From a6ae6f01dd4f7b69034888686a649d58440c8b94 Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Thu, 16 Jul 2026 15:54:10 -0400
Subject: [PATCH 1/9] Update applications.tf

Signed-off-by: Michael Thamm <mike.thamm@canonical.com>
---
 terraform/cos-lite/applications.tf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/terraform/cos-lite/applications.tf b/terraform/cos-lite/applications.tf
index cf4787d7..b51d995b 100644
--- a/terraform/cos-lite/applications.tf
+++ b/terraform/cos-lite/applications.tf
@@ -1,3 +1,4 @@
+# TODO: Remove once done testing
 module "alertmanager" {
   source = "git::https://github.com/canonical/alertmanager-k8s-operator//terraform"
 

From 97d549c88f1d9e2f51ec54bf6d122c4372e1a77d Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Thu, 16 Jul 2026 16:01:14 -0400
Subject: [PATCH 2/9] chore

---
 .github/workflows/_integration.yml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/_integration.yml b/.github/workflows/_integration.yml
index 5719becd..fe937629 100644
--- a/.github/workflows/_integration.yml
+++ b/.github/workflows/_integration.yml
@@ -38,11 +38,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        juju-channel: ["3.6/stable"]
-        scenario: ["tls_full", "tls_external", "tls_internal", "tls_none"]
         include:
-        - juju-channel: "4.1/beta"
-          scenario: "juju_4"
+          - juju-channel: "4.1/beta"
+            scenario: "juju_4"
     steps:
       - name: Checkout
         uses: actions/checkout@v4

From 80c329b24ab14dc3f8f6b3724f75315625a9b77c Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Thu, 16 Jul 2026 16:18:43 -0400
Subject: [PATCH 3/9] chore

---
 .github/workflows/_integration.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/_integration.yml b/.github/workflows/_integration.yml
index fe937629..1fcf44f2 100644
--- a/.github/workflows/_integration.yml
+++ b/.github/workflows/_integration.yml
@@ -38,9 +38,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - juju-channel: "4.1/beta"
-            scenario: "juju_4"
+        juju-channel: ["4.1/beta"]
+        scenario: ["juju_4"]
     steps:
       - name: Checkout
         uses: actions/checkout@v4

From f2fec27b95c97670149c835d28094c0bbdced20a Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Thu, 16 Jul 2026 16:48:32 -0400
Subject: [PATCH 4/9] chore

---
 .github/workflows/terraform.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml
index 7164cc25..b8a0e6f3 100644
--- a/.github/workflows/terraform.yml
+++ b/.github/workflows/terraform.yml
@@ -95,7 +95,7 @@ jobs:
     name: COS Lite Terraform integration
     needs: [test-unit, changes]
     if: ${{ github.event_name == 'workflow_dispatch' || needs.changes.outputs.cos_lite == 'true' }}
-    uses: canonical/observability-stack/.github/workflows/_integration.yml@main
+    uses: canonical/observability-stack/.github/workflows/_integration.yml@MichaelThamm-patch-1
     with:
       product: cos_lite
       runner: self-hosted-linux-amd64-noble-large
@@ -103,7 +103,7 @@ jobs:
     name: COS Terraform integration
     needs: [test-unit, changes]
     if: ${{ github.event_name == 'workflow_dispatch' || needs.changes.outputs.cos == 'true' }}
-    uses: canonical/observability-stack/.github/workflows/_integration.yml@main
+    uses: canonical/observability-stack/.github/workflows/_integration.yml@MichaelThamm-patch-1
     with:
       product: cos
       runner: self-hosted-linux-amd64-noble-xlarge
@@ -111,7 +111,7 @@ jobs:
     name: COS Dev Terraform integration
     needs: [test-unit, changes]
     if: ${{ github.event_name == 'workflow_dispatch' || needs.changes.outputs.cos_dev == 'true' }}
-    uses: canonical/observability-stack/.github/workflows/_integration.yml@main
+    uses: canonical/observability-stack/.github/workflows/_integration.yml@MichaelThamm-patch-1
     with:
       product: cos_dev
       runner: self-hosted-linux-amd64-noble-large
\ No newline at end of file

From 3734c52879c481ebc080017f0cb1dd096484240f Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Fri, 17 Jul 2026 09:44:20 -0400
Subject: [PATCH 5/9] chore

---
 .github/workflows/terraform.yml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml
index b8a0e6f3..8a9884c6 100644
--- a/.github/workflows/terraform.yml
+++ b/.github/workflows/terraform.yml
@@ -107,11 +107,11 @@ jobs:
     with:
       product: cos
       runner: self-hosted-linux-amd64-noble-xlarge
-  test-integration-cos-dev:
-    name: COS Dev Terraform integration
-    needs: [test-unit, changes]
-    if: ${{ github.event_name == 'workflow_dispatch' || needs.changes.outputs.cos_dev == 'true' }}
-    uses: canonical/observability-stack/.github/workflows/_integration.yml@MichaelThamm-patch-1
-    with:
-      product: cos_dev
-      runner: self-hosted-linux-amd64-noble-large
\ No newline at end of file
+  # test-integration-cos-dev:
+  #   name: COS Dev Terraform integration
+  #   needs: [test-unit, changes]
+  #   if: ${{ github.event_name == 'workflow_dispatch' || needs.changes.outputs.cos_dev == 'true' }}
+  #   uses: canonical/observability-stack/.github/workflows/_integration.yml@MichaelThamm-patch-1
+  #   with:
+  #     product: cos_dev
+  #     runner: self-hosted-linux-amd64-noble-large
\ No newline at end of file

