diff --git a/plan-jsrsasign.md b/plan-jsrsasign.md
index a561bba0..da67b749 100644
--- a/plan-jsrsasign.md
+++ b/plan-jsrsasign.md
@@ -242,6 +242,10 @@ After **PR 6:**
 
 Record deviations from the original plan here, newest at the top. One bullet per change: what changed, why, and which PR.
 
+### Post-migration test cleanup — 2026-05-18
+- **Ed25519 / Ed448 expected pubkeys in [tests/operations/tests/PubKeyFromCert.mjs](tests/operations/tests/PubKeyFromCert.mjs) cross-verified externally.** Ed25519 matches `openssl x509 -pubkey -noout` byte-for-byte; Ed448 was verified by extracting the SPKI directly from the cert's DER bytes (openssl 3.6.2 in this environment doesn't support Ed448). A short comment above each `ED*_PUBKEY` constant records the verification so the fixtures aren't read as circular snapshots of `@peculiar/x509`'s own output.
+- **[tests/node/tests/nodeApi.mjs](tests/node/tests/nodeApi.mjs) recipe-format tests no longer feed `Hex to PEM` garbage.** The three `chef.bake` tests previously piped Morse-coded output (dashes/dots) through `Hex to PEM`, which is the reason PR 1 made `derToPem` lenient about non-hex input. They now use `To Hex` → `Hex to PEM` → `To Snake case` and produce well-formed PEM of `"some input"`. Same coverage of compact JSON / clean JSON / optional-args parsing; `derToPem`'s leniency is no longer test-load-bearing (but kept for backwards compatibility).
+
 ### PR 6 — 2026-05-17
 - Removed `jsrsasign` from [package.json](package.json) and [package-lock.json](package-lock.json). No runtime code changes were needed because PRs 1-5 had already moved operations to `@noble/curves`, `@peculiar/x509`, and `asn1js`.
 - Removed stale dependency-name mentions from `src/` comments so `rg -n "jsrsasign" src/` is clean. Remaining mentions are intentionally limited to migration documentation and [CHANGELOG.md](CHANGELOG.md).
diff --git a/tests/node/tests/nodeApi.mjs b/tests/node/tests/nodeApi.mjs
index a84441f3..7d09ef62 100644
--- a/tests/node/tests/nodeApi.mjs
+++ b/tests/node/tests/nodeApi.mjs
@@ -318,31 +318,31 @@ TestRegister.addApiTests([
     }),
 
     it("chef.bake: should take compact JSON format from Chef Website as recipe", async () => {
-        const result = await chef.bake("some input", [{"op": "To Morse Code", "args": ["Dash/Dot", "Backslash", "Comma"]}, {"op": "Hex to PEM", "args": ["SOMETHING"]}, {"op": "To Snake case", "args": [false]}]);
-        assert.strictEqual(result.toString(), "begin_something_dqanaaaa_cg_aka_ao_a_2_g_da_aaaaaaana_no_adqana_ao_a_cg_aaaaana_ao_a_2_g_a_end_something");
+        const result = await chef.bake("some input", [{"op": "To Hex", "args": ["Space", 0]}, {"op": "Hex to PEM", "args": ["SOMETHING"]}, {"op": "To Snake case", "args": [false]}]);
+        assert.strictEqual(result.toString(), "begin_something_c_29_t_zs_bpbn_b_1_d_a_end_something");
     }),
 
     it("chef.bake: should accept Clean JSON format from Chef website as recipe", async () => {
         const result = await chef.bake("some input", [
-            { "op": "To Morse Code",
-                "args": ["Dash/Dot", "Backslash", "Comma"] },
+            { "op": "To Hex",
+                "args": ["Space", 0] },
             { "op": "Hex to PEM",
                 "args": ["SOMETHING"] },
             { "op": "To Snake case",
                 "args": [false] }
         ]);
-        assert.strictEqual(result.toString(), "begin_something_dqanaaaa_cg_aka_ao_a_2_g_da_aaaaaaana_no_adqana_ao_a_cg_aaaaana_ao_a_2_g_a_end_something");
+        assert.strictEqual(result.toString(), "begin_something_c_29_t_zs_bpbn_b_1_d_a_end_something");
     }),
 
     it("chef.bake: should accept Clean JSON format from Chef website - args optional", async () => {
         const result = await chef.bake("some input", [
-            { "op": "To Morse Code" },
+            { "op": "To Hex" },
             { "op": "Hex to PEM",
                 "args": ["SOMETHING"] },
             { "op": "To Snake case",
                 "args": [false] }
         ]);
-        assert.strictEqual(result.toString(), "begin_something_aaaaaaaaaaaaaaa_end_something");
+        assert.strictEqual(result.toString(), "begin_something_c_29_t_zs_bpbn_b_1_d_a_end_something");
     }),
 
     it("chef.bake: should accept operation names from Chef Website which contain forward slash", async () => {
diff --git a/tests/operations/tests/PubKeyFromCert.mjs b/tests/operations/tests/PubKeyFromCert.mjs
index 0fe5a5cd..c71445a1 100644
--- a/tests/operations/tests/PubKeyFromCert.mjs
+++ b/tests/operations/tests/PubKeyFromCert.mjs
@@ -99,6 +99,7 @@ HRMBAf8EBTADAQH/MAUGAytlcANBAI/+03iVq4yJ+DaLVs61w41cVX2UxKvquSzv
 lllkpkclM9LH5dLrw4ArdTjS9zAjzY/02WkphHhICHXt3KqZTwI=
 -----END CERTIFICATE-----`;
 
+// Cross-checked against `openssl x509 -pubkey -noout` on ED25519_CERT.
 const ED25519_PUBKEY = `-----BEGIN PUBLIC KEY-----
 MCowBQYDK2VwAyEAELP6AflXwsuZ5q4NDIO0LP2iCdKRvds4nwsUmRhOw3g=
 -----END PUBLIC KEY-----`;
@@ -115,6 +116,8 @@ VkLqpoDNMRcM3Eb6h3AJpQM0oxGj8q9arjDXqJkXgaO2e0tVn8KKVfy7S8qO72Kd
 rWzZowcOjnWKhXm7JgA=
 -----END CERTIFICATE-----`;
 
+// Cross-checked against the SPKI extracted directly from ED448_CERT's DER
+// bytes (openssl 3.6.2 in this environment does not support Ed448).
 const ED448_PUBKEY = `-----BEGIN PUBLIC KEY-----
 MEMwBQYDK2VxAzoAVN8kG0TMVyGOu/OvBTe8H0Wi4HJrQAlSv4XLwJbkuoi4EeRl
 EHQwXsNYLZTtY2Jra6AWhbVYYaEA