains(t, inspect.Container.Config.Image, "localstack/localstack-azure",
+	assert.Contains(t, inspect.Container.Config.Image, "localstack/localstack-azure",
 		"expected localstack/localstack-azure image, got %s", inspect.Container.Config.Image)
 
 	resp, err := http.Get(fmt.Sprintf("http://localhost:%s/_localstack/health", hostPort))
 	require.NoError(t, err)
 	t.Cleanup(func() { _ = resp.Body.Close() })
-	require.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
 
-	require.Contains(t, stdout, "> Tip:",
+	assert.Contains(t, stdout, "> Tip:",
 		"azure start should print a tip line like AWS does")
 }
 
@@ -1795,8 +1800,8 @@ volume = %q
 		"start", "--config", configFile,
 	)
 	require.NoError(t, err, "lstk start failed: %s", stdout)
-	require.Contains(t, stdout, "already running")
-	require.Contains(t, stdout, "LocalStack Enterprise",
+	assert.Contains(t, stdout, "already running")
+	assert.Contains(t, stdout, "LocalStack Enterprise",
 		"azure header should show the plan from the license the emulator activated into its volume")
 }
 
diff --git a/test/integration/status_test.go b/test/integration/status_test.go
index 0158d03e..2ffd1e68 100644
--- a/test/integration/status_test.go
+++ b/test/integration/status_test.go
@@ -20,6 +20,7 @@ import (
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -72,13 +73,13 @@ func TestStatusCommandShowsResourcesWhenRunning(t *testing.T) {
 	// Not a snapshot: this test needs a real auth token and a live emulator,
 	// so a committed snapshot could not be regenerated by most contributors
 	// (and the resources table layout varies with the emulator image).
-	require.Contains(t, stdout, "running")
-	require.Contains(t, stdout, "SERVICE")
-	require.Contains(t, stdout, "RESOURCE")
-	require.Contains(t, stdout, "S3")
-	require.Contains(t, stdout, "my-test-bucket")
-	require.Contains(t, stdout, "SQS")
-	require.Contains(t, stdout, "my-test-queue")
+	assert.Contains(t, stdout, "running")
+	assert.Contains(t, stdout, "SERVICE")
+	assert.Contains(t, stdout, "RESOURCE")
+	assert.Contains(t, stdout, "S3")
+	assert.Contains(t, stdout, "my-test-bucket")
+	assert.Contains(t, stdout, "SQS")
+	assert.Contains(t, stdout, "my-test-queue")
 	assertCommandTelemetry(t, events, "status", 0)
 }
 
@@ -118,7 +119,7 @@ func TestStatusCommandWorksWithNonDefaultPort(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "--config", configFile, "status")
 	require.NoError(t, err, "lstk status failed: %s", stderr)
-	require.Contains(t, stdout, "4.14.1")
+	assert.Contains(t, stdout, "4.14.1")
 }
 
 func TestStatusCommandWorksWithExternalContainer(t *testing.T) {
@@ -153,7 +154,7 @@ func TestStatusCommandWorksWithExternalContainer(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.LocalStackHost, lsHost(server)), "status")
 	require.NoError(t, err, "lstk status should work with external container: %s", stderr)
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdout, "3.5.0")
+	assert.Contains(t, stdout, "3.5.0")
 }
 
 func TestStatusCommandForSnowflakeShowsNoResources(t *testing.T) {
@@ -168,13 +169,13 @@ func TestStatusCommandForSnowflakeShowsNoResources(t *testing.T) {
 	require.NoError(t, err, "lstk status failed for snowflake: %s", stderr)
 	requireExitCode(t, 0, err)
 
-	require.Contains(t, stdout, "Snowflake")
-	require.Contains(t, stdout, "running")
-	require.Contains(t, stdout, "snowflake.localhost.localstack.cloud:4566",
+	assert.Contains(t, stdout, "Snowflake")
+	assert.Contains(t, stdout, "running")
+	assert.Contains(t, stdout, "snowflake.localhost.localstack.cloud:4566",
 		"snowflake status should display the snowflake-routed host clients use to connect")
 	// Snowflake does not expose AWS resources — no resource table or empty-state message.
-	require.NotContains(t, stdout, "SERVICE")
-	require.NotContains(t, stdout, "No resources deployed")
+	assert.NotContains(t, stdout, "SERVICE")
+	assert.NotContains(t, stdout, "No resources deployed")
 }
 
 func TestStatusCommandForSnowflakeShowsVersion(t *testing.T) {
@@ -203,7 +204,7 @@ func TestStatusCommandForSnowflakeShowsVersion(t *testing.T) {
 	require.NoError(t, err, "lstk status failed: %s", stderr)
 	requireExitCode(t, 0, err)
 
-	require.Contains(t, stdout, "• Version: "+expectedVersion,
+	assert.Contains(t, stdout, "• Version: "+expectedVersion,
 		"snowflake status should display the version reported by /_localstack/health")
 }
 
@@ -231,7 +232,7 @@ func TestStatusCommandShowsNoResourcesWhenEmpty(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.LocalStackHost, lsHost(server)), "status")
 	require.NoError(t, err, "lstk status failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdout, "No resources deployed")
+	assert.Contains(t, stdout, "No resources deployed")
 }
 
 func fetchSnowflakeVersion(t *testing.T, hostPort string) string {
diff --git a/test/integration/stop_test.go b/test/integration/stop_test.go
index e29f2b38..2a927881 100644
--- a/test/integration/stop_test.go
+++ b/test/integration/stop_test.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -22,16 +23,16 @@ func TestStopCommandSucceeds(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "stop")
 	require.NoError(t, err, "lstk stop failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdout, "Stopping", "should show stopping message")
-	require.Contains(t, stdout, "stopped", "should show stopped message")
+	assert.Contains(t, stdout, "Stopping", "should show stopping message")
+	assert.Contains(t, stdout, "stopped", "should show stopped message")
 
 	_, err = dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
-	require.Error(t, err, "container should not exist after stop")
+	assert.Error(t, err, "container should not exist after stop")
 
 	// Both lstk_lifecycle (stop) and lstk_command events should be emitted.
 	byName := collectTelemetryByName(t, events, 2)
-	require.Contains(t, byName, "lstk_lifecycle")
-	require.Contains(t, byName, "lstk_command")
+	assert.Contains(t, byName, "lstk_lifecycle")
+	assert.Contains(t, byName, "lstk_command")
 }
 
 // TestStopCommandRejectsAmbientEndpointURLEvenWithLocalContainerRunning
@@ -50,12 +51,12 @@ func TestStopCommandRejectsAmbientEndpointURLEvenWithLocalContainerRunning(t *te
 
 	stdout, _, err := runLstk(t, ctx, "", env.With(env.DisableEvents, "1").With("LSTK_ENDPOINT_URL", "http://127.0.0.1:1"), "stop")
 	require.Error(t, err)
-	require.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
-	require.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
+	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	assert.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
 
 	inspect, err := dockerClient.ContainerInspect(ctx, containerName, client.ContainerInspectOptions{})
 	require.NoError(t, err, "container should still exist — stop must reject before ever touching it")
-	require.True(t, inspect.Container.State.Running, "container should still be running")
+	assert.True(t, inspect.Container.State.Running, "container should still be running")
 }
 
 func TestStopCommandFailsWhenNotRunning(t *testing.T) {
@@ -67,7 +68,7 @@ func TestStopCommandFailsWhenNotRunning(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "stop")
 	require.Error(t, err, "expected lstk stop to fail when container not running")
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "LocalStack AWS Emulator is not running")
+	assert.Contains(t, stdout, "LocalStack AWS Emulator is not running")
 	assertCommandTelemetry(t, events, "stop", 1)
 }
 
@@ -83,7 +84,7 @@ func TestStopCommandReportsEmulatorSpecificNotRunningMessage(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), "", e, "--config", configFile, "stop")
 	require.Error(t, err, "expected lstk stop to fail when snowflake container not running")
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "LocalStack Snowflake Emulator is not running",
+	assert.Contains(t, stdout, "LocalStack Snowflake Emulator is not running",
 		"stop should match status's emulator-specific message")
 	assertCommandTelemetry(t, events, "stop", 1)
 }
@@ -111,11 +112,11 @@ func TestStopCommandIgnoresForeignEmulatorOnPort(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), "", testEnvWithHome(t.TempDir(), ""), "--config", configFile, "stop")
 	require.Error(t, err, "lstk stop should not match foreign emulator on configured port")
 	requireExitCode(t, 1, err)
-	require.Contains(t, stdout, "LocalStack Snowflake Emulator is not running")
-	require.NotContains(t, stdout, "stopped", "should not have stopped the AWS container")
+	assert.Contains(t, stdout, "LocalStack Snowflake Emulator is not running")
+	assert.NotContains(t, stdout, "stopped", "should not have stopped the AWS container")
 
 	_, inspectErr := dockerClient.ContainerInspect(ctx, "localstack-external-aws", client.ContainerInspectOptions{})
-	require.NoError(t, inspectErr, "AWS container should still exist after snowflake-targeted stop")
+	assert.NoError(t, inspectErr, "AWS container should still exist after snowflake-targeted stop")
 }
 
 func TestStopCommandStopsExternalContainer(t *testing.T) {
@@ -137,10 +138,10 @@ func TestStopCommandStopsExternalContainer(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "stop")
 	require.NoError(t, err, "lstk stop should stop external container: %s", stderr)
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdout, "stopped")
+	assert.Contains(t, stdout, "stopped")
 
 	_, err = dockerClient.ContainerInspect(ctx, "localstack-external", client.ContainerInspectOptions{})
-	require.Error(t, err, "external container should be gone after lstk stop")
+	assert.Error(t, err, "external container should be gone after lstk stop")
 }
 
 func TestStopCommandIsIdempotent(t *testing.T) {
@@ -160,7 +161,7 @@ func TestStopCommandIsIdempotent(t *testing.T) {
 	require.Error(t, err, "container should not exist after first stop")
 
 	_, _, err = runLstk(t, ctx, "", e, "stop")
-	require.Error(t, err, "second lstk stop should fail since container already removed")
+	assert.Error(t, err, "second lstk stop should fail since container already removed")
 	requireExitCode(t, 1, err)
 }
 
@@ -177,9 +178,9 @@ func TestStopCommandJSON(t *testing.T) {
 	requireExitCode(t, 0, err)
 
 	envelope := decodeEnvelope(t, stdout)
-	require.Equal(t, "ok", envelope.Status)
-	require.Equal(t, "stop", envelope.Command)
-	require.Nil(t, envelope.Error)
+	assert.Equal(t, "ok", envelope.Status)
+	assert.Equal(t, "stop", envelope.Command)
+	assert.Nil(t, envelope.Error)
 
 	var data struct {
 		Emulators []struct {
@@ -190,9 +191,9 @@ func TestStopCommandJSON(t *testing.T) {
 	}
 	require.NoError(t, json.Unmarshal(envelope.Data, &data))
 	require.Len(t, data.Emulators, 1)
-	require.Equal(t, "aws", data.Emulators[0].Type)
-	require.Equal(t, "localstack-aws", data.Emulators[0].Name)
-	require.True(t, data.Emulators[0].WasRunning)
+	assert.Equal(t, "aws", data.Emulators[0].Type)
+	assert.Equal(t, "localstack-aws", data.Emulators[0].Name)
+	assert.True(t, data.Emulators[0].WasRunning)
 }
 
 func TestStopCommandJSONNotRunning(t *testing.T) {
@@ -204,8 +205,8 @@ func TestStopCommandJSONNotRunning(t *testing.T) {
 	requireExitCode(t, 1, err)
 
 	envelope := decodeEnvelope(t, stdout)
-	require.Equal(t, "error", envelope.Status)
+	assert.Equal(t, "error", envelope.Status)
 	require.NotNil(t, envelope.Error)
-	require.Equal(t, "EMULATOR_NOT_RUNNING", envelope.Error.Code)
-	require.Equal(t, "EMULATOR", envelope.Error.Category)
+	assert.Equal(t, "EMULATOR_NOT_RUNNING", envelope.Error.Code)
+	assert.Equal(t, "EMULATOR", envelope.Error.Category)
 }
diff --git a/test/integration/telemetry_test.go b/test/integration/telemetry_test.go
index 42fc4b09..1abbc0d0 100644
--- a/test/integration/telemetry_test.go
+++ b/test/integration/telemetry_test.go
@@ -18,6 +18,7 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -76,33 +77,33 @@ func TestStartCommandSendsTelemetryEvent(t *testing.T) {
 
 		select {
 		case event := <-events:
-			require.Equal(t, "lstk_command", event["name"])
+			assert.Equal(t, "lstk_command", event["name"])
 
 			metadata, ok := event["metadata"].(map[string]any)
 			require.True(t, ok)
 			_, err := uuid.Parse(metadata["session_id"].(string))
-			require.NoError(t, err, "session_id should be a valid UUID")
+			assert.NoError(t, err, "session_id should be a valid UUID")
 			_, err = time.Parse("2006-01-02 15:04:05.000000", metadata["client_time"].(string))
-			require.NoError(t, err, "client_time should match expected format")
+			assert.NoError(t, err, "client_time should match expected format")
 
 			payload, ok := event["payload"].(map[string]any)
 			require.True(t, ok)
-			require.NotEmpty(t, payload["machine_id"], "machine_id should be present")
-			require.Equal(t, os.Getenv("CI") != "", payload["is_ci"])
+			assert.NotEmpty(t, payload["machine_id"], "machine_id should be present")
+			assert.Equal(t, os.Getenv("CI") != "", payload["is_ci"])
 
 			environment, ok := payload["environment"].(map[string]any)
 			require.True(t, ok)
-			require.NotEmpty(t, environment["lstk_version"])
-			require.Equal(t, runtime.GOOS, environment["os"])
-			require.Equal(t, runtime.GOARCH, environment["arch"])
+			assert.NotEmpty(t, environment["lstk_version"])
+			assert.Equal(t, runtime.GOOS, environment["os"])
+			assert.Equal(t, runtime.GOARCH, environment["arch"])
 
 			params, ok := payload["parameters"].(map[string]any)
 			require.True(t, ok)
-			require.Equal(t, "start", params["command"])
+			assert.Equal(t, "start", params["command"])
 
 			result, ok := payload["result"].(map[string]any)
 			require.True(t, ok)
-			require.InDelta(t, 0, result["exit_code"], 0)
+			assert.InDelta(t, 0, result["exit_code"], 0)
 		case <-time.After(3 * time.Second):
 			t.Fatal("timed out waiting for telemetry event")
 		}
@@ -146,18 +147,18 @@ func TestStopCommandSendsTelemetryEvents(t *testing.T) {
 	lifecycle, ok := byName["lstk_lifecycle"]
 	require.True(t, ok, "expected lstk_lifecycle event")
 	lp := lifecycle["payload"].(map[string]any)
-	require.Equal(t, "stop", lp["event_type"])
-	require.Equal(t, "aws", lp["emulator"])
+	assert.Equal(t, "stop", lp["event_type"])
+	assert.Equal(t, "aws", lp["emulator"])
 
 	command, ok := byName["lstk_command"]
 	require.True(t, ok, "expected lstk_command event")
 	cp := command["payload"].(map[string]any)
 	params, ok := cp["parameters"].(map[string]any)
 	require.True(t, ok)
-	require.Equal(t, "stop", params["command"])
+	assert.Equal(t, "stop", params["command"])
 	result, ok := cp["result"].(map[string]any)
 	require.True(t, ok)
-	require.InDelta(t, 0, result["exit_code"], 0)
+	assert.InDelta(t, 0, result["exit_code"], 0)
 }
 
 func TestStartCommandSucceedsWhenAnalyticsEndpointUnreachable(t *testing.T) {
@@ -240,11 +241,11 @@ func TestAWSProxyTelemetryRecordsExitCodeAndSubcommand(t *testing.T) {
 	require.True(t, ok)
 	params, ok := payload["parameters"].(map[string]any)
 	require.True(t, ok)
-	require.Equal(t, "aws", params["command"])
-	require.Equal(t, "s3 lss", params["subcommand"])
+	assert.Equal(t, "aws", params["command"])
+	assert.Equal(t, "s3 lss", params["subcommand"])
 	result, ok := payload["result"].(map[string]any)
 	require.True(t, ok)
-	require.InDelta(t, 252, result["exit_code"], 0)
+	assert.InDelta(t, 252, result["exit_code"], 0)
 }
 
 // receiveEventByName waits up to 3s for an event with the given name.
@@ -271,9 +272,9 @@ func assertCommandTelemetry(t *testing.T, events <-chan map[string]any, command
 	event := receiveEventByName(t, events, "lstk_command")
 	payload, _ := event["payload"].(map[string]any)
 	params, _ := payload["parameters"].(map[string]any)
-	require.Equal(t, command, params["command"])
+	assert.Equal(t, command, params["command"])
 	result, _ := payload["result"].(map[string]any)
-	require.InDelta(t, exitCode, result["exit_code"], 0)
+	assert.InDelta(t, exitCode, result["exit_code"], 0)
 }
 
 // Regression test for FLC-648: a slow analytics endpoint must not add to
@@ -376,7 +377,7 @@ func TestFlushTelemetrySubcommandDoesNotSpawnRecursively(t *testing.T) {
 			t.Fatalf("expected 2 flushed events, got %d: %v", i, got)
 		}
 	}
-	require.True(t, got["first_event"] && got["second_event"], "expected both piped events, got: %v", got)
+	assert.True(t, got["first_event"] && got["second_event"], "expected both piped events, got: %v", got)
 
 	// No further events may arrive: that would mean the flusher emitted telemetry about itself.
 	select {
diff --git a/test/integration/terraform_cmd_test.go b/test/integration/terraform_cmd_test.go
index a81141a7..186e366e 100644
--- a/test/integration/terraform_cmd_test.go
+++ b/test/integration/terraform_cmd_test.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -63,7 +64,7 @@ func TestTerraformForwardsArgs(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "version")
 	require.NoError(t, err, "stderr: %s", stderr)
-	require.Contains(t, stdout, "ARGS:version")
+	assert.Contains(t, stdout, "ARGS:version")
 }
 
 func TestTerraformAliasTF(t *testing.T) {
@@ -73,7 +74,7 @@ func TestTerraformAliasTF(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "tf", "version")
 	require.NoError(t, err, "stderr: %s", stderr)
-	require.Contains(t, stdout, "ARGS:version")
+	assert.Contains(t, stdout, "ARGS:version")
 }
 
 // LSTK_TF_CMD selects the binary to invoke (e.g. OpenTofu). A stub named `tofu`
@@ -86,7 +87,7 @@ func TestTerraformHonorsLstkTfCmd(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "version")
 	require.NoError(t, err, "stderr: %s", stderr)
-	require.Contains(t, stdout, "TOFU:version")
+	assert.Contains(t, stdout, "TOFU:version")
 }
 
 func TestTerraformPropagatesExitCode(t *testing.T) {
@@ -96,7 +97,7 @@ func TestTerraformPropagatesExitCode(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "validate")
 	require.Error(t, err)
-	require.Contains(t, stderr, "simulated failure")
+	assert.Contains(t, stderr, "simulated failure")
 	requireExitCode(t, 5, err)
 }
 
@@ -128,12 +129,12 @@ func TestTerraformUnproxiedSkipsOverride(t *testing.T) {
 				"terraform", "--region", "us-west-2", "--account", "111111111111", sub)
 			require.NoError(t, err, "stderr: %s", stderr)
 
-			require.Contains(t, stdout, "ARGS:"+sub)
+			assert.Contains(t, stdout, "ARGS:"+sub)
 			// lstk-specific flags must not be forwarded to terraform.
-			require.NotContains(t, stdout, "--region")
-			require.NotContains(t, stdout, "--account")
+			assert.NotContains(t, stdout, "--region")
+			assert.NotContains(t, stdout, "--account")
 			// No override file generated.
-			require.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
+			assert.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 		})
 	}
 }
@@ -155,8 +156,8 @@ func TestTerraformHelpSkipsOverride(t *testing.T) {
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, e, cmdArgs...)
 			require.NoError(t, err, "stderr: %s", stderr)
 
-			require.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
-			require.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
+			assert.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
+			assert.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 		})
 	}
 }
@@ -171,7 +172,7 @@ func TestTerraformInvalidAccountRejected(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"terraform", "--account", "12345", "plan")
 	require.Error(t, err)
-	require.Contains(t, stderr+stdout, "12-digit")
+	assert.Contains(t, stderr+stdout, "12-digit")
 }
 
 func TestTerraformMissingFlagValue(t *testing.T) {
@@ -181,7 +182,7 @@ func TestTerraformMissingFlagValue(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "--region")
 	require.Error(t, err)
-	require.Contains(t, stderr+stdout, "--region requires a value")
+	assert.Contains(t, stderr+stdout, "--region requires a value")
 }
 
 // 7.7 — positional rules. Flags after the action are forwarded verbatim (use an
@@ -195,7 +196,7 @@ func TestTerraformFlagsAfterActionAreForwarded(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"terraform", "version", "--region", "us-west-2")
 	require.NoError(t, err, "stderr: %s", stderr)
-	require.Contains(t, stdout, "ARGS:version --region us-west-2")
+	assert.Contains(t, stdout, "ARGS:version --region us-west-2")
 }
 
 func TestTerraformFlagBeforeSubcommandRejected(t *testing.T) {
@@ -206,7 +207,7 @@ func TestTerraformFlagBeforeSubcommandRejected(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--account", "111111111111", "terraform", "version")
 	require.Error(t, err)
-	require.Contains(t, stderr+stdout, "must appear after the terraform subcommand")
+	assert.Contains(t, stderr+stdout, "must appear after the terraform subcommand")
 }
 
 // 7.2 — proxied command with no running emulator fails with "not running" and
@@ -221,9 +222,9 @@ func TestTerraformFailsWhenEmulatorNotRunning(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "plan")
 	require.Error(t, err)
-	require.Contains(t, stdout, "is not running")
-	require.Contains(t, stdout, "Start LocalStack:")
-	require.NotContains(t, stdout, "ARGS:plan")
+	assert.Contains(t, stdout, "is not running")
+	assert.Contains(t, stdout, "Start LocalStack:")
+	assert.NotContains(t, stdout, "ARGS:plan")
 }
 
 // 10.4 — lstk terraform only works with the AWS emulator. When a non-AWS
@@ -244,9 +245,9 @@ func TestTerraformRequiresAWSEmulator(t *testing.T) {
 
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), e, "terraform", "plan")
 	require.Error(t, err)
-	require.Contains(t, stdout, "requires the")
-	require.Contains(t, stdout, "Snowflake")
-	require.NotContains(t, stdout, "ARGS:plan")
+	assert.Contains(t, stdout, "requires the")
+	assert.Contains(t, stdout, "Snowflake")
+	assert.NotContains(t, stdout, "ARGS:plan")
 }
 
 // 7.4 + 7.6 (encoding) — LSTK_TF_DRY_RUN generates the override (with resolved
@@ -268,7 +269,7 @@ func TestTerraformDryRunGeneratesOverride(t *testing.T) {
 	require.NoError(t, err, "stderr: %s", stderr)
 
 	// terraform plan must NOT have run.
-	require.NotContains(t, stdout, "ARGS:plan")
+	assert.NotContains(t, stdout, "ARGS:plan")
 
 	overridePath := filepath.Join(workDir, tfOverrideFile)
 	require.FileExists(t, overridePath)
@@ -297,11 +298,11 @@ func TestTerraformRefusesPreexistingOverride(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, ctx, workDir, e, "terraform", "plan")
 	require.Error(t, err)
-	require.Contains(t, stderr+stdout, "refusing to overwrite")
+	assert.Contains(t, stderr+stdout, "refusing to overwrite")
 
 	content, err := os.ReadFile(overridePath)
 	require.NoError(t, err)
-	require.Equal(t, "# my own override\n", string(content), "user's file must be untouched")
+	assert.Equal(t, "# my own override\n", string(content), "user's file must be untouched")
 }
 
 // 7.8 — a proxied `plan` generates the override (with endpoint keys sourced from
@@ -324,11 +325,11 @@ func TestTerraformGeneratesAndRemovesOverride(t *testing.T) {
 	require.NoError(t, err, "stderr: %s", stderr)
 
 	// terraform ran and saw an override carrying the schema-derived s3 endpoint key.
-	require.Contains(t, stdout, "ARGS:plan")
-	require.Contains(t, stdout, "TF>")
-	require.Contains(t, stdout, "s3 =")
+	assert.Contains(t, stdout, "ARGS:plan")
+	assert.Contains(t, stdout, "TF>")
+	assert.Contains(t, stdout, "s3 =")
 	// The override is removed once the run completes.
-	require.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
+	assert.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 }
 
 // 11.4 — a proxied command run with `-chdir=DIR` anchors lstk's work to DIR.
@@ -359,9 +360,9 @@ func TestTerraformChdirAnchorsOverrideToDir(t *testing.T) {
 		require.FileExists(t, overridePath)
 		content, err := os.ReadFile(overridePath)
 		require.NoError(t, err)
-		require.Contains(t, string(content), "s3 =") // schema-derived endpoint key
+		assert.Contains(t, string(content), "s3 =") // schema-derived endpoint key
 		// Nothing was written at the top level.
-		require.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
+		assert.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 	})
 
 	// A live run forwards -chdir to terraform and removes the override after.
@@ -374,9 +375,9 @@ func TestTerraformChdirAnchorsOverrideToDir(t *testing.T) {
 		stdout, stderr, err := runLstk(t, ctx, workDir, e, "terraform", "-chdir=infra", "plan")
 		require.NoError(t, err, "stderr: %s", stderr)
 
-		require.Contains(t, stdout, "ARGS:-chdir=infra plan")
-		require.NoFileExists(t, filepath.Join(infra, tfOverrideFile))
-		require.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
+		assert.Contains(t, stdout, "ARGS:-chdir=infra plan")
+		assert.NoFileExists(t, filepath.Join(infra, tfOverrideFile))
+		assert.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 	})
 }
 
@@ -395,9 +396,9 @@ func TestTerraformChdirMissingDirFails(t *testing.T) {
 
 	stdout, _, err := runLstk(t, ctx, workDir, e, "terraform", "-chdir=does-not-exist", "plan")
 	require.Error(t, err)
-	require.Contains(t, stdout, "does not exist")
-	require.NotContains(t, stdout, "ARGS:")
-	require.NoFileExists(t, filepath.Join(workDir, "does-not-exist", tfOverrideFile))
+	assert.Contains(t, stdout, "does not exist")
+	assert.NotContains(t, stdout, "ARGS:")
+	assert.NoFileExists(t, filepath.Join(workDir, "does-not-exist", tfOverrideFile))
 }
 
 // 7.9 — provider schema unavailable (before init) fails with the init-required
@@ -415,7 +416,7 @@ func TestTerraformSchemaUnavailableRequiresInit(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, ctx, workDir, e, "terraform", "plan")
 	require.Error(t, err)
-	require.Contains(t, stderr+stdout, "terraform init")
-	require.NotContains(t, stdout, "ARGS:plan")
-	require.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
+	assert.Contains(t, stderr+stdout, "terraform init")
+	assert.NotContains(t, stdout, "ARGS:plan")
+	assert.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 }
diff --git a/test/integration/terraform_e2e_test.go b/test/integration/terraform_e2e_test.go
index 8f3dd4af..37899bbb 100644
--- a/test/integration/terraform_e2e_test.go
+++ b/test/integration/terraform_e2e_test.go
@@ -10,6 +10,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -121,7 +122,7 @@ func TestTerraformE2ETopLevelProject(t *testing.T) {
 	require.NoError(t, err, "apply stderr: %s", stderr)
 
 	// The generated override is cleaned up after the run completes.
-	require.NoFileExists(t, filepath.Join(work, tfOverrideFile))
+	assert.NoFileExists(t, filepath.Join(work, tfOverrideFile))
 }
 
 // 8.4 — single aws provider block (no alias): exactly one override block. We
@@ -141,7 +142,7 @@ func TestTerraformE2ESingleProvider(t *testing.T) {
 	tfInit(t, ctx, work, e)
 
 	override := captureOverride(t, ctx, work, e)
-	require.Equal(t, 1, countString(override, `provider "aws" {`), "exactly one provider block")
+	assert.Equal(t, 1, countString(override, `provider "aws" {`), "exactly one provider block")
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
 	require.NoError(t, err, "apply stderr: %s", stderr)
@@ -163,8 +164,8 @@ func TestTerraformE2EMultipleAliases(t *testing.T) {
 	tfInit(t, ctx, work, e)
 
 	override := captureOverride(t, ctx, work, e)
-	require.Equal(t, 2, countString(override, `provider "aws" {`), "default + aliased provider blocks")
-	require.Contains(t, override, `alias = "west"`)
+	assert.Equal(t, 2, countString(override, `provider "aws" {`), "default + aliased provider blocks")
+	assert.Contains(t, override, `alias = "west"`)
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
 	require.NoError(t, err, "apply stderr: %s", stderr)
@@ -195,8 +196,8 @@ func TestTerraformE2ESubdirectoryDiscovery(t *testing.T) {
 	tfInit(t, ctx, work, e)
 
 	override := captureOverride(t, ctx, work, e)
-	require.Contains(t, override, `alias = "replica"`, "sub-directory provider discovered")
-	require.NotContains(t, override, "should_be_ignored", ".terraform provider ignored")
+	assert.Contains(t, override, `alias = "replica"`, "sub-directory provider discovered")
+	assert.NotContains(t, override, "should_be_ignored", ".terraform provider ignored")
 }
 
 // 8.6 — a provider block that explicitly sets an endpoint (e.g. FIPS) is
@@ -216,8 +217,8 @@ func TestTerraformE2EExplicitEndpointOverridden(t *testing.T) {
 	tfInit(t, ctx, work, e)
 
 	override := captureOverride(t, ctx, work, e)
-	require.NotContains(t, override, "s3-fips.us-east-1.amazonaws.com", "user FIPS endpoint must not survive")
-	require.Contains(t, override, "localstack", "override S3 endpoint targets LocalStack")
+	assert.NotContains(t, override, "s3-fips.us-east-1.amazonaws.com", "user FIPS endpoint must not survive")
+	assert.Contains(t, override, "localstack", "override S3 endpoint targets LocalStack")
 
 	_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
 	require.NoError(t, err, "apply must route to LocalStack, not FIPS; stderr: %s", stderr)
@@ -276,7 +277,7 @@ func TestTerraformE2ETofu(t *testing.T) {
 	_, stderr, err = runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
 	require.NoError(t, err, "tofu apply stderr: %s", stderr)
 
-	require.NoFileExists(t, filepath.Join(work, tfOverrideFile))
+	assert.NoFileExists(t, filepath.Join(work, tfOverrideFile))
 }
 
 // captureOverride runs the command with LSTK_TF_DRY_RUN=1 so the generated
diff --git a/test/integration/terraform_s3backend_e2e_test.go b/test/integration/terraform_s3backend_e2e_test.go
index 9d0aee20..0c0efce0 100644
--- a/test/integration/terraform_s3backend_e2e_test.go
+++ b/test/integration/terraform_s3backend_e2e_test.go
@@ -6,6 +6,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -47,9 +48,9 @@ func TestTerraformE2ES3Backend(t *testing.T) {
 	require.NoError(t, err, "apply stderr: %s", stderr)
 
 	// State written to and read back from the LocalStack bucket.
-	require.Contains(t, tfStateList(t, ctx, work, e), "aws_s3_bucket.b")
+	assert.Contains(t, tfStateList(t, ctx, work, e), "aws_s3_bucket.b")
 
-	require.NoFileExists(t, filepath.Join(work, tfOverrideFile))
+	assert.NoFileExists(t, filepath.Join(work, tfOverrideFile))
 }
 
 // 10.2 — an S3 backend with DynamoDB locking: lstk creates the lock table, and
@@ -72,7 +73,7 @@ func TestTerraformE2ES3BackendLocking(t *testing.T) {
 	_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
 	require.NoError(t, err, "apply with DynamoDB locking stderr: %s", stderr)
 
-	require.Contains(t, tfStateList(t, ctx, work, e), "aws_s3_bucket.b")
+	assert.Contains(t, tfStateList(t, ctx, work, e), "aws_s3_bucket.b")
 }
 
 // 10.3 — terraform_remote_state: a producer stack writes state (with an output)
@@ -102,7 +103,7 @@ func TestTerraformE2ERemoteState(t *testing.T) {
 
 	stdout, stderr, err := runTerraform(t, ctx, consumer, e, "output", "-raw", "producer_bucket")
 	require.NoError(t, err, "consumer output stderr: %s", stderr)
-	require.Contains(t, stdout, "lstk-e2e-remote-producer", "consumer read the producer's output from LocalStack remote state")
+	assert.Contains(t, stdout, "lstk-e2e-remote-producer", "consumer read the producer's output from LocalStack remote state")
 }
 
 // 10.4 — the S3 backend flow under OpenTofu (LSTK_TF_CMD=tofu), covering the
@@ -124,7 +125,7 @@ func TestTerraformE2ES3BackendTofu(t *testing.T) {
 	_, stderr, err := runTerraform(t, ctx, work, e, "apply", "-auto-approve", "-no-color")
 	require.NoError(t, err, "tofu apply stderr: %s", stderr)
 
-	require.Contains(t, tfStateList(t, ctx, work, e), "aws_s3_bucket.b")
+	assert.Contains(t, tfStateList(t, ctx, work, e), "aws_s3_bucket.b")
 }
 
 // State-bucket provisioning must address the same LocalStack account as the
@@ -155,12 +156,12 @@ func TestTerraformE2ES3BackendProvisionsInSelectedAccount(t *testing.T) {
 
 	selected, stderr, err := runLstk(t, ctx, work, e, "aws", "--account", account, "s3", "ls")
 	require.NoError(t, err, "listing buckets in the selected account failed: %s", stderr)
-	require.Contains(t, selected, "lstk-tf-state", "the state bucket must exist in the selected account")
+	assert.Contains(t, selected, "lstk-tf-state", "the state bucket must exist in the selected account")
 
 	// And not in the default account, which is where it landed before the fix.
 	deflt, stderr, err := runLstk(t, ctx, work, e, "aws", "s3", "ls")
 	require.NoError(t, err, "listing buckets in the default account failed: %s", stderr)
-	require.NotContains(t, deflt, "lstk-tf-state", "the state bucket must not be in the default account")
+	assert.NotContains(t, deflt, "lstk-tf-state", "the state bucket must not be in the default account")
 }
 
 // 10.5 — a configuration with no S3 backend still behaves as before: `init`
@@ -177,5 +178,5 @@ func TestTerraformE2EInitNoBackendNoEmulator(t *testing.T) {
 	require.NoError(t, err, "backend-less init must not require an emulator; stderr: %s", stderr)
 
