diff --git a/requirements/v1/requirements.txt b/requirements/v1/requirements.txt
index d9baa983..e7124ae8 100644
--- a/requirements/v1/requirements.txt
+++ b/requirements/v1/requirements.txt
@@ -1,3 +1,3 @@
-ops >= 2.1.1
+ops >= 2.1.1,<3.8.0
 pydantic>=2.11,<3
-poetry-core
\ No newline at end of file
+poetry-core
diff --git a/tests/jubilant_helpers.py b/tests/jubilant_helpers.py
index baca3ce5..d2fa47da 100644
--- a/tests/jubilant_helpers.py
+++ b/tests/jubilant_helpers.py
@@ -17,6 +17,9 @@
 TLS_ROOT_DIR = "/var/snap/charmed-etcd/current/tls"
 CLIENT_PORT = 2379
 
+TLSLIBID = "afd8c2bccf834997afce12c2706d2ede"
+CLIENT_TLS_RELATION_NAME = "client-certificates"
+
 logger = logging.getLogger(__name__)
 
 
@@ -73,9 +76,16 @@ def download_client_certificate_from_unit(juju: Juju, app_name: str = ETCD_APP_N
 
     tls_path = TLS_ROOT_DIR
 
-    for file in ["client.pem", "client.key", "client_ca.pem"]:
+    for file in ["client.pem", "client_ca.pem"]:
         juju.scp(f"{unit}:{tls_path}/{file}", file)
 
+    private_key = get_secret_by_label_jubilant(
+        juju, label=f"{TLSLIBID}-private-key-{unit.split('/')[1]}-{CLIENT_TLS_RELATION_NAME}"
+    )["private-key"]
+
+    with open("client.key", "w") as f:
+        f.write(private_key)
+
 
 def get_secret_by_label_jubilant(juju: Juju, label: str) -> Dict[str, str]:
     for secret in juju.secrets():