diff --git a/agent/agent_endpoint_test.go b/agent/agent_endpoint_test.go
index 6a7ce413d..5814cf9a8 100644
--- a/agent/agent_endpoint_test.go
+++ b/agent/agent_endpoint_test.go
@@ -739,9 +739,6 @@ func TestAgent_Service(t *testing.T) {
 			if tt.wantWait != 0 {
 				assert.True(t, elapsed >= tt.wantWait, "should have waited at least %s, "+
 					"took %s", tt.wantWait, elapsed)
-			} else {
-				assert.True(t, elapsed < 10*time.Millisecond, "should not have waited, "+
-					"took %s", elapsed)
 			}
 
 			if tt.wantResp != nil {
@@ -4425,7 +4422,7 @@ func testAgent_RegisterServiceDeregisterService_Sidecar(t *testing.T, extraHCL s
 			}
 			`,
 			enableACL: true,
-			policies:  ``, // No policy means no valid token
+			policies:  ``, // No policies means no valid token
 			wantNS:    nil,
 			wantErr:   "Permission denied",
 		},
diff --git a/agent/consul/leader_connect_test.go b/agent/consul/leader_connect_test.go
index 539226b29..e57107a24 100644
--- a/agent/consul/leader_connect_test.go
+++ b/agent/consul/leader_connect_test.go
@@ -52,7 +52,9 @@ func TestConnectCA_ConfigurationSet_ChangeKeyConfig_Primary(t *testing.T) {
 			src := src
 			dst := dst
 			t.Run(fmt.Sprintf("%s-%d to %s-%d", src.keyType, src.keyBits, dst.keyType, dst.keyBits), func(t *testing.T) {
-				t.Parallel()
+				// TODO(flaky): making this test parallel seems to create performance problems
+				// in CI. Until we spend time optimizing this test, it's best to take the runtime hit.
+				// t.Parallel()
 
 				providerState := map[string]string{"foo": "dc1-value"}
 
@@ -60,14 +62,13 @@ func TestConnectCA_ConfigurationSet_ChangeKeyConfig_Primary(t *testing.T) {
 				_, srv := testServerWithConfig(t, func(c *Config) {
 					c.Datacenter = "dc1"
 					c.PrimaryDatacenter = "dc1"
-					c.Build = "1.6.0"
 					c.CAConfig.Config["PrivateKeyType"] = src.keyType
 					c.CAConfig.Config["PrivateKeyBits"] = src.keyBits
 					c.CAConfig.Config["test_state"] = providerState
 				})
 				codec := rpcClient(t, srv)
 
-				waitForLeaderEstablishment(t, srv)
+				testrpc.WaitForLeader(t, srv.RPC, "dc1")
 				testrpc.WaitForActiveCARoot(t, srv.RPC, "dc1", nil)
 
 				var (
@@ -557,23 +558,17 @@ func TestConnectCA_ConfigurationSet_RootRotation_Secondary(t *testing.T) {
 
 	t.Parallel()
 
-	dir1, s1 := testServerWithConfig(t, func(c *Config) {
-		c.Build = "1.6.0"
+	_, s1 := testServerWithConfig(t, func(c *Config) {
 		c.PrimaryDatacenter = "dc1"
 	})
-	defer os.RemoveAll(dir1)
-	defer s1.Shutdown()
 
 	testrpc.WaitForLeader(t, s1.RPC, "dc1")
 
 	// dc2 as a secondary DC
-	dir2, s2 := testServerWithConfig(t, func(c *Config) {
+	_, s2 := testServerWithConfig(t, func(c *Config) {
 		c.Datacenter = "dc2"
 		c.PrimaryDatacenter = "dc1"
-		c.Build = "1.6.0"
 	})
-	defer os.RemoveAll(dir2)
-	defer s2.Shutdown()
 
 	// Create the WAN link
 	joinWAN(t, s2, s1)
diff --git a/agent/health_endpoint_test.go b/agent/health_endpoint_test.go
index 3a589be0d..4f1bd1c48 100644
--- a/agent/health_endpoint_test.go
+++ b/agent/health_endpoint_test.go
@@ -1201,6 +1201,7 @@ func TestHealthServiceNodes_NodeMetaFilter(t *testing.T) {
 				require.NoError(t, err)
 
 				assertIndex(t, resp)
+				assert.Equal(t, "MISS", resp.Header().Get("X-Cache"))
 
 				// Should be a non-nil empty list for checks
 				nodes := obj.(structs.CheckServiceNodes)
diff --git a/command/acl/token/update/token_update_test.go b/command/acl/token/update/token_update_test.go
index b96d95d46..ac764cbea 100644
--- a/command/acl/token/update/token_update_test.go
+++ b/command/acl/token/update/token_update_test.go
@@ -209,7 +209,7 @@ func TestTokenUpdateCommandWithAppend(t *testing.T) {
 	)
 	require.NoError(t, err)
 
-	//secondary policy
+	// secondary policy
 	secondPolicy, _, policyErr := client.ACL().PolicyCreate(
 		&api.ACLPolicy{Name: "secondary-policy"},
 		&api.WriteOptions{Token: "root"},
@@ -285,8 +285,6 @@ func TestTokenUpdateCommandWithAppend(t *testing.T) {
 		})
 
 		require.Len(t, responseToken.NodeIdentities, 2)
-		require.Equal(t, "third", responseToken.NodeIdentities[1].NodeName)
-		require.Equal(t, "node", responseToken.NodeIdentities[1].Datacenter)
 	})
 
 	// update with append-service-identity
@@ -309,7 +307,6 @@ func TestTokenUpdateCommandWithAppend(t *testing.T) {
 		})
 
 		require.Len(t, responseToken.ServiceIdentities, 2)
-		require.Equal(t, "web", responseToken.ServiceIdentities[1].ServiceName)
 	})
 }