 	// No override is generated for a backend-less init.
-	require.NoFileExists(t, filepath.Join(work, tfOverrideFile))
+	assert.NoFileExists(t, filepath.Join(work, tfOverrideFile))
 }
diff --git a/test/integration/update_test.go b/test/integration/update_test.go
index 644c1fd0..a7fa6c2a 100644
--- a/test/integration/update_test.go
+++ b/test/integration/update_test.go
@@ -23,6 +23,7 @@ import (
 
 	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -36,7 +37,7 @@ func TestUpdateCheckCommand(t *testing.T) {
 	requireExitCode(t, 0, err)
 
 	// Dev builds report a note about skipping update check
-	require.Contains(t, stdout, "Note:", "should show a note (dev build or up-to-date)")
+	assert.Contains(t, stdout, "Note:", "should show a note (dev build or up-to-date)")
 	assertCommandTelemetry(t, events, "update", 0)
 }
 
@@ -47,7 +48,7 @@ func TestUpdateCheckCommandNonInteractive(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, "", testEnvWithHome(t.TempDir(), ""), "update", "--check", "--non-interactive")
 	require.NoError(t, err, "lstk update --check --non-interactive failed: %s", stderr)
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdout, "Note:", "should show a note in non-interactive mode")
+	assert.Contains(t, stdout, "Note:", "should show a note in non-interactive mode")
 }
 
 func TestUpdateCheckCommandJSON(t *testing.T) {
@@ -59,8 +60,8 @@ func TestUpdateCheckCommandJSON(t *testing.T) {
 	requireExitCode(t, 0, err)
 
 	envelope := decodeEnvelope(t, stdout)
-	require.Equal(t, "ok", envelope.Status)
-	require.Equal(t, "update", envelope.Command)
+	assert.Equal(t, "ok", envelope.Status)
+	assert.Equal(t, "update", envelope.Command)
 
 	var data struct {
 		CurrentVersion  string `json:"currentVersion"`
@@ -71,8 +72,8 @@ func TestUpdateCheckCommandJSON(t *testing.T) {
 	// The integration test binary is a dev build, so Check short-circuits
 	// before any network call — this exercises the "checked, none applied"
 	// UpdateCheckedEvent shape without depending on network access.
-	require.Equal(t, "dev", data.CurrentVersion)
-	require.False(t, data.UpdateAvailable)
+	assert.Equal(t, "dev", data.CurrentVersion)
+	assert.False(t, data.UpdateAvailable)
 }
 
 func requireNPM(t *testing.T) {
@@ -145,8 +146,8 @@ func TestUpdateNPMInstall(t *testing.T) {
 
 	require.NoError(t, err, "lstk update failed: %s", stdoutStr)
 	requireExitCode(t, 0, err)
-	require.Contains(t, stdoutStr, "npm install -g", "should always use global install")
-	require.Contains(t, stdoutStr, "Updated to", "should complete the update")
+	assert.Contains(t, stdoutStr, "npm install -g", "should always use global install")
+	assert.Contains(t, stdoutStr, "Updated to", "should complete the update")
 }
 
 func TestUpdateBinaryInPlace(t *testing.T) {
@@ -175,7 +176,7 @@ func TestUpdateBinaryInPlace(t *testing.T) {
 	verCmd := exec.CommandContext(ctx, tmpBinary, "--version")
 	verOut, err := verCmd.CombinedOutput()
 	require.NoError(t, err)
-	require.Contains(t, string(verOut), "0.0.1")
+	assert.Contains(t, string(verOut), "0.0.1")
 
 	// Run update — should download the real latest release from GitHub and
 	// replace itself. HOME is a temp dir so config/log side effects stay
@@ -186,9 +187,9 @@ func TestUpdateBinaryInPlace(t *testing.T) {
 	updateStr := string(updateOut)
 	require.NoError(t, err, "lstk update failed: %s", updateStr)
 	requireExitCode(t, 0, err)
-	require.Contains(t, updateStr, "Update available: 0.0.1", "should detect update")
-	require.Contains(t, updateStr, "Downloading and verifying update", "should download and verify binary")
-	require.Contains(t, updateStr, "Updated to", "should complete the update")
+	assert.Contains(t, updateStr, "Update available: 0.0.1", "should detect update")
+	assert.Contains(t, updateStr, "Downloading and verifying update", "should download and verify binary")
+	assert.Contains(t, updateStr, "Updated to", "should complete the update")
 
 	// Verify the binary was replaced with the release version the update
 	// reported, not just "anything other than 0.0.1".
@@ -197,8 +198,8 @@ func TestUpdateBinaryInPlace(t *testing.T) {
 	verCmd2 := exec.CommandContext(ctx, tmpBinary, "--version")
 	verOut2, err := verCmd2.CombinedOutput()
 	require.NoError(t, err)
-	require.Contains(t, string(verOut2), m[1], "replaced binary should print the downloaded release version")
-	require.NotContains(t, string(verOut2), "0.0.1", "binary should no longer be the old version")
+	assert.Contains(t, string(verOut2), m[1], "replaced binary should print the downloaded release version")
+	assert.NotContains(t, string(verOut2), "0.0.1", "binary should no longer be the old version")
 }
 
 // TestUpdateBinaryInPlaceJSON exercises an actual applied update (not just
@@ -235,18 +236,18 @@ func TestUpdateBinaryInPlaceJSON(t *testing.T) {
 	requireExitCode(t, 0, err)
 
 	envelope := decodeEnvelope(t, strings.TrimSpace(updateStr))
-	require.Equal(t, "ok", envelope.Status)
+	assert.Equal(t, "ok", envelope.Status)
 
 	var data map[string]any
 	require.NoError(t, json.Unmarshal(envelope.Data, &data))
-	require.Equal(t, "0.0.1", data["currentVersion"])
-	require.Equal(t, true, data["updated"])
-	require.Equal(t, "binary", data["method"])
-	require.NotEmpty(t, data["updatedVersion"])
+	assert.Equal(t, "0.0.1", data["currentVersion"])
+	assert.Equal(t, true, data["updated"])
+	assert.Equal(t, "binary", data["method"])
+	assert.NotEmpty(t, data["updatedVersion"])
 	_, hasLatestVersion := data["latestVersion"]
 	_, hasUpdateAvailable := data["updateAvailable"]
-	require.False(t, hasLatestVersion, "applied-update data should not carry a stale latestVersion key from the preceding check")
-	require.False(t, hasUpdateAvailable, "applied-update data should not carry a stale updateAvailable key from the preceding check")
+	assert.False(t, hasLatestVersion, "applied-update data should not carry a stale latestVersion key from the preceding check")
+	assert.False(t, hasUpdateAvailable, "applied-update data should not carry a stale updateAvailable key from the preceding check")
 }
 
 func requireHomebrew(t *testing.T) {
@@ -297,7 +298,7 @@ func TestUpdateHomebrew(t *testing.T) {
 	verCmd := exec.CommandContext(ctx, caskBinary, "--version")
 	verOut, err := verCmd.CombinedOutput()
 	require.NoError(t, err)
-	require.Contains(t, string(verOut), "0.0.1")
+	assert.Contains(t, string(verOut), "0.0.1")
 
 	// Run update — should detect Homebrew and run brew upgrade
 	// Note: brew may consider lstk already up-to-date (its metadata tracks the
@@ -308,8 +309,8 @@ func TestUpdateHomebrew(t *testing.T) {
 	updateStr := string(updateOut)
 	require.NoError(t, err, "lstk update failed: %s", updateStr)
 	requireExitCode(t, 0, err)
-	require.Contains(t, updateStr, "Homebrew", "should detect Homebrew install")
-	require.Contains(t, updateStr, "brew upgrade", "should mention brew upgrade")
+	assert.Contains(t, updateStr, "Homebrew", "should detect Homebrew install")
+	assert.Contains(t, updateStr, "brew upgrade", "should mention brew upgrade")
 }
 
 func TestUpdateNotification(t *testing.T) {
@@ -357,15 +358,15 @@ port = "4566"    # Host port
 		p.write("s")
 
 		out, _ := p.wait()
-		require.Contains(t, out, "New lstk version available")
+		assert.Contains(t, out, "New lstk version available")
 
 		configData, err := os.ReadFile(configFile)
 		require.NoError(t, err)
 		configStr := string(configData)
-		require.Contains(t, configStr, "update_skipped_version", "skipped version should be persisted")
-		require.Contains(t, configStr, "# User-maintained lstk config", "file header comment should be preserved")
-		require.Contains(t, configStr, "# Emulator type", "inline comments should be preserved")
-		require.Contains(t, configStr, `port = "4566"`, "existing config values should be preserved")
+		assert.Contains(t, configStr, "update_skipped_version", "skipped version should be persisted")
+		assert.Contains(t, configStr, "# User-maintained lstk config", "file header comment should be preserved")
+		assert.Contains(t, configStr, "# Emulator type", "inline comments should be preserved")
+		assert.Contains(t, configStr, `port = "4566"`, "existing config values should be preserved")
 	})
 
 	t.Run("update", func(t *testing.T) {
@@ -391,14 +392,14 @@ port = "4566"    # Host port
 
 		out, err := p.wait()
 		require.NoError(t, err, "update should succeed: %s", out)
-		require.Contains(t, out, "New lstk version available")
-		require.Contains(t, out, "Updated to")
+		assert.Contains(t, out, "New lstk version available")
+		assert.Contains(t, out, "Updated to")
 
 		// Verify the binary was actually replaced
 		verCmd := exec.CommandContext(ctx, updateBinary, "--version")
 		verOut, err := verCmd.CombinedOutput()
 		require.NoError(t, err)
-		require.NotContains(t, string(verOut), "0.0.1", "binary should no longer be the old version")
+		assert.NotContains(t, string(verOut), "0.0.1", "binary should no longer be the old version")
 	})
 }
 
@@ -545,11 +546,11 @@ func TestUpdateBinaryMockGitHubHappyPath(t *testing.T) {
 
 	verOut, err := exec.CommandContext(ctx, oldBinary, "--version").CombinedOutput()
 	require.NoError(t, err)
-	require.Contains(t, string(verOut), "0.0.2", "binary should be replaced with the mock release")
+	assert.Contains(t, string(verOut), "0.0.2", "binary should be replaced with the mock release")
 
 	leftovers, err := filepath.Glob(filepath.Join(filepath.Dir(oldBinary), "lstk-update-*"))
 	require.NoError(t, err)
-	require.Empty(t, leftovers, "download temp files should be cleaned up")
+	assert.Empty(t, leftovers, "download temp files should be cleaned up")
 }
 
 // TestUpdateBinaryMockGitHubChecksumMismatch proves the checksum gate: when
@@ -597,16 +598,16 @@ func TestUpdateBinaryMockGitHubChecksumMismatch(t *testing.T) {
 		"Downloading and verifying update...\n" +
 		fmt.Sprintf("Error: update failed: checksum mismatch for %s: expected %s, got %s — the downloaded archive may be corrupted or tampered with; update aborted\n",
 			assetName, hex.EncodeToString(wrongSum[:]), hex.EncodeToString(archiveSum[:]))
-	require.Equal(t, wantStdout, stdout.String(), "full stdout should be exactly the check/download/error sequence")
-	require.Empty(t, stderr.String(), "silent-error handling must not print anything to stderr")
+	assert.Equal(t, wantStdout, stdout.String(), "full stdout should be exactly the check/download/error sequence")
+	assert.Empty(t, stderr.String(), "silent-error handling must not print anything to stderr")
 
 	verOut, err := exec.CommandContext(ctx, oldBinary, "--version").CombinedOutput()
 	require.NoError(t, err, "original binary should still run")
-	require.Contains(t, string(verOut), "0.0.1", "binary must not be replaced on checksum mismatch")
+	assert.Contains(t, string(verOut), "0.0.1", "binary must not be replaced on checksum mismatch")
 
 	leftovers, err := filepath.Glob(filepath.Join(filepath.Dir(oldBinary), "lstk-update-*"))
 	require.NoError(t, err)
-	require.Empty(t, leftovers, "rejected download must not leave temp files behind")
+	assert.Empty(t, leftovers, "rejected download must not leave temp files behind")
 }
 
 // TestUpdateBinaryMockGitHubMissingChecksums proves the fail-closed contract:
@@ -635,14 +636,14 @@ func TestUpdateBinaryMockGitHubMissingChecksums(t *testing.T) {
 	outStr := string(out)
 	require.Error(t, err, "update must fail when checksums.txt is missing, output: %s", outStr)
 	requireExitCode(t, 1, err)
-	require.Contains(t, outStr, "no checksums.txt asset", "should name the missing manifest")
-	require.Contains(t, outStr, "refusing to install an unverifiable binary", "should state the fail-closed policy")
+	assert.Contains(t, outStr, "no checksums.txt asset", "should name the missing manifest")
+	assert.Contains(t, outStr, "refusing to install an unverifiable binary", "should state the fail-closed policy")
 
 	verOut, err := exec.CommandContext(ctx, oldBinary, "--version").CombinedOutput()
 	require.NoError(t, err, "original binary should still run")
-	require.Contains(t, string(verOut), "0.0.1", "binary must not be replaced without a verifiable manifest")
+	assert.Contains(t, string(verOut), "0.0.1", "binary must not be replaced without a verifiable manifest")
 
 	leftovers, err := filepath.Glob(filepath.Join(filepath.Dir(oldBinary), "lstk-update-*"))
 	require.NoError(t, err)
-	require.Empty(t, leftovers, "aborted update must not leave temp files behind")
+	assert.Empty(t, leftovers, "aborted update must not leave temp files behind")
 }
diff --git a/test/integration/version_resolution_test.go b/test/integration/version_resolution_test.go
index b1229bff..cdb60d41 100644
--- a/test/integration/version_resolution_test.go
+++ b/test/integration/version_resolution_test.go
@@ -11,6 +11,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -58,12 +59,12 @@ func TestVersionResolvedViaImageInspection(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL), "start")
 	require.NoError(t, err, "lstk start failed:\nstdout: %s\nstderr: %s", stdout, stderr)
 
-	require.NotEmpty(t, *capturedVersion, "license request should carry a version resolved from image inspection")
-	require.NotEqual(t, "latest", *capturedVersion, "resolved version should not be the unresolved 'latest' tag")
-	require.Contains(t, stdout, "Checking license")
+	assert.NotEmpty(t, *capturedVersion, "license request should carry a version resolved from image inspection")
+	assert.NotEqual(t, "latest", *capturedVersion, "resolved version should not be the unresolved 'latest' tag")
+	assert.Contains(t, stdout, "Checking license")
 
 	semverLike := strings.Contains(*capturedVersion, ".") || strings.Contains(*capturedVersion, "-")
-	require.True(t, semverLike, "resolved version %q should look like a real version", *capturedVersion)
+	assert.True(t, semverLike, "resolved version %q should look like a real version", *capturedVersion)
 }
 
 // Verifies that when the license check fails after image inspection, the command
@@ -81,7 +82,7 @@ func TestCommandFailsNicelyWhenLicenseCheckFails(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, "",
 		env.With(env.APIEndpoint, mockServer.URL), "start")
 	require.Error(t, err, "expected lstk start to fail when license check fails")
-	require.Contains(t, stdout, "License validation failed",
+	assert.Contains(t, stdout, "License validation failed",
 		"stderr: %s", stderr)
 }
 
@@ -116,14 +117,14 @@ image = "127.0.0.1:1/localstack-pro"
 	stdout, stderr, err := runLstk(t, ctx, "", environ, "--config", configFile, "start")
 
 	out := stdout + "\n" + stderr
-	require.Equal(t, "dev", *capturedVersion, "the configured tag should be sent to the license API")
-	require.NotContains(t, out, "license validation failed",
+	assert.Equal(t, "dev", *capturedVersion, "the configured tag should be sent to the license API")
+	assert.NotContains(t, out, "license validation failed",
 		"an unparseable tag must not be treated as a license rejection")
-	require.Contains(t, out, `does not support tag "dev"`,
+	assert.Contains(t, out, `does not support tag "dev"`,
 		"the skipped pre-flight should be surfaced as a warning")
 	require.Error(t, err, "the start should proceed to the pull and fail on the unreachable registry")
 	requireExitCode(t, 1, err)
-	require.Contains(t, out, "Failed to pull")
+	assert.Contains(t, out, "Failed to pull")
 }
 
 // Verifies that pinned tags are validated before pulling (fail-fast path).
@@ -149,7 +150,7 @@ port = "4566"
 	stdout, stderr, err := runLstk(t, ctx, "",
 		env.With(env.APIEndpoint, mockServer.URL), "--config", configFile, "start")
 	require.Error(t, err, "expected lstk start to fail when license check fails")
-	require.Contains(t, stdout, "License validation failed",
+	assert.Contains(t, stdout, "License validation failed",
 		"stderr: %s", stderr)
-	require.Equal(t, "4.0.0", *capturedVersion, "pinned tag should be sent directly to the license API without image inspection")
+	assert.Equal(t, "4.0.0", *capturedVersion, "pinned tag should be sent directly to the license API without image inspection")
 }
diff --git a/test/integration/volume_test.go b/test/integration/volume_test.go
index 0097ce01..eb5d4ea6 100644
--- a/test/integration/volume_test.go
+++ b/test/integration/volume_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/localstack/lstk/test/integration/env"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -26,7 +27,7 @@ func TestVolumePathCommand(t *testing.T) {
 		require.NoError(t, err, stderr)
 		requireExitCode(t, 0, err)
 
-		require.Contains(t, stdout, filepath.Join("lstk", "volume", "localstack-aws"))
+		assert.Contains(t, stdout, filepath.Join("lstk", "volume", "localstack-aws"))
 	})
 
 	t.Run("prints custom volume path from config", func(t *testing.T) {
@@ -129,7 +130,7 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 		require.NoError(t, err, "lstk volume clear failed: %s\nstdout: %s", stderr, stdout)
 		requireExitCode(t, 0, err)
 
-		require.Contains(t, stdout, "Volume data cleared")
+		assert.Contains(t, stdout, "Volume data cleared")
 
 		// Directory itself should still exist
 		_, err = os.Stat(volumeDir)
@@ -138,7 +139,7 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 		// But contents should be gone
 		entries, err := os.ReadDir(volumeDir)
 		require.NoError(t, err)
-		require.Empty(t, entries, "volume directory should be empty")
+		assert.Empty(t, entries, "volume directory should be empty")
 	})
 
 	t.Run("fails without force in non-interactive mode", func(t *testing.T) {
@@ -153,7 +154,7 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 		require.Error(t, err)
 		requireExitCode(t, 1, err)
 
-		require.Contains(t, stderr, "--force")
+		assert.Contains(t, stderr, "--force")
 	})
 
 	t.Run("handles nonexistent volume directory", func(t *testing.T) {
@@ -174,7 +175,7 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 		require.NoError(t, err, "lstk volume clear failed: %s\nstdout: %s", stderr, stdout)
 		requireExitCode(t, 0, err)
 
-		require.Contains(t, stdout, "Volume data cleared")
+		assert.Contains(t, stdout, "Volume data cleared")
 	})
 
 	t.Run("filters by emulator type", func(t *testing.T) {
@@ -196,7 +197,7 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 		_, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "--non-interactive", "volume", "clear", "--force", "--type", "snowflake")
 		require.Error(t, err)
 		requireExitCode(t, 1, err)
-		require.Contains(t, stderr, "not found")
+		assert.Contains(t, stderr, "not found")
 
 		// Correct type should succeed
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "--non-interactive", "volume", "clear", "--force", "--type", "aws")
@@ -205,7 +206,7 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 
 		entries, err := os.ReadDir(volumeDir)
 		require.NoError(t, err)
-		require.Empty(t, entries)
+		assert.Empty(t, entries)
 	})
 
 	t.Run("emits telemetry", func(t *testing.T) {
@@ -264,7 +265,7 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 		}
 
 		requireExitCode(t, 1, err)
-		require.Contains(t, stderr, "sudo")
+		assert.Contains(t, stderr, "sudo")
 	})
 }
 
@@ -304,10 +305,10 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 		out, err := p.wait()
 		require.NoError(t, err)
 
-		require.Contains(t, out, "Volume data cleared")
+		assert.Contains(t, out, "Volume data cleared")
 		entries, err := os.ReadDir(volumeDir)
 		require.NoError(t, err)
-		require.Empty(t, entries, "volume directory should be empty after confirm")
+		assert.Empty(t, entries, "volume directory should be empty after confirm")
 	})
 
 	t.Run("cancels when user presses n", func(t *testing.T) {
@@ -320,10 +321,10 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 		out, err := p.wait()
 		require.NoError(t, err)
 
-		require.Contains(t, out, "Cancelled")
+		assert.Contains(t, out, "Cancelled")
 		entries, err := os.ReadDir(volumeDir)
 		require.NoError(t, err)
-		require.Len(t, entries, 1, "volume directory should be untouched after cancel")
+		assert.Len(t, entries, 1, "volume directory should be untouched after cancel")
 	})
 }
 

From 7837941d4fb05e5adbb9b59675dbdbeadb5aaedc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Wed, 12 Aug 2026 13:18:11 +0200
Subject: [PATCH 14/21] Separate snapshot archive sections with blank lines

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../__snapshots__/envelope_sink_test.snap     |  6 ++-
 .../output/__snapshots__/plain_sink_test.snap | 10 ++++-
 internal/snap/snap.go                         | 25 +++++++-----
 internal/snap/snap_test.go                    | 11 ++---
 .../__snapshots__/cdk_cmd_test.snap           |  6 ++-
 .../endpoint_url_https_test.snap              |  6 ++-
 .../__snapshots__/endpoint_url_test.snap      |  6 ++-
 .../__snapshots__/extension_test.snap         | 12 +++++-
 .../__snapshots__/json_envelope_test.snap     | 10 ++++-
 .../__snapshots__/json_flag_test.snap         | 40 ++++++++++++++++++-
 .../__snapshots__/sam_cmd_test.snap           |  6 ++-
 .../__snapshots__/snapshot_list_test.snap     |  6 ++-
 .../__snapshots__/snapshot_show_test.snap     |  6 ++-
 .../__snapshots__/snapshot_versions_test.snap | 14 ++++++-
 .../__snapshots__/status_test.snap            |  6 ++-
 .../__snapshots__/terraform_cmd_test.snap     |  7 +++-
 .../__snapshots__/update_test.snap            |  6 ++-
 17 files changed, 138 insertions(+), 45 deletions(-)

diff --git a/internal/output/__snapshots__/envelope_sink_test.snap b/internal/output/__snapshots__/envelope_sink_test.snap
index b9ca3e2a..b0f9cc9a 100644
--- a/internal/output/__snapshots__/envelope_sink_test.snap
+++ b/internal/output/__snapshots__/envelope_sink_test.snap
@@ -1,5 +1,5 @@
-Snapshots created by internal/snap. Values are compared with the trailing
-newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. Values are compared with trailing
+newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
 
 -- TestEnvelopeSink_UpdateCheckedEnvelopeJSON_1 --
 {
@@ -14,3 +14,5 @@ newline stripped. UPDATE_SNAPS=true go test rewrites this file.
   "status": "ok",
   "warnings": []
 }
+
+
diff --git a/internal/output/__snapshots__/plain_sink_test.snap b/internal/output/__snapshots__/plain_sink_test.snap
index 0412be43..01197ad7 100644
--- a/internal/output/__snapshots__/plain_sink_test.snap
+++ b/internal/output/__snapshots__/plain_sink_test.snap
@@ -1,10 +1,12 @@
-Snapshots created by internal/snap. Values are compared with the trailing
-newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. Values are compared with trailing
+newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
 
 -- TestPlainSink_EmitsErrorEvent_1 --
 Error: Connection failed
   Cannot connect to Docker
   ==> Start Docker: open -a Docker
+
+
 -- TestPlainSink_EmitsInstanceInfoEvent_full_1 --
 ✔︎ LocalStack AWS Emulator is running
 • Endpoint: localhost.localstack.cloud:4566
@@ -12,6 +14,10 @@ Error: Connection failed
 • Container: localstack-aws
 • Version: <version>
 • Uptime: <time>
+
+
 -- TestPlainSink_EmitsInstanceInfoEvent_minimal_1 --
 ✔︎ LocalStack AWS Emulator is running
 • Endpoint: 127.0.0.1:4566
+
+
diff --git a/internal/snap/snap.go b/internal/snap/snap.go
index b1a62abb..2622b950 100644
--- a/internal/snap/snap.go
+++ b/internal/snap/snap.go
@@ -37,7 +37,7 @@ import (
 )
 
 // header is the comment section of every archive, kept canonical on rewrite.
-const header = "Snapshots created by internal/snap. Values are compared with the trailing\nnewline stripped. UPDATE_SNAPS=true go test rewrites this file.\n\n"
+const header = "Snapshots created by internal/snap. Values are compared with trailing\nnewlines stripped. UPDATE_SNAPS=true go test rewrites this file.\n\n"
 
 // Test-only helper state: the visited registry must span all tests in the
 // package so Clean can tell live snapshots from obsolete ones. The mutex also
@@ -136,12 +136,18 @@ func readArchive(path string) (*txtar.Archive, error) {
 	return txtar.Parse(data), nil
 }
 
-// entryData returns the entry's value (trailing newline stripped) and whether
-// it exists.
+// entrySep is appended to every stored value: the final newline terminates
+// the value's last line and the rest renders as blank lines between sections,
+// keeping the archive readable. In txtar, trailing blank lines belong to the
+// preceding section's data, so entryData strips them back off.
+const entrySep = "\n\n\n"
+
+// entryData returns the entry's value (trailing newlines stripped, see
+// entrySep) and whether it exists.
 func entryData(a *txtar.Archive, name string) (string, bool) {
 	for _, f := range a.Files {
 		if f.Name == name {
-			return strings.TrimSuffix(string(f.Data), "\n"), true
+			return strings.TrimRight(string(f.Data), "\n"), true
 		}
 	}
 	return "", false
@@ -152,11 +158,10 @@ func match(t testing.TB, got, archive string) {
 	if n := flagValue("test.count"); n != "" && n != "1" {
 		t.Fatalf("snap: -count > 1 is not supported (snapshot call numbering would repeat)")
 	}
-	// Values are compared with the trailing newline stripped: the stored form
-	// always ends with exactly one newline (txtar sections are line-based), so
-	// a snapshot cannot distinguish output ending with a newline from output
-	// that doesn't.
-	got = strings.TrimSuffix(got, "\n")
+	// Values are compared with trailing newlines stripped: the stored form
+	// always ends with entrySep, so a snapshot cannot distinguish values that
+	// differ only in trailing newlines.
+	got = strings.TrimRight(got, "\n")
 
 	mu.Lock()
 	defer mu.Unlock()
@@ -201,7 +206,7 @@ func match(t testing.TB, got, archive string) {
 // Callers hold mu.
 func writeEntry(t testing.TB, path string, a *txtar.Archive, entry, value string) {
 	t.Helper()
-	data := []byte(value + "\n")
+	data := []byte(value + entrySep)
 	replaced := false
 	for i := range a.Files {
 		if a.Files[i].Name == entry {
diff --git a/internal/snap/snap_test.go b/internal/snap/snap_test.go
index 7b3cfff1..9b454f93 100644
--- a/internal/snap/snap_test.go
+++ b/internal/snap/snap_test.go
@@ -260,9 +260,10 @@ func TestMatchRejectsSeparatorCollision(t *testing.T) {
 	}
 }
 
-// TestMatchTrailingNewlineInvariant pins the EOF contract: stored entries end
-// with exactly one newline regardless of whether the value had one, and a
-// value matches its stored snapshot with or without a trailing newline.
+// TestMatchTrailingNewlineInvariant pins the spacing contract: stored entries
+// end with entrySep (blank lines between sections) regardless of the value's
+// own trailing newlines, and a value matches its stored snapshot with or
+// without them.
 func TestMatchTrailingNewlineInvariant(t *testing.T) {
 	t.Setenv("CI", "")
 	t.Setenv("UPDATE_SNAPS", "")
@@ -271,8 +272,8 @@ func TestMatchTrailingNewlineInvariant(t *testing.T) {
 	ft := &fakeT{name: "TestFakeEOF"}
 	Match(ft, "line\n")
 	raw, err := os.ReadFile(archive)
-	if err != nil || !strings.HasSuffix(string(raw), "line\n") || strings.HasSuffix(string(raw), "line\n\n") {
-		t.Fatalf("stored entry should end with exactly one newline: %q err=%v", raw, err)
+	if err != nil || !strings.HasSuffix(string(raw), "line"+entrySep) || strings.HasSuffix(string(raw), "line"+entrySep+"\n") {
+		t.Fatalf("stored entry should end with exactly entrySep: %q err=%v", raw, err)
 	}
 
 	for _, got := range []string{"line", "line\n"} {
diff --git a/test/integration/__snapshots__/cdk_cmd_test.snap b/test/integration/__snapshots__/cdk_cmd_test.snap
index ecb13ec1..f41c8c6c 100644
--- a/test/integration/__snapshots__/cdk_cmd_test.snap
+++ b/test/integration/__snapshots__/cdk_cmd_test.snap
@@ -1,5 +1,5 @@
-Snapshots created by internal/snap. Values are compared with the trailing
-newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. Values are compared with trailing
+newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
 
 -- TestCDKInjectsCleanAWSEnv_1 --
 ARGS:synth
@@ -11,3 +11,5 @@ ENV_AWS_SECRET_ACCESS_KEY=test
 ENV_AWS_PROFILE=<unset>
 ENV_AWS_DEFAULT_PROFILE=<unset>
 ENV_AWS_SESSION_TOKEN=<unset>
+
+
diff --git a/test/integration/__snapshots__/endpoint_url_https_test.snap b/test/integration/__snapshots__/endpoint_url_https_test.snap
index 1425d2ba..728ce9b9 100644
--- a/test/integration/__snapshots__/endpoint_url_https_test.snap
+++ b/test/integration/__snapshots__/endpoint_url_https_test.snap
@@ -1,5 +1,5 @@
-Snapshots created by internal/snap. Values are compared with the trailing
-newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. Values are compared with trailing
+newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
 
 -- TestStatusEndpointURLHTTPSRendersReducedOutput_1 --
 Fetching LocalStack status...
@@ -7,3 +7,5 @@ Fetching LocalStack status...
 • Endpoint: https://127.0.0.1:<port>
 • Version: <version>
 > Note: No resources deployed
+
+
diff --git a/test/integration/__snapshots__/endpoint_url_test.snap b/test/integration/__snapshots__/endpoint_url_test.snap
index 97877c22..8a12b92d 100644
--- a/test/integration/__snapshots__/endpoint_url_test.snap
+++ b/test/integration/__snapshots__/endpoint_url_test.snap
@@ -1,5 +1,5 @@
-Snapshots created by internal/snap. Values are compared with the trailing
-newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. Values are compared with trailing
+newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
 
 -- TestStatusEndpointURLRendersReducedOutput_1 --
 Fetching LocalStack status...
@@ -7,3 +7,5 @@ Fetching LocalStack status...
 • Endpoint: http://127.0.0.1:<port>
 • Version: <version>
 > Note: No resources deployed
+
+
diff --git a/test/integration/__snapshots__/extension_test.snap b/test/integration/__snapshots__/extension_test.snap
index fa73973c..56216916 100644
--- a/test/integration/__snapshots__/extension_test.snap
+++ b/test/integration/__snapshots__/extension_test.snap
@@ -1,5 +1,5 @@
-Snapshots created by internal/snap. Values are compared with the trailing
-newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. Values are compared with trailing
+newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
 
 -- TestExtensionEndpointOmittedWhenNoRuntime_1 --
 ARGS=[]
@@ -10,6 +10,8 @@ NON_INTERACTIVE=true
 JSON=false
 SESSION_ID=<id>
 EMULATOR_COUNT=0
+
+
 -- TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly_1 --
 Usage: lstk [options] [command]
 
@@ -57,6 +59,8 @@ Options:
       --timeout duration      Maximum time to wait for the emulator to become ready (overrides LSTK_STARTUP_TIMEOUT; 0 uses the default)
   -t, --type string           Emulator type to start (aws, snowflake, azure)
   -v, --version               Show version
+
+
 -- TestExtensionSessionIDOmittedWhenTelemetryDisabled_1 --
 ARGS=[exit 7]
 SELF=<path>
@@ -65,6 +69,8 @@ CONFIG_DIR=<path>
 NON_INTERACTIVE=true
 JSON=false
 EMULATOR_COUNT=0
+
+
 -- TestExtensionUnknownCommandDispatches_1 --
 ARGS=[world]
 SELF=<path>
@@ -74,3 +80,5 @@ NON_INTERACTIVE=true
 JSON=false
 SESSION_ID=<id>
 EMULATOR_COUNT=0
+
+
diff --git a/test/integration/__snapshots__/json_envelope_test.snap b/test/integration/__snapshots__/json_envelope_test.snap
index dd84c0c5..ce446e4d 100644
--- a/test/integration/__snapshots__/json_envelope_test.snap
+++ b/test/integration/__snapshots__/json_envelope_test.snap
@@ -1,5 +1,5 @@
-Snapshots created by internal/snap. Values are compared with the trailing
-newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. Values are compared with trailing
+newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
 
 -- TestConfigLoadFailureRendersJSONEnvelope_1 --
 {
@@ -15,6 +15,8 @@ newline stripped. UPDATE_SNAPS=true go test rewrites this file.
   "status": "error",
   "warnings": []
 }
+
+
 -- TestNotJSONCapableCommandRendersEnvelope_1 --
 {
   "command": "login",
@@ -29,6 +31,8 @@ newline stripped. UPDATE_SNAPS=true go test rewrites this file.
   "status": "error",
   "warnings": []
 }
+
+
 -- TestUsageErrorAfterJSONRendersEnvelope_1 --
 {
   "command": "stop",
@@ -43,3 +47,5 @@ newline stripped. UPDATE_SNAPS=true go test rewrites this file.
   "status": "error",
   "warnings": []
 }
+
+
diff --git a/test/integration/__snapshots__/json_flag_test.snap b/test/integration/__snapshots__/json_flag_test.snap
index dad06361..e0d160ff 100644
--- a/test/integration/__snapshots__/json_flag_test.snap
+++ b/test/integration/__snapshots__/json_flag_test.snap
@@ -1,5 +1,5 @@
-Snapshots created by internal/snap. Values are compared with the trailing
-newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. Values are compared with trailing
+newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
 
