diff --git a/certgen/Makefile b/certgen/Makefile
index 7418b7c7..4b83b991 100644
--- a/certgen/Makefile
+++ b/certgen/Makefile
@@ -66,7 +66,7 @@ check: .SHELLFLAGS := -eo pipefail -c
 check: certgen_example certgen_ca_example csr_w_ed25519_example csr_example csr_sign csr_cryptocb custom_ext custom_ext_callback
 	./certgen_example | grep -q 'Tests passed'
 	./certgen_ca_example | grep -q 'Tests passed'
-	./csr_w_ed25519_example | grep -q '-----END CERTIFICATE REQUEST-----'
+	./csr_w_ed25519_example 2>&1 | grep -q -- '-----END CERTIFICATE REQUEST-----'
 	./csr_example ecc | grep -q 'Saved PEM to "ecc-csr.pem"'
 	./csr_sign ecc-csr.pem ca-ecc-cert.der ca-ecc-key.der | grep -q 'Tests passed'
 	./csr_cryptocb ecc | grep -q 'Saved CSR PEM to "ecc-csr.pem"'
diff --git a/crypto/pkcs12/Makefile b/crypto/pkcs12/Makefile
index 6671d5b0..a8ecdc03 100644
--- a/crypto/pkcs12/Makefile
+++ b/crypto/pkcs12/Makefile
@@ -19,6 +19,7 @@ clean:
 check: SHELL := /bin/bash
 check: .SHELLFLAGS := -eo pipefail -c
 check: pkcs12-example pkcs12-create-example
-	./pkcs12-example | grep -q 'return value of parsing pkcs12 = 0 SUCCESS'
-	./pkcs12-create-example | grep -q 'Printing PKCS12 DER file to output.p12'
+	# capture first: grep -q closes the pipe on the long DER dump and pipefail then sees the binary's SIGPIPE
+	out=$$(./pkcs12-example 2>&1); grep -q 'return value of parsing pkcs12 = 0 SUCCESS' <<< "$$out"
+	out=$$(./pkcs12-create-example 2>&1); grep -q 'Printing PKCS12 DER file to output.p12' <<< "$$out"
 	@echo "PASS: crypto-pkcs12 checks"
diff --git a/pk/srp/Makefile b/pk/srp/Makefile
index a2897647..335e3f7c 100644
--- a/pk/srp/Makefile
+++ b/pk/srp/Makefile
@@ -27,5 +27,5 @@ check: SHELL := /bin/bash
 check: .SHELLFLAGS := -eo pipefail -c
 check: srp srp_gen
 	./srp wolfssl password | grep -q 'Client verified server proof'
-	./srp_gen wolfssl password | grep -q 'static const byte verifier['
+	./srp_gen wolfssl password | grep -qF 'static const byte verifier['
 	@echo "PASS: pk-srp checks"
diff --git a/signature/rsa_buffer/Makefile b/signature/rsa_buffer/Makefile
index 600d5a82..0ccc3061 100644
--- a/signature/rsa_buffer/Makefile
+++ b/signature/rsa_buffer/Makefile
@@ -38,5 +38,5 @@ clean:
 check: SHELL := /bin/bash
 check: .SHELLFLAGS := -eo pipefail -c
 check: verify
-	./verify | grep -q 'Verified'
+	./verify 2>&1 | grep -q 'Verified'
 	@echo "PASS: signature-rsa-buffer checks"