From 964e09aa029bd36ae9acbfbaa464719f1779960f Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Fri, 17 Jul 2026 15:31:07 -0400
Subject: [PATCH 6/9] chore

---
 .github/workflows/_integration.yml | 14 +++++++++++++-
 justfile                           |  2 +-
 tests/integration/conftest.py      | 26 ++++++++++++++++++++------
 3 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/_integration.yml b/.github/workflows/_integration.yml
index 1fcf44f2..af30d054 100644
--- a/.github/workflows/_integration.yml
+++ b/.github/workflows/_integration.yml
@@ -155,4 +155,16 @@ jobs:
             export S3_ACCESS_KEY=access-key
             export S3_SECRET_KEY=secret-key
           fi
-          just integration ${{ inputs.product }}/${{ matrix.scenario }}
+          if [[ "${{ runner.debug }}" == "1" ]]; then
+            export KEEP_MODELS=true
+            just integration ${{ inputs.product }}/${{ matrix.scenario }} --keep-models
+          else
+            just integration ${{ inputs.product }}/${{ matrix.scenario }}
+          fi
+
+      - name: Open SSH session on failure
+        if: ${{ failure() && (runner.debug == '1') }}
+        uses: mxschmitt/action-tmate@v3
+        with:
+          timeout-minutes: 30
+          limit-access-to-actor: true
diff --git a/justfile b/justfile
index 7e4f9d70..37a26925 100644
--- a/justfile
+++ b/justfile
@@ -72,4 +72,4 @@ unit-test module:
 [group("Integration")]
 [working-directory("./tests/integration")]
 integration *args='':
-  uv run ${uv_flags} pytest -vv -ra --capture=no --exitfirst "${args}"
+  uv run ${uv_flags} pytest -vv -ra --capture=no --exitfirst {{args}}
diff --git a/tests/integration/conftest.py b/tests/integration/conftest.py
index 8b6d95f6..91f492e5 100644
--- a/tests/integration/conftest.py
+++ b/tests/integration/conftest.py
@@ -10,17 +10,31 @@
 from helpers import TfDirManager
 
 
+def pytest_addoption(parser):
+    parser.addoption(
+        "--keep-models",
+        action="store_true",
+        default=False,
+        help="Keep temporarily-created models instead of destroying them after the tests run.",
+    )
+
+
+def _keep_models(request) -> bool:
+    """Whether to keep temporary models, via CLI flag or the KEEP_MODELS env var."""
+    return bool(request.config.getoption("--keep-models")) or (
+        os.environ.get("KEEP_MODELS") is not None
+    )
+
+
 @pytest.fixture(scope="module")
-def ca_model():
-    keep_models: bool = os.environ.get("KEEP_MODELS") is not None
-    with jubilant.temp_model(keep=keep_models) as juju:
+def ca_model(request):
+    with jubilant.temp_model(keep=_keep_models(request)) as juju:
         yield juju
 
 
 @pytest.fixture(scope="module")
-def cos_model():
-    keep_models: bool = os.environ.get("KEEP_MODELS") is not None
-    with jubilant.temp_model(keep=keep_models) as juju:
+def cos_model(request):
+    with jubilant.temp_model(keep=_keep_models(request)) as juju:
         yield juju
 
 

From 3ed4ae4a84365ef08ed1becf2d94865dfd9370d1 Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Fri, 17 Jul 2026 16:25:13 -0400
Subject: [PATCH 7/9] chore

---
 tests/integration/cos/tls_external/track-3.0.tf      | 4 ++--
 tests/integration/cos/tls_external/track-dev.tf      | 4 ++--
 tests/integration/cos/tls_full/track-3.0.tf          | 4 ++--
 tests/integration/cos/tls_full/track-dev.tf          | 4 ++--
 tests/integration/cos_dev/tls_external/track-dev.tf  | 4 ++--
 tests/integration/cos_dev/tls_full/track-dev.tf      | 4 ++--
 tests/integration/cos_lite/tls_external/track-3.0.tf | 4 ++--
 tests/integration/cos_lite/tls_external/track-dev.tf | 4 ++--
 tests/integration/cos_lite/tls_full/track-3.0.tf     | 4 ++--
 tests/integration/cos_lite/tls_full/track-dev.tf     | 4 ++--
 10 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/tests/integration/cos/tls_external/track-3.0.tf b/tests/integration/cos/tls_external/track-3.0.tf
index 7be9c976..bf189dce 100644
--- a/tests/integration/cos/tls_external/track-3.0.tf
+++ b/tests/integration/cos/tls_external/track-3.0.tf
@@ -48,8 +48,8 @@ module "cos" {
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "stable"
   internal_tls                    = false
-  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
-  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
+  external_certificates_offer_url = module.ssc.offers["certificates"].url
+  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
 
   s3_endpoint   = var.s3_endpoint
   s3_secret_key = var.s3_secret_key
diff --git a/tests/integration/cos/tls_external/track-dev.tf b/tests/integration/cos/tls_external/track-dev.tf
index b3abc16e..4595df69 100644
--- a/tests/integration/cos/tls_external/track-dev.tf
+++ b/tests/integration/cos/tls_external/track-dev.tf
@@ -48,8 +48,8 @@ module "cos" {
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "edge"
   internal_tls                    = false
-  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
-  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
+  external_certificates_offer_url = module.ssc.offers["certificates"].url
+  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
 