 -- TestExtensionReceivesJSONFlagInContext_1 --
 ARGS=[--foo]
@@ -10,6 +10,8 @@ NON_INTERACTIVE=true
 JSON=true
 SESSION_ID=<id>
 EMULATOR_COUNT=0
+
+
 -- TestJSONFlagBeforeCommandNameBooleanValues_--json_true_before_the_command_name_is_rejected_1 --
 {
   "command": "aws",
@@ -24,6 +26,8 @@ EMULATOR_COUNT=0
   "status": "error",
   "warnings": []
 }
+
+
 -- TestJSONFlagBeforeCommandNameBooleanValues_a_malformed_value_before_the_command_name_is_rejected_1 --
 {
   "command": "aws",
@@ -38,36 +42,58 @@ EMULATOR_COUNT=0
   "status": "error",
   "warnings": []
 }
+
+
 -- TestJSONFlagProxyCommandsForwardJSON_aws_json_after_the_wrapped_tool_s_own_action_1 --
 Error: aws CLI not found in PATH
   ==> Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
+
+
 -- TestJSONFlagProxyCommandsForwardJSON_aws_json_immediately_after_command_name_1 --
 Error: aws CLI not found in PATH
   ==> Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
+
+
 -- TestJSONFlagProxyCommandsForwardJSON_az_json_after_the_wrapped_tool_s_own_action_1 --
 Error: az CLI not found in PATH
   ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
+
+
 -- TestJSONFlagProxyCommandsForwardJSON_az_json_immediately_after_command_name_1 --
 Error: az CLI not found in PATH
   ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
+
+
 -- TestJSONFlagProxyCommandsForwardJSON_cdk_json_after_the_wrapped_tool_s_own_action_1 --
 Error: cdk not found in PATH
   ==> Install CDK CLI: npm install -g aws-cdk
+
+
 -- TestJSONFlagProxyCommandsForwardJSON_cdk_json_immediately_after_command_name_1 --
 Error: cdk not found in PATH
   ==> Install CDK CLI: npm install -g aws-cdk
+
+
 -- TestJSONFlagProxyCommandsForwardJSON_sam_json_after_the_wrapped_tool_s_own_action_1 --
 Error: sam not found in PATH
   ==> Install AWS SAM CLI: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html
+
+
 -- TestJSONFlagProxyCommandsForwardJSON_sam_json_immediately_after_command_name_1 --
 Error: sam not found in PATH
   ==> Install AWS SAM CLI: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html
+
+
 -- TestJSONFlagProxyCommandsForwardJSON_terraform_json_after_the_wrapped_tool_s_own_action_1 --
 Error: terraform not found in PATH
   ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
+
+
 -- TestJSONFlagProxyCommandsForwardJSON_terraform_json_immediately_after_command_name_1 --
 Error: terraform not found in PATH
   ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
+
+
 -- TestJSONFlagProxyCommandsRejectBeforeCommandName_aws_1 --
 {
   "command": "aws",
@@ -82,6 +108,8 @@ Error: terraform not found in PATH
   "status": "error",
   "warnings": []
 }
+
+
 -- TestJSONFlagProxyCommandsRejectBeforeCommandName_az_1 --
 {
   "command": "az",
@@ -96,6 +124,8 @@ Error: terraform not found in PATH
   "status": "error",
   "warnings": []
 }
+
+
 -- TestJSONFlagProxyCommandsRejectBeforeCommandName_cdk_1 --
 {
   "command": "cdk",
@@ -110,6 +140,8 @@ Error: terraform not found in PATH
   "status": "error",
   "warnings": []
 }
+
+
 -- TestJSONFlagProxyCommandsRejectBeforeCommandName_sam_1 --
 {
   "command": "sam",
@@ -124,6 +156,8 @@ Error: terraform not found in PATH
   "status": "error",
   "warnings": []
 }
+
+
 -- TestJSONFlagProxyCommandsRejectBeforeCommandName_terraform_1 --
 {
   "command": "terraform",
@@ -138,3 +172,5 @@ Error: terraform not found in PATH
   "status": "error",
   "warnings": []
 }
+
+
diff --git a/test/integration/__snapshots__/sam_cmd_test.snap b/test/integration/__snapshots__/sam_cmd_test.snap
index a668baa5..7f95887a 100644
--- a/test/integration/__snapshots__/sam_cmd_test.snap
+++ b/test/integration/__snapshots__/sam_cmd_test.snap
@@ -1,5 +1,5 @@
-Snapshots created by internal/snap. Values are compared with the trailing
-newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. Values are compared with trailing
+newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
 
 -- TestSAMInjectsCleanAWSEnv_1 --
 ARGS:build
@@ -12,3 +12,5 @@ ENV_AWS_SECRET_ACCESS_KEY=test
 ENV_AWS_PROFILE=<unset>
 ENV_AWS_DEFAULT_PROFILE=<unset>
 ENV_AWS_SESSION_TOKEN=<unset>
+
+
diff --git a/test/integration/__snapshots__/snapshot_list_test.snap b/test/integration/__snapshots__/snapshot_list_test.snap
index 8e8d07d0..6f1ac936 100644
--- a/test/integration/__snapshots__/snapshot_list_test.snap
+++ b/test/integration/__snapshots__/snapshot_list_test.snap
@@ -1,5 +1,5 @@
-Snapshots created by internal/snap. Values are compared with the trailing
-newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. Values are compared with trailing
+newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
 
 -- TestSnapshotListSuccessWithoutDocker_1 --
 Fetching snapshots...
@@ -8,3 +8,5 @@ Fetching snapshots...
   NAME           VERSION  LAST CHANGED
   baseline-q2    3        <date>              
   infra-2026-04  1        -
+
+
diff --git a/test/integration/__snapshots__/snapshot_show_test.snap b/test/integration/__snapshots__/snapshot_show_test.snap
index ce241f7e..73d4ddad 100644
--- a/test/integration/__snapshots__/snapshot_show_test.snap
+++ b/test/integration/__snapshots__/snapshot_show_test.snap
@@ -1,5 +1,5 @@
-Snapshots created by internal/snap. Values are compared with the trailing
-newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. Values are compared with trailing
+newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
 
 -- TestSnapshotShowSuccessWithoutDocker_1 --
 Fetching snapshot...
@@ -15,3 +15,5 @@ Services        s3, lambda, dynamodb, sqs
 Resources
   lambda        1 function
   s3            3 buckets
+
+
diff --git a/test/integration/__snapshots__/snapshot_versions_test.snap b/test/integration/__snapshots__/snapshot_versions_test.snap
index 4aec80c8..378c3847 100644
--- a/test/integration/__snapshots__/snapshot_versions_test.snap
+++ b/test/integration/__snapshots__/snapshot_versions_test.snap
@@ -1,5 +1,5 @@
-Snapshots created by internal/snap. Values are compared with the trailing
-newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. Values are compared with trailing
+newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
 
 -- TestSnapshotShowPinnedVersion_1 --
 Fetching snapshot version 1...
@@ -11,11 +11,15 @@ LocalStack      <calv>
 Message         the first one
 
 Services        s3
+
+
 -- TestSnapshotShowVersionNotFound_1 --
 Fetching snapshot version 99...
 Error: Version 99 of 'pod:my-baseline' not found
   The highest available version is 3.
   ==> List available versions: lstk snapshot versions pod:my-baseline
+
+
 -- TestSnapshotVersionsFiltersDeletedVersions_1 --
 Fetching versions...
 ~ 2 versions
@@ -23,8 +27,12 @@ Fetching versions...
   VERSION  CREATED  LOCALSTACK  SERVICES
   3        -        keep-three  -
   1        -        keep-one    -
+
+
 -- TestSnapshotVersionsRejectsS3Ref_1 --
 Error: snapshot versions is only supported for Cloud Pods (pod: refs), not S3 remotes
+
+
 -- TestSnapshotVersionsSuccessWithoutDocker_1 --
 Fetching versions...
 ~ 3 versions
@@ -33,3 +41,5 @@ Fetching versions...
   3        <date>                <calv>      s3, lambda
   2        <date>                <calv>      s3
   1        <date>                <calv>      -
+
+
diff --git a/test/integration/__snapshots__/status_test.snap b/test/integration/__snapshots__/status_test.snap
index 70450cb4..a0b459df 100644
--- a/test/integration/__snapshots__/status_test.snap
+++ b/test/integration/__snapshots__/status_test.snap
@@ -1,7 +1,9 @@
-Snapshots created by internal/snap. Values are compared with the trailing
-newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. Values are compared with trailing
+newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
 
 -- TestStatusCommandFailsWhenNotRunning_1 --
 Error: LocalStack AWS Emulator is not running
   ==> Start LocalStack: lstk
   ==> See help: lstk -h
+
+
diff --git a/test/integration/__snapshots__/terraform_cmd_test.snap b/test/integration/__snapshots__/terraform_cmd_test.snap
index afe1dc3c..86f190a3 100644
--- a/test/integration/__snapshots__/terraform_cmd_test.snap
+++ b/test/integration/__snapshots__/terraform_cmd_test.snap
@@ -1,5 +1,5 @@
-Snapshots created by internal/snap. Values are compared with the trailing
-newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. Values are compared with trailing
+newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
 
 -- TestTerraformDryRunGeneratesOverride_1 --
 # Generated by lstk - do not edit. This file is removed automatically.
@@ -18,7 +18,10 @@ provider "aws" {
   }
 }
 
+
 -- TestTerraformMissingBinary_1 --
 
 Error: terraform not found in PATH
   ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
+
+
diff --git a/test/integration/__snapshots__/update_test.snap b/test/integration/__snapshots__/update_test.snap
index 115a9bf4..c54b5bc6 100644
--- a/test/integration/__snapshots__/update_test.snap
+++ b/test/integration/__snapshots__/update_test.snap
@@ -1,8 +1,10 @@
-Snapshots created by internal/snap. Values are compared with the trailing
-newline stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. Values are compared with trailing
+newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
 
 -- TestUpdateBinaryMockGitHubHappyPath_1 --
 Checking for updates...
 Update available: 0.0.1 → v0.0.2
 Downloading and verifying update...
 ✔︎ Updated to v0.0.2
+
+

From 79c91c9796e1180990af4f56706b6125166014fe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Wed, 12 Aug 2026 13:36:19 +0200
Subject: [PATCH 15/21] Switch snapshot archives to bracket-header format with
 --- terminator

Co-Authored-By: Claude <noreply@anthropic.com>
---
 CLAUDE.md                                     |   2 +-
 go.mod                                        |   2 +-
 .../__snapshots__/envelope_sink_test.snap     |   9 +-
 .../output/__snapshots__/plain_sink_test.snap |  17 +-
 internal/snap/snap.go                         | 204 ++++++++++++------
 internal/snap/snap_test.go                    | 104 +++++----
 .../__snapshots__/cdk_cmd_test.snap           |   9 +-
 .../endpoint_url_https_test.snap              |   9 +-
 .../__snapshots__/endpoint_url_test.snap      |   9 +-
 .../__snapshots__/extension_test.snap         |  21 +-
 .../__snapshots__/json_envelope_test.snap     |  17 +-
 .../__snapshots__/json_flag_test.snap         |  77 ++++---
 .../__snapshots__/sam_cmd_test.snap           |   9 +-
 .../__snapshots__/snapshot_list_test.snap     |   9 +-
 .../__snapshots__/snapshot_show_test.snap     |   9 +-
 .../__snapshots__/snapshot_versions_test.snap |  25 ++-
 .../__snapshots__/status_test.snap            |   9 +-
 .../__snapshots__/terraform_cmd_test.snap     |  12 +-
 .../__snapshots__/update_test.snap            |   9 +-
 test/integration/go.mod                       |   1 -
 test/integration/go.sum                       |   2 -
 21 files changed, 324 insertions(+), 241 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 588b8a58..1e6b9d47 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -233,7 +233,7 @@ When drafting Slack messages, PR descriptions, review replies, release notes, or
 # Testing
 
 - Prefer integration tests to cover most cases. Use unit tests when integration tests are not practical.
-- Assertions use `github.com/stretchr/testify` (`require` for fatal checks). Snapshots use the in-house `internal/snap` helper: `snap.Match(t, s)` stores snapshots in one txtar archive per test file (`__snapshots__/<test_file>.snap`, one `-- TestName_N --` section per Match call); missing snapshots are created locally but fail in CI; `UPDATE_SNAPS=true go test` rewrites them. txtar has no escaping, so a value containing a line that parses as a section separator is rejected (round-trip guard) — sanitize such values before matching. `snap.MatchJSON(t, raw, "data.currentVersion", ...)` snapshots a JSON document in canonical pretty-printed form, masking the values at the given dotted paths with `<any>` (a path that doesn't resolve fails the test; objects only, no array indexing). A package using snapshots must wire `func TestMain(m *testing.M) { os.Exit(snap.Clean(m)) }` — obsolete snapshots then fail the run (or are deleted under `UPDATE_SNAPS=true`); cleanup is skipped on filtered (`-run`/`-skip`) or failed runs. Sanitize volatile values before matching with label-anchored regexes, not value-shaped ones (see `sanitizeSnapshot` in `internal/output`; RE2 has no lookahead, so a bare semver pattern corrupts IPv4 strings).
+- Assertions use `github.com/stretchr/testify` (`require` for fatal checks). Snapshots use the in-house `internal/snap` helper: `snap.Match(t, s)` stores snapshots in one archive per test file (`__snapshots__/<test_file>.snap`): a `[TestName_N]` header line per Match call, the value verbatim, and a `---` terminator on its own line (so a value and the same value plus one final newline are indistinguishable; other newlines are preserved exactly). Missing snapshots are created locally but fail in CI; `UPDATE_SNAPS=true go test` rewrites them. The format has no escaping, so a value containing a line that is exactly `---` is rejected (round-trip guard) — sanitize such values before matching. `snap.MatchJSON(t, raw, "data.currentVersion", ...)` snapshots a JSON document in canonical pretty-printed form, masking the values at the given dotted paths with `<any>` (a path that doesn't resolve fails the test; objects only, no array indexing). A package using snapshots must wire `func TestMain(m *testing.M) { os.Exit(snap.Clean(m)) }` — obsolete snapshots then fail the run (or are deleted under `UPDATE_SNAPS=true`); cleanup is skipped on filtered (`-run`/`-skip`) or failed runs. Sanitize volatile values before matching with label-anchored regexes, not value-shaped ones (see `sanitizeSnapshot` in `internal/output`; RE2 has no lookahead, so a bare semver pattern corrupts IPv4 strings).
 - **When fixing a bug, always add an integration test** that fails before the fix and passes after. This prevents regressions and documents the exact scenario that was broken.
 - Integration tests that run the CLI binary with Bubble Tea must use a PTY since Bubble Tea requires a terminal. Use the cross-platform helpers in `test/integration/pty_helpers_test.go` — `runLstkInPTY` for run-to-completion, or `startLstkInPTY`/`startCmdInPTY` returning a `ptyProc` with `waitForOutput`/`write`/`wait`/`kill` for interactive prompts — never `creack/pty` directly. The helpers wrap `charmbracelet/x/xpty` (Unix PTY on macOS/Linux, ConPTY on Windows), so PTY tests run on Windows too; output from `wait()`/`output()` is ANSI-stripped because ConPTY injects its own repaint sequences. `creack/pty` remains only in `signal_forwarding_test.go` (build-tagged `!windows`; POSIX signal semantics don't port).
 - Never fake an external CLI (`aws`, `az`, `terraform`, `cdk`, `sam`, `aws_completer`, browser openers) with a shell script — scripts don't run on Windows. Use `writeFakeTool`/`installFakeTool` (`test/integration/faketool_test.go`), which copy a compiled Go stand-in (`test-samples/faketool`) onto PATH configured via a JSON sidecar (echo lines with `{argN}`/`{args}`/`{env:NAME}` placeholders, arg-prefix cases like `--version`, sleep, exit codes, record-to-file).
diff --git a/go.mod b/go.mod
index 7ab23795..24a92fc0 100644
--- a/go.mod
+++ b/go.mod
@@ -35,7 +35,6 @@ require (
 	go.uber.org/mock v0.6.0
 	golang.org/x/sys v0.47.0
 	golang.org/x/term v0.45.0
-	golang.org/x/tools v0.47.0
 	gopkg.in/ini.v1 v1.67.3
 	gotest.tools/v3 v3.5.2
 )
@@ -98,6 +97,7 @@ require (
 	golang.org/x/net v0.57.0 // indirect
 	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
 	google.golang.org/grpc v1.83.0 // indirect
diff --git a/internal/output/__snapshots__/envelope_sink_test.snap b/internal/output/__snapshots__/envelope_sink_test.snap
index b0f9cc9a..d8305bcf 100644
--- a/internal/output/__snapshots__/envelope_sink_test.snap
+++ b/internal/output/__snapshots__/envelope_sink_test.snap
@@ -1,7 +1,7 @@
-Snapshots created by internal/snap. Values are compared with trailing
-newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
 
--- TestEnvelopeSink_UpdateCheckedEnvelopeJSON_1 --
+[TestEnvelopeSink_UpdateCheckedEnvelopeJSON_1]
 {
   "command": "update",
   "data": {
@@ -14,5 +14,4 @@ newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
   "status": "ok",
   "warnings": []
 }
-
-
+---
diff --git a/internal/output/__snapshots__/plain_sink_test.snap b/internal/output/__snapshots__/plain_sink_test.snap
index 01197ad7..aabfdf57 100644
--- a/internal/output/__snapshots__/plain_sink_test.snap
+++ b/internal/output/__snapshots__/plain_sink_test.snap
@@ -1,23 +1,22 @@
-Snapshots created by internal/snap. Values are compared with trailing
-newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
 
--- TestPlainSink_EmitsErrorEvent_1 --
+[TestPlainSink_EmitsErrorEvent_1]
 Error: Connection failed
   Cannot connect to Docker
   ==> Start Docker: open -a Docker
+---
 
-
--- TestPlainSink_EmitsInstanceInfoEvent_full_1 --
+[TestPlainSink_EmitsInstanceInfoEvent_full_1]
 ✔︎ LocalStack AWS Emulator is running
 • Endpoint: localhost.localstack.cloud:4566
 • Persistence: Enabled
 • Container: localstack-aws
 • Version: <version>
 • Uptime: <time>
+---
 
-
--- TestPlainSink_EmitsInstanceInfoEvent_minimal_1 --
+[TestPlainSink_EmitsInstanceInfoEvent_minimal_1]
 ✔︎ LocalStack AWS Emulator is running
 • Endpoint: 127.0.0.1:4566
-
-
+---
diff --git a/internal/snap/snap.go b/internal/snap/snap.go
index 2622b950..f735b6fc 100644
--- a/internal/snap/snap.go
+++ b/internal/snap/snap.go
@@ -8,10 +8,21 @@
 // UPDATE_SNAPS=true go test ./... rewrites snapshots and lets Clean delete
 // obsolete ones.
 //
-// Storage is one txtar archive per test file (__snapshots__/<test_file>.snap)
-// with one section per Match call, named TestName_N (N = call number within
-// the test). txtar has no escaping, so a snapshot value containing a line
-// that looks like a txtar section separator ("-- name --") cannot be stored;
+// Storage is one archive per test file (__snapshots__/<test_file>.snap) with
+// one section per Match call:
+//
+//	[TestName_1]
+//	value
+//	---
+//
+//	[TestName_2]
+//	...
+//
+// N is the Match call number within the test. A value's newlines are stored
+// verbatim; the "---" terminator always sits on its own line, so a value not
+// ending in a newline gets one — a snapshot therefore cannot distinguish a
+// value from the same value plus one final newline. The format has no
+// escaping: a value containing a line that is exactly "---" cannot be stored;
 // write guards against that with a parse round-trip and fails with guidance
 // to sanitize the value instead.
 package snap
@@ -33,11 +44,12 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
-	"golang.org/x/tools/txtar"
 )
 
-// header is the comment section of every archive, kept canonical on rewrite.
-const header = "Snapshots created by internal/snap. Values are compared with trailing\nnewlines stripped. UPDATE_SNAPS=true go test rewrites this file.\n\n"
+// header is the comment block of every archive, kept canonical on rewrite.
+const header = "Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites\nthis file.\n\n"
+
+const terminator = "---"
 
 // Test-only helper state: the visited registry must span all tests in the
 // package so Clean can tell live snapshots from obsolete ones. The mutex also
@@ -48,7 +60,16 @@ var (
 	calls   = map[string]int{}             // archive path + test name -> Match call count
 )
 
-var unsafeChars = regexp.MustCompile(`[^A-Za-z0-9._-]+`)
+var (
+	unsafeChars = regexp.MustCompile(`[^A-Za-z0-9._-]+`)
+	entryStart  = regexp.MustCompile(`^\[(.+)\]$`)
+)
+
+// entry is one named snapshot inside an archive.
+type entry struct {
+	name  string
+	value string
+}
 
 // Match compares got against the stored snapshot for the calling test,
 // creating the snapshot on first local run or rewriting it when
@@ -111,7 +132,7 @@ func mask(v any, segs []string) bool {
 	return mask(m[segs[0]], segs[1:])
 }
 
-// callerArchive resolves the txtar archive for the test file that called the
+// callerArchive resolves the archive for the test file that called the
 // exported Match/MatchJSON function (two frames up):
 // <dir>/__snapshots__/<test_file_without_.go>.snap.
 func callerArchive(t testing.TB) string {
@@ -124,107 +145,164 @@ func callerArchive(t testing.TB) string {
 	return filepath.Join(filepath.Dir(file), "__snapshots__", base+".snap")
 }
 
+// parseArchive decodes the archive format. Everything before the first
+// "[name]" line is the header comment and is discarded (rewrites emit the
+// canonical header). Each entry's value is the lines between its "[name]"
+// line and the next "---" line, verbatim; blank lines between entries are
+// separators.
+func parseArchive(data []byte) ([]entry, error) {
+	var entries []entry
+	lines := strings.Split(string(data), "\n")
+	for i := 0; i < len(lines); i++ {
+		m := entryStart.FindStringSubmatch(lines[i])
+		if m == nil {
+			continue
+		}
+		var value strings.Builder
+		terminated := false
+		j := i + 1
+		for ; j < len(lines); j++ {
+			if lines[j] == terminator {
+				terminated = true
+				break
+			}
+			value.WriteString(lines[j])
+			value.WriteString("\n")
+		}
+		if !terminated {
+			return nil, fmt.Errorf("entry %q has no %q terminator", m[1], terminator)
+		}
+		entries = append(entries, entry{name: m[1], value: value.String()})
+		i = j
+	}
+	return entries, nil
+}
+
+// formatArchive encodes entries (name-sorted) with the canonical header, the
+// "---" terminator on its own line, and one blank line between entries. A
+// value not ending in a newline gets one so the terminator stays on its own
+// line.
+func formatArchive(entries []entry) []byte {
+	sort.Slice(entries, func(i, j int) bool { return entries[i].name < entries[j].name })
+	var b strings.Builder
+	b.WriteString(header)
+	for i, e := range entries {
+		if i > 0 {
+			b.WriteString("\n")
+		}
+		b.WriteString("[" + e.name + "]\n")
+		v := e.value
+		if v != "" && !strings.HasSuffix(v, "\n") {
+			v += "\n"
+		}
+		b.WriteString(v)
+		b.WriteString(terminator + "\n")
+	}
+	return []byte(b.String())
+}
+
 // readArchive parses the archive at path. A missing file is an empty archive.
-func readArchive(path string) (*txtar.Archive, error) {
+func readArchive(path string) ([]entry, error) {
 	data, err := os.ReadFile(path)
 	if errors.Is(err, os.ErrNotExist) {
-		return &txtar.Archive{}, nil
+		return nil, nil
 	}
 	if err != nil {
 		return nil, err
 	}
-	return txtar.Parse(data), nil
+	return parseArchive(data)
 }
 
-// entrySep is appended to every stored value: the final newline terminates
-// the value's last line and the rest renders as blank lines between sections,
-// keeping the archive readable. In txtar, trailing blank lines belong to the
-// preceding section's data, so entryData strips them back off.
-const entrySep = "\n\n\n"
-
-// entryData returns the entry's value (trailing newlines stripped, see
-// entrySep) and whether it exists.
-func entryData(a *txtar.Archive, name string) (string, bool) {
-	for _, f := range a.Files {
-		if f.Name == name {
-			return strings.TrimRight(string(f.Data), "\n"), true
+// entryValue returns the entry's value and whether it exists.
+func entryValue(entries []entry, name string) (string, bool) {
+	for _, e := range entries {
+		if e.name == name {
+			return e.value, true
 		}
 	}
 	return "", false
 }
 
+// ensureNL normalizes a value for comparison: the terminator sits on its own
+// line, so stored values always end with a newline — a value without one is
+// indistinguishable from the same value with one.
+func ensureNL(s string) string {
+	if s != "" && !strings.HasSuffix(s, "\n") {
+		return s + "\n"
+	}
+	return s
+}
+
 func match(t testing.TB, got, archive string) {
 	t.Helper()
 	if n := flagValue("test.count"); n != "" && n != "1" {
 		t.Fatalf("snap: -count > 1 is not supported (snapshot call numbering would repeat)")
 	}
-	// Values are compared with trailing newlines stripped: the stored form
-	// always ends with entrySep, so a snapshot cannot distinguish values that
-	// differ only in trailing newlines.
-	got = strings.TrimRight(got, "\n")
+	got = ensureNL(got)
 
 	mu.Lock()
 	defer mu.Unlock()
 
 	key := archive + "|" + t.Name()
 	calls[key]++
-	entry := unsafeChars.ReplaceAllString(t.Name(), "_") + "_" + strconv.Itoa(calls[key])
+	name := unsafeChars.ReplaceAllString(t.Name(), "_") + "_" + strconv.Itoa(calls[key])
 	if visited[archive] == nil {
 		visited[archive] = map[string]bool{}
 	}
-	visited[archive][entry] = true
+	visited[archive][name] = true
 
-	a, err := readArchive(archive)
+	entries, err := readArchive(archive)
 	if err != nil {
 		t.Fatalf("snap: reading %s: %v", archive, err)
 		return
 	}
-	want, exists := entryData(a, entry)
+	want, exists := entryValue(entries, name)
 	update := os.Getenv("UPDATE_SNAPS") == "true"
 	switch {
 	case !exists:
 		if isCI() && !update {
-			t.Fatalf("snap: missing snapshot %q in %s (snapshots are never created in CI; run the test locally and commit the file)", entry, archive)
+			t.Fatalf("snap: missing snapshot %q in %s (snapshots are never created in CI; run the test locally and commit the file)", name, archive)
 			return
 		}
-		writeEntry(t, archive, a, entry, got)
-		t.Logf("snap: created %q in %s", entry, archive)
+		writeEntry(t, archive, entries, name, got)
+		t.Logf("snap: created %q in %s", name, archive)
 	case want != got:
 		if update {
-			writeEntry(t, archive, a, entry, got)
-			t.Logf("snap: updated %q in %s", entry, archive)
+			writeEntry(t, archive, entries, name, got)
+			t.Logf("snap: updated %q in %s", name, archive)
 			return
 		}
 		t.Errorf("snapshot mismatch (-want +got):\n%s\nrun UPDATE_SNAPS=true go test to update %s", cmp.Diff(want, got), archive)
 	}
 }
 
-// writeEntry upserts entry=value into the archive and saves it with a
-// canonical header and name-sorted sections. A parse round-trip guards
-// against values txtar cannot represent (a line matching the "-- name --"
-// section separator); such values must be sanitized by the caller instead.
-// Callers hold mu.
-func writeEntry(t testing.TB, path string, a *txtar.Archive, entry, value string) {
+// writeEntry upserts name=value into the archive and saves it. A parse
+// round-trip guards against values the format cannot represent (a line that
+// is exactly the "---" terminator); such values must be sanitized by the
+// caller instead. Callers hold mu.
+func writeEntry(t testing.TB, path string, entries []entry, name, value string) {
 	t.Helper()
-	data := []byte(value + entrySep)
 	replaced := false
-	for i := range a.Files {
-		if a.Files[i].Name == entry {
-			a.Files[i].Data = data
+	for i := range entries {
+		if entries[i].name == name {
+			entries[i].value = value
 			replaced = true
 			break
 		}
 	}
 	if !replaced {
-		a.Files = append(a.Files, txtar.File{Name: entry, Data: data})
+		entries = append(entries, entry{name: name, value: value})
 	}
-	sort.Slice(a.Files, func(i, j int) bool { return a.Files[i].Name < a.Files[j].Name })
-	a.Comment = []byte(header)
 
-	out := txtar.Format(a)
-	back := txtar.Parse(out)
-	if got, ok := entryData(back, entry); !ok || got != value {
-		t.Fatalf("snap: value for %q does not survive the txtar round-trip (it likely contains a line matching the \"-- name --\" section separator); sanitize the value before snapshotting", entry)
+	out := formatArchive(entries)
+	back, err := parseArchive(out)
+	if err == nil {
+		if got, ok := entryValue(back, name); !ok || got != ensureNL(value) {
+			err = fmt.Errorf("value does not survive the round-trip")
+		}
+	}
+	if err != nil {
+		t.Fatalf("snap: value for %q cannot be stored (%v — it likely contains a line that is exactly %q); sanitize the value before snapshotting", name, err, terminator)
 		return
 	}
 	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
@@ -276,22 +354,22 @@ func Clean(m *testing.M) int {
 // Match call visited, returning how many it found. An archive left with no
 // entries is removed entirely.
 func cleanEntries(archive string, seen map[string]bool, update bool) (int, error) {
-	a, err := readArchive(archive)
+	entries, err := readArchive(archive)
 	if err != nil {
 		return 0, err
 	}
-	var live []txtar.File
+	var live []entry
 	obsolete := 0
-	for _, f := range a.Files {
-		if seen[f.Name] {
-			live = append(live, f)
+	for _, e := range entries {
+		if seen[e.name] {
+			live = append(live, e)
 			continue
 		}
 		obsolete++
 		if update {
-			fmt.Fprintf(os.Stderr, "snap: removed obsolete snapshot %q from %s\n", f.Name, archive)
+			fmt.Fprintf(os.Stderr, "snap: removed obsolete snapshot %q from %s\n", e.name, archive)
 		} else {
-			fmt.Fprintf(os.Stderr, "snap: obsolete snapshot %q in %s (UPDATE_SNAPS=true go test to remove)\n", f.Name, archive)
+			fmt.Fprintf(os.Stderr, "snap: obsolete snapshot %q in %s (UPDATE_SNAPS=true go test to remove)\n", e.name, archive)
 		}
 	}
 	if obsolete == 0 || !update {
@@ -300,9 +378,7 @@ func cleanEntries(archive string, seen map[string]bool, update bool) (int, error
 	if len(live) == 0 {
 		return obsolete, os.Remove(archive)
 	}
-	a.Files = live
-	a.Comment = []byte(header)
-	return obsolete, os.WriteFile(archive, txtar.Format(a), 0o644)
+	return obsolete, os.WriteFile(archive, formatArchive(live), 0o644)
 }
 
 // cleanOrphanArchives deletes (update mode) or reports .snap files in visited
diff --git a/internal/snap/snap_test.go b/internal/snap/snap_test.go
index 9b454f93..fe043736 100644
--- a/internal/snap/snap_test.go
+++ b/internal/snap/snap_test.go
@@ -5,8 +5,6 @@ import (
 	"path/filepath"
 	"strings"
 	"testing"
-
-	"golang.org/x/tools/txtar"
 )
 
 // fakeT records failures instead of failing the real test. Only the methods
@@ -60,27 +58,28 @@ func testArchive(t *testing.T) string {
 	return path
 }
 
-// entry reads the named entry from the archive, reporting whether it exists.
-func entry(t *testing.T, archive, name string) (string, bool) {
+// getEntry reads the named entry from the archive, reporting whether it
+// exists.
+func getEntry(t *testing.T, archive, name string) (string, bool) {
 	t.Helper()
-	a, err := readArchive(archive)
+	entries, err := readArchive(archive)
 	if err != nil {
 		t.Fatal(err)
 	}
-	return entryData(a, name)
+	return entryValue(entries, name)
 }
 
 // seed writes the given entries into the archive directly.
-func seed(t *testing.T, archive string, entries map[string]string) {
+func seed(t *testing.T, archive string, values map[string]string) {
 	t.Helper()
 	if err := os.MkdirAll(filepath.Dir(archive), 0o755); err != nil {
 		t.Fatal(err)
 	}
-	a := &txtar.Archive{Comment: []byte(header)}
-	for name, value := range entries {
-		a.Files = append(a.Files, txtar.File{Name: name, Data: []byte(value + "\n")})
+	var entries []entry
+	for name, value := range values {
+		entries = append(entries, entry{name: name, value: ensureNL(value)})
 	}
-	if err := os.WriteFile(archive, txtar.Format(a), 0o644); err != nil {
+	if err := os.WriteFile(archive, formatArchive(entries), 0o644); err != nil {
 		t.Fatal(err)
 	}
 }
@@ -95,8 +94,8 @@ func TestMatchCreatesThenMatches(t *testing.T) {
 	if ft.failed {
 		t.Fatalf("first Match should create, not fail: %q", ft.msg)
 	}
-	got, ok := entry(t, archive, "TestFakeCreate_1")
-	if !ok || got != "hello\nworld" {
+	got, ok := getEntry(t, archive, "TestFakeCreate_1")
+	if !ok || got != "hello\nworld\n" {
 		t.Fatalf("stored entry: %q ok=%v", got, ok)
 	}
 
@@ -141,10 +140,10 @@ func TestMatchUpdatesOnEnv(t *testing.T) {
 	if ft.failed {
 		t.Fatalf("update mode should rewrite, not fail: %q", ft.msg)
 	}
-	if got, ok := entry(t, archive, "TestFakeUpdate_1"); !ok || got != "new" {
+	if got, ok := getEntry(t, archive, "TestFakeUpdate_1"); !ok || got != "new\n" {
 		t.Fatalf("entry not updated: %q ok=%v", got, ok)
 	}
-	if got, ok := entry(t, archive, "TestOther_1"); !ok || got != "untouched" {
+	if got, ok := getEntry(t, archive, "TestOther_1"); !ok || got != "untouched\n" {
 		t.Fatalf("sibling entry must survive an update: %q ok=%v", got, ok)
 	}
 }
@@ -159,7 +158,7 @@ func TestMatchMissingSnapshotFailsInCI(t *testing.T) {
 	if !ft.fatal {
 		t.Fatal("missing snapshot in CI must be fatal")
 	}
-	if _, ok := entry(t, archive, "TestFakeCI_1"); ok {
+	if _, ok := getEntry(t, archive, "TestFakeCI_1"); ok {
 		t.Fatal("snapshot must not be created in CI")
 	}
 }
@@ -175,8 +174,8 @@ func TestMatchCountsCallsWithinOneTest(t *testing.T) {
 	if ft.failed {
 		t.Fatalf("unexpected failure: %q", ft.msg)
 	}
-	for name, want := range map[string]string{"TestFakeMulti_1": "first", "TestFakeMulti_2": "second"} {
-		if got, ok := entry(t, archive, name); !ok || got != want {
+	for name, want := range map[string]string{"TestFakeMulti_1": "first\n", "TestFakeMulti_2": "second\n"} {
+		if got, ok := getEntry(t, archive, name); !ok || got != want {
 			t.Fatalf("%s: got=%q ok=%v", name, got, ok)
 		}
 	}
@@ -192,7 +191,7 @@ func TestMatchJSONMasksAndCanonicalizes(t *testing.T) {
 	if ft.failed {
 		t.Fatalf("unexpected failure: %q", ft.msg)
 	}
-	got, ok := entry(t, archive, "TestFakeJSON_1")
+	got, ok := getEntry(t, archive, "TestFakeJSON_1")
 	if !ok {
 		t.Fatal("entry missing")
 	}
@@ -233,61 +232,86 @@ func TestMatchJSONFatalPathsWriteNoSnapshot(t *testing.T) {
 	MatchJSON(&fakeT{name: "TestFakeJSONBadPath"}, []byte(`{"data":{}}`), "data.version")
 
 	for _, name := range []string{"TestFakeJSONInvalid_1", "TestFakeJSONBadPath_1"} {
-		if _, ok := entry(t, archive, name); ok {
+		if _, ok := getEntry(t, archive, name); ok {
 			t.Fatalf("fatal MatchJSON call must not write %s", name)
 		}
 	}
 }
 
