diff --git a/compos/tests/java/android/compos/test/ComposTestCase.java b/compos/tests/java/android/compos/test/ComposTestCase.java
index b70e367..b31f4f3 100644
--- a/compos/tests/java/android/compos/test/ComposTestCase.java
+++ b/compos/tests/java/android/compos/test/ComposTestCase.java
@@ -197,7 +197,6 @@
                                 10000,
                                 validator.getAbsolutePath(),
                                 "dice-chain",
-                                "--allow-any-mode",
                                 bcc_file.getAbsolutePath());
         assertWithMessage("hwtrust failed").about(command_results()).that(result).isSuccess();
     }
diff --git a/rialto/tests/test.rs b/rialto/tests/test.rs
index c2e45f2..0d57301 100644
--- a/rialto/tests/test.rs
+++ b/rialto/tests/test.rs
@@ -71,7 +71,7 @@
 
     check_processing_reverse_request(&mut vm)?;
     let key_pair = check_processing_generating_key_pair_request(&mut vm)?;
-    check_processing_generating_certificate_request(&mut vm, &key_pair.maced_public_key, vm_type)?;
+    check_processing_generating_certificate_request(&mut vm, &key_pair.maced_public_key)?;
     check_attestation_request(&mut vm, &key_pair, vm_type)?;
     Ok(())
 }
@@ -111,7 +111,6 @@
 fn check_processing_generating_certificate_request(
     vm: &mut ServiceVm,
     maced_public_key: &[u8],
-    vm_type: VmType,
 ) -> Result<()> {
     let params = GenerateCertificateRequestParams {
         keys_to_sign: vec![maced_public_key.to_vec()],
@@ -123,7 +122,7 @@
     info!("Received response: {response:?}.");
 
     match response {
-        Response::GenerateCertificateRequest(csr) => check_csr(csr, vm_type),
+        Response::GenerateCertificateRequest(csr) => check_csr(csr),
         _ => bail!("Incorrect response type: {response:?}"),
     }
 }
@@ -276,14 +275,8 @@
     Ok(())
 }
 
-fn check_csr(csr: Vec<u8>, vm_type: VmType) -> Result<()> {
-    let mut session = Session::default();
-
-    // Allow any mode for non-protected VMs because they use a fake DICE chain with the mode set to
-    // debug.
-    session.set_allow_any_mode(vm_type == VmType::NonProtectedVm);
-
-    let _csr = rkp::Csr::from_cbor(&session, &csr[..]).context("Failed to parse CSR")?;
+fn check_csr(csr: Vec<u8>) -> Result<()> {
+    let _csr = rkp::Csr::from_cbor(&Session::default(), &csr[..]).context("Failed to parse CSR")?;
     Ok(())
 }
 
diff --git a/tests/helper/src/java/com/android/microdroid/test/device/MicrodroidDeviceTestBase.java b/tests/helper/src/java/com/android/microdroid/test/device/MicrodroidDeviceTestBase.java
index 280207e..9b25f86 100644
--- a/tests/helper/src/java/com/android/microdroid/test/device/MicrodroidDeviceTestBase.java
+++ b/tests/helper/src/java/com/android/microdroid/test/device/MicrodroidDeviceTestBase.java
@@ -16,6 +16,7 @@
 package com.android.microdroid.test.device;
 
 import static android.content.pm.PackageManager.FEATURE_VIRTUALIZATION_FRAMEWORK;
+import static android.content.pm.PackageManager.FEATURE_WATCH;
 
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.TruthJUnit.assume;
@@ -222,6 +223,12 @@
                 .isFalse();
     }
 
+    protected void assumeVsrCompliant() {
+        assume().withMessage("Watches are not VSR compliant")
+                .that(mCtx.getPackageManager().hasSystemFeature(FEATURE_WATCH))
+                .isFalse();
+    }
+
     protected boolean isGsi() {
         return new File("/system/system_ext/etc/init/init.gsi.rc").exists();
     }
diff --git a/tests/hostside/helper/java/com/android/microdroid/test/host/MicrodroidHostTestCaseBase.java b/tests/hostside/helper/java/com/android/microdroid/test/host/MicrodroidHostTestCaseBase.java
index 6954b30..432f5e6 100644
--- a/tests/hostside/helper/java/com/android/microdroid/test/host/MicrodroidHostTestCaseBase.java
+++ b/tests/hostside/helper/java/com/android/microdroid/test/host/MicrodroidHostTestCaseBase.java
@@ -284,6 +284,6 @@
     }
 
     protected boolean isPkvmHypervisor() throws DeviceNotAvailableException {
-        return getDevice().getProperty("ro.boot.hypervisor.version").equals("kvm.arm-protected");
+        return "kvm.arm-protected".equals(getDevice().getProperty("ro.boot.hypervisor.version"));
     }
 }
diff --git a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidCapabilitiesTest.java b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidCapabilitiesTest.java
index 3b755a0..08bc310 100644
--- a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidCapabilitiesTest.java
+++ b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidCapabilitiesTest.java
@@ -63,6 +63,7 @@
     @Test
     @VsrTest(requirements = "VSR-7.1-001.005")
     public void avfIsRequired() {
+        assumeVsrCompliant();
         assume().withMessage("Requirement doesn't apply due to vendor API level")
                 .that(getVendorApiLevel())
                 .isAtLeast(202404);
diff --git a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
index c94f171..fd67659 100644
--- a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
+++ b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
@@ -2288,6 +2288,7 @@
     @Test
     @VsrTest(requirements = {"VSR-7.1-001.003"})
     public void kernelVersionRequirement() throws Exception {
+        assumeVsrCompliant();
         int firstApiLevel = SystemProperties.getInt("ro.product.first_api_level", 0);
         assume().withMessage("Skip on devices launched before Android 14 (API level 34)")
                 .that(firstApiLevel)