   s3_endpoint   = var.s3_endpoint
   s3_secret_key = var.s3_secret_key
diff --git a/tests/integration/cos/tls_full/track-3.0.tf b/tests/integration/cos/tls_full/track-3.0.tf
index 21c0245e..6df8dcd3 100644
--- a/tests/integration/cos/tls_full/track-3.0.tf
+++ b/tests/integration/cos/tls_full/track-3.0.tf
@@ -48,8 +48,8 @@ module "cos" {
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "stable"
   internal_tls                    = true
-  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
-  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
+  external_certificates_offer_url = module.ssc.offers["certificates"].url
+  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
 
   s3_endpoint   = var.s3_endpoint
   s3_secret_key = var.s3_secret_key
diff --git a/tests/integration/cos/tls_full/track-dev.tf b/tests/integration/cos/tls_full/track-dev.tf
index ad28155e..5c11f6da 100644
--- a/tests/integration/cos/tls_full/track-dev.tf
+++ b/tests/integration/cos/tls_full/track-dev.tf
@@ -48,8 +48,8 @@ module "cos" {
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "edge"
   internal_tls                    = true
-  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
-  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
+  external_certificates_offer_url = module.ssc.offers["certificates"].url
+  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
 
   s3_endpoint   = var.s3_endpoint
   s3_secret_key = var.s3_secret_key
diff --git a/tests/integration/cos_dev/tls_external/track-dev.tf b/tests/integration/cos_dev/tls_external/track-dev.tf
index 45d0913d..d9b5c1fd 100644
--- a/tests/integration/cos_dev/tls_external/track-dev.tf
+++ b/tests/integration/cos_dev/tls_external/track-dev.tf
@@ -36,6 +36,6 @@ module "cos-dev" {
   model_uuid                      = data.juju_model.cos-model.uuid
   risk                            = "edge"
   internal_tls                    = false
-  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
-  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
+  external_certificates_offer_url = module.ssc.offers["certificates"].url
+  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
 }
diff --git a/tests/integration/cos_dev/tls_full/track-dev.tf b/tests/integration/cos_dev/tls_full/track-dev.tf
index 7b09b326..a2453d36 100644
--- a/tests/integration/cos_dev/tls_full/track-dev.tf
+++ b/tests/integration/cos_dev/tls_full/track-dev.tf
@@ -36,6 +36,6 @@ module "cos-dev" {
   model_uuid                      = data.juju_model.cos-model.uuid
   risk                            = "edge"
   internal_tls                    = true
-  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
-  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
+  external_certificates_offer_url = module.ssc.offers["certificates"].url
+  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
 }
diff --git a/tests/integration/cos_lite/tls_external/track-3.0.tf b/tests/integration/cos_lite/tls_external/track-3.0.tf
index ba7b4f71..5e60fc62 100644
--- a/tests/integration/cos_lite/tls_external/track-3.0.tf
+++ b/tests/integration/cos_lite/tls_external/track-3.0.tf
@@ -37,6 +37,6 @@ module "cos-lite" {
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "stable"
   internal_tls                    = false
-  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
-  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
+  external_certificates_offer_url = module.ssc.offers["certificates"].url
+  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
 }
diff --git a/tests/integration/cos_lite/tls_external/track-dev.tf b/tests/integration/cos_lite/tls_external/track-dev.tf
index db5bf179..a371e59a 100644
--- a/tests/integration/cos_lite/tls_external/track-dev.tf
+++ b/tests/integration/cos_lite/tls_external/track-dev.tf
@@ -36,6 +36,6 @@ module "cos-lite" {
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "edge"
   internal_tls                    = false
-  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
-  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
+  external_certificates_offer_url = module.ssc.offers["certificates"].url
+  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
 }
diff --git a/tests/integration/cos_lite/tls_full/track-3.0.tf b/tests/integration/cos_lite/tls_full/track-3.0.tf
index f94aacf8..162b3fbe 100644
--- a/tests/integration/cos_lite/tls_full/track-3.0.tf
+++ b/tests/integration/cos_lite/tls_full/track-3.0.tf
@@ -36,6 +36,6 @@ module "cos-lite" {
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "stable"
   internal_tls                    = true
-  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
-  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
+  external_certificates_offer_url = module.ssc.offers["certificates"].url
+  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
 }
diff --git a/tests/integration/cos_lite/tls_full/track-dev.tf b/tests/integration/cos_lite/tls_full/track-dev.tf
index 3d0ddcc1..fe95a3e3 100644
--- a/tests/integration/cos_lite/tls_full/track-dev.tf
+++ b/tests/integration/cos_lite/tls_full/track-dev.tf
@@ -36,6 +36,6 @@ module "cos-lite" {
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "edge"
   internal_tls                    = true
-  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
-  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
+  external_certificates_offer_url = module.ssc.offers["certificates"].url
+  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
 }

From 73a1adc9ab08239bf3ead76d2d82d25d3c435803 Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Fri, 17 Jul 2026 16:53:50 -0400
Subject: [PATCH 8/9] chore

