diff --git a/server/server_account_test.go b/server/server_account_test.go
index 58f4d5d4..f4b4d7c5 100644
--- a/server/server_account_test.go
+++ b/server/server_account_test.go
@@ -9,6 +9,7 @@ import (
 	"heckel.io/ntfy/v2/util"
 	"io"
 	"net/netip"
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -673,7 +674,6 @@ func TestAccount_Reservation_Delete_Messages_And_Attachments(t *testing.T) {
 		t.Parallel()
 		conf := newTestConfigWithAuthFile(t, databaseURL)
 		conf.AuthDefault = user.PermissionReadWrite
-		conf.AttachmentOrphanGracePeriod = 0 // For testing: delete orphans immediately
 		s := newTestServer(t, conf)
 
 		// Create user with tier
@@ -741,7 +741,11 @@ func TestAccount_Reservation_Delete_Messages_And_Attachments(t *testing.T) {
 		require.Equal(t, 200, rr.Code)
 
 		// Verify that messages and attachments were deleted
-		// This does not explicitly call the manager!
+		// This does not explicitly call the manager! We backdate the files so sync's
+		// grace period doesn't protect them.
+		past := time.Now().Add(-2 * time.Hour)
+		os.Chtimes(filepath.Join(s.config.AttachmentCacheDir, m1.ID), past, past)
+		os.Chtimes(filepath.Join(s.config.AttachmentCacheDir, m2.ID), past, past)
 		waitFor(t, func() bool {
 			s.attachment.Sync() // File cleanup is done by sync, not by the manager
 			ms, err := s.messageCache.Messages("mytopic1", model.SinceAllMessages, false)
diff --git a/server/server_payments_test.go b/server/server_payments_test.go
index 30b1a22e..86e72c6d 100644
--- a/server/server_payments_test.go
+++ b/server/server_payments_test.go
@@ -14,6 +14,7 @@ import (
 	"heckel.io/ntfy/v2/util"
 	"io"
 	"net/netip"
+	"os"
 	"path/filepath"
 	"strings"
 	"sync"
@@ -443,7 +444,6 @@ func TestPayments_Webhook_Subscription_Updated_Downgrade_From_PastDue_To_Active(
 		c := newTestConfigWithAuthFile(t, databaseURL)
 		c.StripeSecretKey = "secret key"
 		c.StripeWebhookKey = "webhook key"
-		c.AttachmentOrphanGracePeriod = 0 // For testing: delete orphans immediately
 		s := newTestServer(t, c)
 		s.stripe = stripeMock
 
@@ -544,7 +544,11 @@ func TestPayments_Webhook_Subscription_Updated_Downgrade_From_PastDue_To_Active(
 		require.Equal(t, 1, len(r)) // "ztopic" reservation was deleted
 		require.Equal(t, "atopic", r[0].Topic)
 
-		// Verify that messages and attachments were deleted
+		// Verify that messages and attachments were deleted. We backdate the
+		// attachment files so sync's grace period doesn't protect them.
+		past := time.Now().Add(-2 * time.Hour)
+		os.Chtimes(filepath.Join(s.config.AttachmentCacheDir, a2.ID), past, past)
+		os.Chtimes(filepath.Join(s.config.AttachmentCacheDir, z2.ID), past, past)
 		time.Sleep(time.Second)
 		s.execManager()
 		s.attachment.Sync() // File cleanup is done by sync, not by the manager
diff --git a/server/server_test.go b/server/server_test.go
index 75d61772..644c0877 100644
--- a/server/server_test.go
+++ b/server/server_test.go
@@ -2285,7 +2285,6 @@ func TestServer_PublishAttachmentAndExpire(t *testing.T) {
 
 		c := newTestConfig(t, databaseURL)
 		c.AttachmentExpiryDuration = time.Millisecond // Hack
-		c.AttachmentOrphanGracePeriod = 0             // For testing: delete orphans immediately
 		s := newTestServer(t, c)
 
 		// Publish and make sure we can retrieve it
@@ -2300,7 +2299,9 @@ func TestServer_PublishAttachmentAndExpire(t *testing.T) {
 		require.Equal(t, 200, response.Code)
 		require.Equal(t, content, response.Body.String())
 
-		// Prune and makes sure it's gone
+		// Prune and makes sure it's gone. We backdate the file so sync's grace
+		// period doesn't protect it, then run the manager + sync explicitly.
+		require.Nil(t, os.Chtimes(file, time.Now().Add(-2*time.Hour), time.Now().Add(-2*time.Hour)))
 		waitFor(t, func() bool {
 			s.execManager()
 			s.attachment.Sync() // File cleanup is done by sync, not by the manager