diff --git a/.github/workflows/stepup-behat.yml b/.github/workflows/stepup-behat.yml
index 783b49e..db1894d 100644
--- a/.github/workflows/stepup-behat.yml
+++ b/.github/workflows/stepup-behat.yml
@@ -28,6 +28,13 @@ jobs:
           cd stepup
           cp .env.test .env
           cp gateway/surfnet_yubikey.yaml.dist gateway/surfnet_yubikey.yaml
+          if [ ! -f ../core/haproxy/haproxy.pem ] || [ ! -f ../core/haproxy/haproxy.crt ]; then
+            ../core/scripts/create_dev_ca.sh
+          fi
+          # Distribute the dev CA to the app containers: the base image imports
+          # /config/haproxy/haproxy.crt on startup so services trust each other
+          # over HAProxy TLS. start-dev-env.sh does this copy; CI must too.
+          cp ../core/haproxy/haproxy.crt haproxy/haproxy.crt
           ${DOCKER_COMPOSE} up -d
       - name: Install composer dependencies on the Behat container
         run: |
diff --git a/stepup/tests/behat/features/bootstrap/SelfServiceContext.php b/stepup/tests/behat/features/bootstrap/SelfServiceContext.php
index c912cf9..b6dae22 100644
--- a/stepup/tests/behat/features/bootstrap/SelfServiceContext.php
+++ b/stepup/tests/behat/features/bootstrap/SelfServiceContext.php
@@ -78,9 +78,9 @@ public function logoutOfSelfService()
 
         $this->minkContext->pressButton('Sign out');
 
-        $expectBaseUrl = 'https://www.surf.nl/';
+        $expectBaseUrl = 'https://ssp.dev.openconext.local/';
         if (substr($this->minkContext->getSession()->getCurrentUrl(), 0, strlen($expectBaseUrl)) !== $expectBaseUrl) {
-            throw new Exception("after logout we should be redirected to the surf domain");
+            throw new Exception("after logout we should be redirected to the local test SP domain");
         }
     }