---
 tests/integration/cos/tls_external/track-3.0.tf      | 9 +++++++--
 tests/integration/cos/tls_external/track-dev.tf      | 9 +++++++--
 tests/integration/cos/tls_full/track-3.0.tf          | 9 +++++++--
 tests/integration/cos/tls_full/track-dev.tf          | 9 +++++++--
 tests/integration/cos_dev/tls_external/track-dev.tf  | 9 +++++++--
 tests/integration/cos_dev/tls_full/track-dev.tf      | 9 +++++++--
 tests/integration/cos_lite/tls_external/track-3.0.tf | 9 +++++++--
 tests/integration/cos_lite/tls_external/track-dev.tf | 9 +++++++--
 tests/integration/cos_lite/tls_full/track-3.0.tf     | 9 +++++++--
 tests/integration/cos_lite/tls_full/track-dev.tf     | 9 +++++++--
 10 files changed, 70 insertions(+), 20 deletions(-)

diff --git a/tests/integration/cos/tls_external/track-3.0.tf b/tests/integration/cos/tls_external/track-3.0.tf
index bf189dce..fbf3c4ea 100644
--- a/tests/integration/cos/tls_external/track-3.0.tf
+++ b/tests/integration/cos/tls_external/track-3.0.tf
@@ -48,8 +48,8 @@ module "cos" {
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "stable"
   internal_tls                    = false
-  external_certificates_offer_url = module.ssc.offers["certificates"].url
-  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
+  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
+  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
 
   s3_endpoint   = var.s3_endpoint
   s3_secret_key = var.s3_secret_key
@@ -63,4 +63,9 @@ module "cos" {
   mimir_worker      = { backend_units = 1, read_units = 1, write_units = 1 }
   tempo_coordinator = { units = 1 }
   tempo_worker      = { compactor_units = 1, distributor_units = 1, ingester_units = 1, metrics_generator_units = 1, querier_units = 1, query_frontend_units = 1 }
+
+  # The offer URLs must stay static strings so count/for_each in the module
+  # remain known at plan time. depends_on guarantees the CA model's offers are
+  # created before COS consumes them, without introducing apply-time-unknowns.
+  depends_on = [module.ssc]
 }
diff --git a/tests/integration/cos/tls_external/track-dev.tf b/tests/integration/cos/tls_external/track-dev.tf
index 4595df69..03ad9901 100644
--- a/tests/integration/cos/tls_external/track-dev.tf
+++ b/tests/integration/cos/tls_external/track-dev.tf
@@ -48,8 +48,8 @@ module "cos" {
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "edge"
   internal_tls                    = false
-  external_certificates_offer_url = module.ssc.offers["certificates"].url
-  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
+  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
+  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
 
   s3_endpoint   = var.s3_endpoint
   s3_secret_key = var.s3_secret_key
@@ -63,4 +63,9 @@ module "cos" {
   mimir_worker      = { backend_units = 1, read_units = 1, write_units = 1 }
   tempo_coordinator = { units = 1 }
   tempo_worker      = { compactor_units = 1, distributor_units = 1, ingester_units = 1, metrics_generator_units = 1, querier_units = 1, query_frontend_units = 1 }
+
+  # The offer URLs must stay static strings so count/for_each in the module
+  # remain known at plan time. depends_on guarantees the CA model's offers are
+  # created before COS consumes them, without introducing apply-time-unknowns.
+  depends_on = [module.ssc]
 }
diff --git a/tests/integration/cos/tls_full/track-3.0.tf b/tests/integration/cos/tls_full/track-3.0.tf
index 6df8dcd3..28f76939 100644
--- a/tests/integration/cos/tls_full/track-3.0.tf
+++ b/tests/integration/cos/tls_full/track-3.0.tf
@@ -48,8 +48,8 @@ module "cos" {
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "stable"
   internal_tls                    = true
-  external_certificates_offer_url = module.ssc.offers["certificates"].url
-  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
+  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
+  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
 
   s3_endpoint   = var.s3_endpoint
   s3_secret_key = var.s3_secret_key
@@ -63,4 +63,9 @@ module "cos" {
   mimir_worker      = { backend_units = 1, read_units = 1, write_units = 1 }
   tempo_coordinator = { units = 1 }
   tempo_worker      = { compactor_units = 1, distributor_units = 1, ingester_units = 1, metrics_generator_units = 1, querier_units = 1, query_frontend_units = 1 }
+
+  # The offer URLs must stay static strings so count/for_each in the module
+  # remain known at plan time. depends_on guarantees the CA model's offers are
+  # created before COS consumes them, without introducing apply-time-unknowns.
+  depends_on = [module.ssc]
 }
diff --git a/tests/integration/cos/tls_full/track-dev.tf b/tests/integration/cos/tls_full/track-dev.tf
index 5c11f6da..e5851900 100644
--- a/tests/integration/cos/tls_full/track-dev.tf
+++ b/tests/integration/cos/tls_full/track-dev.tf
@@ -48,8 +48,8 @@ module "cos" {
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "edge"
   internal_tls                    = true
-  external_certificates_offer_url = module.ssc.offers["certificates"].url
-  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
+  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
+  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
 
