diff --git a/crates/synth-cli/tests/async_intrinsics_gate.rs b/crates/synth-cli/tests/async_intrinsics_gate.rs
index 809b889e..5ff7ac28 100644
--- a/crates/synth-cli/tests/async_intrinsics_gate.rs
+++ b/crates/synth-cli/tests/async_intrinsics_gate.rs
@@ -16,16 +16,22 @@
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
+/// Locate the `synth` binary the way every other CLI test does.
+///
+/// This used to walk two parents up from `current_exe()` and append `synth`,
+/// which happens to be right for the plain `target/debug/deps/<test>` layout and
+/// WRONG for any other. Under `cargo llvm-cov` the test binary lives at
+/// `target/llvm-cov-target/debug/build/synth-cli/<hash>/out/<test>`, so the walk
+/// produced `…/<hash>/synth` — a path that does not exist — and BOTH tests in
+/// this file failed for a missing binary rather than for anything they assert.
+/// That kept `Code Coverage` red repo-wide while the required `Test` job (plain
+/// layout) stayed green: a real gate, failing for a reason unrelated to the code.
+///
+/// `CARGO_BIN_EXE_<name>` is set by Cargo at compile time to the actual path of
+/// the built binary, so it is correct under every target-dir layout. Same
+/// mechanism as the other CLI integration tests in this directory.
 fn synth_binary() -> PathBuf {
-    let mut path = std::env::current_exe()
-        .unwrap()
-        .parent()
-        .unwrap()
-        .parent()
-        .unwrap()
-        .to_path_buf();
-    path.push("synth");
-    path
+    PathBuf::from(env!("CARGO_BIN_EXE_synth"))
 }
 
 fn workspace_root() -> PathBuf {
diff --git a/crates/synth-cli/tests/wast_compile.rs b/crates/synth-cli/tests/wast_compile.rs
index c0c3df42..20ed0336 100644
--- a/crates/synth-cli/tests/wast_compile.rs
+++ b/crates/synth-cli/tests/wast_compile.rs
@@ -6,17 +6,19 @@
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
+/// Locate the `synth` binary. See the identical note in
+/// `async_intrinsics_gate.rs`: walking up from `current_exe()` only works for
+/// the plain `target/debug/deps/<test>` layout, and silently produces a
+/// nonexistent path under `cargo llvm-cov` (where the test binary lives at
+/// `target/llvm-cov-target/debug/build/synth-cli/<hash>/out/<test>`). Every
+/// test in this file then failed on a MISSING BINARY rather than on what it
+/// asserts, which is why `Code Coverage` was red repo-wide while the required
+/// `Test` job — same assertions, plain layout — stayed green.
+///
+/// `CARGO_BIN_EXE_<name>` is the thing Cargo actually sets for integration
+/// tests, and it is layout-independent by construction.
 fn synth_binary() -> PathBuf {
-    // cargo sets this for integration tests
-    let mut path = std::env::current_exe()
-        .unwrap()
-        .parent()
-        .unwrap()
-        .parent()
-        .unwrap()
-        .to_path_buf();
-    path.push("synth");
-    path
+    PathBuf::from(env!("CARGO_BIN_EXE_synth"))
 }
 
 fn workspace_root() -> PathBuf {