-// TestMatchRejectsSeparatorCollision pins the txtar limitation: a value
-// containing a line that parses as a section separator cannot be stored and
+// TestMatchRejectsTerminatorCollision pins the format limitation: a value
+// containing a line that is exactly the "---" terminator cannot be stored and
 // must fail loudly instead of corrupting the archive.
-func TestMatchRejectsSeparatorCollision(t *testing.T) {
+func TestMatchRejectsTerminatorCollision(t *testing.T) {
 	t.Setenv("CI", "")
 	t.Setenv("UPDATE_SNAPS", "")
 	archive := testArchive(t)
 
 	ft := &fakeT{name: "TestFakeCollision"}
-	Match(ft, "before\n-- sneaky --\nafter")
+	Match(ft, "before\n---\nafter")
 	if !ft.fatal {
-		t.Fatal("separator collision must be fatal")
+		t.Fatal("terminator collision must be fatal")
 	}
-	if !strings.Contains(ft.msg, "round-trip") {
-		t.Fatalf("collision message should explain the round-trip guard, got %q", ft.msg)
+	if !strings.Contains(ft.msg, "sanitize") {
+		t.Fatalf("collision message should point at sanitizing, got %q", ft.msg)
 	}
 	if _, err := os.Stat(archive); !os.IsNotExist(err) {
 		t.Fatal("colliding value must not be written")
 	}
 }
 
-// TestMatchTrailingNewlineInvariant pins the spacing contract: stored entries
-// end with entrySep (blank lines between sections) regardless of the value's
-// own trailing newlines, and a value matches its stored snapshot with or
-// without them.
+// TestMatchTrailingNewlineInvariant pins the terminator contract: "---"
+// always sits on its own line, a value and the same value plus one final
+// newline are indistinguishable, but additional trailing blank lines are
+// preserved and distinguish values.
 func TestMatchTrailingNewlineInvariant(t *testing.T) {
 	t.Setenv("CI", "")
 	t.Setenv("UPDATE_SNAPS", "")
 	archive := testArchive(t)
 
 	ft := &fakeT{name: "TestFakeEOF"}
-	Match(ft, "line\n")
+	Match(ft, "line")
 	raw, err := os.ReadFile(archive)
-	if err != nil || !strings.HasSuffix(string(raw), "line"+entrySep) || strings.HasSuffix(string(raw), "line"+entrySep+"\n") {
-		t.Fatalf("stored entry should end with exactly entrySep: %q err=%v", raw, err)
+	if err != nil || !strings.HasSuffix(string(raw), "line\n---\n") {
+		t.Fatalf("terminator should sit on its own line: %q err=%v", raw, err)
 	}
 
-	for _, got := range []string{"line", "line\n"} {
+	// "line" and "line\n" are the same snapshot; "line\n\n" is not.
+	for got, wantMatch := range map[string]bool{"line": true, "line\n": true, "line\n\n": false} {
 		mu.Lock()
 		delete(calls, archive+"|TestFakeEOF")
 		mu.Unlock()
 		ft := &fakeT{name: "TestFakeEOF"}
 		Match(ft, got)
-		if ft.failed {
-			t.Fatalf("Match(%q) should match the stored snapshot: %q", got, ft.msg)
+		if ft.failed == wantMatch {
+			t.Fatalf("Match(%q): failed=%v, want match=%v (%q)", got, ft.failed, wantMatch, ft.msg)
 		}
 	}
 }
 
+// TestMatchPreservesInteriorTrailingBlankLines pins that a value ending in
+// blank lines keeps them across the store/compare round-trip.
+func TestMatchPreservesInteriorTrailingBlankLines(t *testing.T) {
+	t.Setenv("CI", "")
+	t.Setenv("UPDATE_SNAPS", "")
+	archive := testArchive(t)
+
+	value := "top\n\nmiddle\n\n\n"
+	ft := &fakeT{name: "TestFakeBlanks"}
+	Match(ft, value)
+	if got, ok := getEntry(t, archive, "TestFakeBlanks_1"); !ok || got != value {
+		t.Fatalf("blank lines not preserved: %q ok=%v", got, ok)
+	}
+
+	mu.Lock()
+	delete(calls, archive+"|TestFakeBlanks")
+	mu.Unlock()
+	ft = &fakeT{name: "TestFakeBlanks"}
+	Match(ft, value)
+	if ft.failed {
+		t.Fatalf("re-Match should succeed: %q", ft.msg)
+	}
+}
+
 func TestCleanEntries(t *testing.T) {
 	dir := t.TempDir()
 	archive := filepath.Join(dir, "some_test.snap")
@@ -302,7 +326,7 @@ func TestCleanEntries(t *testing.T) {
 	if err != nil || n != 1 {
 		t.Fatalf("report mode: n=%d err=%v", n, err)
 	}
-	if _, ok := entry(t, archive, "TestGone_1"); !ok {
+	if _, ok := getEntry(t, archive, "TestGone_1"); !ok {
 		t.Fatal("report mode must not delete entries")
 	}
 
@@ -311,10 +335,10 @@ func TestCleanEntries(t *testing.T) {
 	if err != nil || n != 1 {
 		t.Fatalf("update mode: n=%d err=%v", n, err)
 	}
-	if _, ok := entry(t, archive, "TestGone_1"); ok {
+	if _, ok := getEntry(t, archive, "TestGone_1"); ok {
 		t.Fatal("stale entry should be deleted")
 	}
-	if got, ok := entry(t, archive, "TestLive_1"); !ok || got != "keep" {
+	if got, ok := getEntry(t, archive, "TestLive_1"); !ok || got != "keep\n" {
 		t.Fatalf("live entry should survive: %q ok=%v", got, ok)
 	}
 
diff --git a/test/integration/__snapshots__/cdk_cmd_test.snap b/test/integration/__snapshots__/cdk_cmd_test.snap
index f41c8c6c..f6ccc5e6 100644
--- a/test/integration/__snapshots__/cdk_cmd_test.snap
+++ b/test/integration/__snapshots__/cdk_cmd_test.snap
@@ -1,7 +1,7 @@
-Snapshots created by internal/snap. Values are compared with trailing
-newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
 
--- TestCDKInjectsCleanAWSEnv_1 --
+[TestCDKInjectsCleanAWSEnv_1]
 ARGS:synth
 ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
 ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
@@ -11,5 +11,4 @@ ENV_AWS_SECRET_ACCESS_KEY=test
 ENV_AWS_PROFILE=<unset>
 ENV_AWS_DEFAULT_PROFILE=<unset>
 ENV_AWS_SESSION_TOKEN=<unset>
-
-
+---
diff --git a/test/integration/__snapshots__/endpoint_url_https_test.snap b/test/integration/__snapshots__/endpoint_url_https_test.snap
index 728ce9b9..4de00929 100644
--- a/test/integration/__snapshots__/endpoint_url_https_test.snap
+++ b/test/integration/__snapshots__/endpoint_url_https_test.snap
@@ -1,11 +1,10 @@
-Snapshots created by internal/snap. Values are compared with trailing
-newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
 
--- TestStatusEndpointURLHTTPSRendersReducedOutput_1 --
+[TestStatusEndpointURLHTTPSRendersReducedOutput_1]
 Fetching LocalStack status...
 ✔︎ LocalStack AWS Emulator is running
 • Endpoint: https://127.0.0.1:<port>
 • Version: <version>
 > Note: No resources deployed
-
-
+---
diff --git a/test/integration/__snapshots__/endpoint_url_test.snap b/test/integration/__snapshots__/endpoint_url_test.snap
index 8a12b92d..af5e09e0 100644
--- a/test/integration/__snapshots__/endpoint_url_test.snap
+++ b/test/integration/__snapshots__/endpoint_url_test.snap
@@ -1,11 +1,10 @@
-Snapshots created by internal/snap. Values are compared with trailing
-newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
 
--- TestStatusEndpointURLRendersReducedOutput_1 --
+[TestStatusEndpointURLRendersReducedOutput_1]
 Fetching LocalStack status...
 ✔︎ LocalStack AWS Emulator is running
 • Endpoint: http://127.0.0.1:<port>
 • Version: <version>
 > Note: No resources deployed
-
-
+---
diff --git a/test/integration/__snapshots__/extension_test.snap b/test/integration/__snapshots__/extension_test.snap
index 56216916..0aabccc2 100644
--- a/test/integration/__snapshots__/extension_test.snap
+++ b/test/integration/__snapshots__/extension_test.snap
@@ -1,7 +1,7 @@
-Snapshots created by internal/snap. Values are compared with trailing
-newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
 
--- TestExtensionEndpointOmittedWhenNoRuntime_1 --
+[TestExtensionEndpointOmittedWhenNoRuntime_1]
 ARGS=[]
 SELF=<path>
 API_VERSION=1
@@ -10,9 +10,9 @@ NON_INTERACTIVE=true
 JSON=false
 SESSION_ID=<id>
 EMULATOR_COUNT=0
+---
 
-
--- TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly_1 --
+[TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly_1]
 Usage: lstk [options] [command]
 
 LSTK - LocalStack command-line interface
@@ -59,9 +59,9 @@ Options:
       --timeout duration      Maximum time to wait for the emulator to become ready (overrides LSTK_STARTUP_TIMEOUT; 0 uses the default)
   -t, --type string           Emulator type to start (aws, snowflake, azure)
   -v, --version               Show version
+---
 
-
--- TestExtensionSessionIDOmittedWhenTelemetryDisabled_1 --
+[TestExtensionSessionIDOmittedWhenTelemetryDisabled_1]
 ARGS=[exit 7]
 SELF=<path>
 API_VERSION=1
@@ -69,9 +69,9 @@ CONFIG_DIR=<path>
 NON_INTERACTIVE=true
 JSON=false
 EMULATOR_COUNT=0
+---
 
-
--- TestExtensionUnknownCommandDispatches_1 --
+[TestExtensionUnknownCommandDispatches_1]
 ARGS=[world]
 SELF=<path>
 API_VERSION=1
@@ -80,5 +80,4 @@ NON_INTERACTIVE=true
 JSON=false
 SESSION_ID=<id>
 EMULATOR_COUNT=0
-
-
+---
diff --git a/test/integration/__snapshots__/json_envelope_test.snap b/test/integration/__snapshots__/json_envelope_test.snap
index ce446e4d..8b8c6043 100644
--- a/test/integration/__snapshots__/json_envelope_test.snap
+++ b/test/integration/__snapshots__/json_envelope_test.snap
@@ -1,7 +1,7 @@
-Snapshots created by internal/snap. Values are compared with trailing
-newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
 
--- TestConfigLoadFailureRendersJSONEnvelope_1 --
+[TestConfigLoadFailureRendersJSONEnvelope_1]
 {
   "command": "stop",
   "data": null,
@@ -15,9 +15,9 @@ newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
   "status": "error",
   "warnings": []
 }
+---
 
-
--- TestNotJSONCapableCommandRendersEnvelope_1 --
+[TestNotJSONCapableCommandRendersEnvelope_1]
 {
   "command": "login",
   "data": null,
@@ -31,9 +31,9 @@ newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
   "status": "error",
   "warnings": []
 }
+---
 
-
--- TestUsageErrorAfterJSONRendersEnvelope_1 --
+[TestUsageErrorAfterJSONRendersEnvelope_1]
 {
   "command": "stop",
   "data": null,
@@ -47,5 +47,4 @@ newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
   "status": "error",
   "warnings": []
 }
-
-
+---
diff --git a/test/integration/__snapshots__/json_flag_test.snap b/test/integration/__snapshots__/json_flag_test.snap
index e0d160ff..82457d33 100644
--- a/test/integration/__snapshots__/json_flag_test.snap
+++ b/test/integration/__snapshots__/json_flag_test.snap
@@ -1,7 +1,7 @@
-Snapshots created by internal/snap. Values are compared with trailing
-newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
 
--- TestExtensionReceivesJSONFlagInContext_1 --
+[TestExtensionReceivesJSONFlagInContext_1]
 ARGS=[--foo]
 SELF=<path>
 API_VERSION=1
@@ -10,9 +10,9 @@ NON_INTERACTIVE=true
 JSON=true
 SESSION_ID=<id>
 EMULATOR_COUNT=0
+---
 
-
--- TestJSONFlagBeforeCommandNameBooleanValues_--json_true_before_the_command_name_is_rejected_1 --
+[TestJSONFlagBeforeCommandNameBooleanValues_--json_true_before_the_command_name_is_rejected_1]
 {
   "command": "aws",
   "data": null,
@@ -26,9 +26,9 @@ EMULATOR_COUNT=0
   "status": "error",
   "warnings": []
 }
+---
 
-
--- TestJSONFlagBeforeCommandNameBooleanValues_a_malformed_value_before_the_command_name_is_rejected_1 --
+[TestJSONFlagBeforeCommandNameBooleanValues_a_malformed_value_before_the_command_name_is_rejected_1]
 {
   "command": "aws",
   "data": null,
@@ -42,59 +42,59 @@ EMULATOR_COUNT=0
   "status": "error",
   "warnings": []
 }
+---
 
-
--- TestJSONFlagProxyCommandsForwardJSON_aws_json_after_the_wrapped_tool_s_own_action_1 --
+[TestJSONFlagProxyCommandsForwardJSON_aws_json_after_the_wrapped_tool_s_own_action_1]
 Error: aws CLI not found in PATH
   ==> Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
+---
 
-
--- TestJSONFlagProxyCommandsForwardJSON_aws_json_immediately_after_command_name_1 --
+[TestJSONFlagProxyCommandsForwardJSON_aws_json_immediately_after_command_name_1]
 Error: aws CLI not found in PATH
   ==> Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
+---
 
-
--- TestJSONFlagProxyCommandsForwardJSON_az_json_after_the_wrapped_tool_s_own_action_1 --
+[TestJSONFlagProxyCommandsForwardJSON_az_json_after_the_wrapped_tool_s_own_action_1]
 Error: az CLI not found in PATH
   ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
+---
 
-
--- TestJSONFlagProxyCommandsForwardJSON_az_json_immediately_after_command_name_1 --
+[TestJSONFlagProxyCommandsForwardJSON_az_json_immediately_after_command_name_1]
 Error: az CLI not found in PATH
   ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
+---
 
-
--- TestJSONFlagProxyCommandsForwardJSON_cdk_json_after_the_wrapped_tool_s_own_action_1 --
+[TestJSONFlagProxyCommandsForwardJSON_cdk_json_after_the_wrapped_tool_s_own_action_1]
 Error: cdk not found in PATH
   ==> Install CDK CLI: npm install -g aws-cdk
+---
 
-
--- TestJSONFlagProxyCommandsForwardJSON_cdk_json_immediately_after_command_name_1 --
+[TestJSONFlagProxyCommandsForwardJSON_cdk_json_immediately_after_command_name_1]
 Error: cdk not found in PATH
   ==> Install CDK CLI: npm install -g aws-cdk
+---
 
-
--- TestJSONFlagProxyCommandsForwardJSON_sam_json_after_the_wrapped_tool_s_own_action_1 --
+[TestJSONFlagProxyCommandsForwardJSON_sam_json_after_the_wrapped_tool_s_own_action_1]
 Error: sam not found in PATH
   ==> Install AWS SAM CLI: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html
+---
 
-
--- TestJSONFlagProxyCommandsForwardJSON_sam_json_immediately_after_command_name_1 --
+[TestJSONFlagProxyCommandsForwardJSON_sam_json_immediately_after_command_name_1]
 Error: sam not found in PATH
   ==> Install AWS SAM CLI: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html
+---
 
-
--- TestJSONFlagProxyCommandsForwardJSON_terraform_json_after_the_wrapped_tool_s_own_action_1 --
+[TestJSONFlagProxyCommandsForwardJSON_terraform_json_after_the_wrapped_tool_s_own_action_1]
 Error: terraform not found in PATH
   ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
+---
 
-
--- TestJSONFlagProxyCommandsForwardJSON_terraform_json_immediately_after_command_name_1 --
+[TestJSONFlagProxyCommandsForwardJSON_terraform_json_immediately_after_command_name_1]
 Error: terraform not found in PATH
   ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
+---
 
-
--- TestJSONFlagProxyCommandsRejectBeforeCommandName_aws_1 --
+[TestJSONFlagProxyCommandsRejectBeforeCommandName_aws_1]
 {
   "command": "aws",
   "data": null,
@@ -108,9 +108,9 @@ Error: terraform not found in PATH
   "status": "error",
   "warnings": []
 }
+---
 
-
--- TestJSONFlagProxyCommandsRejectBeforeCommandName_az_1 --
+[TestJSONFlagProxyCommandsRejectBeforeCommandName_az_1]
 {
   "command": "az",
   "data": null,
@@ -124,9 +124,9 @@ Error: terraform not found in PATH
   "status": "error",
   "warnings": []
 }
+---
 
-
--- TestJSONFlagProxyCommandsRejectBeforeCommandName_cdk_1 --
+[TestJSONFlagProxyCommandsRejectBeforeCommandName_cdk_1]
 {
   "command": "cdk",
   "data": null,
@@ -140,9 +140,9 @@ Error: terraform not found in PATH
   "status": "error",
   "warnings": []
 }
+---
 
-
--- TestJSONFlagProxyCommandsRejectBeforeCommandName_sam_1 --
+[TestJSONFlagProxyCommandsRejectBeforeCommandName_sam_1]
 {
   "command": "sam",
   "data": null,
@@ -156,9 +156,9 @@ Error: terraform not found in PATH
   "status": "error",
   "warnings": []
 }
+---
 
-
--- TestJSONFlagProxyCommandsRejectBeforeCommandName_terraform_1 --
+[TestJSONFlagProxyCommandsRejectBeforeCommandName_terraform_1]
 {
   "command": "terraform",
   "data": null,
@@ -172,5 +172,4 @@ Error: terraform not found in PATH
   "status": "error",
   "warnings": []
 }
-
-
+---
diff --git a/test/integration/__snapshots__/sam_cmd_test.snap b/test/integration/__snapshots__/sam_cmd_test.snap
index 7f95887a..fd758331 100644
--- a/test/integration/__snapshots__/sam_cmd_test.snap
+++ b/test/integration/__snapshots__/sam_cmd_test.snap
@@ -1,7 +1,7 @@
-Snapshots created by internal/snap. Values are compared with trailing
-newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
 
--- TestSAMInjectsCleanAWSEnv_1 --
+[TestSAMInjectsCleanAWSEnv_1]
 ARGS:build
 ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
 ENV_AWS_ENDPOINT_URL_S3=<unset>
@@ -12,5 +12,4 @@ ENV_AWS_SECRET_ACCESS_KEY=test
 ENV_AWS_PROFILE=<unset>
 ENV_AWS_DEFAULT_PROFILE=<unset>
 ENV_AWS_SESSION_TOKEN=<unset>
-
-
+---
diff --git a/test/integration/__snapshots__/snapshot_list_test.snap b/test/integration/__snapshots__/snapshot_list_test.snap
index 6f1ac936..3759edab 100644
--- a/test/integration/__snapshots__/snapshot_list_test.snap
+++ b/test/integration/__snapshots__/snapshot_list_test.snap
@@ -1,12 +1,11 @@
-Snapshots created by internal/snap. Values are compared with trailing
-newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
 
--- TestSnapshotListSuccessWithoutDocker_1 --
+[TestSnapshotListSuccessWithoutDocker_1]
 Fetching snapshots...
 ~ 2 snapshots
 
   NAME           VERSION  LAST CHANGED
   baseline-q2    3        <date>              
   infra-2026-04  1        -
-
-
+---
diff --git a/test/integration/__snapshots__/snapshot_show_test.snap b/test/integration/__snapshots__/snapshot_show_test.snap
index 73d4ddad..c41b87ba 100644
--- a/test/integration/__snapshots__/snapshot_show_test.snap
+++ b/test/integration/__snapshots__/snapshot_show_test.snap
@@ -1,7 +1,7 @@
-Snapshots created by internal/snap. Values are compared with trailing
-newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
 
--- TestSnapshotShowSuccessWithoutDocker_1 --
+[TestSnapshotShowSuccessWithoutDocker_1]
 Fetching snapshot...
 Name            my-baseline
 Version         1
@@ -15,5 +15,4 @@ Services        s3, lambda, dynamodb, sqs
 Resources
   lambda        1 function
   s3            3 buckets
-
-
+---
diff --git a/test/integration/__snapshots__/snapshot_versions_test.snap b/test/integration/__snapshots__/snapshot_versions_test.snap
index 378c3847..fa5499c4 100644
--- a/test/integration/__snapshots__/snapshot_versions_test.snap
+++ b/test/integration/__snapshots__/snapshot_versions_test.snap
@@ -1,7 +1,7 @@
-Snapshots created by internal/snap. Values are compared with trailing
-newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
 
--- TestSnapshotShowPinnedVersion_1 --
+[TestSnapshotShowPinnedVersion_1]
 Fetching snapshot version 1...
 Name            my-baseline
 Version         1
@@ -11,29 +11,29 @@ LocalStack      <calv>
 Message         the first one
 
 Services        s3
+---
 
-
--- TestSnapshotShowVersionNotFound_1 --
+[TestSnapshotShowVersionNotFound_1]
 Fetching snapshot version 99...
 Error: Version 99 of 'pod:my-baseline' not found
   The highest available version is 3.
   ==> List available versions: lstk snapshot versions pod:my-baseline
+---
 
-
--- TestSnapshotVersionsFiltersDeletedVersions_1 --
+[TestSnapshotVersionsFiltersDeletedVersions_1]
 Fetching versions...
 ~ 2 versions
 
   VERSION  CREATED  LOCALSTACK  SERVICES
   3        -        keep-three  -
   1        -        keep-one    -
+---
 
-
--- TestSnapshotVersionsRejectsS3Ref_1 --
+[TestSnapshotVersionsRejectsS3Ref_1]
 Error: snapshot versions is only supported for Cloud Pods (pod: refs), not S3 remotes
+---
 
-
--- TestSnapshotVersionsSuccessWithoutDocker_1 --
+[TestSnapshotVersionsSuccessWithoutDocker_1]
 Fetching versions...
 ~ 3 versions
 
@@ -41,5 +41,4 @@ Fetching versions...
   3        <date>                <calv>      s3, lambda
   2        <date>                <calv>      s3
   1        <date>                <calv>      -
-
-
+---
diff --git a/test/integration/__snapshots__/status_test.snap b/test/integration/__snapshots__/status_test.snap
index a0b459df..e0369198 100644
--- a/test/integration/__snapshots__/status_test.snap
+++ b/test/integration/__snapshots__/status_test.snap
@@ -1,9 +1,8 @@
-Snapshots created by internal/snap. Values are compared with trailing
-newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
 
--- TestStatusCommandFailsWhenNotRunning_1 --
+[TestStatusCommandFailsWhenNotRunning_1]
 Error: LocalStack AWS Emulator is not running
   ==> Start LocalStack: lstk
   ==> See help: lstk -h
-
-
+---
diff --git a/test/integration/__snapshots__/terraform_cmd_test.snap b/test/integration/__snapshots__/terraform_cmd_test.snap
index 86f190a3..1826a508 100644
--- a/test/integration/__snapshots__/terraform_cmd_test.snap
+++ b/test/integration/__snapshots__/terraform_cmd_test.snap
@@ -1,7 +1,7 @@
-Snapshots created by internal/snap. Values are compared with trailing
-newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
 
--- TestTerraformDryRunGeneratesOverride_1 --
+[TestTerraformDryRunGeneratesOverride_1]
 # Generated by lstk - do not edit. This file is removed automatically.
 
 provider "aws" {
@@ -18,10 +18,10 @@ provider "aws" {
   }
 }
 
+---
 
--- TestTerraformMissingBinary_1 --
+[TestTerraformMissingBinary_1]
 
 Error: terraform not found in PATH
   ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
-
-
+---
diff --git a/test/integration/__snapshots__/update_test.snap b/test/integration/__snapshots__/update_test.snap
index c54b5bc6..1704e602 100644
--- a/test/integration/__snapshots__/update_test.snap
+++ b/test/integration/__snapshots__/update_test.snap
@@ -1,10 +1,9 @@
-Snapshots created by internal/snap. Values are compared with trailing
-newlines stripped. UPDATE_SNAPS=true go test rewrites this file.
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
 
--- TestUpdateBinaryMockGitHubHappyPath_1 --
+[TestUpdateBinaryMockGitHubHappyPath_1]
 Checking for updates...
 Update available: 0.0.1 → v0.0.2
 Downloading and verifying update...
 ✔︎ Updated to v0.0.2
-
-
+---
diff --git a/test/integration/go.mod b/test/integration/go.mod
index d663a772..e5a083af 100644
--- a/test/integration/go.mod
+++ b/test/integration/go.mod
@@ -23,7 +23,6 @@ require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 
diff --git a/test/integration/go.sum b/test/integration/go.sum
index 8f55665e..33ebe64e 100644
--- a/test/integration/go.sum
+++ b/test/integration/go.sum
@@ -119,8 +119,6 @@ go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOy
 go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

From 3f07786cb34ed16ad756c89362df0fb02d8f6fdb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Wed, 12 Aug 2026 13:45:37 +0200
Subject: [PATCH 16/21] Test that near-terminator lines round-trip in snapshot
 archives

Co-Authored-By: Claude <noreply@anthropic.com>
---
 internal/snap/snap_test.go | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/internal/snap/snap_test.go b/internal/snap/snap_test.go
index fe043736..9084cc06 100644
--- a/internal/snap/snap_test.go
+++ b/internal/snap/snap_test.go
@@ -396,3 +396,31 @@ func TestCleanOrphanArchives(t *testing.T) {
 		}
 	}
 }
+
+// TestMatchStoresNearTerminatorLines pins that only a line that is exactly
+// "---" is unstorable: lines merely containing or resembling the terminator
+// (markdown-style rules, indented dashes, inline dashes) round-trip fine.
+func TestMatchStoresNearTerminatorLines(t *testing.T) {
+	t.Setenv("CI", "")
+	t.Setenv("UPDATE_SNAPS", "")
+	archive := testArchive(t)
+
+	value := "----\n--- text\n ---\na---b\n-- almost --\n"
+	ft := &fakeT{name: "TestFakeDashes"}
+	Match(ft, value)
+	if ft.failed {
+		t.Fatalf("near-terminator lines should be storable: %q", ft.msg)
+	}
+	if got, ok := getEntry(t, archive, "TestFakeDashes_1"); !ok || got != value {
+		t.Fatalf("round-trip mangled the value: %q ok=%v", got, ok)
+	}
+
+	mu.Lock()
+	delete(calls, archive+"|TestFakeDashes")
+	mu.Unlock()
+	ft = &fakeT{name: "TestFakeDashes"}
+	Match(ft, value)
+	if ft.failed {
+		t.Fatalf("re-Match against stored snapshot failed: %q", ft.msg)
+	}
+}

From 4c1de7f91b2af1bfb496cff0f040f3aae5930c3d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Wed, 12 Aug 2026 16:31:12 +0200
Subject: [PATCH 17/21] Convert output assertions to per-stream snapshots in
 integration tests

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../output/__snapshots__/plain_sink_test.snap |  44 ++++
 internal/output/plain_sink_test.go            |  50 ++--
 .../__snapshots__/aws_cmd_test.snap           |  39 +++
 .../__snapshots__/aws_completion_test.snap    |  34 +++
 .../__snapshots__/awsconfig_test.snap         |  16 ++
 .../__snapshots__/az_cmd_test.snap            |  20 ++
 .../__snapshots__/az_interception_test.snap   |  16 ++
 .../__snapshots__/az_pty_test.snap            |   8 +
 .../__snapshots__/cdk_cmd_test.snap           | 189 ++++++++++++++
 .../__snapshots__/completion_test.snap        |  34 +++
 .../__snapshots__/config_test.snap            |  22 ++
 .../__snapshots__/emulator_type_test.snap     |  20 ++
 .../endpoint_url_https_test.snap              |   4 +
 .../__snapshots__/endpoint_url_test.snap      |  78 ++++++
 .../__snapshots__/exit_code_test.snap         | 140 ++++++++++
 .../__snapshots__/extension_test.snap         | 105 ++++++++
 .../__snapshots__/json_envelope_test.snap     |  20 ++
 .../__snapshots__/json_flag_test.snap         |  70 +++++
 .../__snapshots__/logout_test.snap            |   7 +
 test/integration/__snapshots__/logs_test.snap |   6 +
 .../__snapshots__/multiple_installs_test.snap |  10 +
 .../__snapshots__/sam_cmd_test.snap           | 246 ++++++++++++++++++
 .../__snapshots__/setup_azure_test.snap       |  22 ++
 .../__snapshots__/snapshot_list_test.snap     |  23 ++
 .../__snapshots__/snapshot_load_test.snap     |  34 +++
 .../snapshot_load_version_test.snap           |  62 +++++
 .../__snapshots__/snapshot_remove_test.snap   |  38 +++
 .../__snapshots__/snapshot_save_test.snap     |  42 +++
 .../__snapshots__/snapshot_show_test.snap     |  30 +++
 .../__snapshots__/snapshot_versions_test.snap |  51 ++++
 .../__snapshots__/start_snapshot_test.snap    |  10 +
 .../integration/__snapshots__/start_test.snap |   6 +
 .../__snapshots__/terraform_cmd_test.snap     |  75 ++++++
 .../__snapshots__/update_test.snap            |  12 +
 .../__snapshots__/volume_test.snap            |  10 +
 test/integration/aws_cmd_test.go              |  19 +-
 test/integration/aws_completion_test.go       |  17 +-
 test/integration/awsconfig_test.go            |   8 +-
 test/integration/az_cmd_test.go               |  13 +-
 test/integration/az_interception_test.go      |   9 +-
 test/integration/az_pty_test.go               |   4 +-
 test/integration/cdk_cmd_test.go              |  33 ++-
 test/integration/completion_test.go           |  11 +-
 test/integration/config_test.go               |   9 +-
 test/integration/emulator_type_test.go        |   9 +-
 test/integration/endpoint_url_https_test.go   |   4 +-
 test/integration/endpoint_url_test.go         |  53 ++--
 test/integration/exit_code_test.go            |  29 +--
 test/integration/extension_test.go            |  13 +-
 test/integration/json_envelope_test.go        |  12 +-
 test/integration/json_flag_test.go            |  31 +--
 test/integration/logout_test.go               |   3 +-
 test/integration/logs_test.go                 |   4 +-
 test/integration/multiple_installs_test.go    |   5 +-
 test/integration/sam_cmd_test.go              |  67 ++---
 test/integration/setup_azure_test.go          |  17 +-
 test/integration/snapshot_list_test.go        |  11 +-
 test/integration/snapshot_load_test.go        |  13 +-
 .../integration/snapshot_load_version_test.go |  28 +-
 test/integration/snapshot_remove_test.go      |  15 +-
 test/integration/snapshot_save_test.go        |  13 +-
 test/integration/snapshot_show_test.go        |  16 +-
 test/integration/snapshot_versions_test.go    |  24 +-
 test/integration/start_snapshot_test.go       |   5 +-
 test/integration/start_test.go                |   3 +-
 test/integration/terraform_cmd_test.go        |  33 +--
 test/integration/update_test.go               |   6 +-
 test/integration/volume_test.go               |   5 +-
 68 files changed, 1820 insertions(+), 315 deletions(-)
 create mode 100644 test/integration/__snapshots__/aws_cmd_test.snap
 create mode 100644 test/integration/__snapshots__/aws_completion_test.snap
 create mode 100644 test/integration/__snapshots__/awsconfig_test.snap
 create mode 100644 test/integration/__snapshots__/az_cmd_test.snap
 create mode 100644 test/integration/__snapshots__/az_interception_test.snap
 create mode 100644 test/integration/__snapshots__/az_pty_test.snap
 create mode 100644 test/integration/__snapshots__/completion_test.snap
 create mode 100644 test/integration/__snapshots__/config_test.snap
 create mode 100644 test/integration/__snapshots__/emulator_type_test.snap
 create mode 100644 test/integration/__snapshots__/exit_code_test.snap
 create mode 100644 test/integration/__snapshots__/logout_test.snap
 create mode 100644 test/integration/__snapshots__/logs_test.snap
 create mode 100644 test/integration/__snapshots__/multiple_installs_test.snap
 create mode 100644 test/integration/__snapshots__/setup_azure_test.snap
 create mode 100644 test/integration/__snapshots__/snapshot_load_test.snap
 create mode 100644 test/integration/__snapshots__/snapshot_load_version_test.snap
 create mode 100644 test/integration/__snapshots__/snapshot_remove_test.snap
 create mode 100644 test/integration/__snapshots__/snapshot_save_test.snap
 create mode 100644 test/integration/__snapshots__/start_snapshot_test.snap
 create mode 100644 test/integration/__snapshots__/start_test.snap
 create mode 100644 test/integration/__snapshots__/volume_test.snap

diff --git a/internal/output/__snapshots__/plain_sink_test.snap b/internal/output/__snapshots__/plain_sink_test.snap
index aabfdf57..02748312 100644
--- a/internal/output/__snapshots__/plain_sink_test.snap
+++ b/internal/output/__snapshots__/plain_sink_test.snap
@@ -20,3 +20,47 @@ Error: Connection failed
 ✔︎ LocalStack AWS Emulator is running
 • Endpoint: 127.0.0.1:4566
 ---
+
+[TestPlainSink_EmitsLogLineEvent_1]
+2024-01-01 hello from container
+---
+
+[TestPlainSink_EmitsMessageEventInfo_1]
+hello
+---
+
+[TestPlainSink_EmitsMessageEventWarning_1]
+> Warning: something went wrong
+---
+
+[TestPlainSink_EmitsSpinnerEvent_active_spinner_1]
+Loading...
+---
+
+[TestPlainSink_EmitsStatusEvent_pulling_phase_1]
+Preparing LocalStack...
+---
+
+[TestPlainSink_EmitsStatusEvent_ready_phase_with_detail_1]
+✔︎ LocalStack is running (abc123)
+---
+
+[TestPlainSink_EmitsStatusEvent_ready_phase_without_detail_1]
+✔︎ LocalStack is running
+---
+
+[TestPlainSink_EmitsStatusEvent_starting_phase_1]
+Starting LocalStack...
+---
+
+[TestPlainSink_EmitsStatusEvent_unknown_phase_with_detail_1]
+LocalStack: custom (info)
+---
+
+[TestPlainSink_EmitsStatusEvent_unknown_phase_without_detail_1]
+LocalStack: custom
+---
+
+[TestPlainSink_EmitsStatusEvent_waiting_phase_1]
+Waiting for LocalStack to be ready...
+---
diff --git a/internal/output/plain_sink_test.go b/internal/output/plain_sink_test.go
index fede6cad..884d585c 100644
--- a/internal/output/plain_sink_test.go
+++ b/internal/output/plain_sink_test.go
@@ -26,7 +26,7 @@ func TestPlainSink_EmitsMessageEventInfo(t *testing.T) {
 
 	sink.Emit(MessageEvent{Severity: SeverityInfo, Text: "hello"})
 
