diff --git a/pkg/oidcclient/login.go b/pkg/oidcclient/login.go
index 36b688e2..ffd827e9 100644
--- a/pkg/oidcclient/login.go
+++ b/pkg/oidcclient/login.go
@@ -850,9 +850,9 @@ func (h *handlerState) serve(listener net.Listener) func() {
 	}
 	go func() { _ = srv.Serve(listener) }()
 	return func() {
-		// Gracefully shut down the server, allowing up to 5 seconds for
+		// Gracefully shut down the server, allowing up to 5 00ms for
 		// clients to receive any in-flight responses.
-		shutdownCtx, cancel := context.WithTimeout(h.ctx, 5*time.Second)
+		shutdownCtx, cancel := context.WithTimeout(h.ctx, 500*time.Millisecond)
 		_ = srv.Shutdown(shutdownCtx)
 		cancel()
 	}
diff --git a/test/integration/cli_test.go b/test/integration/cli_test.go
index 2e69bc32..ea710e92 100644
--- a/test/integration/cli_test.go
+++ b/test/integration/cli_test.go
@@ -355,7 +355,7 @@ func runPinnipedLoginOIDC(
 
 	// Expect to be redirected to the localhost callback.
 	t.Logf("waiting for redirect to callback")
-	callbackURLPattern := regexp.MustCompile(`\A` + regexp.QuoteMeta(env.CLIUpstreamOIDC.CallbackURL) + `\?.+\z`)
+	callbackURLPattern := regexp.MustCompile(`\A` + regexp.QuoteMeta(env.CLIUpstreamOIDC.CallbackURL) + `(\?.+)?\z`)
 	browsertest.WaitForURL(t, page, callbackURLPattern)
 
 	// Wait for the "pre" element that gets rendered for a `text/plain` page, and