diff --git a/scripts/integration-vm.py b/scripts/integration-vm.py
index 36386ae..09dfc40 100644
--- a/scripts/integration-vm.py
+++ b/scripts/integration-vm.py
@@ -97,7 +97,7 @@ def render_run_hosts(name, ip, ansible_user, groups):
         "all:",
         "  children:",
     ]
-    for g in groups:
+    for g in dict.fromkeys(groups):
         lines += [
             f"    {g}:",
             "      hosts:",
diff --git a/tests/test_integration_vm.py b/tests/test_integration_vm.py
index c4df696..1d0a750 100644
--- a/tests/test_integration_vm.py
+++ b/tests/test_integration_vm.py
@@ -1,5 +1,6 @@
 import importlib.util
 import pathlib
+import pytest
 
 _PATH = pathlib.Path(__file__).resolve().parent.parent / "scripts" / "integration-vm.py"
 _spec = importlib.util.spec_from_file_location("integration_vm", _PATH)
@@ -43,3 +44,35 @@ def test_user_data_injects_key_and_ansible_user():
     assert "name: ansible" in ud
     assert "ssh-ed25519 AAAA... claude@ubongo" in ud
     assert "NOPASSWD:ALL" in ud
+
+
+def test_cert_file_valid_tier():
+    p = ivm.cert_file("le-staging")
+    assert p.name == "le-staging.yml" and p.parent.name == "certs"
+
+def test_cert_file_rejects_bad_tier():
+    with pytest.raises(ValueError):
+        ivm.cert_file("bogus")
+
+def test_render_run_hosts_single_host_in_groups():
+    out = ivm.render_run_hosts("boma-it-askari-x", "192.168.150.42",
+                               "ansible", ["offsite_hosts"])
+    assert "offsite_hosts:" in out
+    assert "boma-it-askari-x:" in out
+    assert "ansible_host: 192.168.150.42" in out
+    assert "ansible_user: ansible" in out
+    assert "askari:" not in out.replace("boma-it-askari-x:", "")
+
+def test_free_mib_returns_zero_when_absent():
+    assert ivm.free_mib("MemTotal:    16384 kB\n") == 0
+
+def test_render_run_hosts_multiple_groups():
+    out = ivm.render_run_hosts("boma-it-x-1", "192.168.150.5", "ansible",
+                               ["offsite_hosts", "docker_hosts"])
+    assert "offsite_hosts:" in out
+    assert "docker_hosts:" in out
+
+def test_render_run_hosts_dedups_groups():
+    out = ivm.render_run_hosts("boma-it-x-1", "192.168.150.5", "ansible",
+                               ["docker_hosts", "docker_hosts"])
+    assert out.count("docker_hosts:") == 1