-	assert.Equal(t, "hello\n", out.String())
+	snap.Match(t, out.String())
 }
 
 func TestPlainSink_EmitsMessageEventWarning(t *testing.T) {
@@ -35,49 +35,41 @@ func TestPlainSink_EmitsMessageEventWarning(t *testing.T) {
 
 	sink.Emit(MessageEvent{Severity: SeverityWarning, Text: "something went wrong"})
 
-	assert.Equal(t, "> Warning: something went wrong\n", out.String())
+	snap.Match(t, out.String())
 }
 
 func TestPlainSink_EmitsStatusEvent(t *testing.T) {
 	tests := []struct {
-		name     string
-		event    ContainerStatusEvent
-		expected string
+		name  string
+		event ContainerStatusEvent
 	}{
 		{
-			name:     "pulling phase",
-			event:    ContainerStatusEvent{Phase: "pulling", Container: "localstack/localstack:latest"},
-			expected: "Preparing LocalStack...\n",
+			name:  "pulling phase",
+			event: ContainerStatusEvent{Phase: "pulling", Container: "localstack/localstack:latest"},
 		},
 		{
-			name:     "starting phase",
-			event:    ContainerStatusEvent{Phase: "starting", Container: "localstack-aws"},
-			expected: "Starting LocalStack...\n",
+			name:  "starting phase",
+			event: ContainerStatusEvent{Phase: "starting", Container: "localstack-aws"},
 		},
 		{
-			name:     "waiting phase",
-			event:    ContainerStatusEvent{Phase: "waiting", Container: "localstack-aws"},
-			expected: "Waiting for LocalStack to be ready...\n",
+			name:  "waiting phase",
+			event: ContainerStatusEvent{Phase: "waiting", Container: "localstack-aws"},
 		},
 		{
-			name:     "ready phase with detail",
-			event:    ContainerStatusEvent{Phase: "ready", Container: "localstack-aws", Detail: "abc123"},
-			expected: fmt.Sprintf("%s LocalStack is running (abc123)\n", SuccessMarker()),
+			name:  "ready phase with detail",
+			event: ContainerStatusEvent{Phase: "ready", Container: "localstack-aws", Detail: "abc123"},
 		},
 		{
-			name:     "ready phase without detail",
-			event:    ContainerStatusEvent{Phase: "ready", Container: "localstack-aws"},
-			expected: fmt.Sprintf("%s LocalStack is running\n", SuccessMarker()),
+			name:  "ready phase without detail",
+			event: ContainerStatusEvent{Phase: "ready", Container: "localstack-aws"},
 		},
 		{
-			name:     "unknown phase with detail",
-			event:    ContainerStatusEvent{Phase: "custom", Container: "localstack-aws", Detail: "info"},
-			expected: "LocalStack: custom (info)\n",
+			name:  "unknown phase with detail",
+			event: ContainerStatusEvent{Phase: "custom", Container: "localstack-aws", Detail: "info"},
 		},
 		{
-			name:     "unknown phase without detail",
-			event:    ContainerStatusEvent{Phase: "custom", Container: "localstack-aws"},
-			expected: "LocalStack: custom\n",
+			name:  "unknown phase without detail",
+			event: ContainerStatusEvent{Phase: "custom", Container: "localstack-aws"},
 		},
 	}
 
@@ -88,7 +80,7 @@ func TestPlainSink_EmitsStatusEvent(t *testing.T) {
 
 			sink.Emit(tt.event)
 
-			assert.Equal(t, tt.expected, out.String())
+			snap.Match(t, out.String())
 		})
 	}
 }
@@ -123,7 +115,7 @@ func TestPlainSink_EmitsLogLineEvent(t *testing.T) {
 
 	sink.Emit(LogLineEvent{Source: "container", Line: "2024-01-01 hello from container"})
 
-	assert.Equal(t, "2024-01-01 hello from container\n", out.String())
+	snap.Match(t, out.String())
 }
 
 func TestPlainSink_EmitsSpinnerEvent(t *testing.T) {
@@ -133,7 +125,7 @@ func TestPlainSink_EmitsSpinnerEvent(t *testing.T) {
 
 		sink.Emit(SpinnerEvent{Active: true, Text: "Loading"})
 
-		assert.Equal(t, "Loading...\n", out.String())
+		snap.Match(t, out.String())
 	})
 
 	t.Run("stop spinner is silent", func(t *testing.T) {
diff --git a/test/integration/__snapshots__/aws_cmd_test.snap b/test/integration/__snapshots__/aws_cmd_test.snap
new file mode 100644
index 00000000..abaae776
--- /dev/null
+++ b/test/integration/__snapshots__/aws_cmd_test.snap
@@ -0,0 +1,39 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestAWSCommandFailsWhenAWSCLINotInstalled_1]
+Error: aws CLI not found in PATH
+  ==> Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
+---
+
+[TestAWSCommandHelpSkipsDockerAndEmulator_--help_1]
+ARGS:--help
+---
+
+[TestAWSCommandHelpSkipsDockerAndEmulator_-h_1]
+ARGS:-h
+---
+
+[TestAWSCommandHelpSkipsDockerAndEmulator_help_1]
+ARGS:help
+---
+
+[TestAWSCommandHelpSkipsDockerAndEmulator_s3_--help_1]
+ARGS:s3 --help
+---
+
+[TestAWSCommandHelpSkipsDockerAndEmulator_s3_help_1]
+ARGS:s3 help
+---
+
+[TestAWSCommandRejectsAccountWithoutValue_1]
+Error: --account requires a value
+---
+
+[TestAWSCommandRejectsInvalidAccount_1]
+Error: --account must be a 12-digit AWS account id, got "12345"
+---
+
+[TestAWSCommandRejectsPreSubcommandAccount_1]
+Error: --account must appear after the aws subcommand (e.g. `lstk aws --account 111111111111 ...`)
+---
diff --git a/test/integration/__snapshots__/aws_completion_test.snap b/test/integration/__snapshots__/aws_completion_test.snap
new file mode 100644
index 00000000..4063cc2f
--- /dev/null
+++ b/test/integration/__snapshots__/aws_completion_test.snap
@@ -0,0 +1,34 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestAWSCompletionAppendsTrailingSpaceForNewWord_1]
+compline=[aws s3 ]
+ls
+list-buckets
+:4
+---
+
+[TestAWSCompletionDegradesWhenCompleterMissing_1]
+:0
+---
+
+[TestAWSCompletionDelegatesToAWSCompleter_1]
+compline=[aws s3 l]
+ls
+list-buckets
+:4
+---
+
+[TestAWSCompletionNeedsNoDockerOrEmulator_1]
+compline=[aws s3 l]
+ls
+list-buckets
+:4
+---
+
+[TestAWSCompletionStripsGlobalFlags_1]
+compline=[aws s3 l]
+ls
+list-buckets
+:4
+---
diff --git a/test/integration/__snapshots__/awsconfig_test.snap b/test/integration/__snapshots__/awsconfig_test.snap
new file mode 100644
index 00000000..e764ead8
--- /dev/null
+++ b/test/integration/__snapshots__/awsconfig_test.snap
@@ -0,0 +1,16 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestSetupAWSNonInteractiveCreatesProfile_1]
+✔︎ Created LocalStack profile in ~/.aws
+---
+
+[TestSetupAWSNonInteractiveIsIdempotent_1]
+> Note: LocalStack AWS profile is already configured.
+---
+
+[TestSetupAWSNonInteractiveOverwriteRequiresForce_1]
+Error: Refusing to overwrite the existing LocalStack AWS profile
+  a 'localstack' AWS profile already exists with different values
+  ==> Overwrite it: lstk setup aws --force
+---
diff --git a/test/integration/__snapshots__/az_cmd_test.snap b/test/integration/__snapshots__/az_cmd_test.snap
new file mode 100644
index 00000000..73760e9a
--- /dev/null
+++ b/test/integration/__snapshots__/az_cmd_test.snap
@@ -0,0 +1,20 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestAzCommandConfigFlagSelectsConfigFile_1]
+AZ_ARGS:group list
+---
+
+[TestAzCommandConfigFlagSelectsConfigFile_2]
+Error: Azure CLI integration is not set up
+  ==> Set it up: lstk setup azure
+---
+
+[TestAzCommandFailsWhenAzureCLINotInstalled_1]
+Error: az CLI not found in PATH
+  ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
+---
+
+[TestAzCommandStripsGlobalFlagsFromPassthrough_1]
+AZ_ARGS:group list
+---
diff --git a/test/integration/__snapshots__/az_interception_test.snap b/test/integration/__snapshots__/az_interception_test.snap
new file mode 100644
index 00000000..88a37f40
--- /dev/null
+++ b/test/integration/__snapshots__/az_interception_test.snap
@@ -0,0 +1,16 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestAzStartInterceptionRoutesToSubcommand_1]
+Error: az CLI not found in PATH
+  ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
+---
+
+[TestAzStopInterceptionFailsWhenAzureCLINotInstalled_1]
+Error: az CLI not found in PATH
+  ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
+---
+
+[TestAzStopInterceptionNoOpWhenNotIntercepting_1]
+> Note: 'LocalStack' is not the active Azure cloud (currently 'AzureCloud'); nothing to revert.
+---
diff --git a/test/integration/__snapshots__/az_pty_test.snap b/test/integration/__snapshots__/az_pty_test.snap
new file mode 100644
index 00000000..4a5c2989
--- /dev/null
+++ b/test/integration/__snapshots__/az_pty_test.snap
@@ -0,0 +1,8 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestAzWithPipedStdoutKeepsPipe_1]
+STDOUT_TTY:no
+PYTHONUNBUFFERED:1
+piped
+---
diff --git a/test/integration/__snapshots__/cdk_cmd_test.snap b/test/integration/__snapshots__/cdk_cmd_test.snap
index f6ccc5e6..b93b1209 100644
--- a/test/integration/__snapshots__/cdk_cmd_test.snap
+++ b/test/integration/__snapshots__/cdk_cmd_test.snap
@@ -1,6 +1,115 @@
 Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
 this file.
 
+[TestCDKAccountRejected_123456789012_1]
+---
+
+[TestCDKAccountRejected_123456789012_2]
+Error: --account is not supported by lstk cdk; CDK always uses the default LocalStack account 000000000000
+---
+
+[TestCDKAccountRejected_12345_1]
+---
+
+[TestCDKAccountRejected_12345_2]
+Error: --account is not supported by lstk cdk; CDK always uses the default LocalStack account 000000000000
+---
+
+[TestCDKFlagBeforeSubcommandRejected_1]
+---
+
+[TestCDKFlagBeforeSubcommandRejected_2]
+Error: --region and --account must appear after the cdk subcommand (e.g. `lstk cdk --region us-west-2 ...`)
+---
+
+[TestCDKFlagsAfterActionAreForwarded_1]
+ARGS:synth --region us-west-2
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKForwardsArgs_1]
+ARGS:synth
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKHelpNoEmulator_--help_1]
+ARGS:--help
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKHelpNoEmulator_-h_1]
+ARGS:-h
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKHelpNoEmulator_deploy_--help_1]
+ARGS:deploy --help
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKHelpNoEmulator_deploy_help_1]
+ARGS:deploy help
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKHelpNoEmulator_help_1]
+ARGS:help
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKHonorsLstkCdkCmd_1]
+MYCDK:synth
+---
+
 [TestCDKInjectsCleanAWSEnv_1]
 ARGS:synth
 ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
@@ -12,3 +121,83 @@ ENV_AWS_PROFILE=<unset>
 ENV_AWS_DEFAULT_PROFILE=<unset>
 ENV_AWS_SESSION_TOKEN=<unset>
 ---
+
+[TestCDKMissingBinary_1]
+---
+
+[TestCDKMissingBinary_2]
+Error: cdk not found in PATH
+  ==> Install CDK CLI: npm install -g aws-cdk
+---
+
+[TestCDKOfflineCommandsNoEmulator_doctor_1]
+ARGS:doctor
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKOfflineCommandsNoEmulator_init_1]
+ARGS:init
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKOfflineCommandsNoEmulator_ls_1]
+ARGS:ls
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKOfflineCommandsNoEmulator_synth_1]
+ARGS:synth
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKOfflineCommandsNoEmulator_version_1]
+ARGS:version
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKPropagatesExitCode_1]
+cdk: simulated failure
+---
+
+[TestCDKVersionTooOld_1]
+---
+
+[TestCDKVersionTooOld_2]
+Error: AWS CDK 2.176.0 is too old; lstk requires 2.177.0 or newer (it points CDK at LocalStack via AWS_ENDPOINT_URL, which older versions ignore)
+  ==> Upgrade CDK CLI: npm install -g aws-cdk@latest
+---
diff --git a/test/integration/__snapshots__/completion_test.snap b/test/integration/__snapshots__/completion_test.snap
new file mode 100644
index 00000000..d0492db0
--- /dev/null
+++ b/test/integration/__snapshots__/completion_test.snap
@@ -0,0 +1,34 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestBashCompletionFallbackYieldsToInstalledPackage_1]
+package version
+---
+
+[TestBashCompletionReassemblesWordbreakSplits_adjacent_pieces_re-join_1]
+cur=--config=./cfg
+prev=lstk
+cword=1
+nwords=2
+---
+
+[TestBashCompletionReassemblesWordbreakSplits_empty_word_after_separator-then-space_1]
+cur=
+prev=--config=
+cword=2
+nwords=3
+---
+
+[TestBashCompletionReassemblesWordbreakSplits_whitespace-surrounded_separator_stays_separate_1]
+cur=./x
+prev==
+cword=3
+nwords=4
+---
+
+[TestBashCompletionReassemblesWordbreakSplits_word_after_separator-then-space_stays_separate_1]
+cur=st
+prev=--config=
+cword=2
+nwords=3
+---
diff --git a/test/integration/__snapshots__/config_test.snap b/test/integration/__snapshots__/config_test.snap
new file mode 100644
index 00000000..c6ef65c0
--- /dev/null
+++ b/test/integration/__snapshots__/config_test.snap
@@ -0,0 +1,22 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestConfigWithInvalidContainerNameFails_1]
+---
+
+[TestConfigWithInvalidContainerNameFails_2]
+Error: failed to get config: invalid container config: invalid container name "my emulator": must start with a letter or digit and use only letters, digits, dots, hyphens, and underscores
+---
+
+[TestConfigWithMissingRequiredPortFails_1]
+Error: failed to get config: invalid container config: port is required for aws emulator
+---
+
+[TestStartWithMultipleContainersFailsFast_1]
+Error: Unsupported configuration
+  found 2 [[containers]] blocks in your config, but only one is supported at a time
+  ==> Edit your config file so only one [[containers]] block is enabled: lstk config path
+---
+
+[TestStartWithMultipleContainersFailsFast_2]
+---
diff --git a/test/integration/__snapshots__/emulator_type_test.snap b/test/integration/__snapshots__/emulator_type_test.snap
new file mode 100644
index 00000000..55c16e55
--- /dev/null
+++ b/test/integration/__snapshots__/emulator_type_test.snap
@@ -0,0 +1,20 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestStartTypeErrorsOnMultipleBlocks_1]
+Error: Unsupported configuration
+  found 2 [[containers]] blocks in your config, but only one is supported at a time
+  ==> Edit your config file so only one [[containers]] block is enabled: lstk config path
+---
+
+[TestStartTypeErrorsWhenNoContainersBlock_1]
+Error: failed to switch emulator type: no [[containers]] block found in config
+---
+
+[TestStartTypeInvalidValue_1]
+Error: invalid emulator type "bogus" (must be one of: aws, snowflake, azure)
+---
+
+[TestStartTypePositionalRejected_1]
+Error: unexpected argument "azure"; select the emulator with --type (e.g. lstk start --type azure)
+---
diff --git a/test/integration/__snapshots__/endpoint_url_https_test.snap b/test/integration/__snapshots__/endpoint_url_https_test.snap
index 4de00929..9978a6d7 100644
--- a/test/integration/__snapshots__/endpoint_url_https_test.snap
+++ b/test/integration/__snapshots__/endpoint_url_https_test.snap
@@ -8,3 +8,7 @@ Fetching LocalStack status...
 • Version: <version>
 > Note: No resources deployed
 ---
+
+[TestStatusEndpointURLHTTPSSchemeMismatchSuggestsHTTP_1]
+Error: could not reach LocalStack emulator at https://127.0.0.1:<port>: Get "https://127.0.0.1:<port>/_localstack/health": http: server gave HTTP response to HTTPS client, but http://127.0.0.1:<port> responded — retry with that URL
+---
diff --git a/test/integration/__snapshots__/endpoint_url_test.snap b/test/integration/__snapshots__/endpoint_url_test.snap
index af5e09e0..c1b7cdfb 100644
--- a/test/integration/__snapshots__/endpoint_url_test.snap
+++ b/test/integration/__snapshots__/endpoint_url_test.snap
@@ -1,6 +1,54 @@
 Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
 this file.
 
+[TestAWSCommandEndpointURLAfterSubcommandPassesThrough_1]
+> Note: No AWS profile found, run 'lstk setup aws'
+ENDPOINT:http://127.0.0.1:<port>
+ARGS:--endpoint-url http://127.0.0.1:<port> s3 ls
+---
+
+[TestAWSCommandEndpointURLNoDockerRequired_1]
+> Note: No AWS profile found, run 'lstk setup aws'
+ENDPOINT:http://127.0.0.1:<port>
+ARGS:s3 ls
+---
+
+[TestCDKAWSEndpointURLBypassesDockerCheck_1]
+ARGS:deploy MyStack
+ENV_AWS_ENDPOINT_URL=http://<host>:<port>
+ENV_AWS_ENDPOINT_URL_S3=http://<host>:<port>
+ENV_AWS_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKAWSEndpointURLWrongTypeFails_1]
+Error: lstk cdk requires the AWS emulator, but the endpoint at http://127.0.0.1:<port> is a LocalStack Azure Emulator emulator
+---
+
+[TestLogsRejectsAmbientEndpointURL_1]
+Error: logs does not support LSTK_ENDPOINT_URL: it operates on a local Docker container or local filesystem state with no remote equivalent (LSTK_ENDPOINT_URL is set)
+---
+
+[TestLogsRejectsExplicitEndpointURL_1]
+Error: logs does not support --endpoint-url: it operates on a local Docker container or local filesystem state with no remote equivalent (--endpoint-url was passed)
+---
+
+[TestRestartRejectsAmbientEndpointURL_1]
+Error: restart does not support AWS_ENDPOINT_URL: it operates on a local Docker container or local filesystem state with no remote equivalent (AWS_ENDPOINT_URL is set)
+---
+
+[TestStartRejectsAmbientEndpointURL_1]
+Error: start does not support LSTK_ENDPOINT_URL: it operates on a local Docker container or local filesystem state with no remote equivalent (LSTK_ENDPOINT_URL is set)
+---
+
+[TestStartRejectsExplicitEndpointURL_1]
+Error: start does not support --endpoint-url: it operates on a local Docker container or local filesystem state with no remote equivalent (--endpoint-url was passed)
+---
+
 [TestStatusEndpointURLRendersReducedOutput_1]
 Fetching LocalStack status...
 ✔︎ LocalStack AWS Emulator is running
@@ -8,3 +56,33 @@ Fetching LocalStack status...
 • Version: <version>
 > Note: No resources deployed
 ---
+
+[TestStatusEndpointURLShowsResources_1]
+Fetching LocalStack status...
+✔︎ LocalStack AWS Emulator is running
+• Endpoint: http://127.0.0.1:<port>
+• Version: <version>
+~ 1 resources · 1 services
+  SERVICE  RESOURCE        REGION     ACCOUNT
+  S3       my-test-bucket  us-east-1  000000000000
+---
+
+[TestStatusUnreachableEndpointURLFailsClosed_1]
+Error: could not reach LocalStack emulator at http://127.0.0.1:<port>: unexpected status 404 from http://127.0.0.1:<port>/_localstack/health
+---
+
+[TestStopRejectsAmbientEndpointURL_1]
+Error: stop does not support LSTK_ENDPOINT_URL: it operates on a local Docker container or local filesystem state with no remote equivalent (LSTK_ENDPOINT_URL is set)
+---
+
+[TestVolumeClearRejectsAmbientEndpointURL_1]
+Error: volume clear does not support LSTK_ENDPOINT_URL: it operates on a local Docker container or local filesystem state with no remote equivalent (LSTK_ENDPOINT_URL is set)
+---
+
+[TestVolumePathRejectsAmbientEndpointURL_1]
+Error: volume path does not support LSTK_ENDPOINT_URL: it operates on a local Docker container or local filesystem state with no remote equivalent (LSTK_ENDPOINT_URL is set)
+---
+
+[TestVolumePathRejectsExplicitEndpointURL_1]
+Error: volume path does not support --endpoint-url: it operates on a local Docker container or local filesystem state with no remote equivalent (--endpoint-url was passed)
+---
diff --git a/test/integration/__snapshots__/exit_code_test.snap b/test/integration/__snapshots__/exit_code_test.snap
new file mode 100644
index 00000000..9dc0ecd7
--- /dev/null
+++ b/test/integration/__snapshots__/exit_code_test.snap
@@ -0,0 +1,140 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestBareParentCommandExitsZero_completion_1]
+Generate the autocompletion script for lstk for the specified shell.
+See each sub-command's help for details on how to use the generated script.
+
+Usage: lstk completion [flags]
+
+Commands:
+  bash        Generate the autocompletion script for bash
+  fish        Generate the autocompletion script for fish
+  powershell  Generate the autocompletion script for powershell
+  zsh         Generate the autocompletion script for zsh
+
+Options:
+  -h, --help   help for completion
+
+Global Options:
+      --config string         Path to config file
+      --endpoint-url string   Target an existing, externally-managed emulator at this URL
+      --json                  Output in JSON format (only supported by some commands)
+      --non-interactive       Disable interactive mode
+---
+
+[TestBareParentCommandExitsZero_config_1]
+Manage configuration
+
+Usage: lstk config [flags]
+
+Commands:
+  path        Print the configuration file path
+
+Options:
+  -h, --help   help for config
+
+Global Options:
+      --config string         Path to config file
+      --endpoint-url string   Target an existing, externally-managed emulator at this URL
+      --json                  Output in JSON format (only supported by some commands)
+      --non-interactive       Disable interactive mode
+---
+
+[TestBareParentCommandExitsZero_setup_1]
+Set up emulator CLI integration for AWS or Azure.
+
+Usage: lstk setup [flags]
+
+Commands:
+  aws         Set up the LocalStack AWS profile
+  azure       Set up Azure CLI integration with LocalStack
+
+Options:
+  -h, --help   help for setup
+
+Global Options:
+      --config string         Path to config file
+      --endpoint-url string   Target an existing, externally-managed emulator at this URL
+      --json                  Output in JSON format (only supported by some commands)
+      --non-interactive       Disable interactive mode
+---
+
+[TestBareParentCommandExitsZero_snapshot_1]
+Manage emulator snapshots
+
+Usage: lstk snapshot [flags]
+
+Commands:
+  list        List Cloud Pod snapshots available on the LocalStack platform
+  load        Load a snapshot into the running emulator
+  remove      Delete a cloud snapshot from the LocalStack platform
+  save        Save a snapshot of the emulator state
+  show        Show metadata for a cloud snapshot
+  versions    List the version history of a cloud snapshot
+
+Options:
+  -h, --help   help for snapshot
+
+Global Options:
+      --config string         Path to config file
+      --endpoint-url string   Target an existing, externally-managed emulator at this URL
+      --json                  Output in JSON format (only supported by some commands)
+      --non-interactive       Disable interactive mode
+---
+
+[TestBareParentCommandExitsZero_volume_1]
+Manage emulator volume
+
+Usage: lstk volume [flags]
+
+Commands:
+  clear       Clear emulator volume data
+  path        Print the volume directory path
+
+Options:
+  -h, --help   help for volume
+
+Global Options:
+      --config string         Path to config file
+      --endpoint-url string   Target an existing, externally-managed emulator at this URL
+      --json                  Output in JSON format (only supported by some commands)
+      --non-interactive       Disable interactive mode
+---
+
+[TestInvalidUsageExitsNonZero_removed_config_profile_subcommand_1]
+Error: unknown command "profile" for "lstk config"
+---
+
+[TestInvalidUsageExitsNonZero_unknown_command_1]
+Error: unknown command "bogus-command" for lstk
+  ==> See help: lstk -h
+---
+
+[TestInvalidUsageExitsNonZero_unknown_completion_shell_1]
+Error: unknown command "bogus" for "lstk completion"
+---
+
+[TestInvalidUsageExitsNonZero_unknown_config_subcommand_1]
+Error: unknown command "bogus" for "lstk config"
+---
+
+[TestInvalidUsageExitsNonZero_unknown_flag_on_root_1]
+Error: unknown flag: --bogus-flag-xyz
+---
+
+[TestInvalidUsageExitsNonZero_unknown_flag_on_start_1]
+Error: unknown flag: --bogus-flag-xyz
+---
+
+[TestInvalidUsageExitsNonZero_unknown_setup_subcommand_1]
+Error: unknown command "bogus" for "lstk setup"
+---
+
+[TestInvalidUsageExitsNonZero_unknown_snapshot_subcommand_1]
+Error: unknown command "bogus" for "lstk snapshot"
+---
+
+[TestInvalidUsageExitsNonZero_unknown_volume_subcommand_1]
+Error: unknown command "bogus" for "lstk volume"
+---
diff --git a/test/integration/__snapshots__/extension_test.snap b/test/integration/__snapshots__/extension_test.snap
index 0aabccc2..f73a86a5 100644
--- a/test/integration/__snapshots__/extension_test.snap
+++ b/test/integration/__snapshots__/extension_test.snap
@@ -1,6 +1,54 @@
 Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
 this file.
 
+[TestExtensionBundledWinsOverPath_1]
+Usage: lstk [options] [command]
+
+LSTK - LocalStack command-line interface
+
+Commands:
+  completion  Generate the autocompletion script for the specified shell
+  config      Manage configuration
+  help        Help about any command
+  load        Load a snapshot into the running emulator
+  login       Manage login
+  logout      Remove stored authentication credentials
+  logs        Show emulator logs
+  reset       Reset emulator state
+  restart     Restart emulator
+  save        Save a snapshot of the emulator state
+  setup       Set up emulator CLI integration
+  snapshot    Manage emulator snapshots
+  start       Start emulator
+  status      Show emulator status and deployed resources
+  stop        Stop emulator
+  update      Update lstk to the latest version
+  volume      Manage emulator volume
+
+Tools:
+  aws         Run AWS CLI commands against LocalStack
+  az          Run Azure CLI commands against LocalStack
+  cdk         Run AWS CDK against LocalStack
+  sam         Run the AWS SAM CLI against LocalStack
+  terraform   Run Terraform against LocalStack
+
+Extensions:
+  deploy
+
+Options:
+      --config string         Path to config file
+      --endpoint-url string   Target an existing, externally-managed emulator at this URL
+  -h, --help                  Show help
+      --json                  Output in JSON format (only supported by some commands)
+      --no-snapshot           Skip auto-loading the configured snapshot for this run
+      --non-interactive       Disable interactive mode
+      --persist               Persist emulator state across restarts
+      --snapshot string       Snapshot REF to load after start (overrides config for this run)
+      --timeout duration      Maximum time to wait for the emulator to become ready (overrides LSTK_STARTUP_TIMEOUT; 0 uses the default)
+  -t, --type string           Emulator type to start (aws, snowflake, azure)
+  -v, --version               Show version
+---
+
 [TestExtensionEndpointOmittedWhenNoRuntime_1]
 ARGS=[]
 SELF=<path>
@@ -61,6 +109,58 @@ Options:
   -v, --version               Show version
 ---
 
+[TestExtensionHelpMissingDescriptionsFileDegrades_1]
+Usage: lstk [options] [command]
+
+LSTK - LocalStack command-line interface
+
+Commands:
+  completion  Generate the autocompletion script for the specified shell
+  config      Manage configuration
+  help        Help about any command
+  load        Load a snapshot into the running emulator
+  login       Manage login
+  logout      Remove stored authentication credentials
+  logs        Show emulator logs
+  reset       Reset emulator state
+  restart     Restart emulator
+  save        Save a snapshot of the emulator state
+  setup       Set up emulator CLI integration
+  snapshot    Manage emulator snapshots
+  start       Start emulator
+  status      Show emulator status and deployed resources
+  stop        Stop emulator
+  update      Update lstk to the latest version
+  volume      Manage emulator volume
+
+Tools:
+  aws         Run AWS CLI commands against LocalStack
+  az          Run Azure CLI commands against LocalStack
+  cdk         Run AWS CDK against LocalStack
+  sam         Run the AWS SAM CLI against LocalStack
+  terraform   Run Terraform against LocalStack
+
+Extensions:
+  deploy
+
+Options:
+      --config string         Path to config file
+      --endpoint-url string   Target an existing, externally-managed emulator at this URL
+  -h, --help                  Show help
+      --json                  Output in JSON format (only supported by some commands)
+      --no-snapshot           Skip auto-loading the configured snapshot for this run
+      --non-interactive       Disable interactive mode
+      --persist               Persist emulator state across restarts
+      --snapshot string       Snapshot REF to load after start (overrides config for this run)
+      --timeout duration      Maximum time to wait for the emulator to become ready (overrides LSTK_STARTUP_TIMEOUT; 0 uses the default)
+  -t, --type string           Emulator type to start (aws, snowflake, azure)
+  -v, --version               Show version
+---
+
+[TestExtensionSelfAuthorizationRefusesWithoutToken_1]
+lstk-ref: not authorized (no auth token conveyed)
+---
+
 [TestExtensionSessionIDOmittedWhenTelemetryDisabled_1]
 ARGS=[exit 7]
 SELF=<path>
@@ -81,3 +181,8 @@ JSON=false
 SESSION_ID=<id>
 EMULATOR_COUNT=0
 ---
+
+[TestExtensionUnknownCommandNoExtensionErrors_1]
+Error: unknown command "nope" for lstk
+  ==> See help: lstk -h
+---
diff --git a/test/integration/__snapshots__/json_envelope_test.snap b/test/integration/__snapshots__/json_envelope_test.snap
index 8b8c6043..bfb20c29 100644
--- a/test/integration/__snapshots__/json_envelope_test.snap
+++ b/test/integration/__snapshots__/json_envelope_test.snap
@@ -17,6 +17,22 @@ this file.
 }
 ---
 
+[TestConfigNotFoundRendersJSONEnvelope_1]
+{
+  "command": "reset",
+  "data": null,
+  "error": {
+    "category": "CONFIG",
+    "code": "CONFIG_NOT_FOUND",
+    "message": "<any>",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+---
+
 [TestNotJSONCapableCommandRendersEnvelope_1]
 {
   "command": "login",
@@ -48,3 +64,7 @@ this file.
   "warnings": []
 }
 ---
+
+[TestUsageErrorBeforeJSONFallsBackToPlainText_1]
+Error: unknown flag: --bogus-flag
+---
diff --git a/test/integration/__snapshots__/json_flag_test.snap b/test/integration/__snapshots__/json_flag_test.snap
index 82457d33..b67eaaf4 100644
--- a/test/integration/__snapshots__/json_flag_test.snap
+++ b/test/integration/__snapshots__/json_flag_test.snap
@@ -12,6 +12,14 @@ SESSION_ID=<id>
 EMULATOR_COUNT=0
 ---
 
+[TestJSONFlagBeforeCommandNameBooleanValues_--json_false_before_the_command_name_is_not_rejected_1]
+Error: aws CLI not found in PATH
+  ==> Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
+---
+
+[TestJSONFlagBeforeCommandNameBooleanValues_--json_false_before_the_command_name_is_not_rejected_2]
+---
+
 [TestJSONFlagBeforeCommandNameBooleanValues_--json_true_before_the_command_name_is_rejected_1]
 {
   "command": "aws",
@@ -49,51 +57,81 @@ Error: aws CLI not found in PATH
   ==> Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
 ---
 
+[TestJSONFlagProxyCommandsForwardJSON_aws_json_after_the_wrapped_tool_s_own_action_2]
+---
+
 [TestJSONFlagProxyCommandsForwardJSON_aws_json_immediately_after_command_name_1]
 Error: aws CLI not found in PATH
   ==> Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
 ---
 
+[TestJSONFlagProxyCommandsForwardJSON_aws_json_immediately_after_command_name_2]
+---
+
 [TestJSONFlagProxyCommandsForwardJSON_az_json_after_the_wrapped_tool_s_own_action_1]
 Error: az CLI not found in PATH
   ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
 ---
 
+[TestJSONFlagProxyCommandsForwardJSON_az_json_after_the_wrapped_tool_s_own_action_2]
+---
+
 [TestJSONFlagProxyCommandsForwardJSON_az_json_immediately_after_command_name_1]
 Error: az CLI not found in PATH
   ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
 ---
 
+[TestJSONFlagProxyCommandsForwardJSON_az_json_immediately_after_command_name_2]
+---
+
 [TestJSONFlagProxyCommandsForwardJSON_cdk_json_after_the_wrapped_tool_s_own_action_1]
 Error: cdk not found in PATH
   ==> Install CDK CLI: npm install -g aws-cdk
 ---
 
+[TestJSONFlagProxyCommandsForwardJSON_cdk_json_after_the_wrapped_tool_s_own_action_2]
+---
+
 [TestJSONFlagProxyCommandsForwardJSON_cdk_json_immediately_after_command_name_1]
 Error: cdk not found in PATH
   ==> Install CDK CLI: npm install -g aws-cdk
 ---
 
+[TestJSONFlagProxyCommandsForwardJSON_cdk_json_immediately_after_command_name_2]
+---
+
 [TestJSONFlagProxyCommandsForwardJSON_sam_json_after_the_wrapped_tool_s_own_action_1]
 Error: sam not found in PATH
   ==> Install AWS SAM CLI: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html
 ---
 
+[TestJSONFlagProxyCommandsForwardJSON_sam_json_after_the_wrapped_tool_s_own_action_2]
+---
+
 [TestJSONFlagProxyCommandsForwardJSON_sam_json_immediately_after_command_name_1]
 Error: sam not found in PATH
   ==> Install AWS SAM CLI: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html
 ---
 
+[TestJSONFlagProxyCommandsForwardJSON_sam_json_immediately_after_command_name_2]
+---
+
 [TestJSONFlagProxyCommandsForwardJSON_terraform_json_after_the_wrapped_tool_s_own_action_1]
 Error: terraform not found in PATH
   ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
 ---
 
+[TestJSONFlagProxyCommandsForwardJSON_terraform_json_after_the_wrapped_tool_s_own_action_2]
+---
+
 [TestJSONFlagProxyCommandsForwardJSON_terraform_json_immediately_after_command_name_1]
 Error: terraform not found in PATH
   ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
 ---
 
+[TestJSONFlagProxyCommandsForwardJSON_terraform_json_immediately_after_command_name_2]
+---
+
 [TestJSONFlagProxyCommandsRejectBeforeCommandName_aws_1]
 {
   "command": "aws",
@@ -173,3 +211,35 @@ Error: terraform not found in PATH
   "warnings": []
 }
 ---
+
+[TestJSONFlagRejectsDefaultStartBehavior_1]
+{
+  "command": "start",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"start\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+---
+
+[TestJSONFlagRejectsUnannotatedBuiltinCommand_1]
+{
+  "command": "status",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"status\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+---
diff --git a/test/integration/__snapshots__/logout_test.snap b/test/integration/__snapshots__/logout_test.snap
new file mode 100644
index 00000000..7fbd965c
--- /dev/null
+++ b/test/integration/__snapshots__/logout_test.snap
@@ -0,0 +1,7 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestLogoutCommandSucceedsWhenNoToken_1]
+Logging out......
+> Note: Not currently logged in
+---
diff --git a/test/integration/__snapshots__/logs_test.snap b/test/integration/__snapshots__/logs_test.snap
new file mode 100644
index 00000000..c4d244c2
--- /dev/null
+++ b/test/integration/__snapshots__/logs_test.snap
@@ -0,0 +1,6 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestLogsTailRejectsInvalidValue_1]
+Error: invalid --tail value "bogus": expected a non-negative integer or "all"
+---
diff --git a/test/integration/__snapshots__/multiple_installs_test.snap b/test/integration/__snapshots__/multiple_installs_test.snap
new file mode 100644
index 00000000..0e873df6
--- /dev/null
+++ b/test/integration/__snapshots__/multiple_installs_test.snap
@@ -0,0 +1,10 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestUpdateCheckDoesNotWarnOnSingleInstall_1]
+> Note: Running a development build, skipping update check
+---
+
+[TestUpdateCheckDoesNotWarnOnSymlinkedAliases_1]
+> Note: Running a development build, skipping update check
+---
diff --git a/test/integration/__snapshots__/sam_cmd_test.snap b/test/integration/__snapshots__/sam_cmd_test.snap
index fd758331..e3d0cc39 100644
--- a/test/integration/__snapshots__/sam_cmd_test.snap
+++ b/test/integration/__snapshots__/sam_cmd_test.snap
@@ -1,6 +1,134 @@
 Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
 this file.
 
