diff --git a/terraform/cos-lite/integrations.tf b/terraform/cos-lite/integrations.tf
index 99a2bb0e..772b8eeb 100644
--- a/terraform/cos-lite/integrations.tf
+++ b/terraform/cos-lite/integrations.tf
@@ -239,7 +239,7 @@ resource "juju_integration" "grafana_ingress" {
 
   application {
     name     = module.traefik.app_name
-    endpoint = module.traefik.endpoints.traefik_route
+    endpoint = module.traefik.endpoints.ingress
   }
 
   application {
diff --git a/terraform/cos/integrations.tf b/terraform/cos/integrations.tf
index 3cd93be5..c055d86e 100644
--- a/terraform/cos/integrations.tf
+++ b/terraform/cos/integrations.tf
@@ -291,6 +291,10 @@ resource "juju_integration" "ingress" {
       app_name = module.loki.app_names.loki_coordinator
       endpoint = module.loki.endpoints.ingress
     }
+    grafana = {
+      app_name = module.grafana.app_name
+      endpoint = module.grafana.endpoints.ingress
+    }
   }
   model_uuid = var.model_uuid
 
@@ -308,10 +312,6 @@ resource "juju_integration" "ingress" {
 
 resource "juju_integration" "traefik_route" {
   for_each = {
-    grafana = {
-      app_name = module.grafana.app_name
-      endpoint = module.grafana.endpoints.ingress
-    }
     tempo = {
       app_name = module.tempo.app_names.tempo_coordinator
       endpoint = module.tempo.endpoints.ingress
diff --git a/tests/integration/cos/tls_external/test_upgrade_cos_tls_external.py b/tests/integration/cos/tls_external/test_upgrade_cos_tls_external.py
index 2e8941fb..4db63bad 100644
--- a/tests/integration/cos/tls_external/test_upgrade_cos_tls_external.py
+++ b/tests/integration/cos/tls_external/test_upgrade_cos_tls_external.py
@@ -24,7 +24,9 @@
 
 
 def test_envvars():
-    assert all(S3_ENDPOINT.values())
+    assert all(S3_ENDPOINT.values()), (
+        f"export the following env vars (upper case) before running this test: {S3_ENDPOINT.keys()}"
+    )
 
 
 def test_deploy_from_track(
@@ -32,9 +34,6 @@ def test_deploy_from_track(
 ):
     # GIVEN a module deployed from track n
     tf_manager.init(TRACK_2_TF_FILE)
-    tf_manager.apply(
-        target="ssc", ca_model=ca_model.model, cos_model=cos_model.model, **S3_ENDPOINT
-    )
     tf_manager.apply(ca_model=ca_model.model, cos_model=cos_model.model, **S3_ENDPOINT)
     wait_for_active_idle_without_error([cos_model], timeout=5400)
     tls_ctx = get_tls_context(tmp_path, ca_model, "self-signed-certificates")
diff --git a/tests/integration/cos/tls_external/track-2.tf b/tests/integration/cos/tls_external/track-2.tf
index a43682ea..5c940b27 100644
--- a/tests/integration/cos/tls_external/track-2.tf
+++ b/tests/integration/cos/tls_external/track-2.tf
@@ -48,7 +48,8 @@ module "cos" {
   model_uuid                      = data.juju_model.cos-model.uuid
   channel                         = "2/edge"
   internal_tls                    = "false"
-  external_certificates_offer_url = module.ssc.offers.certificates.url
+  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
+  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
 
   s3_endpoint   = var.s3_endpoint
   s3_secret_key = var.s3_secret_key
diff --git a/tests/integration/cos/tls_full/test_upgrade_cos_tls_full.py b/tests/integration/cos/tls_full/test_upgrade_cos_tls_full.py
index a0e1b8d2..8a5a651c 100644
--- a/tests/integration/cos/tls_full/test_upgrade_cos_tls_full.py
+++ b/tests/integration/cos/tls_full/test_upgrade_cos_tls_full.py
@@ -24,7 +24,9 @@
 
