diff --git a/node/src/key-store.test.ts b/node/src/key-store.test.ts
index cd83a29..ff66448 100644
--- a/node/src/key-store.test.ts
+++ b/node/src/key-store.test.ts
@@ -57,7 +57,9 @@ describe("device key store", () => {
   if (process.env.CVLT_TEST_OS_KEYSTORE === "1") {
     it(`round-trips through the ${process.platform} OS credential store`, async () => {
       const root = mkdtempSync(join(tmpdir(), "cvlt-key-store-os-"))
-      const origin = `https://os-store-${process.platform}-${Date.now()}.invalid`
+      const origin = process.platform === "linux"
+        ? "https://linux-option-104.invalid"
+        : `https://os-store-${process.platform}-${Date.now()}.invalid`
       const previous = {
         config: process.env.XDG_CONFIG_HOME,
         passphrase: process.env.CVLT_KEYSTORE_PASSPHRASE,
@@ -79,7 +81,7 @@ describe("device key store", () => {
             stdio: "ignore",
           })
         } else if (process.platform === "linux") {
-          spawnSync("secret-tool", ["clear", "service", "circlesac.cvlt", "account", stored.account], {
+          spawnSync("secret-tool", ["clear", "--", "service", "circlesac.cvlt", "account", stored.account], {
             stdio: "ignore",
           })
         }
diff --git a/node/src/key-store.ts b/node/src/key-store.ts
index fd0643c..0a58edb 100644
--- a/node/src/key-store.ts
+++ b/node/src/key-store.ts
@@ -37,7 +37,7 @@ function macWrite(account: string, value: string): boolean {
 }
 
 function linuxRead(account: string): string | null {
-  const result = spawnSync("secret-tool", ["lookup", "service", "circlesac.cvlt", "account", account], {
+  const result = spawnSync("secret-tool", ["lookup", "--", "service", "circlesac.cvlt", "account", account], {
     encoding: "utf8",
   })
   return result.status === 0 && result.stdout.trim() ? result.stdout.trim() : null
@@ -46,7 +46,7 @@ function linuxRead(account: string): string | null {
 function linuxWrite(account: string, value: string): boolean {
   const result = spawnSync(
     "secret-tool",
-    ["store", "--label", "Circles Vault client key", "service", "circlesac.cvlt", "account", account],
+    ["store", "--label", "Circles Vault client key", "--", "service", "circlesac.cvlt", "account", account],
     { input: value, encoding: "utf8" }
   )
   if (process.env.CVLT_TEST_OS_KEYSTORE === "1" && result.status !== 0) {