   s3_endpoint   = var.s3_endpoint
   s3_secret_key = var.s3_secret_key
@@ -63,4 +63,9 @@ module "cos" {
   mimir_worker      = { backend_units = 1, read_units = 1, write_units = 1 }
   tempo_coordinator = { units = 1 }
   tempo_worker      = { compactor_units = 1, distributor_units = 1, ingester_units = 1, metrics_generator_units = 1, querier_units = 1, query_frontend_units = 1 }
+
+  # The offer URLs must stay static strings so count/for_each in the module
+  # remain known at plan time. depends_on guarantees the CA model's offers are
+  # created before COS consumes them, without introducing apply-time-unknowns.
+  depends_on = [module.ssc]
 }
diff --git a/tests/integration/cos_dev/tls_external/track-dev.tf b/tests/integration/cos_dev/tls_external/track-dev.tf
index d9b5c1fd..d402d3ca 100644
--- a/tests/integration/cos_dev/tls_external/track-dev.tf
+++ b/tests/integration/cos_dev/tls_external/track-dev.tf
@@ -36,6 +36,11 @@ module "cos-dev" {
   model_uuid                      = data.juju_model.cos-model.uuid
   risk                            = "edge"
   internal_tls                    = false
-  external_certificates_offer_url = module.ssc.offers["certificates"].url
-  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
+  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
+  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
+
+  # The offer URLs must stay static strings so count/for_each in the module
+  # remain known at plan time. depends_on guarantees the CA model's offers are
+  # created before COS consumes them, without introducing apply-time-unknowns.
+  depends_on = [module.ssc]
 }
diff --git a/tests/integration/cos_dev/tls_full/track-dev.tf b/tests/integration/cos_dev/tls_full/track-dev.tf
index a2453d36..d716f508 100644
--- a/tests/integration/cos_dev/tls_full/track-dev.tf
+++ b/tests/integration/cos_dev/tls_full/track-dev.tf
@@ -36,6 +36,11 @@ module "cos-dev" {
   model_uuid                      = data.juju_model.cos-model.uuid
   risk                            = "edge"
   internal_tls                    = true
-  external_certificates_offer_url = module.ssc.offers["certificates"].url
-  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
+  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
+  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
+
+  # The offer URLs must stay static strings so count/for_each in the module
+  # remain known at plan time. depends_on guarantees the CA model's offers are
+  # created before COS consumes them, without introducing apply-time-unknowns.
+  depends_on = [module.ssc]
 }
diff --git a/tests/integration/cos_lite/tls_external/track-3.0.tf b/tests/integration/cos_lite/tls_external/track-3.0.tf
index 5e60fc62..8aee32e6 100644
--- a/tests/integration/cos_lite/tls_external/track-3.0.tf
+++ b/tests/integration/cos_lite/tls_external/track-3.0.tf
@@ -37,6 +37,11 @@ module "cos-lite" {
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "stable"
   internal_tls                    = false
-  external_certificates_offer_url = module.ssc.offers["certificates"].url
-  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
+  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
+  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
+
+  # The offer URLs must stay static strings so count/for_each in the module
+  # remain known at plan time. depends_on guarantees the CA model's offers are
+  # created before COS consumes them, without introducing apply-time-unknowns.
+  depends_on = [module.ssc]
 }
diff --git a/tests/integration/cos_lite/tls_external/track-dev.tf b/tests/integration/cos_lite/tls_external/track-dev.tf
index a371e59a..3d3d6ff5 100644
--- a/tests/integration/cos_lite/tls_external/track-dev.tf
+++ b/tests/integration/cos_lite/tls_external/track-dev.tf
@@ -36,6 +36,11 @@ module "cos-lite" {
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "edge"
   internal_tls                    = false
-  external_certificates_offer_url = module.ssc.offers["certificates"].url
-  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
+  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
+  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
+
+  # The offer URLs must stay static strings so count/for_each in the module
+  # remain known at plan time. depends_on guarantees the CA model's offers are
+  # created before COS consumes them, without introducing apply-time-unknowns.
+  depends_on = [module.ssc]
 }
diff --git a/tests/integration/cos_lite/tls_full/track-3.0.tf b/tests/integration/cos_lite/tls_full/track-3.0.tf
index 162b3fbe..b9882260 100644
--- a/tests/integration/cos_lite/tls_full/track-3.0.tf
+++ b/tests/integration/cos_lite/tls_full/track-3.0.tf
@@ -36,6 +36,11 @@ module "cos-lite" {
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "stable"
   internal_tls                    = true
-  external_certificates_offer_url = module.ssc.offers["certificates"].url
-  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
+  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
+  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
+
+  # The offer URLs must stay static strings so count/for_each in the module
+  # remain known at plan time. depends_on guarantees the CA model's offers are
+  # created before COS consumes them, without introducing apply-time-unknowns.
+  depends_on = [module.ssc]
 }
diff --git a/tests/integration/cos_lite/tls_full/track-dev.tf b/tests/integration/cos_lite/tls_full/track-dev.tf
index fe95a3e3..f096cf00 100644
--- a/tests/integration/cos_lite/tls_full/track-dev.tf
+++ b/tests/integration/cos_lite/tls_full/track-dev.tf
@@ -36,6 +36,11 @@ module "cos-lite" {
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "edge"
   internal_tls                    = true
-  external_certificates_offer_url = module.ssc.offers["certificates"].url
-  external_ca_cert_offer_url      = module.ssc.offers["send-ca-cert"].url
+  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
+  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
+
+  # The offer URLs must stay static strings so count/for_each in the module
+  # remain known at plan time. depends_on guarantees the CA model's offers are
+  # created before COS consumes them, without introducing apply-time-unknowns.
+  depends_on = [module.ssc]
 }