+[TestSAMAccountSupported_1]
+ARGS:build
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-east-1
+ENV_AWS_DEFAULT_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=123456789012
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMDoesNotInjectAmbientRegion_1]
+ARGS:deploy
+ENV_AWS_ENDPOINT_URL=http://<host>:<port>
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=eu-west-1
+ENV_AWS_DEFAULT_REGION=eu-west-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMDoesNotInjectRegionForOfflineSubcommand_1]
+ARGS:build
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=ap-northeast-1
+ENV_AWS_DEFAULT_REGION=ap-northeast-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMDoesNotInjectRegionWhenNotSelected_1]
+ARGS:deploy
+ENV_AWS_ENDPOINT_URL=http://<host>:<port>
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-east-1
+ENV_AWS_DEFAULT_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMFlagBeforeSubcommandRejected_1]
+---
+
+[TestSAMFlagBeforeSubcommandRejected_2]
+Error: --region and --account must appear after the sam subcommand (e.g. `lstk sam --region us-west-2 ...`)
+---
+
+[TestSAMFlagsAfterActionAreForwarded_1]
+ARGS:build --region us-west-2
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-east-1
+ENV_AWS_DEFAULT_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMForwardsArgs_1]
+ARGS:build
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-east-1
+ENV_AWS_DEFAULT_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMHelpNoEmulator_--help_1]
+ARGS:--help
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-east-1
+ENV_AWS_DEFAULT_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMHelpNoEmulator_-h_1]
+ARGS:-h
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-east-1
+ENV_AWS_DEFAULT_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMHelpNoEmulator_deploy_--help_1]
+ARGS:deploy --help
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-east-1
+ENV_AWS_DEFAULT_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMHonorsLstkSamCmd_1]
+MYSAM:build
+---
+
 [TestSAMInjectsCleanAWSEnv_1]
 ARGS:build
 ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
@@ -13,3 +141,121 @@ ENV_AWS_PROFILE=<unset>
 ENV_AWS_DEFAULT_PROFILE=<unset>
 ENV_AWS_SESSION_TOKEN=<unset>
 ---
+
+[TestSAMInvalidAccountRejected_1]
+---
+
+[TestSAMInvalidAccountRejected_2]
+Error: --account must be a 12-digit AWS account id, got "12345"
+---
+
+[TestSAMLeavesUserSuppliedRegionFlagAlone_1]
+ARGS:deploy --region us-west-1
+ENV_AWS_ENDPOINT_URL=http://<host>:<port>
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=ap-northeast-1
+ENV_AWS_DEFAULT_REGION=ap-northeast-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMMissingBinary_1]
+---
+
+[TestSAMMissingBinary_2]
+Error: sam not found in PATH
+  ==> Install AWS SAM CLI: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html
+---
+
+[TestSAMOfflineCommandsNoEmulator_build_1]
+ARGS:build
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-west-2
+ENV_AWS_DEFAULT_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMOfflineCommandsNoEmulator_docs_1]
+ARGS:docs
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-west-2
+ENV_AWS_DEFAULT_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMOfflineCommandsNoEmulator_init_1]
+ARGS:init
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-west-2
+ENV_AWS_DEFAULT_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMOfflineCommandsNoEmulator_pipeline_1]
+ARGS:pipeline
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-west-2
+ENV_AWS_DEFAULT_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMOfflineCommandsNoEmulator_validate_1]
+ARGS:validate
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-west-2
+ENV_AWS_DEFAULT_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMPropagatesExitCode_1]
+sam: simulated failure
+---
+
+[TestSAMPutsSelectedRegionOnTheCommandLine_1]
+ARGS:deploy --region ap-northeast-1
+ENV_AWS_ENDPOINT_URL=http://<host>:<port>
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=ap-northeast-1
+ENV_AWS_DEFAULT_REGION=ap-northeast-1
+ENV_AWS_ACCESS_KEY_ID=121212122323
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMVersionTooOld_1]
+---
+
+[TestSAMVersionTooOld_2]
+Error: AWS SAM CLI 1.94.0 is too old; lstk requires 1.95.0 or newer (it points SAM at LocalStack via AWS_ENDPOINT_URL, which older versions ignore)
+  ==> Upgrade AWS SAM CLI: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html
+---
diff --git a/test/integration/__snapshots__/setup_azure_test.snap b/test/integration/__snapshots__/setup_azure_test.snap
new file mode 100644
index 00000000..52482b23
--- /dev/null
+++ b/test/integration/__snapshots__/setup_azure_test.snap
@@ -0,0 +1,22 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestAzCommandErrorsWhenNotSetUp_1]
+Error: Azure CLI integration is not set up
+  ==> Set it up: lstk setup azure
+---
+
+[TestSetupAzureAliasAz_1]
+Error: no azure emulator configured — run 'lstk start' and select the Azure emulator first
+---
+
+[TestSetupAzureNonInteractiveRunsWithoutTerminal_1]
+Error: no azure emulator configured — run 'lstk start' and select the Azure emulator first
+---
+
+[TestSetupAzureReportsMissingAzCLIOnce_1]
+Error: az CLI not found in PATH — install it from https://learn.microsoft.com/en-us/cli/azure/
+---
+
+[TestSetupAzureReportsMissingAzCLIOnce_2]
+---
diff --git a/test/integration/__snapshots__/snapshot_list_test.snap b/test/integration/__snapshots__/snapshot_list_test.snap
index 3759edab..08337920 100644
--- a/test/integration/__snapshots__/snapshot_list_test.snap
+++ b/test/integration/__snapshots__/snapshot_list_test.snap
@@ -1,6 +1,29 @@
 Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
 this file.
 
+[TestSnapshotListAllFlag_1]
+Fetching snapshots...
+~ 1 snapshot
+
+  NAME     VERSION  LAST CHANGED
+  org-pod  1        -
+---
+
+[TestSnapshotListEmpty_1]
+Fetching snapshots...
+> Note: No snapshots found
+---
+
+[TestSnapshotListRequiresAuthToken_1]
+Error: Authentication required to list snapshots
+  ==> Log in: lstk login
+  ==> Or set a token: export LOCALSTACK_AUTH_TOKEN=<token>
+---
+
+[TestSnapshotListServerError_1]
+Error: list snapshots: failed to list cloud pods: status 500: internal error
+---
+
 [TestSnapshotListSuccessWithoutDocker_1]
 Fetching snapshots...
 ~ 2 snapshots
diff --git a/test/integration/__snapshots__/snapshot_load_test.snap b/test/integration/__snapshots__/snapshot_load_test.snap
new file mode 100644
index 00000000..f61e426f
--- /dev/null
+++ b/test/integration/__snapshots__/snapshot_load_test.snap
@@ -0,0 +1,34 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestSnapshotLoadDryRunOnLocalRef_1]
+Error: --dry-run is only supported for pod refs — use the "pod:" prefix (e.g. pod:my-baseline --dry-run)
+---
+
+[TestSnapshotLoadDryRunPodNoAuthToken_1]
+Error: pod snapshots require authentication — set LOCALSTACK_AUTH_TOKEN or run "lstk login"
+---
+
+[TestSnapshotLoadPodInvalidName_pod__1]
+Error: invalid pod name "": must not be empty
+---
+
+[TestSnapshotLoadPodInvalidName_pod_bad.name_1]
+Error: invalid pod name "bad.name": use letters, digits, hyphens, and underscores only
+---
+
+[TestSnapshotLoadPodInvalidName_pod_my_pod_1]
+Error: invalid pod name "my pod": use letters, digits, hyphens, and underscores only
+---
+
+[TestSnapshotLoadPodNoAuthToken_1]
+Error: pod snapshots require authentication — set LOCALSTACK_AUTH_TOKEN or run "lstk login"
+---
+
+[TestSnapshotLoadRemoteRejected_oras_registry_image_1]
+Error: remote destinations are not yet supported — coming soon
+---
+
+[TestSnapshotLoadS3RequiresPodName_1]
+Error: a pod name is required to load from S3: lstk snapshot load <pod-name> s3://bucket/key
+---
diff --git a/test/integration/__snapshots__/snapshot_load_version_test.snap b/test/integration/__snapshots__/snapshot_load_version_test.snap
new file mode 100644
index 00000000..bf1f6cbc
--- /dev/null
+++ b/test/integration/__snapshots__/snapshot_load_version_test.snap
@@ -0,0 +1,62 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestSnapshotLoadPodVersionDryRun_1]
+Checking diff for pod "my-baseline" (version 3)......
+Dry-run results for pod:my-baseline:3
+
+  s3  + 1 addition
+
+✔︎ No state was modified.
+---
+
+[TestSnapshotLoadPodVersionNotFound_1]
+Loading snapshot from pod "my-baseline" (version 99)......
+Error: Could not load snapshot
+  Unable to load pod my-baseline with version 99. The maximum version available in the remote storage is 3
+  ==> List available versions: lstk snapshot versions pod:my-baseline
+---
+
+[TestSnapshotLoadPodVersionReachesWire_1]
+Loading snapshot from pod "my-baseline" (version 3)......
+✔︎ Snapshot loaded from pod:my-baseline:3
+• Services: s3
+---
+
+[TestSnapshotLoadPodWithoutVersionOmitsParam_1]
+Loading snapshot from pod "my-baseline"......
+✔︎ Snapshot loaded from pod:my-baseline
+• Services: s3
+---
+
+[TestSnapshotLoadRejectsMalformedVersion_pod_my-baseline_0_1]
+Error: invalid version "0" in "pod:my-baseline:0": use a positive integer
+---
+
+[TestSnapshotLoadRejectsMalformedVersion_pod_my-baseline__1]
+Error: invalid version "" in "pod:my-baseline:": use a positive integer
+---
+
+[TestSnapshotLoadRejectsMalformedVersion_pod_my-baseline_abc_1]
+Error: invalid version "abc" in "pod:my-baseline:abc": use a positive integer
+---
+
+[TestSnapshotLoadS3RejectsPodVersion_1]
+Error: a specific snapshot version is not supported here: "my-pod:3" — S3 remotes do not support snapshot versions
+---
+
+[TestSnapshotRemoveRejectsPodVersion_1]
+Error: a specific snapshot version is not supported here: drop the ':3' from "pod:my-baseline:3"
+---
+
+[TestSnapshotSaveRejectsPodVersion_pod_destination_1]
+Error: a specific snapshot version is not supported here: 'pod:my-baseline:3' — the platform assigns the version on each save; use 'pod:my-baseline'
+---
+
+[TestSnapshotSaveRejectsPodVersion_s3_remote_1]
+Error: a specific snapshot version is not supported here: "my-pod:3" — S3 remotes do not support snapshot versions
+---
+
+[TestStartSnapshotFlagAcceptsPodVersion_1]
+Error: invalid version "abc" in "pod:my-baseline:abc": use a positive integer
+---
diff --git a/test/integration/__snapshots__/snapshot_remove_test.snap b/test/integration/__snapshots__/snapshot_remove_test.snap
new file mode 100644
index 00000000..db28d949
--- /dev/null
+++ b/test/integration/__snapshots__/snapshot_remove_test.snap
@@ -0,0 +1,38 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestSnapshotRemoteSchemeRejected_oras_registry_snap_1]
+Error: remote destinations are not yet supported — coming soon
+---
+
+[TestSnapshotRemoteSchemeRejected_s3_bucket_snap_1]
+Error: remote destinations are not yet supported — coming soon
+---
+
+[TestSnapshotRemoveLocalBareNameRejected_1]
+Error: 'my-baseline' resolves to a local file (./my-baseline.snapshot); CLI cannot delete local files
+---
+
+[TestSnapshotRemoveLocalRefRejected_1]
+Error: './my-baseline.zip' resolves to a local file (./my-baseline.snapshot); CLI cannot delete local files
+---
+
+[TestSnapshotRemoveNonInteractiveRequiresForce_1]
+Error: snapshot remove requires confirmation; use --force to skip in non-interactive mode
+---
+
+[TestSnapshotRemovePodInvalidName_pod__1]
+Error: invalid pod name "": must not be empty
+---
+
+[TestSnapshotRemovePodInvalidName_pod_bad.name_1]
+Error: invalid pod name "bad.name": use letters, digits, hyphens, and underscores only
+---
+
+[TestSnapshotRemovePodInvalidName_pod_my_pod_1]
+Error: invalid pod name "my pod": use letters, digits, hyphens, and underscores only
+---
+
+[TestSnapshotRemovePodNoAuthToken_1]
+Error: pod snapshots require authentication — set LOCALSTACK_AUTH_TOKEN or run "lstk login"
+---
diff --git a/test/integration/__snapshots__/snapshot_save_test.snap b/test/integration/__snapshots__/snapshot_save_test.snap
new file mode 100644
index 00000000..195c301e
--- /dev/null
+++ b/test/integration/__snapshots__/snapshot_save_test.snap
@@ -0,0 +1,42 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestSnapshotSavePodInvalidName_pod__1]
+Error: invalid pod name "": must not be empty
+---
+
+[TestSnapshotSavePodInvalidName_pod_bad.name_1]
+Error: invalid pod name "bad.name": use letters, digits, hyphens, and underscores only
+---
+
+[TestSnapshotSavePodInvalidName_pod_my_pod_1]
+Error: invalid pod name "my pod": use letters, digits, hyphens, and underscores only
+---
+
+[TestSnapshotSavePodNoAuthToken_1]
+Error: pod snapshots require authentication — set LOCALSTACK_AUTH_TOKEN or run "lstk login"
+---
+
+[TestSnapshotSavePodServicesInvalidFormat_____1]
+Error: must be a comma-separated list of service names (letters, digits, hyphens, underscores)
+---
+
+[TestSnapshotSavePodServicesInvalidFormat_s3__1]
+Error: must be a comma-separated list of service names (letters, digits, hyphens, underscores)
+---
+
+[TestSnapshotSavePodServicesInvalidFormat_s3_lambda_1]
+Error: must be a comma-separated list of service names (letters, digits, hyphens, underscores)
+---
+
+[TestSnapshotSaveRemoteRejected_oras_registry_my-snap_1]
+Error: remote destinations are not yet supported — coming soon
+---
+
+[TestSnapshotSaveS3CredentialsInURLRejected_1]
+Error: do not put credentials in the s3:// URL; use AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or --profile
+---
+
+[TestSnapshotSaveS3MissingCredentials_1]
+Error: AWS credentials required for S3 snapshots: set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, set AWS_PROFILE, or pass --profile <name>
+---
diff --git a/test/integration/__snapshots__/snapshot_show_test.snap b/test/integration/__snapshots__/snapshot_show_test.snap
index c41b87ba..5bf1ed24 100644
--- a/test/integration/__snapshots__/snapshot_show_test.snap
+++ b/test/integration/__snapshots__/snapshot_show_test.snap
@@ -1,6 +1,26 @@
 Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
 this file.
 
+[TestSnapshotShowNotFound_1]
+Fetching snapshot...
+Error: Snapshot 'pod:missing' not found
+  ==> List your snapshots: lstk snapshot list
+---
+
+[TestSnapshotShowRejectsLocalPath_1]
+Error: './my-snapshot' resolves to a local file (./my-snapshot.snapshot); CLI cannot show local snapshots
+---
+
+[TestSnapshotShowRejectsPodNameWithPeriod_1]
+Error: invalid pod name "release.v1": use letters, digits, hyphens, and underscores only
+---
+
+[TestSnapshotShowRequiresAuthToken_1]
+Error: Authentication required to show snapshots
+  ==> Log in: lstk login
+  ==> Or set a token: export LOCALSTACK_AUTH_TOKEN=<token>
+---
+
 [TestSnapshotShowSuccessWithoutDocker_1]
 Fetching snapshot...
 Name            my-baseline
@@ -16,3 +36,13 @@ Resources
   lambda        1 function
   s3            3 buckets
 ---
+
+[TestSnapshotShowWithoutResources_1]
+Fetching snapshot...
+Name            bare
+Version         1
+Size            <size>
+LocalStack      <calv> 
+
+Services        s3, sqs
+---
diff --git a/test/integration/__snapshots__/snapshot_versions_test.snap b/test/integration/__snapshots__/snapshot_versions_test.snap
index fa5499c4..e0d6fac7 100644
--- a/test/integration/__snapshots__/snapshot_versions_test.snap
+++ b/test/integration/__snapshots__/snapshot_versions_test.snap
@@ -20,6 +20,11 @@ Error: Version 99 of 'pod:my-baseline' not found
   ==> List available versions: lstk snapshot versions pod:my-baseline
 ---
 
+[TestSnapshotVersionsEmptyHistory_1]
+Fetching versions...
+> Note: No versions found for 'pod:blank'
+---
+
 [TestSnapshotVersionsFiltersDeletedVersions_1]
 Fetching versions...
 ~ 2 versions
@@ -29,10 +34,56 @@ Fetching versions...
   1        -        keep-one    -
 ---
 
+[TestSnapshotVersionsNoDockerRequired_1]
+Fetching versions...
+~ 3 versions
+
+  VERSION  CREATED               LOCALSTACK  SERVICES
+  3        <date>                <calv>      s3, lambda
+  2        <date>                <calv>      s3
+  1        <date>                <calv>      -
+---
+
+[TestSnapshotVersionsNotFound_1]
+Fetching versions...
+Error: Snapshot 'pod:missing' not found
+  ==> List your snapshots: lstk snapshot list
+---
+
+[TestSnapshotVersionsOrasKeepsComingSoon_1]
+Error: remote destinations are not yet supported — coming soon
+---
+
+[TestSnapshotVersionsRejectsInvalidPodName_1]
+Error: invalid pod name "release.v1": use letters, digits, hyphens, and underscores only
+---
+
+[TestSnapshotVersionsRejectsLocalPath_1]
+Error: './my-snapshot' resolves to a local file (./my-snapshot.snapshot); CLI cannot list versions of local snapshots
+---
+
 [TestSnapshotVersionsRejectsS3Ref_1]
 Error: snapshot versions is only supported for Cloud Pods (pod: refs), not S3 remotes
 ---
 
+[TestSnapshotVersionsRejectsVersionSuffix_1]
+Error: a specific snapshot version is not supported here: drop the ':3' from "pod:my-baseline:3"
+---
+
+[TestSnapshotVersionsRequiresAuthToken_1]
+Error: Authentication required to list snapshot versions
+  ==> Log in: lstk login
+  ==> Or set a token: export LOCALSTACK_AUTH_TOKEN=<token>
+---
+
+[TestSnapshotVersionsSingleVersionUsesSingularNoun_1]
+Fetching versions...
+~ 1 version
+
+  VERSION  CREATED  LOCALSTACK  SERVICES
+  1        -        -           -
+---
+
 [TestSnapshotVersionsSuccessWithoutDocker_1]
 Fetching versions...
 ~ 3 versions
diff --git a/test/integration/__snapshots__/start_snapshot_test.snap b/test/integration/__snapshots__/start_snapshot_test.snap
new file mode 100644
index 00000000..9343227a
--- /dev/null
+++ b/test/integration/__snapshots__/start_snapshot_test.snap
@@ -0,0 +1,10 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestStartSnapshotConflictingFlags_1]
+Error: --snapshot and --no-snapshot cannot be used together
+---
+
+[TestStartSnapshotInvalidPodName_1]
+Error: invalid pod name "bad.name": use letters, digits, hyphens, and underscores only
+---
diff --git a/test/integration/__snapshots__/start_test.snap b/test/integration/__snapshots__/start_test.snap
new file mode 100644
index 00000000..1d9b5434
--- /dev/null
+++ b/test/integration/__snapshots__/start_test.snap
@@ -0,0 +1,6 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestStartCommandRejectsInvalidExposePorts_1]
+Error: failed to get config: invalid container config: invalid expose_ports entry "53/sctp": protocol must be "tcp" or "udp"
+---
diff --git a/test/integration/__snapshots__/terraform_cmd_test.snap b/test/integration/__snapshots__/terraform_cmd_test.snap
index 1826a508..ef7e3f06 100644
--- a/test/integration/__snapshots__/terraform_cmd_test.snap
+++ b/test/integration/__snapshots__/terraform_cmd_test.snap
@@ -1,6 +1,10 @@
 Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
 this file.
 
+[TestTerraformAliasTF_1]
+ARGS:version
+---
+
 [TestTerraformDryRunGeneratesOverride_1]
 # Generated by lstk - do not edit. This file is removed automatically.
 
@@ -20,8 +24,79 @@ provider "aws" {
 
 ---
 
+[TestTerraformFlagBeforeSubcommandRejected_1]
+---
+
+[TestTerraformFlagBeforeSubcommandRejected_2]
+Error: --region and --account must appear after the terraform subcommand (e.g. `lstk terraform --region us-west-2 ...`)
+---
+
+[TestTerraformFlagsAfterActionAreForwarded_1]
+ARGS:version --region us-west-2
+---
+
+[TestTerraformForwardsArgs_1]
+ARGS:version
+---
+
+[TestTerraformHelpSkipsOverride_--help_1]
+ARGS:--help
+---
+
+[TestTerraformHelpSkipsOverride_-h_1]
+ARGS:-h
+---
+
+[TestTerraformHelpSkipsOverride_-help_1]
+ARGS:-help
+---
+
+[TestTerraformHelpSkipsOverride_plan_--help_1]
+ARGS:plan --help
+---
+
+[TestTerraformHonorsLstkTfCmd_1]
+TOFU:version
+---
+
+[TestTerraformInvalidAccountRejected_1]
+---
+
+[TestTerraformInvalidAccountRejected_2]
+Error: --account must be a 12-digit AWS account id, got "12345"
+---
+
 [TestTerraformMissingBinary_1]
+---
 
+[TestTerraformMissingBinary_2]
 Error: terraform not found in PATH
   ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
 ---
+
+[TestTerraformMissingFlagValue_1]
+---
+
+[TestTerraformMissingFlagValue_2]
+Error: --region requires a value
+---
+
+[TestTerraformPropagatesExitCode_1]
+terraform: simulated failure
+---
+
+[TestTerraformUnproxiedSkipsOverride_fmt_1]
+ARGS:fmt
+---
+
+[TestTerraformUnproxiedSkipsOverride_init_1]
+ARGS:init
+---
+
+[TestTerraformUnproxiedSkipsOverride_validate_1]
+ARGS:validate
+---
+
+[TestTerraformUnproxiedSkipsOverride_version_1]
+ARGS:version
+---
diff --git a/test/integration/__snapshots__/update_test.snap b/test/integration/__snapshots__/update_test.snap
index 1704e602..53712e37 100644
--- a/test/integration/__snapshots__/update_test.snap
+++ b/test/integration/__snapshots__/update_test.snap
@@ -1,9 +1,21 @@
 Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
 this file.
 
+[TestUpdateBinaryMockGitHubChecksumMismatch_1]
+lstk 0.0.1
+---
+
 [TestUpdateBinaryMockGitHubHappyPath_1]
 Checking for updates...
 Update available: 0.0.1 → v0.0.2
 Downloading and verifying update...
 ✔︎ Updated to v0.0.2
 ---
+
+[TestUpdateBinaryMockGitHubHappyPath_2]
+lstk 0.0.2
+---
+
+[TestUpdateBinaryMockGitHubMissingChecksums_1]
+lstk 0.0.1
+---
diff --git a/test/integration/__snapshots__/volume_test.snap b/test/integration/__snapshots__/volume_test.snap
new file mode 100644
index 00000000..58b43129
--- /dev/null
+++ b/test/integration/__snapshots__/volume_test.snap
@@ -0,0 +1,10 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestVolumeClearCommand_fails_without_force_in_non-interactive_mode_1]
+Error: volume clear requires confirmation; use --force to skip in non-interactive mode
+---
+
+[TestVolumeClearCommand_filters_by_emulator_type_1]
+Error: emulator type "snowflake" not found in config; available: [aws]
+---
diff --git a/test/integration/aws_cmd_test.go b/test/integration/aws_cmd_test.go
index e7cd0208..08d58fdb 100644
--- a/test/integration/aws_cmd_test.go
+++ b/test/integration/aws_cmd_test.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
 	"github.com/stretchr/testify/assert"
@@ -375,9 +376,8 @@ func TestAWSCommandRejectsInvalidAccount(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "--account", "12345", "s3", "ls")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "12-digit AWS account id")
-	// The AWS CLI must not have run.
-	assert.NotContains(t, stdout, "ARGS:")
+	// The AWS CLI must not have run, so the snapshot carries no ARGS: line.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.5 (missing value)
@@ -389,8 +389,7 @@ func TestAWSCommandRejectsAccountWithoutValue(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "--account")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "--account requires a value")
-	assert.NotContains(t, stdout, "ARGS:")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.6 — a flag before the `aws` token would be eaten during Cobra's command
@@ -403,8 +402,7 @@ func TestAWSCommandRejectsPreSubcommandAccount(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "--account", "111111111111", "aws", "s3", "ls")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "must appear after the aws subcommand")
-	assert.NotContains(t, stdout, "ARGS:")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // The leading flag is consumed before the help short-circuit, so help still
@@ -427,9 +425,7 @@ func TestAWSCommandFailsWhenAWSCLINotInstalled(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "s3", "ls")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "aws CLI not found in PATH")
-	assert.Contains(t, stdout, "Install AWS CLI:")
-	assert.Contains(t, stdout, "https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestAWSCommandUsesDefaultPortWithoutConfig(t *testing.T) {
@@ -525,8 +521,7 @@ func TestAWSCommandHelpSkipsDockerAndEmulator(t *testing.T) {
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, cmdArgs...)
 			require.NoError(t, err, "stderr: %s", stderr)
 
-			assert.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
-			assert.NotContains(t, stdout, "--endpoint-url")
+			snap.Match(t, sanitizeOutput(stdout))
 		})
 	}
 }
diff --git a/test/integration/aws_completion_test.go b/test/integration/aws_completion_test.go
index c9e580f7..26f3ee4f 100644
--- a/test/integration/aws_completion_test.go
+++ b/test/integration/aws_completion_test.go
@@ -7,6 +7,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 )
 
@@ -37,12 +38,7 @@ func TestAWSCompletionDelegatesToAWSCompleter(t *testing.T) {
 
 	// The completer strips the first word of COMP_LINE and resolves the rest
 	// against the aws command tree, so lstk's own name must not be in it.
-	assert.Contains(t, stdout, "compline=[aws s3 l]")
-	assert.NotContains(t, stdout, "compline=[lstk")
-
-	completions := strings.Fields(stdout)
-	assert.Contains(t, completions, "ls")
-	assert.Contains(t, completions, "list-buckets")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestAWSCompletionAppendsTrailingSpaceForNewWord verifies the cursor position
@@ -57,7 +53,7 @@ func TestAWSCompletionAppendsTrailingSpaceForNewWord(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "__complete", "aws", "s3", "")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "compline=[aws s3 ]")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestAWSCompletionStripsGlobalFlags keeps lstk's own persistent flags out of
@@ -73,7 +69,7 @@ func TestAWSCompletionStripsGlobalFlags(t *testing.T) {
 		"__complete", "aws", "--non-interactive", "s3", "l")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "compline=[aws s3 l]")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestAWSCompletionNeedsNoDockerOrEmulator guards the property that makes this
@@ -91,8 +87,7 @@ func TestAWSCompletionNeedsNoDockerOrEmulator(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "__complete", "aws", "s3", "l")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "ls")
-	assert.NotContains(t, stdout, "Docker is not available")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestAWSCompletionDegradesWhenCompleterMissing verifies a machine without
@@ -108,7 +103,7 @@ func TestAWSCompletionDegradesWhenCompleterMissing(t *testing.T) {
 
 	// ShellCompDirectiveDefault (0) — hand the word back to the shell's own
 	// file completion rather than offering nothing at all.
-	assert.Equal(t, ":0", strings.TrimSpace(stdout))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestBashCompletionForAWSSubcommand drives the real generated bash script the
diff --git a/test/integration/awsconfig_test.go b/test/integration/awsconfig_test.go
index bcf50ae4..ee0d1a46 100644
--- a/test/integration/awsconfig_test.go
+++ b/test/integration/awsconfig_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -252,8 +253,7 @@ func TestSetupAWSNonInteractiveCreatesProfile(t *testing.T) {
 		"setup", "aws",
 	)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "Created LocalStack profile in ~/.aws")
-	assert.NotContains(t, stdout, "requires an interactive terminal")
+	snap.Match(t, sanitizeOutput(stdout))
 
 	configContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "config"))
 	require.NoError(t, err, "~/.aws/config should have been created")
@@ -280,7 +280,7 @@ func TestSetupAWSNonInteractiveIsIdempotent(t *testing.T) {
 	// not be treated as an overwrite (no --force required).
 	stdout, _, err := runLstk(t, testContext(t), "", baseEnv, "setup", "aws")
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "already configured")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSetupAWSNonInteractiveOverwriteRequiresForce(t *testing.T) {
@@ -297,7 +297,7 @@ func TestSetupAWSNonInteractiveOverwriteRequiresForce(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), "", baseEnv, "setup", "aws")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "--force")
+	snap.Match(t, sanitizeOutput(stdout))
 
 	// The existing profile must be left untouched.
 	configContent, err := os.ReadFile(filepath.Join(awsDir, "config"))
diff --git a/test/integration/az_cmd_test.go b/test/integration/az_cmd_test.go
index 177bc6c3..b769016c 100644
--- a/test/integration/az_cmd_test.go
+++ b/test/integration/az_cmd_test.go
@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -22,9 +23,7 @@ func TestAzCommandFailsWhenAzureCLINotInstalled(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), workDir, e, "az", "group", "list")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "az CLI not found in PATH")
-	assert.Contains(t, stdout, "Install Azure CLI:")
-	assert.Contains(t, stdout, "https://learn.microsoft.com/en-us/cli/azure/")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // azureHealthServer answers like an Azure-flavored emulator: /_localstack/health
@@ -119,9 +118,7 @@ func TestAzCommandStripsGlobalFlagsFromPassthrough(t *testing.T) {
 		"--endpoint-url", srv.URL, "--config", configPath, "--non-interactive", "az", "group", "list")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "AZ_ARGS:group list")
-	assert.NotContains(t, stdout, "--non-interactive")
-	assert.NotContains(t, stdout, "--config")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // --config must select the given config file for `lstk az` too: the Azure setup
@@ -137,12 +134,12 @@ func TestAzCommandConfigFlagSelectsConfigFile(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "--config", configPath, "az", "group", "list")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "AZ_ARGS:group list")
+	snap.Match(t, sanitizeOutput(stdout))
 
 	stdout, _, err = runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "az", "group", "list")
 	require.Error(t, err, "without --config the azure setup marker must not be found")
-	assert.Contains(t, stdout, "Azure CLI integration is not set up")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestAzCommandShowsSpinnerForSlowOperation(t *testing.T) {
diff --git a/test/integration/az_interception_test.go b/test/integration/az_interception_test.go
index f9224ded..b70a446e 100644
--- a/test/integration/az_interception_test.go
+++ b/test/integration/az_interception_test.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -43,8 +44,7 @@ func TestAzStartInterceptionRoutesToSubcommand(t *testing.T) {
 		"az", "start-interception",
 	)
 	require.Error(t, err)
-	assert.Contains(t, stdout, "az CLI not found in PATH")
-	assert.NotContains(t, stdout, "not set up")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // stop-interception is a safe no-op when LocalStack is not the active cloud — e.g.
@@ -62,7 +62,7 @@ func TestAzStopInterceptionNoOpWhenNotIntercepting(t *testing.T) {
 		"az", "stop-interception",
 	)
 	require.NoError(t, err, "stop-interception must not fail when LocalStack is not active")
-	assert.Contains(t, stdout, "not the active Azure cloud")
+	snap.Match(t, sanitizeOutput(stdout))
 
