diff --git a/test/smoke/hardware.sh b/test/smoke/hardware.sh
index 03101d23..4cd84028 100755
--- a/test/smoke/hardware.sh
+++ b/test/smoke/hardware.sh
@@ -19,6 +19,11 @@ if ! command -v umockdev-run >/dev/null; then
 fi
 
 smoke::setup
+# waybar is linked with ASan, but umockdev-run injects its own LD_PRELOAD, which
+# lands ahead of the ASan runtime and makes ASan abort before main() ("ASan
+# runtime does not come first"). Disabling the link-order check lets the
+# instrumented binary run under the preload.
+export ASAN_OPTIONS="${ASAN_OPTIONS}:verify_asan_link_order=0"
 smoke::start_compositor
 trap smoke::stop EXIT
 
diff --git a/test/smoke/leakcheck.sh b/test/smoke/leakcheck.sh
index 36f5d21e..005f5740 100755
--- a/test/smoke/leakcheck.sh
+++ b/test/smoke/leakcheck.sh
@@ -12,6 +12,9 @@ source "$DIR/lib.sh"
 
 export SMOKE_DETECT_LEAKS=1
 smoke::setup
+# Report leaks without aborting: abort_on_error=1 (the default gate) would turn
+# LSan's exit-time report into a core dump. This tier only reports.
+export ASAN_OPTIONS="detect_leaks=1:halt_on_error=0:abort_on_error=0:detect_odr_violation=0"
 smoke::start_compositor
 trap smoke::stop EXIT
 
diff --git a/test/smoke/lib.sh b/test/smoke/lib.sh
index 5ba02d5b..e3848442 100755
--- a/test/smoke/lib.sh
+++ b/test/smoke/lib.sh
@@ -111,7 +111,7 @@ smoke::assert_alive() {
 # Fail on sanitizer reports and GTK/GLib criticals in the log.
 smoke::assert_clean() {
     local bad
-    bad="$(grep -iE 'AddressSanitizer|runtime error:|LeakSanitizer|Gtk-CRITICAL|GLib-CRITICAL|GLib-GObject-CRITICAL|assertion .*failed|segfault|terminate called|SUMMARY: .*Sanitizer' "$SMOKE_LOG" || true)"
+    bad="$(grep -iE 'AddressSanitizer|runtime error:|LeakSanitizer|Gtk-CRITICAL|GLib-CRITICAL|GLib-GObject-CRITICAL|assertion .*failed|segfault|terminate called|SUMMARY: .*Sanitizer|ASan runtime does not come first' "$SMOKE_LOG" || true)"
     if [ -n "$bad" ]; then
         echo "::error::waybar reported sanitizer/critical issues:"
         echo "$bad"
diff --git a/test/smoke/state.sh b/test/smoke/state.sh
index 80c1b04f..77fb31e2 100755
--- a/test/smoke/state.sh
+++ b/test/smoke/state.sh
@@ -15,14 +15,21 @@ DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=lib.sh
 source "$DIR/lib.sh"
 
-smoke::setup
-smoke::start_compositor
-trap 'smoke::stop; [ -n "${MPD_PID:-}" ] && kill "$MPD_PID" 2>/dev/null; [ -n "${PA_STARTED:-}" ] && pulseaudio --kill 2>/dev/null; true' EXIT
-
 fail=0
 MPD_PID=""
 PA_STARTED=""
 
+cleanup() {
+    smoke::stop
+    [ -n "$MPD_PID" ] && kill "$MPD_PID" 2>/dev/null || true
+    [ -n "$PA_STARTED" ] && pulseaudio --kill 2>/dev/null || true
+    return 0
+}
+
+smoke::setup
+smoke::start_compositor
+trap cleanup EXIT
+
 # ---------------------------------------------------------------- mpd -----
 mpd_tier() {
     if ! command -v mpd >/dev/null || ! command -v mpc >/dev/null; then
@@ -39,7 +46,10 @@ state_file "$d/state"
 pid_file "$d/pid"
 bind_to_address "127.0.0.1"
 port "6600"
-audio_output { type "null" name "null" }
+audio_output {
+    type "null"
+    name "null"
+}
 EOF
     mpd --no-daemon "$conf" >/tmp/mpd.log 2>&1 &
     MPD_PID=$!