From aed97283db9d5db2405f64a52dcb2ccc5da85388 Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Mon, 20 Jul 2026 08:49:39 -0400
Subject: [PATCH 9/9] Done testing

---
 .github/workflows/_integration.yml            |  7 +++++--
 .github/workflows/terraform.yml               | 20 +++++++++----------
 terraform/cos-lite/applications.tf            |  1 -
 .../integration/cos/tls_external/track-3.0.tf |  9 +++------
 .../integration/cos/tls_external/track-dev.tf |  9 +++------
 tests/integration/cos/tls_full/track-3.0.tf   |  9 +++------
 tests/integration/cos/tls_full/track-dev.tf   |  9 +++------
 .../cos_dev/tls_external/track-dev.tf         |  9 +++------
 .../integration/cos_dev/tls_full/track-dev.tf |  9 +++------
 .../cos_lite/tls_external/track-3.0.tf        |  9 +++------
 .../cos_lite/tls_external/track-dev.tf        |  9 +++------
 .../cos_lite/tls_full/track-3.0.tf            |  9 +++------
 .../cos_lite/tls_full/track-dev.tf            |  9 +++------
 13 files changed, 45 insertions(+), 73 deletions(-)

diff --git a/.github/workflows/_integration.yml b/.github/workflows/_integration.yml
index af30d054..5ea461c2 100644
--- a/.github/workflows/_integration.yml
+++ b/.github/workflows/_integration.yml
@@ -38,8 +38,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        juju-channel: ["4.1/beta"]
-        scenario: ["juju_4"]
+        juju-channel: ["3.6/stable"]
+        scenario: ["tls_full", "tls_external", "tls_internal", "tls_none"]
+        include:
+        - juju-channel: "4.1/beta"
+          scenario: "juju_4"
     steps:
       - name: Checkout
         uses: actions/checkout@v4
diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml
index 8a9884c6..7164cc25 100644
--- a/.github/workflows/terraform.yml
+++ b/.github/workflows/terraform.yml
@@ -95,7 +95,7 @@ jobs:
     name: COS Lite Terraform integration
     needs: [test-unit, changes]
     if: ${{ github.event_name == 'workflow_dispatch' || needs.changes.outputs.cos_lite == 'true' }}
-    uses: canonical/observability-stack/.github/workflows/_integration.yml@MichaelThamm-patch-1
+    uses: canonical/observability-stack/.github/workflows/_integration.yml@main
     with:
       product: cos_lite
       runner: self-hosted-linux-amd64-noble-large
@@ -103,15 +103,15 @@ jobs:
     name: COS Terraform integration
     needs: [test-unit, changes]
     if: ${{ github.event_name == 'workflow_dispatch' || needs.changes.outputs.cos == 'true' }}
-    uses: canonical/observability-stack/.github/workflows/_integration.yml@MichaelThamm-patch-1
+    uses: canonical/observability-stack/.github/workflows/_integration.yml@main
     with:
       product: cos
       runner: self-hosted-linux-amd64-noble-xlarge
-  # test-integration-cos-dev:
-  #   name: COS Dev Terraform integration
-  #   needs: [test-unit, changes]
-  #   if: ${{ github.event_name == 'workflow_dispatch' || needs.changes.outputs.cos_dev == 'true' }}
-  #   uses: canonical/observability-stack/.github/workflows/_integration.yml@MichaelThamm-patch-1
-  #   with:
-  #     product: cos_dev
-  #     runner: self-hosted-linux-amd64-noble-large
\ No newline at end of file
+  test-integration-cos-dev:
+    name: COS Dev Terraform integration
+    needs: [test-unit, changes]
+    if: ${{ github.event_name == 'workflow_dispatch' || needs.changes.outputs.cos_dev == 'true' }}
+    uses: canonical/observability-stack/.github/workflows/_integration.yml@main
+    with:
+      product: cos_dev
+      runner: self-hosted-linux-amd64-noble-large
\ No newline at end of file
diff --git a/terraform/cos-lite/applications.tf b/terraform/cos-lite/applications.tf
index b51d995b..cf4787d7 100644
--- a/terraform/cos-lite/applications.tf
+++ b/terraform/cos-lite/applications.tf
@@ -1,4 +1,3 @@
-# TODO: Remove once done testing
 module "alertmanager" {
   source = "git::https://github.com/canonical/alertmanager-k8s-operator//terraform"
 
diff --git a/tests/integration/cos/tls_external/track-3.0.tf b/tests/integration/cos/tls_external/track-3.0.tf
index fbf3c4ea..8ecc168e 100644
--- a/tests/integration/cos/tls_external/track-3.0.tf
+++ b/tests/integration/cos/tls_external/track-3.0.tf
@@ -44,7 +44,9 @@ module "ssc" {
 }
 