 	// It must not have switched the active cloud to anything.
 	active, azErr := runAzRaw(t, testContext(t), env.WithHome(home), "cloud", "show", "--query", "name", "-o", "tsv")
@@ -79,8 +79,7 @@ func TestAzStopInterceptionFailsWhenAzureCLINotInstalled(t *testing.T) {
 		"az", "stop-interception",
 	)
 	require.Error(t, err)
-	assert.Contains(t, stdout, "az CLI not found in PATH")
-	assert.Contains(t, stdout, "Install Azure CLI:")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestAzInterception exercises the full start/stop-interception lifecycle against a real
diff --git a/test/integration/az_pty_test.go b/test/integration/az_pty_test.go
index 2a000933..6329a5b3 100644
--- a/test/integration/az_pty_test.go
+++ b/test/integration/az_pty_test.go
@@ -13,6 +13,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -153,6 +154,5 @@ func TestAzWithPipedStdoutKeepsPipe(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), workDir, e, "--endpoint-url", srv.URL, "az", "group", "list")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "STDOUT_TTY:no")
-	assert.Contains(t, stdout, "piped")
+	snap.Match(t, sanitizeOutput(stdout))
 }
diff --git a/test/integration/cdk_cmd_test.go b/test/integration/cdk_cmd_test.go
index c229c5fa..836cc4f2 100644
--- a/test/integration/cdk_cmd_test.go
+++ b/test/integration/cdk_cmd_test.go
@@ -50,7 +50,7 @@ func TestCDKForwardsArgs(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:synth")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.1 — propagates the cdk exit code.
@@ -61,7 +61,7 @@ func TestCDKPropagatesExitCode(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
 	require.Error(t, err)
-	assert.Contains(t, stderr, "simulated failure")
+	snap.Match(t, sanitizeOutput(stderr))
 	requireExitCode(t, 7, err)
 }
 
@@ -105,8 +105,9 @@ func TestCDKOfflineCommandsNoEmulator(t *testing.T) {
 				"cdk", "--region", "us-west-2", sub)
 			require.NoError(t, err, "stderr: %s", stderr)
 
-			assert.Contains(t, stdout, "ARGS:"+sub)
-			assert.NotContains(t, stdout, "--region")
+			// The snapshot pins the forwarded args: the leading --region must
+			// be stripped, not forwarded to cdk.
+			snap.Match(t, sanitizeOutput(stdout))
 		})
 	}
 }
@@ -126,7 +127,7 @@ func TestCDKHelpNoEmulator(t *testing.T) {
 			cmdArgs := append([]string{"cdk"}, args...)
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, cmdArgs...)
 			require.NoError(t, err, "stderr: %s", stderr)
-			assert.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
+			snap.Match(t, sanitizeOutput(stdout))
 		})
 	}
 }
@@ -139,9 +140,10 @@ func TestCDKVersionTooOld(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "2.177.0")
-	// cdk was never run for real.
-	assert.NotContains(t, stdout, "ARGS:synth")
+	// The snapshots pin the full version error; cdk was never run for real
+	// (no ARGS line in either stream).
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.5 — a missing cdk binary yields the install error.
@@ -151,7 +153,8 @@ func TestCDKMissingBinary(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "not found in PATH")
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.6 — --account is not supported for cdk and is rejected at the command
@@ -168,8 +171,9 @@ func TestCDKAccountRejected(t *testing.T) {
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 				"cdk", "--account", value, "synth")
 			require.Error(t, err)
-			assert.Contains(t, stderr+stdout, "not supported")
-			assert.NotContains(t, stdout, "ARGS:synth")
+			// The snapshots pin the rejection; cdk was never run (no ARGS line).
+			snap.Match(t, sanitizeOutput(stderr))
+			snap.Match(t, sanitizeOutput(stdout))
 		})
 	}
 }
@@ -183,7 +187,7 @@ func TestCDKFlagsAfterActionAreForwarded(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"cdk", "synth", "--region", "us-west-2")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:synth --region us-west-2")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.6 — a flag before the subcommand is rejected with a clear message.
@@ -195,7 +199,8 @@ func TestCDKFlagBeforeSubcommandRejected(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--account", "111111111111", "cdk", "synth")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "must appear after the cdk subcommand")
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.7 — LSTK_CDK_CMD selects the binary to invoke.
@@ -210,7 +215,7 @@ func TestCDKHonorsLstkCdkCmd(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "MYCDK:synth")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.3 — an AWS-contacting command with no running emulator fails with "not
diff --git a/test/integration/completion_test.go b/test/integration/completion_test.go
index 948eb114..295e610f 100644
--- a/test/integration/completion_test.go
+++ b/test/integration/completion_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 )
 
@@ -141,35 +142,30 @@ func TestBashCompletionReassemblesWordbreakSplits(t *testing.T) {
 		compWords string
 		cword     int
 		line      string
-		expect    []string
 	}{
 		{
 			name:      "adjacent pieces re-join",
 			compWords: `lstk --config = ./cfg`,
 			cword:     3,
 			line:      "lstk --config=./cfg",
-			expect:    []string{"cur=--config=./cfg", "prev=lstk", "cword=1", "nwords=2"},
 		},
 		{
 			name:      "word after separator-then-space stays separate",
 			compWords: `lstk --config = st`,
 			cword:     3,
 			line:      "lstk --config= st",
-			expect:    []string{"cur=st", "prev=--config=", "cword=2", "nwords=3"},
 		},
 		{
 			name:      "whitespace-surrounded separator stays separate",
 			compWords: `lstk --config = ./x`,
 			cword:     3,
 			line:      "lstk --config = ./x",
-			expect:    []string{"cur=./x", "prev==", "cword=3", "nwords=4"},
 		},
 		{
 			name:      "empty word after separator-then-space",
 			compWords: `lstk --config = ""`,
 			cword:     3,
 			line:      "lstk --config= ",
-			expect:    []string{"cur=", "prev=--config=", "cword=2", "nwords=3"},
 		},
 	}
 
@@ -197,8 +193,7 @@ run_reassembly
 			require.NoError(t, err, "driver failed\nstdout: %s\nstderr: %s", stdout, stderr)
 			assert.NotContains(t, stderr, "command not found")
 
-			lines := strings.Split(strings.TrimRight(stdout, "\n"), "\n")
-			assert.Equal(t, tc.expect, lines)
+			snap.Match(t, sanitizeOutput(stdout))
 		})
 	}
 }
@@ -215,5 +210,5 @@ _get_comp_words_by_ref
 `
 	stdout, stderr, err := runBashCompletionDriver(t, driver)
 	require.NoError(t, err, "driver failed\nstdout: %s\nstderr: %s", stdout, stderr)
-	assert.Contains(t, stdout, "package version")
+	snap.Match(t, sanitizeOutput(stdout))
 }
diff --git a/test/integration/config_test.go b/test/integration/config_test.go
index f1fbbb41..3201335c 100644
--- a/test/integration/config_test.go
+++ b/test/integration/config_test.go
@@ -7,6 +7,7 @@ import (
 	"runtime"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
 	"github.com/stretchr/testify/assert"
@@ -163,7 +164,7 @@ tag = "latest"
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "stop")
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "port is required")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestConfigWithInvalidContainerNameFails(t *testing.T) {
@@ -182,7 +183,8 @@ container_name = "my emulator"
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "stop")
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout+stderr, `invalid container name "my emulator"`)
+	snap.Match(t, sanitizeOutput(stdout))
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestStartWithMultipleContainersFailsFast(t *testing.T) {
@@ -204,7 +206,8 @@ port = "4567"
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "start")
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout+stderr, "only one is supported at a time")
+	snap.Match(t, sanitizeOutput(stdout))
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestLegacyYAMLConfigGivesHelpfulError(t *testing.T) {
diff --git a/test/integration/emulator_type_test.go b/test/integration/emulator_type_test.go
index e11109ea..57ca1351 100644
--- a/test/integration/emulator_type_test.go
+++ b/test/integration/emulator_type_test.go
@@ -6,6 +6,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
 	"github.com/stretchr/testify/assert"
@@ -148,7 +149,7 @@ func TestStartTypeErrorsOnMultipleBlocks(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "azure", "--non-interactive")
 
 	require.Error(t, err)
-	assert.Contains(t, stdout, "Unsupported configuration")
+	snap.Match(t, sanitizeOutput(stdout))
 	// Config must be left untouched — neither block's type is rewritten.
 	data, readErr := os.ReadFile(configPath)
 	require.NoError(t, readErr)
@@ -168,7 +169,7 @@ func TestStartTypePositionalRejected(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "azure", "--non-interactive")
 
 	require.Error(t, err)
-	assert.Contains(t, stderr, "select the emulator with --type")
+	snap.Match(t, sanitizeOutput(stderr))
 	require.NoFileExists(t, configPath)
 }
 
@@ -187,7 +188,7 @@ func TestStartTypeErrorsWhenNoContainersBlock(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "azure", "--non-interactive")
 
 	require.Error(t, err)
-	assert.Contains(t, stderr, "[[containers]] block")
+	snap.Match(t, sanitizeOutput(stderr))
 	// The env table's type key must be left untouched, not corrupted to "azure".
 	data, readErr := os.ReadFile(configPath)
 	require.NoError(t, readErr)
@@ -201,7 +202,7 @@ func TestStartTypeInvalidValue(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "bogus", "--non-interactive")
 
 	require.Error(t, err)
-	assert.Contains(t, stderr, `invalid emulator type "bogus"`)
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // TestStartTypeFlagRefusesSwitchWhenDifferentEmulatorRunning is the end-to-end
diff --git a/test/integration/endpoint_url_https_test.go b/test/integration/endpoint_url_https_test.go
index 2b4732a6..344853b5 100644
--- a/test/integration/endpoint_url_https_test.go
+++ b/test/integration/endpoint_url_https_test.go
@@ -188,9 +188,7 @@ func TestStatusEndpointURLHTTPSSchemeMismatchSuggestsHTTP(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", httpsURL, "status")
 	require.Error(t, err)
-	assert.Contains(t, stderr, "could not reach LocalStack emulator at "+httpsURL)
-	assert.Contains(t, stderr, srv.URL+" responded")
-	assert.Contains(t, stderr, "retry with that URL")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // TestStatusEndpointURLHTTPSRendersReducedOutput is the https counterpart of
diff --git a/test/integration/endpoint_url_test.go b/test/integration/endpoint_url_test.go
index 0f6e6fd3..57e36987 100644
--- a/test/integration/endpoint_url_test.go
+++ b/test/integration/endpoint_url_test.go
@@ -76,8 +76,7 @@ func TestAWSCommandEndpointURLNoDockerRequired(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "aws", "s3", "ls")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ENDPOINT:"+srv.URL)
-	assert.Contains(t, stdout, "ARGS:s3 ls")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestAWSCommandEndpointURLAfterSubcommandPassesThrough proves the aws-CLI
@@ -100,12 +99,11 @@ func TestAWSCommandEndpointURLAfterSubcommandPassesThrough(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "aws", "--endpoint-url", "http://127.0.0.1:9", "s3", "ls")
 	require.NoError(t, err, "stderr: %s", stderr)
-	// lstk's own resolution used the pre-command mock — proven by succeeding
-	// at all with DOCKER_HOST broken.
-	assert.Contains(t, stdout, "ENDPOINT:"+srv.URL)
-	// The user's own post-command --endpoint-url reached the wrapped aws
-	// binary untouched, appearing in its forwarded args.
-	assert.Contains(t, stdout, "ARGS:--endpoint-url http://127.0.0.1:9 s3 ls")
+	// The snapshot pins both facts: lstk's own resolution used the pre-command
+	// mock (ENDPOINT line — proven by succeeding at all with DOCKER_HOST
+	// broken), and the user's own post-command --endpoint-url reached the
+	// wrapped aws binary untouched, appearing in its forwarded args.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestLogsRejectsExplicitEndpointURL proves logs (a Docker-lifecycle command
@@ -121,8 +119,7 @@ func TestLogsRejectsExplicitEndpointURL(t *testing.T) {
 	// print a second copy to stderr.
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "logs", "--endpoint-url", "http://localhost:4566")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "logs")
-	assert.Contains(t, stdout, "does not support --endpoint-url")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestVolumePathRejectsExplicitEndpointURL mirrors the logs case for the
@@ -133,7 +130,7 @@ func TestVolumePathRejectsExplicitEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "volume", "path", "--endpoint-url", "http://localhost:4566")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "does not support --endpoint-url")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestStartRejectsExplicitEndpointURL proves `start` (previously missing from
@@ -146,8 +143,7 @@ func TestStartRejectsExplicitEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--endpoint-url", "http://localhost:4566")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "start")
-	assert.Contains(t, stdout, "does not support --endpoint-url")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // The following tests prove the corrected behavior from design.md's Decision
@@ -164,9 +160,7 @@ func TestLogsRejectsAmbientEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "logs")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "logs")
-	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
-	assert.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestStopRejectsAmbientEndpointURL(t *testing.T) {
@@ -176,7 +170,7 @@ func TestStopRejectsAmbientEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "stop")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestRestartRejectsAmbientEndpointURL(t *testing.T) {
@@ -186,8 +180,7 @@ func TestRestartRejectsAmbientEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "restart")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "does not support AWS_ENDPOINT_URL")
-	assert.Contains(t, stdout, "AWS_ENDPOINT_URL is set")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestVolumePathRejectsAmbientEndpointURL(t *testing.T) {
@@ -196,7 +189,7 @@ func TestVolumePathRejectsAmbientEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "volume", "path")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestVolumeClearRejectsAmbientEndpointURL(t *testing.T) {
@@ -205,7 +198,7 @@ func TestVolumeClearRejectsAmbientEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "volume", "clear")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestStartRejectsAmbientEndpointURL(t *testing.T) {
@@ -215,8 +208,7 @@ func TestStartRejectsAmbientEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "start")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "start")
-	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestSnapshotShowIgnoresEndpointURL proves `snapshot show` silently ignores
@@ -294,10 +286,7 @@ func TestStatusEndpointURLShowsResources(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "status")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "SERVICE")
-	assert.Contains(t, stdout, "RESOURCE")
-	assert.Contains(t, stdout, "S3")
-	assert.Contains(t, stdout, "my-test-bucket")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestStatusEndpointURLInteractiveRendersTUI proves `status` against an
@@ -364,8 +353,9 @@ func TestStatusUnreachableEndpointURLFailsClosed(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", notLocalStack.URL, "status")
 	require.Error(t, err)
-	assert.Contains(t, stderr, "could not reach")
-	assert.NotContains(t, stderr, "lstk start")
+	// The snapshot pins the full error, including that it never suggests
+	// `lstk start` — the target is an emulator lstk did not start.
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // TestCDKAWSEndpointURLBypassesDockerCheck proves the BREAKING change:
@@ -384,7 +374,7 @@ func TestCDKAWSEndpointURLBypassesDockerCheck(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "deploy", "MyStack")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, fmt.Sprintf("ENV_AWS_ENDPOINT_URL=%s", srv.URL))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestCDKAWSEndpointURLWrongTypeFails proves the type-detection gate: an
@@ -410,6 +400,5 @@ func TestCDKAWSEndpointURLWrongTypeFails(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", azureLike.URL, "cdk", "deploy", "MyStack")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "requires the AWS emulator")
-	assert.Contains(t, stdout, "Azure")
+	snap.Match(t, sanitizeOutput(stdout))
 }
diff --git a/test/integration/exit_code_test.go b/test/integration/exit_code_test.go
index afbd0ba4..8e17e018 100644
--- a/test/integration/exit_code_test.go
+++ b/test/integration/exit_code_test.go
@@ -3,7 +3,7 @@ package integration_test
 import (
 	"testing"
 
-	"github.com/stretchr/testify/assert"
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/stretchr/testify/require"
 )
 
@@ -18,19 +18,18 @@ func TestInvalidUsageExitsNonZero(t *testing.T) {
 	t.Parallel()
 
 	cases := []struct {
-		name     string
-		args     []string
-		wantText string
+		name string
+		args []string
 	}{
-		{"unknown flag on start", []string{"start", "--bogus-flag-xyz"}, "unknown flag"},
-		{"unknown flag on root", []string{"--bogus-flag-xyz"}, "unknown flag"},
-		{"unknown command", []string{"bogus-command"}, "unknown command"},
-		{"unknown config subcommand", []string{"config", "bogus"}, `unknown command "bogus"`},
-		{"removed config profile subcommand", []string{"config", "profile"}, `unknown command "profile"`},
-		{"unknown setup subcommand", []string{"setup", "bogus"}, `unknown command "bogus"`},
-		{"unknown volume subcommand", []string{"volume", "bogus"}, `unknown command "bogus"`},
-		{"unknown snapshot subcommand", []string{"snapshot", "bogus"}, `unknown command "bogus"`},
-		{"unknown completion shell", []string{"completion", "bogus"}, `unknown command "bogus"`},
+		{"unknown flag on start", []string{"start", "--bogus-flag-xyz"}},
+		{"unknown flag on root", []string{"--bogus-flag-xyz"}},
+		{"unknown command", []string{"bogus-command"}},
+		{"unknown config subcommand", []string{"config", "bogus"}},
+		{"removed config profile subcommand", []string{"config", "profile"}},
+		{"unknown setup subcommand", []string{"setup", "bogus"}},
+		{"unknown volume subcommand", []string{"volume", "bogus"}},
+		{"unknown snapshot subcommand", []string{"snapshot", "bogus"}},
+		{"unknown completion shell", []string{"completion", "bogus"}},
 	}
 
 	for _, tc := range cases {
@@ -41,7 +40,7 @@ func TestInvalidUsageExitsNonZero(t *testing.T) {
 			_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, tc.args...)
 			require.Error(t, err, "expected %v to fail", tc.args)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, tc.wantText)
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
@@ -60,7 +59,7 @@ func TestBareParentCommandExitsZero(t *testing.T) {
 			stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, parent)
 			require.NoError(t, err)
 			requireExitCode(t, 0, err)
-			assert.Contains(t, stdout, "Usage:")
+			snap.Match(t, sanitizeOutput(stdout))
 		})
 	}
 }
diff --git a/test/integration/extension_test.go b/test/integration/extension_test.go
index 725db33a..8e37eee5 100644
--- a/test/integration/extension_test.go
+++ b/test/integration/extension_test.go
@@ -163,7 +163,7 @@ func TestExtensionUnknownCommandNoExtensionErrors(t *testing.T) {
 	// goes to stderr, matching Cobra's own unknown-command output.
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), envWithPath(tmpHome, t.TempDir()), "nope")
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "unknown command")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestExtensionExitCodePropagates(t *testing.T) {
@@ -231,7 +231,7 @@ func TestExtensionSelfAuthorizationRefusesWithoutToken(t *testing.T) {
 	environ = append(environ, "DOCKER_HOST=tcp://127.0.0.1:1")
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "deploy", "auth")
 	requireExitCode(t, 13, err)
-	require.Contains(t, stderr, "not authorized")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestExtensionInvocationRecordedInTelemetry(t *testing.T) {
@@ -409,8 +409,9 @@ func TestExtensionHelpMissingDescriptionsFileDegrades(t *testing.T) {
 	tmpHome := t.TempDir()
 	stdout, stderr, err := runBinary(t, t.TempDir(), envWithPath(tmpHome, t.TempDir()), lstkBin, "--help")
 	require.NoError(t, err, stderr)
-	require.Contains(t, stdout, "Extensions:")
-	require.Contains(t, stdout, "deploy")
+	// The snapshot pins the Extensions section listing `deploy` with no
+	// description column when the descriptions file is absent.
+	snap.Match(t, stdout)
 }
 
 func TestExtensionResolvableViaSymlinkedLstk(t *testing.T) {
@@ -481,8 +482,8 @@ func TestExtensionBundledWinsOverPath(t *testing.T) {
 	require.NoError(t, err)
 	require.Contains(t, stdout, "SELF="+resolvedBundle, "expected the bundled extension to run, not the PATH one")
 
-	// Help lists the de-duplicated name exactly once.
+	// Help lists the de-duplicated name exactly once — pinned by the snapshot.
 	helpOut, _, err := runBinary(t, t.TempDir(), envWithPath(tmpHome, extDir), lstkBin, "--help")
 	require.NoError(t, err)
-	require.Equal(t, 1, strings.Count(helpOut, "\n  deploy"))
+	snap.Match(t, helpOut)
 }
diff --git a/test/integration/json_envelope_test.go b/test/integration/json_envelope_test.go
index 3b7a92c4..c031f628 100644
--- a/test/integration/json_envelope_test.go
+++ b/test/integration/json_envelope_test.go
@@ -85,7 +85,7 @@ func TestUsageErrorBeforeJSONFallsBackToPlainText(t *testing.T) {
 	requireExitCode(t, 1, err)
 
 	assert.Empty(t, stdout, "no JSON should be attempted when --json wasn't parsed yet")
-	assert.Contains(t, stderr, "bogus-flag")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // TestConfigLoadFailureRendersJSONEnvelope covers PR #374's review comment:
@@ -125,10 +125,8 @@ func TestConfigNotFoundRendersJSONEnvelope(t *testing.T) {
 	requireExitCode(t, 1, err)
 	assert.Empty(t, stderr, "the plain-text fallback in Execute() must not also fire alongside the envelope")
 
-	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "error", envelope.Status)
-	assert.Equal(t, "reset", envelope.Command)
-	require.NotNil(t, envelope.Error)
-	assert.Equal(t, "CONFIG_NOT_FOUND", envelope.Error.Code)
-	assert.Equal(t, "CONFIG", envelope.Error.Category)
+	decodeEnvelope(t, stdout)
+	// error.message embeds the temp-dir config path (and an OS-specific
+	// not-found detail), so it is masked.
+	snap.MatchJSON(t, []byte(stdout), "error.message")
 }
diff --git a/test/integration/json_flag_test.go b/test/integration/json_flag_test.go
index fb8838de..c805f4f0 100644
--- a/test/integration/json_flag_test.go
+++ b/test/integration/json_flag_test.go
@@ -19,12 +19,8 @@ func TestJSONFlagRejectsUnannotatedBuiltinCommand(t *testing.T) {
 	t.Parallel()
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "status", "--json")
 	requireExitCode(t, 1, err)
-	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "status", envelope.Command)
-	assert.Equal(t, "error", envelope.Status)
-	require.NotNil(t, envelope.Error)
-	assert.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
-	assert.Contains(t, envelope.Error.Message, "status")
+	decodeEnvelope(t, stdout)
+	snap.MatchJSON(t, []byte(stdout))
 	assert.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
 }
 
@@ -32,11 +28,8 @@ func TestJSONFlagRejectsDefaultStartBehavior(t *testing.T) {
 	t.Parallel()
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--json")
 	requireExitCode(t, 1, err)
-	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "start", envelope.Command)
-	assert.Equal(t, "error", envelope.Status)
-	require.NotNil(t, envelope.Error)
-	assert.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
+	decodeEnvelope(t, stdout)
+	snap.MatchJSON(t, []byte(stdout))
 	assert.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
 }
 
@@ -103,9 +96,10 @@ func TestJSONFlagProxyCommandsForwardJSON(t *testing.T) {
 			args := append([]string{tc.name, "--json"}, tc.args...)
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, environ, args...)
 			require.Error(t, err)
-			// The snapshot pins the wrapped tool's missing-binary error —
+			// The snapshots pin the wrapped tool's missing-binary error —
 			// proof --json was forwarded, not rejected by lstk.
-			snap.Match(t, sanitizeOutput(stdout+"\n"+stderr))
+			snap.Match(t, sanitizeOutput(stdout))
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 
 		t.Run(tc.name+"/json after the wrapped tool's own action", func(t *testing.T) {
@@ -114,7 +108,8 @@ func TestJSONFlagProxyCommandsForwardJSON(t *testing.T) {
 			args := append(append([]string{tc.name}, tc.args...), "--json")
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, environ, args...)
 			require.Error(t, err)
-			snap.Match(t, sanitizeOutput(stdout+"\n"+stderr))
+			snap.Match(t, sanitizeOutput(stdout))
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
@@ -163,9 +158,11 @@ func TestJSONFlagBeforeCommandNameBooleanValues(t *testing.T) {
 		t.Parallel()
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).WithHome(t.TempDir()), "--json=false", "aws", "s3", "ls")
 		require.Error(t, err)
-		combined := stdout + stderr
-		require.Contains(t, combined, "not found in PATH", "the wrapped tool should have run (and failed for its own, unrelated reason)")
-		require.NotContains(t, combined, "is not able to provide output in JSON format")
+		// The snapshots pin the wrapped tool's missing-binary error (proof the
+		// tool was invoked, i.e. --json=false was not rejected) with no
+		// NOT_JSON_CAPABLE envelope anywhere.
+		snap.Match(t, sanitizeOutput(stdout))
+		snap.Match(t, sanitizeOutput(stderr))
 	})
 
 	t.Run("a malformed value before the command name is rejected", func(t *testing.T) {
diff --git a/test/integration/logout_test.go b/test/integration/logout_test.go
index 2fde824f..c6218487 100644
--- a/test/integration/logout_test.go
+++ b/test/integration/logout_test.go
@@ -6,6 +6,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
 	"github.com/stretchr/testify/assert"
@@ -39,7 +40,7 @@ func TestLogoutCommandSucceedsWhenNoToken(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), "", env.Without(env.AuthToken).With(env.AnalyticsEndpoint, analyticsSrv.URL), "logout")
 	require.NoError(t, err, "lstk logout should succeed even with no token: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "Not currently logged in")
+	snap.Match(t, sanitizeOutput(stdout))
 	assertCommandTelemetry(t, events, "logout", 0)
 }
 
diff --git a/test/integration/logs_test.go b/test/integration/logs_test.go
index 6f40d04e..c2f296c4 100644
--- a/test/integration/logs_test.go
+++ b/test/integration/logs_test.go
@@ -12,6 +12,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
 	"github.com/stretchr/testify/assert"
@@ -212,8 +213,7 @@ func TestLogsTailRejectsInvalidValue(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), "", env.Without(), "--config", configFile, "logs", "--tail", "bogus")
 	require.Error(t, err, "expected lstk logs --tail bogus to fail")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "bogus", "error should name the invalid value")
-	assert.Contains(t, stderr, "--tail", "error should name the flag")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestLogsTailWithFollowStartsFromTail(t *testing.T) {
diff --git a/test/integration/multiple_installs_test.go b/test/integration/multiple_installs_test.go
index 083f2b15..7ef44982 100644
--- a/test/integration/multiple_installs_test.go
+++ b/test/integration/multiple_installs_test.go
@@ -6,6 +6,7 @@ import (
 	"runtime"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/require"
 )
@@ -53,7 +54,7 @@ func TestUpdateCheckDoesNotWarnOnSingleInstall(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "update", "--check")
 	require.NoError(t, err, stderr)
-	require.NotContains(t, stdout, "Multiple lstk installations found")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestUpdateCheckDoesNotWarnOnSymlinkedAliases(t *testing.T) {
@@ -70,7 +71,7 @@ func TestUpdateCheckDoesNotWarnOnSymlinkedAliases(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "update", "--check")
 	require.NoError(t, err, stderr)
-	require.NotContains(t, stdout, "Multiple lstk installations found")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestUpdateCheckJSONReportsMultipleInstallsWarning(t *testing.T) {
diff --git a/test/integration/sam_cmd_test.go b/test/integration/sam_cmd_test.go
index 943d6c2f..6cd65b46 100644
--- a/test/integration/sam_cmd_test.go
+++ b/test/integration/sam_cmd_test.go
@@ -51,7 +51,7 @@ func TestSAMForwardsArgs(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:build")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // propagates the sam exit code.
@@ -62,7 +62,7 @@ func TestSAMPropagatesExitCode(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
 	require.Error(t, err)
-	assert.Contains(t, stderr, "simulated failure")
+	snap.Match(t, sanitizeOutput(stderr))
 	requireExitCode(t, 7, err)
 }
 
@@ -103,8 +103,9 @@ func TestSAMOfflineCommandsNoEmulator(t *testing.T) {
 				"sam", "--region", "us-west-2", sub)
 			require.NoError(t, err, "stderr: %s", stderr)
 
-			assert.Contains(t, stdout, "ARGS:"+sub)
-			assert.NotContains(t, stdout, "--region")
+			// The snapshot pins the forwarded args: the leading --region must
+			// be stripped, not forwarded to sam.
+			snap.Match(t, sanitizeOutput(stdout))
 		})
 	}
 }
@@ -123,7 +124,7 @@ func TestSAMHelpNoEmulator(t *testing.T) {
 			cmdArgs := append([]string{"sam"}, args...)
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, cmdArgs...)
 			require.NoError(t, err, "stderr: %s", stderr)
-			assert.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
+			snap.Match(t, sanitizeOutput(stdout))
 		})
 	}
 }
@@ -136,9 +137,10 @@ func TestSAMVersionTooOld(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "1.95.0")
-	// sam was never run for real.
-	assert.NotContains(t, stdout, "ARGS:build")
+	// The snapshots pin the full version error; sam was never run for real
+	// (no ARGS line in either stream).
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // a missing sam binary yields the install error.
@@ -148,7 +150,8 @@ func TestSAMMissingBinary(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "not found in PATH")
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // --account is supported for sam (unlike cdk): a valid 12-digit value is
@@ -161,7 +164,7 @@ func TestSAMAccountSupported(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"sam", "--account", "123456789012", "build")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=123456789012")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // an invalid --account value is rejected at the command boundary before sam runs.
@@ -173,8 +176,9 @@ func TestSAMInvalidAccountRejected(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"sam", "--account", "12345", "build")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "12-digit")
-	assert.NotContains(t, stdout, "ARGS:build")
+	// The snapshots pin the rejection; sam was never run (no ARGS line).
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // flags after the subcommand are forwarded to sam unchanged.
@@ -186,7 +190,7 @@ func TestSAMFlagsAfterActionAreForwarded(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"sam", "build", "--region", "us-west-2")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:build --region us-west-2")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // a flag before the subcommand is rejected with a clear message.
@@ -198,7 +202,8 @@ func TestSAMFlagBeforeSubcommandRejected(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--account", "111111111111", "sam", "build")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "must appear after the sam subcommand")
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // LSTK_SAM_CMD selects the binary to invoke.
@@ -213,7 +218,7 @@ func TestSAMHonorsLstkSamCmd(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "MYSAM:build")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // an AWS-contacting command with no running emulator fails with "not running"
@@ -270,9 +275,9 @@ func TestSAMPutsSelectedRegionOnTheCommandLine(t *testing.T) {
 		"--endpoint-url", srv.URL, "sam", "--region", "ap-northeast-1", "--account", "121212122323", "deploy")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "--region ap-northeast-1", "the region must be on sam's command line")
-	assert.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
-	assert.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=121212122323")
+	// The snapshot pins the ARGS line (region on sam's command line) and the
+	// env (region and account).
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // Without lstk's --region there is nothing to assert over samconfig.toml, so
@@ -288,9 +293,9 @@ func TestSAMDoesNotInjectRegionWhenNotSelected(t *testing.T) {
 		"--endpoint-url", srv.URL, "sam", "deploy")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	assert.NotContains(t, stdout, "--region")
-	// The environment still carries the default, as before.
-	assert.Contains(t, stdout, "ENV_AWS_REGION=us-east-1")
+	// The snapshot pins the bare ARGS line (no --region injected) while the
+	// environment still carries the default, as before.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // An ambient AWS_REGION is used but is not a selection: it is commonly exported
@@ -306,8 +311,9 @@ func TestSAMDoesNotInjectAmbientRegion(t *testing.T) {
 		"--endpoint-url", srv.URL, "sam", "deploy")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	assert.NotContains(t, stdout, "--region")
-	assert.Contains(t, stdout, "ENV_AWS_REGION=eu-west-1")
+	// The snapshot pins the bare ARGS line (no --region injected) with the
+	// ambient region still in the environment.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // Offline subcommands never get the flag: `init` and `docs` reject --region
@@ -321,9 +327,9 @@ func TestSAMDoesNotInjectRegionForOfflineSubcommand(t *testing.T) {
 		"sam", "--region", "ap-northeast-1", "build")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "ARGS:build")
-	assert.NotContains(t, stdout, "--region")
-	assert.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
+	// The snapshot pins the bare ARGS line (no --region forwarded or injected)
+	// with the selected region still in the environment.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // A --region the user addressed to sam directly wins: appending lstk's after it
@@ -338,9 +344,8 @@ func TestSAMLeavesUserSuppliedRegionFlagAlone(t *testing.T) {
 		"--endpoint-url", srv.URL, "sam", "--region", "ap-northeast-1", "deploy", "--region", "us-west-1")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	// Pinned to the whole ARGS line: lstk must not append a second --region.
-	assert.Contains(t, stdout, "ARGS:deploy --region us-west-1\n")
-	// The environment still carries lstk's resolved region, as it always has;
-	// sam's own command-line flag is what outranks it.
-	assert.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
+	// The snapshot pins the whole ARGS line (lstk must not append a second
+	// --region) and the environment, which still carries lstk's resolved
+	// region as it always has; sam's own command-line flag is what outranks it.
+	snap.Match(t, sanitizeOutput(stdout))
 }
diff --git a/test/integration/setup_azure_test.go b/test/integration/setup_azure_test.go
index cbc73ed1..bf588414 100644
--- a/test/integration/setup_azure_test.go
+++ b/test/integration/setup_azure_test.go
@@ -4,9 +4,9 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -69,8 +69,7 @@ func TestAzCommandErrorsWhenNotSetUp(t *testing.T) {
 	)
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Azure CLI integration is not set up")
-	assert.Contains(t, stdout, "lstk setup azure")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // Non-interactive mode must not be rejected upfront (CI use case): with no
@@ -84,8 +83,7 @@ func TestSetupAzureNonInteractiveRunsWithoutTerminal(t *testing.T) {
 		"setup", "azure",
 	)
 	require.Error(t, err)
-	assert.Contains(t, stderr, "no azure emulator configured")
-	assert.NotContains(t, stderr, "interactive terminal")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // `lstk setup az` must resolve to `setup azure`: the Azure tool-proxy command
@@ -100,8 +98,7 @@ func TestSetupAzureAliasAz(t *testing.T) {
 		"setup", "az",
 	)
 	require.Error(t, err)
-	assert.NotContains(t, stderr, "unknown command")
-	assert.Contains(t, stderr, "no azure emulator configured")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // When the az CLI is missing, the error must be reported exactly once —
@@ -115,10 +112,8 @@ func TestSetupAzureReportsMissingAzCLIOnce(t *testing.T) {
 		"setup", "azure",
 	)
 	require.Error(t, err)
-	assert.Contains(t, stderr, "az CLI not found in PATH")
-	combined := stdout + stderr
-	assert.Equal(t, 1, strings.Count(combined, "az CLI not found in PATH"),
-		"missing az CLI must be reported exactly once, got:\n%s", combined)
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestAzCommandErrorsWhenEmulatorNotRunning(t *testing.T) {
diff --git a/test/integration/snapshot_list_test.go b/test/integration/snapshot_list_test.go
index 186a0969..aeb18d85 100644
--- a/test/integration/snapshot_list_test.go
+++ b/test/integration/snapshot_list_test.go
@@ -5,7 +5,6 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
-	"strings"
 	"sync"
 	"testing"
 
