diff --git a/action.yml b/action.yml
index 7eeb165..a4a6c51 100644
--- a/action.yml
+++ b/action.yml
@@ -152,6 +152,15 @@ runs:
           args="$args --ostag ${{ inputs.ostag }}"
         fi
 
+        # work around broken/incomplete local CA trust stores on some runners by pointing
+        # Python's default SSL context at certifi's CA bundle, regardless of which install
+        # path below ends up running
+        python3 -m pip install --quiet --disable-pip-version-check certifi || true
+        cert_file="$(python3 -m certifi 2>/dev/null || true)"
+        if [[ -n "$cert_file" ]]; then
+          export SSL_CERT_FILE="$cert_file"
+        fi
+
         # download the installation script if necessary
         if command -v get-modflow &> /dev/null
         then
diff --git a/test/test.py b/test/test.py
index 886923a..d356a4e 100644
--- a/test/test.py
+++ b/test/test.py
@@ -31,7 +31,7 @@
         'crt',
         'mt3dms',
         'mf2005dbl',
-        'zonbud3',
+        'zonbud',
         'gridgen',
         'mflgrdbl',
         'mfnwt',
@@ -59,6 +59,12 @@
     "modflow6-nightly-build": ["libmf6"]
 }
 
+# executables that have been renamed upstream at some point; accept the old
+# name too, so tests pass against both latest and older pinned release tags
+exe_aliases = {
+    'zonbud': ['zonbud3'],
+}
+
 # apply subset filter, if provided
 if subset:
     expected_exes = {k: [vv for vv in v if vv in subset] for k, v in expected_exes.items()}
@@ -98,6 +104,14 @@ def get_expected_files(repository) -> Tuple[List[str], List[str]]:
     return exes, libs
 
 
+def alt_names(exe) -> List[str]:
+    """Given an (possibly suffixed) expected exe name, return itself plus any
+    known former/alternate names it may appear as, with the same suffix."""
+    base, _, suffix = exe.partition('.')
+    suffix = f".{suffix}" if suffix else ""
+    return [exe] + [f"{alias}{suffix}" for alias in exe_aliases.get(base, [])]
+
+
 # check install location exists
 assert path.is_dir(), f"Install location {path} doesn't exist"
 print(f"Found install location: {path}")
@@ -109,15 +123,17 @@ def get_expected_files(repository) -> Tuple[List[str], List[str]]:
 
 # check executables exist
 found = sorted([p.name for p in path.glob("*")])
+found_set = set(found)
 exp_exes, exp_libs = get_expected_files(repo)
 expected = exp_exes + exp_libs
-assert set(found) >= set(exp_exes), f"Executables/libraries missing:\n Found {set(found)}\n Expected {set(exp_exes)}"
+missing = [exe for exe in exp_exes if not (set(alt_names(exe)) & found_set)]
+assert not missing, f"Executables/libraries missing:\n Found {found_set}\n Expected {set(exp_exes)}"
 print(f"Found all expected executables/libraries:")
 pprint(expected)
 
 # check executables are on the PATH
 for exe in exp_exes:
-    assert which(exe), f"Executable {exe} not found on path"
+    assert any(which(name) for name in alt_names(exe)), f"Executable {exe} not found on path"
 print(f"Verified executables are on system path")