 module "cos" {
-  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos?ref=track/3.0"
+  source     = "git::https://github.com/canonical/observability-stack//terraform/cos?ref=track/3.0"
+  depends_on = [module.ssc] # Ensure the CA model's offers exist before COS consumes them.
+
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "stable"
   internal_tls                    = false
@@ -63,9 +65,4 @@ module "cos" {
   mimir_worker      = { backend_units = 1, read_units = 1, write_units = 1 }
   tempo_coordinator = { units = 1 }
   tempo_worker      = { compactor_units = 1, distributor_units = 1, ingester_units = 1, metrics_generator_units = 1, querier_units = 1, query_frontend_units = 1 }
-
-  # The offer URLs must stay static strings so count/for_each in the module
-  # remain known at plan time. depends_on guarantees the CA model's offers are
-  # created before COS consumes them, without introducing apply-time-unknowns.
-  depends_on = [module.ssc]
 }
diff --git a/tests/integration/cos/tls_external/track-dev.tf b/tests/integration/cos/tls_external/track-dev.tf
index 03ad9901..5f4eaee0 100644
--- a/tests/integration/cos/tls_external/track-dev.tf
+++ b/tests/integration/cos/tls_external/track-dev.tf
@@ -44,7 +44,9 @@ module "ssc" {
 }
 
 module "cos" {
-  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos"
+  source     = "git::https://github.com/canonical/observability-stack//terraform/cos"
+  depends_on = [module.ssc] # Ensure the CA model's offers exist before COS consumes them.
+
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "edge"
   internal_tls                    = false
@@ -63,9 +65,4 @@ module "cos" {
   mimir_worker      = { backend_units = 1, read_units = 1, write_units = 1 }
   tempo_coordinator = { units = 1 }
   tempo_worker      = { compactor_units = 1, distributor_units = 1, ingester_units = 1, metrics_generator_units = 1, querier_units = 1, query_frontend_units = 1 }
-
-  # The offer URLs must stay static strings so count/for_each in the module
-  # remain known at plan time. depends_on guarantees the CA model's offers are
-  # created before COS consumes them, without introducing apply-time-unknowns.
-  depends_on = [module.ssc]
 }
diff --git a/tests/integration/cos/tls_full/track-3.0.tf b/tests/integration/cos/tls_full/track-3.0.tf
index 28f76939..c77f8009 100644
--- a/tests/integration/cos/tls_full/track-3.0.tf
+++ b/tests/integration/cos/tls_full/track-3.0.tf
@@ -44,7 +44,9 @@ module "ssc" {
 }
 
 module "cos" {
-  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos?ref=track/3.0"
+  source     = "git::https://github.com/canonical/observability-stack//terraform/cos?ref=track/3.0"
+  depends_on = [module.ssc] # Ensure the CA model's offers exist before COS consumes them.
+
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "stable"
   internal_tls                    = true
@@ -63,9 +65,4 @@ module "cos" {
   mimir_worker      = { backend_units = 1, read_units = 1, write_units = 1 }
   tempo_coordinator = { units = 1 }
   tempo_worker      = { compactor_units = 1, distributor_units = 1, ingester_units = 1, metrics_generator_units = 1, querier_units = 1, query_frontend_units = 1 }
-
-  # The offer URLs must stay static strings so count/for_each in the module
-  # remain known at plan time. depends_on guarantees the CA model's offers are
-  # created before COS consumes them, without introducing apply-time-unknowns.
-  depends_on = [module.ssc]
 }
diff --git a/tests/integration/cos/tls_full/track-dev.tf b/tests/integration/cos/tls_full/track-dev.tf
index e5851900..6c901fe7 100644
--- a/tests/integration/cos/tls_full/track-dev.tf
+++ b/tests/integration/cos/tls_full/track-dev.tf
@@ -44,7 +44,9 @@ module "ssc" {
 }
 
 module "cos" {
-  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos"
+  source     = "git::https://github.com/canonical/observability-stack//terraform/cos"
+  depends_on = [module.ssc] # Ensure the CA model's offers exist before COS consumes them.
+
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "edge"
   internal_tls                    = true
@@ -63,9 +65,4 @@ module "cos" {
   mimir_worker      = { backend_units = 1, read_units = 1, write_units = 1 }
   tempo_coordinator = { units = 1 }
   tempo_worker      = { compactor_units = 1, distributor_units = 1, ingester_units = 1, metrics_generator_units = 1, querier_units = 1, query_frontend_units = 1 }
-
-  # The offer URLs must stay static strings so count/for_each in the module
-  # remain known at plan time. depends_on guarantees the CA model's offers are
-  # created before COS consumes them, without introducing apply-time-unknowns.
-  depends_on = [module.ssc]
 }
diff --git a/tests/integration/cos_dev/tls_external/track-dev.tf b/tests/integration/cos_dev/tls_external/track-dev.tf
index d402d3ca..47fe602f 100644
--- a/tests/integration/cos_dev/tls_external/track-dev.tf
+++ b/tests/integration/cos_dev/tls_external/track-dev.tf
@@ -32,15 +32,12 @@ module "ssc" {
 }
 
 module "cos-dev" {
-  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos-dev"
+  source     = "git::https://github.com/canonical/observability-stack//terraform/cos-dev"
+  depends_on = [module.ssc] # Ensure the CA model's offers exist before COS consumes them.
+
   model_uuid                      = data.juju_model.cos-model.uuid
   risk                            = "edge"
   internal_tls                    = false
   external_certificates_offer_url = "admin/${var.ca_model}.certificates"
   external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
-
-  # The offer URLs must stay static strings so count/for_each in the module
-  # remain known at plan time. depends_on guarantees the CA model's offers are
-  # created before COS consumes them, without introducing apply-time-unknowns.
-  depends_on = [module.ssc]
 }
diff --git a/tests/integration/cos_dev/tls_full/track-dev.tf b/tests/integration/cos_dev/tls_full/track-dev.tf
index d716f508..f2c58553 100644
--- a/tests/integration/cos_dev/tls_full/track-dev.tf
+++ b/tests/integration/cos_dev/tls_full/track-dev.tf
@@ -32,15 +32,12 @@ module "ssc" {
 }
 
