diff --git a/test/manifest.bats b/test/manifest.bats
index 2a226d1..3719e8e 100644
--- a/test/manifest.bats
+++ b/test/manifest.bats
@@ -860,3 +860,53 @@ m_nojq_path() {
   [ "$status" -eq 1 ]
   [[ "$output" == *"packages/web/.env.development"* ]] || false
 }
+
+@test "verify: external blob that fails to decrypt is a finding (exit 1)" {
+  init_with_remote
+  m_gradle_src $'beaconClerkPkTest=pk_test_abc\n'
+  create_project_dir verifyextcorrupt
+  printf 'gradle-properties ~/.gradle/gradle.properties beaconClerkPkTest\n' > .secrets-files
+  "$SECRETS_BIN" push >/dev/null 2>&1
+  printf 'garbage' > "$SECRETS_DIR/verifyextcorrupt/external/"*.age
+  run "$SECRETS_BIN" verify
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"external"* ]] || false
+}
+
+@test "verify: an unsafe dotenv path in the manifest is a finding (exit 1)" {
+  init_with_remote
+  create_project_dir verifyunsafe
+  "$SECRETS_BIN" push >/dev/null 2>&1
+  # Hand-edit the committed manifest to declare a traversal path the rail refuses.
+  jq '.dotenv += ["../evil"]' .secrets.json > .secrets.json.tmp && mv .secrets.json.tmp .secrets.json
+  run "$SECRETS_BIN" verify
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"unsafe"* ]] || false
+}
+
+@test "verify: unknown flag dies with usage" {
+  init_with_remote
+  create_project_dir verifyflag
+  "$SECRETS_BIN" push >/dev/null 2>&1
+  run "$SECRETS_BIN" verify --bogus
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"Unknown verify flag"* ]] || false
+}
+
+@test "verify: malformed manifest is refused" {
+  init_with_remote
+  create_project_dir verifymalformed
+  "$SECRETS_BIN" push >/dev/null 2>&1
+  printf 'not json{' > .secrets.json
+  run "$SECRETS_BIN" verify
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"JSON"* ]] || false
+}
+
+@test "verify --all: empty store reports nothing to check (exit 0)" {
+  init_with_remote
+  cd "$WORK_DIR"
+  run "$SECRETS_BIN" verify --all
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"empty"* ]] || false
+}