@@ -102,8 +101,7 @@ func TestSnapshotListAllFlag(t *testing.T) {
 	called, creator, _ := cap.get()
 	require.True(t, called, "the platform list endpoint should have been called")
 	assert.Equal(t, "", creator, "--all should omit the ?creator param")
-	assert.Contains(t, stdout, "~ 1 snapshot")
-	assert.Contains(t, stdout, "org-pod")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotListEmpty(t *testing.T) {
@@ -116,7 +114,7 @@ func TestSnapshotListEmpty(t *testing.T) {
 		"--non-interactive", "snapshot", "list",
 	)
 	require.NoError(t, err, "lstk snapshot list failed: %s", stderr)
-	assert.Contains(t, stdout, "No snapshots found")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotListSendsBasicAuthHeader(t *testing.T) {
@@ -153,8 +151,7 @@ func TestSnapshotListRequiresAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "list",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Authentication required")
-	assert.Contains(t, stdout, "lstk login")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotListServerError(t *testing.T) {
@@ -173,7 +170,7 @@ func TestSnapshotListServerError(t *testing.T) {
 		"--non-interactive", "snapshot", "list",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, strings.ToLower(stderr), "error")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotListInteractive(t *testing.T) {
diff --git a/test/integration/snapshot_load_test.go b/test/integration/snapshot_load_test.go
index c954fb28..54c4650d 100644
--- a/test/integration/snapshot_load_test.go
+++ b/test/integration/snapshot_load_test.go
@@ -9,6 +9,7 @@ import (
 	"sync/atomic"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -157,7 +158,7 @@ func TestSnapshotLoadRemoteRejected(t *testing.T) {
 				"--non-interactive", "snapshot", "load", ref,
 			)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "not yet supported")
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
@@ -172,7 +173,7 @@ func TestSnapshotLoadS3RequiresPodName(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "s3://bucket/key",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "pod name is required")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotLoadPodNoAuthToken(t *testing.T) {
@@ -184,7 +185,7 @@ func TestSnapshotLoadPodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "authentication")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotLoadPodInvalidName(t *testing.T) {
@@ -198,7 +199,7 @@ func TestSnapshotLoadPodInvalidName(t *testing.T) {
 				"--non-interactive", "snapshot", "load", ref,
 			)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "invalid pod name")
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
@@ -493,7 +494,7 @@ func TestSnapshotLoadDryRunOnLocalRef(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "--dry-run", snapPath,
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "pod refs")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotLoadDryRunPodNoAuthToken(t *testing.T) {
@@ -505,7 +506,7 @@ func TestSnapshotLoadDryRunPodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "--dry-run", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "authentication")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotLoadDryRunPodSuccess(t *testing.T) {
diff --git a/test/integration/snapshot_load_version_test.go b/test/integration/snapshot_load_version_test.go
index a6d77b58..352e5323 100644
--- a/test/integration/snapshot_load_version_test.go
+++ b/test/integration/snapshot_load_version_test.go
@@ -7,6 +7,7 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -100,7 +101,8 @@ func TestSnapshotLoadPodVersionReachesWire(t *testing.T) {
 	assert.Equal(t, "3", query.Get("version"))
 	assert.Equal(t, "account-region-merge", query.Get("merge"), "the default merge strategy still applies")
 
-	assert.Contains(t, stdout, "pod:my-baseline:3", "the loaded source should name the pinned version")
+	// The snapshot pins that the loaded source names the pinned version.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestSnapshotLoadPodWithoutVersionOmitsParam: an unpinned ref must not send
@@ -120,8 +122,8 @@ func TestSnapshotLoadPodWithoutVersionOmitsParam(t *testing.T) {
 	require.True(t, called, "the pod load endpoint should have been called")
 	assert.False(t, query.Has("version"), "an unpinned load must not send a version parameter")
 
-	assert.Contains(t, stdout, "pod:my-baseline")
-	assert.NotContains(t, stdout, "pod:my-baseline:")
+	// The snapshot pins that no version suffix is rendered for an unpinned ref.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestLoadAliasAcceptsPodVersion: the root `lstk load` alias shares the REF
@@ -160,8 +162,7 @@ func TestSnapshotLoadPodVersionDryRun(t *testing.T) {
 	assert.Equal(t, "/_localstack/pods/my-baseline/diff", path)
 	assert.Equal(t, "3", query.Get("version"))
 
-	assert.Contains(t, stdout, "Dry-run results for pod:my-baseline:3")
-	assert.Contains(t, stdout, "No state was modified")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestSnapshotLoadPodVersionNotFound: the emulator's own message already names
@@ -182,8 +183,7 @@ func TestSnapshotLoadPodVersionNotFound(t *testing.T) {
 	_, _, query := cap.get()
 	assert.Equal(t, "99", query.Get("version"))
 
-	assert.Contains(t, stdout, "maximum version available in the remote storage is 3")
-	assert.Contains(t, stdout, "lstk snapshot versions pod:my-baseline")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestSnapshotLoadRejectsMalformedVersion: a colon in a ref is unambiguously a
@@ -205,8 +205,7 @@ func TestSnapshotLoadRejectsMalformedVersion(t *testing.T) {
 				"--non-interactive", "--endpoint-url", srv.URL, "snapshot", "load", ref,
 			)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "invalid version")
-			assert.NotContains(t, stderr, "invalid pod name")
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
@@ -221,7 +220,7 @@ func TestSnapshotLoadS3RejectsPodVersion(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "my-pod:3", "s3://bucket/prefix",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "S3 remotes do not support snapshot versions")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // TestSnapshotSaveRejectsPodVersion: the platform assigns a version on every
@@ -235,8 +234,7 @@ func TestSnapshotSaveRejectsPodVersion(t *testing.T) {
 			"--non-interactive", "snapshot", "save", "pod:my-baseline:3",
 		)
 		requireExitCode(t, 1, err)
-		assert.Contains(t, stderr, "the platform assigns the version on each save")
-		assert.NotContains(t, stderr, "invalid pod name")
+		snap.Match(t, sanitizeOutput(stderr))
 	})
 
 	t.Run("s3 remote", func(t *testing.T) {
@@ -245,7 +243,7 @@ func TestSnapshotSaveRejectsPodVersion(t *testing.T) {
 			"--non-interactive", "snapshot", "save", "my-pod:3", "s3://bucket/prefix",
 		)
 		requireExitCode(t, 1, err)
-		assert.Contains(t, stderr, "S3 remotes do not support snapshot versions")
+		snap.Match(t, sanitizeOutput(stderr))
 	})
 }
 
@@ -259,7 +257,7 @@ func TestSnapshotRemoveRejectsPodVersion(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline:3", "--force",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "drop the ':3'")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // TestStartSnapshotFlagAcceptsPodVersion: --snapshot goes through the same REF
@@ -272,5 +270,5 @@ func TestStartSnapshotFlagAcceptsPodVersion(t *testing.T) {
 		"--non-interactive", "start", "--snapshot", "pod:my-baseline:abc",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "invalid version")
+	snap.Match(t, sanitizeOutput(stderr))
 }
diff --git a/test/integration/snapshot_remove_test.go b/test/integration/snapshot_remove_test.go
index e6469f36..5f050912 100644
--- a/test/integration/snapshot_remove_test.go
+++ b/test/integration/snapshot_remove_test.go
@@ -7,6 +7,7 @@ import (
 	"sync/atomic"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -41,8 +42,7 @@ func TestSnapshotRemoveLocalRefRejected(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "./my-baseline.zip",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "resolves to a local file")
-	assert.Contains(t, stderr, "CLI cannot delete local files")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotRemoveLocalBareNameRejected(t *testing.T) {
@@ -54,8 +54,7 @@ func TestSnapshotRemoveLocalBareNameRejected(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "resolves to a local file")
-	assert.Contains(t, stderr, "CLI cannot delete local files")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotRemovePodNoAuthToken(t *testing.T) {
@@ -67,7 +66,7 @@ func TestSnapshotRemovePodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline", "--force",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "authentication")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotRemovePodInvalidName(t *testing.T) {
@@ -82,7 +81,7 @@ func TestSnapshotRemovePodInvalidName(t *testing.T) {
 				"--non-interactive", "snapshot", "remove", ref,
 			)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "invalid pod name")
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
@@ -96,7 +95,7 @@ func TestSnapshotRemoveNonInteractiveRequiresForce(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "--force")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotRemoteSchemeRejected(t *testing.T) {
@@ -111,7 +110,7 @@ func TestSnapshotRemoteSchemeRejected(t *testing.T) {
 				"--non-interactive", "snapshot", "remove", ref,
 			)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "not yet supported")
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
diff --git a/test/integration/snapshot_save_test.go b/test/integration/snapshot_save_test.go
index 77975785..2b539c3c 100644
--- a/test/integration/snapshot_save_test.go
+++ b/test/integration/snapshot_save_test.go
@@ -14,6 +14,7 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -232,7 +233,7 @@ func TestSnapshotSaveRemoteRejected(t *testing.T) {
 
 			_, stderr, err := runLstk(t, ctx, t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--non-interactive", "snapshot", "save", dest)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "not yet supported")
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
@@ -248,7 +249,7 @@ func TestSnapshotSaveS3MissingCredentials(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "my-pod", "s3://my-bucket/prefix",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "AWS credentials required")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotSaveS3CredentialsInURLRejected(t *testing.T) {
@@ -262,7 +263,7 @@ func TestSnapshotSaveS3CredentialsInURLRejected(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "my-pod", "s3://my-bucket/prefix?access_key_id=AKIA&secret_access_key=secret",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "do not put credentials")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // mockPodS3Server handles the remote registration plus pod save against an S3
@@ -413,7 +414,7 @@ func TestSnapshotSavePodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "authentication")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotSavePodInvalidName(t *testing.T) {
@@ -429,7 +430,7 @@ func TestSnapshotSavePodInvalidName(t *testing.T) {
 
 			_, stderr, err := runLstk(t, ctx, t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--non-interactive", "snapshot", "save", dest)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "invalid pod name")
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
@@ -559,7 +560,7 @@ func TestSnapshotSavePodServicesInvalidFormat(t *testing.T) {
 				"--non-interactive", "snapshot", "save", "pod:my-baseline", "--services", value,
 			)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "comma-separated list of service names")
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
diff --git a/test/integration/snapshot_show_test.go b/test/integration/snapshot_show_test.go
index a240bf94..3aff106b 100644
--- a/test/integration/snapshot_show_test.go
+++ b/test/integration/snapshot_show_test.go
@@ -4,7 +4,6 @@ import (
 	"encoding/base64"
 	"net/http"
 	"net/http/httptest"
-	"strings"
 	"sync"
 	"testing"
 
@@ -99,8 +98,9 @@ func TestSnapshotShowWithoutResources(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "pod:bare",
 	)
 	require.NoError(t, err, "lstk snapshot show failed: %s", stderr)
-	assert.Contains(t, stdout, "s3, sqs")
-	assert.NotContains(t, stdout, "Resources", "Resources section must be omitted when no counts are available")
+	// The snapshot pins that the Resources section is omitted when no counts
+	// are available.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestSnapshotShowPodNameLeadingUnderscore covers a name the platform's
@@ -139,7 +139,7 @@ func TestSnapshotShowRejectsPodNameWithPeriod(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "pod:release.v1",
 	)
 	require.Error(t, err, "a dotted pod name must be rejected client-side")
-	assert.Contains(t, stderr, "invalid pod name")
+	snap.Match(t, sanitizeOutput(stderr))
 
 	called, _, _ := cap.get()
 	assert.False(t, called, "the platform endpoint must not be called for an invalid name")
@@ -176,7 +176,7 @@ func TestSnapshotShowRejectsLocalPath(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "./my-snapshot",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, strings.ToLower(stderr), "local")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotShowNotFound(t *testing.T) {
@@ -192,8 +192,7 @@ func TestSnapshotShowNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "pod:missing",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "not found")
-	assert.Contains(t, stdout, "lstk snapshot list")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotShowRequiresAuthToken(t *testing.T) {
@@ -214,6 +213,5 @@ func TestSnapshotShowRequiresAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Authentication required")
-	assert.Contains(t, stdout, "lstk login")
+	snap.Match(t, sanitizeOutput(stdout))
 }
diff --git a/test/integration/snapshot_versions_test.go b/test/integration/snapshot_versions_test.go
index c89c636f..c32834a9 100644
--- a/test/integration/snapshot_versions_test.go
+++ b/test/integration/snapshot_versions_test.go
@@ -3,7 +3,6 @@ package integration_test
 import (
 	"net/http"
 	"net/http/httptest"
-	"strings"
 	"testing"
 
 	"github.com/localstack/lstk/internal/snap"
@@ -92,7 +91,7 @@ func TestSnapshotVersionsSingleVersionUsesSingularNoun(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:solo",
 	)
 	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
-	assert.Contains(t, stdout, "~ 1 version\n")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotVersionsEmptyHistory(t *testing.T) {
@@ -105,8 +104,8 @@ func TestSnapshotVersionsEmptyHistory(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:blank",
 	)
 	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
-	assert.Contains(t, stdout, "No versions found for 'pod:blank'")
-	assert.NotContains(t, stdout, "VERSION", "no table should be rendered")
+	// The snapshot pins that no table is rendered for an empty history.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestSnapshotVersionsNoDockerRequired proves the command reads the platform API
@@ -122,7 +121,7 @@ func TestSnapshotVersionsNoDockerRequired(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:my-baseline",
 	)
 	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
-	assert.Contains(t, stdout, "~ 3 versions")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotVersionsRejectsLocalPath(t *testing.T) {
@@ -135,8 +134,7 @@ func TestSnapshotVersionsRejectsLocalPath(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "./my-snapshot",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, strings.ToLower(stderr), "local")
-	assert.Contains(t, stderr, "list versions of local snapshots")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // TestSnapshotVersionsRejectsS3Ref: S3 remotes are fully supported by
@@ -169,7 +167,7 @@ func TestSnapshotVersionsOrasKeepsComingSoon(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "oras://registry/image",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "coming soon")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // TestSnapshotShowPinnedVersion: show is read-only and the platform returns every
@@ -227,7 +225,7 @@ func TestSnapshotVersionsRejectsVersionSuffix(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:my-baseline:3",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "drop the ':3'")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotVersionsRejectsInvalidPodName(t *testing.T) {
@@ -240,7 +238,7 @@ func TestSnapshotVersionsRejectsInvalidPodName(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:release.v1",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "invalid pod name")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotVersionsNotFound(t *testing.T) {
@@ -256,8 +254,7 @@ func TestSnapshotVersionsNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:missing",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "not found")
-	assert.Contains(t, stdout, "lstk snapshot list")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotVersionsRequiresAuthToken(t *testing.T) {
@@ -272,6 +269,5 @@ func TestSnapshotVersionsRequiresAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Authentication required")
-	assert.Contains(t, stdout, "lstk login")
+	snap.Match(t, sanitizeOutput(stdout))
 }
diff --git a/test/integration/start_snapshot_test.go b/test/integration/start_snapshot_test.go
index 26bc6986..09be82b9 100644
--- a/test/integration/start_snapshot_test.go
+++ b/test/integration/start_snapshot_test.go
@@ -5,6 +5,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -21,7 +22,7 @@ func TestStartSnapshotConflictingFlags(t *testing.T) {
 		"--non-interactive", "start", "--snapshot", "pod:my-baseline", "--no-snapshot",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "cannot be used together")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestStartSnapshotInvalidPodName(t *testing.T) {
@@ -33,7 +34,7 @@ func TestStartSnapshotInvalidPodName(t *testing.T) {
 		"--non-interactive", "start", "--snapshot", "pod:bad.name",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "invalid pod name")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestStartSnapshotLocalFileNotFound(t *testing.T) {
diff --git a/test/integration/start_test.go b/test/integration/start_test.go
index 49ea60d4..488b1f80 100644
--- a/test/integration/start_test.go
+++ b/test/integration/start_test.go
@@ -18,6 +18,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/api/types/network"
 	"github.com/moby/moby/client"
@@ -803,7 +804,7 @@ expose_ports = ["53/sctp"]
 
 	_, stderr, err := runLstk(t, testContext(t), "", testEnvWithHome(t.TempDir(), ""), "--config", configFile, "status")
 	require.Error(t, err)
-	assert.Contains(t, stderr, `protocol must be "tcp" or "udp"`)
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestStartCommandSetsUpContainerCorrectly(t *testing.T) {
diff --git a/test/integration/terraform_cmd_test.go b/test/integration/terraform_cmd_test.go
index 186e366e..255ae223 100644
--- a/test/integration/terraform_cmd_test.go
+++ b/test/integration/terraform_cmd_test.go
@@ -64,7 +64,7 @@ func TestTerraformForwardsArgs(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "version")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:version")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestTerraformAliasTF(t *testing.T) {
@@ -74,7 +74,7 @@ func TestTerraformAliasTF(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "tf", "version")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:version")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // LSTK_TF_CMD selects the binary to invoke (e.g. OpenTofu). A stub named `tofu`
@@ -87,7 +87,7 @@ func TestTerraformHonorsLstkTfCmd(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "version")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "TOFU:version")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestTerraformPropagatesExitCode(t *testing.T) {
@@ -97,7 +97,7 @@ func TestTerraformPropagatesExitCode(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "validate")
 	require.Error(t, err)
-	assert.Contains(t, stderr, "simulated failure")
+	snap.Match(t, sanitizeOutput(stderr))
 	requireExitCode(t, 5, err)
 }
 
@@ -108,9 +108,10 @@ func TestTerraformMissingBinary(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "version")
 	require.Error(t, err)
-	// The snapshot pins the full missing-binary error card, install hint
+	// The snapshots pin the full missing-binary error card, install hint
 	// included.
-	snap.Match(t, sanitizeOutput(stderr+"\n"+stdout))
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.3 — fmt/validate/version/init run without generating an override and without
@@ -129,10 +130,9 @@ func TestTerraformUnproxiedSkipsOverride(t *testing.T) {
 				"terraform", "--region", "us-west-2", "--account", "111111111111", sub)
 			require.NoError(t, err, "stderr: %s", stderr)
 
-			assert.Contains(t, stdout, "ARGS:"+sub)
-			// lstk-specific flags must not be forwarded to terraform.
-			assert.NotContains(t, stdout, "--region")
-			assert.NotContains(t, stdout, "--account")
+			// The snapshot pins the forwarded args: lstk-specific flags
+			// (--region/--account) must not be forwarded to terraform.
+			snap.Match(t, sanitizeOutput(stdout))
 			// No override file generated.
 			assert.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 		})
@@ -156,7 +156,7 @@ func TestTerraformHelpSkipsOverride(t *testing.T) {
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, e, cmdArgs...)
 			require.NoError(t, err, "stderr: %s", stderr)
 
-			assert.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
+			snap.Match(t, sanitizeOutput(stdout))
 			assert.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 		})
 	}
@@ -172,7 +172,8 @@ func TestTerraformInvalidAccountRejected(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"terraform", "--account", "12345", "plan")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "12-digit")
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestTerraformMissingFlagValue(t *testing.T) {
@@ -182,7 +183,8 @@ func TestTerraformMissingFlagValue(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "--region")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "--region requires a value")
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.7 — positional rules. Flags after the action are forwarded verbatim (use an
@@ -196,7 +198,7 @@ func TestTerraformFlagsAfterActionAreForwarded(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"terraform", "version", "--region", "us-west-2")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:version --region us-west-2")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestTerraformFlagBeforeSubcommandRejected(t *testing.T) {
@@ -207,7 +209,8 @@ func TestTerraformFlagBeforeSubcommandRejected(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--account", "111111111111", "terraform", "version")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "must appear after the terraform subcommand")
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.2 — proxied command with no running emulator fails with "not running" and
diff --git a/test/integration/update_test.go b/test/integration/update_test.go
index a7fa6c2a..2ad6478e 100644
--- a/test/integration/update_test.go
+++ b/test/integration/update_test.go
@@ -546,7 +546,7 @@ func TestUpdateBinaryMockGitHubHappyPath(t *testing.T) {
 
 	verOut, err := exec.CommandContext(ctx, oldBinary, "--version").CombinedOutput()
 	require.NoError(t, err)
-	assert.Contains(t, string(verOut), "0.0.2", "binary should be replaced with the mock release")
+	snap.Match(t, sanitizeOutput(string(verOut)))
 
 	leftovers, err := filepath.Glob(filepath.Join(filepath.Dir(oldBinary), "lstk-update-*"))
 	require.NoError(t, err)
@@ -603,7 +603,7 @@ func TestUpdateBinaryMockGitHubChecksumMismatch(t *testing.T) {
 
 	verOut, err := exec.CommandContext(ctx, oldBinary, "--version").CombinedOutput()
 	require.NoError(t, err, "original binary should still run")
-	assert.Contains(t, string(verOut), "0.0.1", "binary must not be replaced on checksum mismatch")
+	snap.Match(t, sanitizeOutput(string(verOut)))
 
 	leftovers, err := filepath.Glob(filepath.Join(filepath.Dir(oldBinary), "lstk-update-*"))
 	require.NoError(t, err)
@@ -641,7 +641,7 @@ func TestUpdateBinaryMockGitHubMissingChecksums(t *testing.T) {
 
 	verOut, err := exec.CommandContext(ctx, oldBinary, "--version").CombinedOutput()
 	require.NoError(t, err, "original binary should still run")
-	assert.Contains(t, string(verOut), "0.0.1", "binary must not be replaced without a verifiable manifest")
+	snap.Match(t, sanitizeOutput(string(verOut)))
 
 	leftovers, err := filepath.Glob(filepath.Join(filepath.Dir(oldBinary), "lstk-update-*"))
 	require.NoError(t, err)
diff --git a/test/integration/volume_test.go b/test/integration/volume_test.go
index eb5d4ea6..99d5e485 100644
--- a/test/integration/volume_test.go
+++ b/test/integration/volume_test.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -154,7 +155,7 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 		require.Error(t, err)
 		requireExitCode(t, 1, err)
 
-		assert.Contains(t, stderr, "--force")
+		snap.Match(t, sanitizeOutput(stderr))
 	})
 
 	t.Run("handles nonexistent volume directory", func(t *testing.T) {
@@ -197,7 +198,7 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 		_, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "--non-interactive", "volume", "clear", "--force", "--type", "snowflake")
 		require.Error(t, err)
 		requireExitCode(t, 1, err)
-		assert.Contains(t, stderr, "not found")
+		snap.Match(t, sanitizeOutput(stderr))
 
 		// Correct type should succeed
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "--non-interactive", "volume", "clear", "--force", "--type", "aws")

From cc9025e579759418aef7bcc180be00414a3da373 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Wed, 12 Aug 2026 16:40:27 +0200
Subject: [PATCH 18/21] Strip ambient AWS env vars from integration test
 environments

Co-Authored-By: Claude <noreply@anthropic.com>
---
 test/integration/env/env.go | 30 ++++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/test/integration/env/env.go b/test/integration/env/env.go
index 1d8f8a7e..b5766988 100644
--- a/test/integration/env/env.go
+++ b/test/integration/env/env.go
@@ -71,20 +71,34 @@ func Require(t testing.TB, key Key) string {
 
 type Environ []string
 
-func Without(keys ...Key) Environ {
+// ambientAWSKeys are the AWS credential/config variables lstk and the wrapped
+// tools resolve from the environment. They are stripped from every test
+// environment so the developer's real shell (profile, region, keys, endpoint
+// overrides) can't leak into wrapped-tool env dumps, credential resolution, or
+// snapshotted output; tests exercising ambient behavior set them explicitly
+// via With, which wins because exec dedups duplicate keys to the last value.
+var ambientAWSKeys = []Key{
+	"AWS_PROFILE", "AWS_DEFAULT_PROFILE",
+	"AWS_REGION", "AWS_DEFAULT_REGION",
+	"AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN",
+	"AWS_ENDPOINT_URL", "AWS_ENDPOINT_URL_S3",
+	"LSTK_ENDPOINT_URL",
+}
+
+func base() Environ {
 	return Environ(os.Environ()).
+		Without(ambientAWSKeys...).
 		With(AnalyticsEndpoint, UnreachableAnalyticsEndpoint).
 		With(AzureCollectTelemetry, "false").
-		With(SamCliTelemetry, "0").
-		Without(keys...)
+		With(SamCliTelemetry, "0")
+}
+
+func Without(keys ...Key) Environ {
+	return base().Without(keys...)
 }
 
 func With(key Key, value string) Environ {
-	return Environ(os.Environ()).
-		With(AnalyticsEndpoint, UnreachableAnalyticsEndpoint).
-		With(AzureCollectTelemetry, "false").
-		With(SamCliTelemetry, "0").
-		With(key, value)
+	return base().With(key, value)
 }
 
 func (e Environ) Without(keys ...Key) Environ {

From 6149b48d0cc1d67a6b38f0741c450d23e95c29b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Wed, 12 Aug 2026 16:56:07 +0200
Subject: [PATCH 19/21] Finish xpty migration of license ESC-decline PTY test

Co-Authored-By: Claude <noreply@anthropic.com>
---
 test/integration/license_test.go | 40 +++++++-------------------------
 1 file changed, 9 insertions(+), 31 deletions(-)

diff --git a/test/integration/license_test.go b/test/integration/license_test.go
index 535f59d0..81f79c0b 100644
--- a/test/integration/license_test.go
+++ b/test/integration/license_test.go
@@ -1,7 +1,6 @@
 package integration_test
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
@@ -11,13 +10,11 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"runtime"
 	"strings"
 	"sync/atomic"
 	"testing"
 	"time"
 
-	"github.com/creack/pty"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
 	"github.com/stretchr/testify/assert"
@@ -260,9 +257,6 @@ func TestLicenseRejectionOffersReloginAndRetries(t *testing.T) {
 // matches by (image repo, internal port), so an emulator already running on 4566
 // makes `lstk start` report that instead of ever reaching the license check.
 func TestLicenseRejectionEscDeclineShowsManualSteps(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("PTY not supported on Windows")
-	}
 	requireDocker(t)
 
 	// cleanupLicense, not cleanup: the container has to go, but there is no need
@@ -286,39 +280,23 @@ func TestLicenseRejectionEscDeclineShowsManualSteps(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
 	t.Cleanup(cancel)
 
-	cmd := exec.CommandContext(ctx, binaryPath(), "start", "--config", configFile)
-	cmd.Env = environ
-	ptmx, err := pty.Start(cmd)
-	require.NoError(t, err, "failed to start command in PTY")
-	defer func() { _ = ptmx.Close() }()
-
-	out := &syncBuffer{}
-	outputCh := make(chan struct{})
-	go func() {
-		_, _ = io.Copy(out, ptmx)
-		close(outputCh)
-	}()
-	// require.Eventually's message args are evaluated before the wait, so the
+	p := startLstkInPTY(t, ctx, environ, "start", "--config", configFile)
+	// waitForOutputTimeout's message args are evaluated before the wait, so the
 	// transcript has to be logged from a cleanup to be of any use.
 	t.Cleanup(func() {
 		if t.Failed() {
-			t.Logf("PTY transcript:\n%s", out.String())
+			t.Logf("PTY transcript:\n%s", p.output())
 		}
 	})
 
-	require.Eventually(t, func() bool {
-		return bytes.Contains(out.Bytes(), []byte("ESC to exit"))
-	}, 60*time.Second, 100*time.Millisecond, "the re-login prompt must be on screen, advertising the decline key")
-
-	_, err = ptmx.Write([]byte{0x1b})
-	require.NoError(t, err)
+	p.waitForOutputTimeout("ESC to exit", 60*time.Second, "the re-login prompt must be on screen, advertising the decline key")
+	p.write("\x1b")
 
-	err = cmd.Wait()
-	<-outputCh
+	out, err := p.wait()
 	requireExitCode(t, 1, err)
-	assert.Contains(t, out.String(), "License validation failed", "declining must render the failure")
-	assert.Contains(t, out.String(), "lstk logout", "declining must point at the manual recovery")
-	assert.Contains(t, out.String(), "LOCALSTACK_AUTH_TOKEN", "declining must mention the env var alternative")
+	assert.Contains(t, out, "License validation failed", "declining must render the failure")
+	assert.Contains(t, out, "lstk logout", "declining must point at the manual recovery")
+	assert.Contains(t, out, "LOCALSTACK_AUTH_TOKEN", "declining must mention the env var alternative")
 }
 
 func licenseFilePath(t *testing.T) string {

From be4fbca11a9386d8d59fc27c46e3a81808a68a01 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Thu, 13 Aug 2026 10:13:55 +0200
Subject: [PATCH 20/21] Mask environment-dependent MACHINE_ID in extension
 snapshot output

Co-Authored-By: Claude <noreply@anthropic.com>
---
 test/integration/__snapshots__/extension_test.snap |  2 ++
 test/integration/__snapshots__/json_flag_test.snap |  1 +
 test/integration/snap_sanitize_test.go             | 10 ++++++++--
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/test/integration/__snapshots__/extension_test.snap b/test/integration/__snapshots__/extension_test.snap
index f73a86a5..80efdd3b 100644
--- a/test/integration/__snapshots__/extension_test.snap
+++ b/test/integration/__snapshots__/extension_test.snap
@@ -57,6 +57,7 @@ CONFIG_DIR=<path>
 NON_INTERACTIVE=true
 JSON=false
 SESSION_ID=<id>
+MACHINE_ID=<id>
 EMULATOR_COUNT=0
 ---
 
@@ -179,6 +180,7 @@ CONFIG_DIR=<path>
 NON_INTERACTIVE=true
 JSON=false
 SESSION_ID=<id>
+MACHINE_ID=<id>
 EMULATOR_COUNT=0
 ---
 
diff --git a/test/integration/__snapshots__/json_flag_test.snap b/test/integration/__snapshots__/json_flag_test.snap
index b67eaaf4..9349deb7 100644
--- a/test/integration/__snapshots__/json_flag_test.snap
+++ b/test/integration/__snapshots__/json_flag_test.snap
@@ -9,6 +9,7 @@ CONFIG_DIR=<path>
 NON_INTERACTIVE=true
 JSON=true
 SESSION_ID=<id>
+MACHINE_ID=<id>
 EMULATOR_COUNT=0
 ---
 
diff --git a/test/integration/snap_sanitize_test.go b/test/integration/snap_sanitize_test.go
index 70e8845e..02114020 100644
--- a/test/integration/snap_sanitize_test.go
+++ b/test/integration/snap_sanitize_test.go
@@ -25,7 +25,10 @@ var (
 	sanitizeEndpointHostRe = regexp.MustCompile(`(ENV_AWS_ENDPOINT_URL(?:_S3)?=https?://)[^:\s]+`)
 	// Any URL pointing at the default gateway port (terraform override
 	// endpoints, rendered endpoint lines) — anchored on :4566 so it can't
-	// touch unrelated URLs.
+	// touch unrelated URLs. Like sanitizeSizeRe below, this mask is
+	// shape-anchored across the whole stream: a test that needs to assert a
+	// specific host on :4566 (or a specific size) can't — narrow the anchor
+	// if that case ever appears.
 	sanitizeGatewayHostRe = regexp.MustCompile(`(https?://)[^:"\s]+(:4566)`)
 	// Rendered snapshot metadata: timestamps ("2026-04-15 14:32 UTC"),
 	// human-readable sizes ("47.3 MB"), and LocalStack calendar versions
@@ -36,7 +39,10 @@ var (
 	sanitizeCalverRe = regexp.MustCompile(`\b20\d{2}\.\d{2}\b`)
 	// Reference-extension echo lines carrying temp paths or random ids.
 	sanitizeExtPathRe = regexp.MustCompile(`(?m)^(SELF=|CONFIG_DIR=).*$`)
-	sanitizeExtIDRe   = regexp.MustCompile(`(?m)^(SESSION_ID=).*$`)
+	// MACHINE_ID's value is environment-dependent twice over: its origin
+	// prefix (dkr_/sys_/gen_) depends on whether Docker or /etc/machine-id is
+	// available on the host, and the rest is a host-derived hash or random id.
+	sanitizeExtIDRe = regexp.MustCompile(`(?m)^((?:SESSION|MACHINE)_ID=).*$`)
 	// Defense in depth: a real auth token must never land in a committed
 	// snapshot or a failure diff, even if a test forgets to strip it.
 	sanitizeExtTokenRe = regexp.MustCompile(`(?m)^(AUTH_TOKEN=).*$`)

From 56b055b98cfa29f0db86559f4d6aeca7798a549d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Pallar=C3=A9s?=
 <cristian.pallares@localstack.cloud>
Date: Fri, 14 Aug 2026 13:51:10 +0200
Subject: [PATCH 21/21] Give sam validate e2e test headroom over cold-runner
 startup

Co-Authored-By: Claude <noreply@anthropic.com>
---
 test/integration/sam_e2e_test.go | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/test/integration/sam_e2e_test.go b/test/integration/sam_e2e_test.go
index 8ecefe46..befab4b4 100644
--- a/test/integration/sam_e2e_test.go
+++ b/test/integration/sam_e2e_test.go
@@ -6,6 +6,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
@@ -59,7 +60,11 @@ func samE2EEnv(t *testing.T) env.Environ {
 func TestSAME2EValidateOffline(t *testing.T) {
 	requireSAM(t)
 
-	ctx := testContext(t)
+	// Not testContext: the frozen-Python sam CLI plus --lint's cfn-lint init
+	// can exceed 2 minutes on a cold Windows runner, and the context expiring
+	// kills a sam that already printed a successful validation.
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	t.Cleanup(cancel)
 	work := copySAMSample(t, "hello")
 	e := samE2EEnv(t)