 
 def test_envvars():
-    assert all(S3_ENDPOINT.values())
+    assert all(S3_ENDPOINT.values()), (
+        f"export the following env vars (upper case) before running this test: {S3_ENDPOINT.keys()}"
+    )
 
 
 def test_deploy_from_track(
@@ -32,9 +34,6 @@ def test_deploy_from_track(
 ):
     # GIVEN a module deployed from track n
     tf_manager.init(TRACK_2_TF_FILE)
-    tf_manager.apply(
-        target="ssc", ca_model=ca_model.model, cos_model=cos_model.model, **S3_ENDPOINT
-    )
     tf_manager.apply(ca_model=ca_model.model, cos_model=cos_model.model, **S3_ENDPOINT)
     wait_for_active_idle_without_error([cos_model], timeout=5400)
     tls_ctx = get_tls_context(tmp_path, ca_model, "self-signed-certificates")
diff --git a/tests/integration/cos/tls_full/track-2.tf b/tests/integration/cos/tls_full/track-2.tf
index 4a7f67db..6151f22a 100644
--- a/tests/integration/cos/tls_full/track-2.tf
+++ b/tests/integration/cos/tls_full/track-2.tf
@@ -48,7 +48,8 @@ module "cos" {
   model_uuid                      = data.juju_model.cos-model.uuid
   channel                         = "2/edge"
   internal_tls                    = "true"
-  external_certificates_offer_url = module.ssc.offers.certificates.url
+  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
+  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
 
   s3_endpoint   = var.s3_endpoint
   s3_secret_key = var.s3_secret_key
diff --git a/tests/integration/cos/tls_internal/test_upgrade_cos_tls_internal.py b/tests/integration/cos/tls_internal/test_upgrade_cos_tls_internal.py
index 422176c2..84bef0ea 100644
--- a/tests/integration/cos/tls_internal/test_upgrade_cos_tls_internal.py
+++ b/tests/integration/cos/tls_internal/test_upgrade_cos_tls_internal.py
@@ -23,7 +23,9 @@
 
 
 def test_envvars():
-    assert all(S3_ENDPOINT.values())
+    assert all(S3_ENDPOINT.values()), (
+        f"export the following env vars (upper case) before running this test: {S3_ENDPOINT.keys()}"
+    )
 
 
 def test_deploy_from_track(tmp_path, tf_manager, cos_model: jubilant.Juju):
diff --git a/tests/integration/cos/tls_none/test_upgrade_cos_tls_none.py b/tests/integration/cos/tls_none/test_upgrade_cos_tls_none.py
index 8b062533..bf4a3dff 100644
--- a/tests/integration/cos/tls_none/test_upgrade_cos_tls_none.py
+++ b/tests/integration/cos/tls_none/test_upgrade_cos_tls_none.py
@@ -23,7 +23,9 @@
 
 
 def test_envvars():
-    assert all(S3_ENDPOINT.values())
+    assert all(S3_ENDPOINT.values()), (
+        f"export the following env vars (upper case) before running this test: {S3_ENDPOINT.keys()}"
+    )
 
 
 def test_deploy_from_track(tf_manager, cos_model: jubilant.Juju):
diff --git a/tests/integration/cos_lite/tls_external/test_upgrade_cos_lite_tls_external.py b/tests/integration/cos_lite/tls_external/test_upgrade_cos_lite_tls_external.py
index 177ef86e..e8996217 100644
--- a/tests/integration/cos_lite/tls_external/test_upgrade_cos_lite_tls_external.py
+++ b/tests/integration/cos_lite/tls_external/test_upgrade_cos_lite_tls_external.py
@@ -24,7 +24,6 @@ def test_deploy_from_track(
 ):
     # GIVEN a module deployed from track n-1
     tf_manager.init(TRACK_1_TF_FILE)
-    tf_manager.apply(target="ssc", ca_model=ca_model.model, cos_model=cos_model.model)
     tf_manager.apply(ca_model=ca_model.model, cos_model=cos_model.model)
     wait_for_active_idle_without_error([ca_model, cos_model])
 
