diff --git a/examples/agent-eval/src/test/runCodingAgent.test.ts b/examples/agent-eval/src/test/runCodingAgent.test.ts
index 535586760..7059187a4 100644
--- a/examples/agent-eval/src/test/runCodingAgent.test.ts
+++ b/examples/agent-eval/src/test/runCodingAgent.test.ts
@@ -69,7 +69,10 @@ describe("startAnthropicMock", () => {
     const first = await startAnthropicMock({ port: 0, commands: [] });
     try {
       const { port } = first.address() as AddressInfo;
-      await expect(startAnthropicMock({ port, commands: [] })).rejects.toThrow(/EADDRINUSE/);
+      // The code, not the message: Bun words it "Failed to start server. Is port N in use?"
+      await expect(startAnthropicMock({ port, commands: [] })).rejects.toMatchObject({
+        code: "EADDRINUSE",
+      });
     } finally {
       first.close();
     }
diff --git a/vitest.config.ts b/vitest.config.ts
index 40dc810e5..8a398742c 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -226,8 +226,11 @@ export default defineConfig({
     // inherits `process.env` — which is the whole point: the credential store
     // is decrypted once here instead of once per test file. Absolute, like
     // every other path in this file, since a relative one resolves against
-    // each project's own root.
-    globalSetup: [abs("vitest.globalSetup.ts")],
+    // each project's own root. A `--typecheck.only` run executes no test and
+    // needs no keys, and is run after `build:types` alone: the hydrate imports
+    // `@workglow/storage` source, whose `@workglow/util` import resolves to a
+    // `dist/node.js` that build never wrote.
+    globalSetup: typecheckCli.only ? [] : [abs("vitest.globalSetup.ts")],
     projects,
     coverage: {
       provider: "v8", // or 'istanbul'