diff --git a/.github/workflows/test-library.yml b/.github/workflows/test-library.yml
index ee7417b7..5c33d2c6 100644
--- a/.github/workflows/test-library.yml
+++ b/.github/workflows/test-library.yml
@@ -174,16 +174,8 @@ jobs:
 
           echo "$output"
 
-          # TODO hal/library.c does not currently return an error code during failure
-          # Test only looks for the word "Failure"
-          # See https://github.com/wolfSSL/wolfBoot/pull/625
-
-          # If the tool printed "Failure", treat it as a failure regardless of exit code
-          if echo "$output" | grep -F "Failure" >/dev/null; then
-              status=1
-          fi
-
-          # Must have failed (non-zero exit)
+          # A rejected image must exit non-zero: wolfBoot_start() propagates
+          # the verify error to the process exit code
           if [ "$status" -eq 0 ]; then
             echo "Expected failure, but exit code was 0"
             exit 1
diff --git a/hal/library.c b/hal/library.c
index 465bed78..9bf5ef9f 100644
--- a/hal/library.c
+++ b/hal/library.c
@@ -165,7 +165,9 @@ int wolfBoot_start(void)
                         (int)os_image.signature_ok);
     }
 
-    return 0;
+    /* The error paths reach this point with ret < 0; propagate it so a
+     * rejected image does not look like a successful boot to the caller. */
+    return ret;
 }