diff --git a/tests/integration/cos_lite/tls_external/track-1.tf b/tests/integration/cos_lite/tls_external/track-1.tf
index 8ece2a32..2a2f183f 100644
--- a/tests/integration/cos_lite/tls_external/track-1.tf
+++ b/tests/integration/cos_lite/tls_external/track-1.tf
@@ -36,7 +36,8 @@ module "cos-lite" {
   model_uuid                      = data.juju_model.cos-model.uuid
   channel                         = "1/stable"
   internal_tls                    = "false"
-  external_certificates_offer_url = module.ssc.offers.certificates.url
+  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
+  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
 
   traefik           = { channel = "latest/edge" }  # TODO: Switch to latest/stable when rev257 hits stable
 }
diff --git a/tests/integration/cos_lite/tls_external/track-2.tf b/tests/integration/cos_lite/tls_external/track-2.tf
index 476299aa..6f819d90 100644
--- a/tests/integration/cos_lite/tls_external/track-2.tf
+++ b/tests/integration/cos_lite/tls_external/track-2.tf
@@ -36,7 +36,8 @@ module "cos-lite" {
   model_uuid                      = data.juju_model.cos-model.uuid
   channel                         = "2/edge"
   internal_tls                    = "false"
-  external_certificates_offer_url = module.ssc.offers.certificates.url
+  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
+  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
 
   traefik           = { channel = "latest/edge" }  # TODO: Switch to latest/stable when rev257 hits stable
 }
diff --git a/tests/integration/cos_lite/tls_full/test_upgrade_cos_lite_tls_full.py b/tests/integration/cos_lite/tls_full/test_upgrade_cos_lite_tls_full.py
index 8a8abc82..41ccc176 100644
--- a/tests/integration/cos_lite/tls_full/test_upgrade_cos_lite_tls_full.py
+++ b/tests/integration/cos_lite/tls_full/test_upgrade_cos_lite_tls_full.py
@@ -24,7 +24,6 @@ def test_deploy_from_track(
 ):
     # GIVEN a module deployed from track n-1
     tf_manager.init(TRACK_1_TF_FILE)
-    tf_manager.apply(target="ssc", ca_model=ca_model.model, cos_model=cos_model.model)
     tf_manager.apply(ca_model=ca_model.model, cos_model=cos_model.model)
     wait_for_active_idle_without_error([ca_model, cos_model])
 
diff --git a/tests/integration/cos_lite/tls_full/track-1.tf b/tests/integration/cos_lite/tls_full/track-1.tf
index 3a2de76c..fa75e106 100644
--- a/tests/integration/cos_lite/tls_full/track-1.tf
+++ b/tests/integration/cos_lite/tls_full/track-1.tf
@@ -36,7 +36,8 @@ module "cos-lite" {
   model_uuid                      = data.juju_model.cos-model.uuid
   channel                         = "1/stable"
   internal_tls                    = "true"
-  external_certificates_offer_url = module.ssc.offers.certificates.url
+  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
+  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
 
   traefik           = { channel = "latest/edge" }  # TODO: Switch to latest/stable when rev257 hits stable
 }
diff --git a/tests/integration/cos_lite/tls_full/track-2.tf b/tests/integration/cos_lite/tls_full/track-2.tf
index 814f14dc..d6089644 100644
--- a/tests/integration/cos_lite/tls_full/track-2.tf
+++ b/tests/integration/cos_lite/tls_full/track-2.tf
@@ -36,7 +36,8 @@ module "cos-lite" {
   model_uuid                      = data.juju_model.cos-model.uuid
   channel                         = "2/edge"
   internal_tls                    = "true"
-  external_certificates_offer_url = module.ssc.offers.certificates.url
+  external_certificates_offer_url = "admin/${var.ca_model}.certificates"
+  external_ca_cert_offer_url      = "admin/${var.ca_model}.send-ca-cert"
 
   traefik           = { channel = "latest/edge" }  # TODO: Switch to latest/stable when rev257 hits stable
 }