 module "cos-dev" {
-  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos-dev"
+  source     = "git::https://github.com/canonical/observability-stack//terraform/cos-dev"
+  depends_on = [module.ssc] # Ensure the CA model's offers exist before COS consumes them.
+
   model_uuid                      = data.juju_model.cos-model.uuid
   risk                            = "edge"
   internal_tls                    = true
   external_certificates_offer_url = "admin/${var.ca_model}.certificates"
   external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
-
-  # The offer URLs must stay static strings so count/for_each in the module
-  # remain known at plan time. depends_on guarantees the CA model's offers are
-  # created before COS consumes them, without introducing apply-time-unknowns.
-  depends_on = [module.ssc]
 }
diff --git a/tests/integration/cos_lite/tls_external/track-3.0.tf b/tests/integration/cos_lite/tls_external/track-3.0.tf
index 8aee32e6..2566b37a 100644
--- a/tests/integration/cos_lite/tls_external/track-3.0.tf
+++ b/tests/integration/cos_lite/tls_external/track-3.0.tf
@@ -33,15 +33,12 @@ module "ssc" {
 }
 
 module "cos-lite" {
-  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos-lite?ref=track/3.0"
+  source     = "git::https://github.com/canonical/observability-stack//terraform/cos-lite?ref=track/3.0"
+  depends_on = [module.ssc] # Ensure the CA model's offers exist before COS consumes them.
+
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "stable"
   internal_tls                    = false
   external_certificates_offer_url = "admin/${var.ca_model}.certificates"
   external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
-
-  # The offer URLs must stay static strings so count/for_each in the module
-  # remain known at plan time. depends_on guarantees the CA model's offers are
-  # created before COS consumes them, without introducing apply-time-unknowns.
-  depends_on = [module.ssc]
 }
diff --git a/tests/integration/cos_lite/tls_external/track-dev.tf b/tests/integration/cos_lite/tls_external/track-dev.tf
index 3d3d6ff5..5cb5d03a 100644
--- a/tests/integration/cos_lite/tls_external/track-dev.tf
+++ b/tests/integration/cos_lite/tls_external/track-dev.tf
@@ -32,15 +32,12 @@ module "ssc" {
 }
 
 module "cos-lite" {
-  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos-lite"
+  source     = "git::https://github.com/canonical/observability-stack//terraform/cos-lite"
+  depends_on = [module.ssc] # Ensure the CA model's offers exist before COS consumes them.
+
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "edge"
   internal_tls                    = false
   external_certificates_offer_url = "admin/${var.ca_model}.certificates"
   external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
-
-  # The offer URLs must stay static strings so count/for_each in the module
-  # remain known at plan time. depends_on guarantees the CA model's offers are
-  # created before COS consumes them, without introducing apply-time-unknowns.
-  depends_on = [module.ssc]
 }
diff --git a/tests/integration/cos_lite/tls_full/track-3.0.tf b/tests/integration/cos_lite/tls_full/track-3.0.tf
index b9882260..459ae0f9 100644
--- a/tests/integration/cos_lite/tls_full/track-3.0.tf
+++ b/tests/integration/cos_lite/tls_full/track-3.0.tf
@@ -32,15 +32,12 @@ module "ssc" {
 }
 
 module "cos-lite" {
-  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos-lite?ref=track/3.0"
+  source     = "git::https://github.com/canonical/observability-stack//terraform/cos-lite?ref=track/3.0"
+  depends_on = [module.ssc] # Ensure the CA model's offers exist before COS consumes them.
+
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "stable"
   internal_tls                    = true
   external_certificates_offer_url = "admin/${var.ca_model}.certificates"
   external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
-
-  # The offer URLs must stay static strings so count/for_each in the module
-  # remain known at plan time. depends_on guarantees the CA model's offers are
-  # created before COS consumes them, without introducing apply-time-unknowns.
-  depends_on = [module.ssc]
 }
diff --git a/tests/integration/cos_lite/tls_full/track-dev.tf b/tests/integration/cos_lite/tls_full/track-dev.tf
index f096cf00..64a9437e 100644
--- a/tests/integration/cos_lite/tls_full/track-dev.tf
+++ b/tests/integration/cos_lite/tls_full/track-dev.tf
@@ -32,15 +32,12 @@ module "ssc" {
 }
 
 module "cos-lite" {
-  source                          = "git::https://github.com/canonical/observability-stack//terraform/cos-lite"
+  source     = "git::https://github.com/canonical/observability-stack//terraform/cos-lite"
+  depends_on = [module.ssc] # Ensure the CA model's offers exist before COS consumes them.
+
   model                           = { uuid = data.juju_model.cos-model.uuid }
   risk                            = "edge"
   internal_tls                    = true
   external_certificates_offer_url = "admin/${var.ca_model}.certificates"
   external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
-
-  # The offer URLs must stay static strings so count/for_each in the module
-  # remain known at plan time. depends_on guarantees the CA model's offers are
-  # created before COS consumes them, without introducing apply-time-unknowns.
-  depends_on = [module.ssc]
 }