diff --git a/test/Duende.Bff.EntityFramework.Tests/Duende.Bff.EntityFramework.Tests.csproj b/test/Duende.Bff.EntityFramework.Tests/Duende.Bff.EntityFramework.Tests.csproj
index 69d72212..ab3fbe0c 100644
--- a/test/Duende.Bff.EntityFramework.Tests/Duende.Bff.EntityFramework.Tests.csproj
+++ b/test/Duende.Bff.EntityFramework.Tests/Duende.Bff.EntityFramework.Tests.csproj
@@ -10,7 +10,7 @@
             <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
             <PrivateAssets>all</PrivateAssets>
         </PackageReference>
-        <PackageReference Include="FluentAssertions" Version="5.10.3" />
+        <PackageReference Include="FluentAssertions" Version="6.7.0" />
         <PackageReference Include="coverlet.collector" Version="3.1.2">
             <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
             <PrivateAssets>all</PrivateAssets>
diff --git a/test/Duende.Bff.EntityFramework.Tests/UserSessionStoreTests.cs b/test/Duende.Bff.EntityFramework.Tests/UserSessionStoreTests.cs
index ba041844..8b79dda5 100644
--- a/test/Duende.Bff.EntityFramework.Tests/UserSessionStoreTests.cs
+++ b/test/Duende.Bff.EntityFramework.Tests/UserSessionStoreTests.cs
@@ -486,10 +486,10 @@ await _subject.CreateUserSessionAsync(new UserSession
             }
         }
         [Fact]
-        public void GetUserSessionsAsync_for_missing_sub_and_sid_should_throw()
+        public async Task GetUserSessionsAsync_for_missing_sub_and_sid_should_throw()
         {
             Func<Task> f = () => _subject.GetUserSessionsAsync(new UserSessionsFilter());
-            f.Should().Throw<Exception>();
+            await f.Should().ThrowAsync<Exception>();
         }
 
 
@@ -801,10 +801,10 @@ await _subject.CreateUserSessionAsync(new UserSession
             }
         }
         [Fact]
-        public void DeleteUserSessionsAsync_for_missing_sub_and_sid_should_throw()
+        public async Task DeleteUserSessionsAsync_for_missing_sub_and_sid_should_throw()
         {
             Func<Task> f = () => _subject.DeleteUserSessionsAsync(new UserSessionsFilter());
-            f.Should().Throw<Exception>();
+            await f.Should().ThrowAsync<Exception>();
         }
         
         [Fact]
@@ -841,7 +841,7 @@ public async Task concurrent_deletes_with_exception_handler_and_detatching_shoul
             await ctx1.SaveChangesAsync();
 
             Func<Task> f1 = async () => await ctx2.SaveChangesAsync();
-            f1.Should().Throw<DbUpdateConcurrencyException>();
+            await f1.Should().ThrowAsync<DbUpdateConcurrencyException>();
 
             try
             {
diff --git a/test/Duende.Bff.Tests/Duende.Bff.Tests.csproj b/test/Duende.Bff.Tests/Duende.Bff.Tests.csproj
index 51c91e27..58567d9a 100644
--- a/test/Duende.Bff.Tests/Duende.Bff.Tests.csproj
+++ b/test/Duende.Bff.Tests/Duende.Bff.Tests.csproj
@@ -12,7 +12,7 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
-    <PackageReference Include="FluentAssertions" Version="5.10.3" />
+    <PackageReference Include="FluentAssertions" Version="6.7.0" />
     <PackageReference Include="coverlet.collector" Version="3.1.2">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
diff --git a/test/Duende.Bff.Tests/Endpoints/Management/LoginEndpointTests.cs b/test/Duende.Bff.Tests/Endpoints/Management/LoginEndpointTests.cs
index a41740e5..56df5183 100644
--- a/test/Duende.Bff.Tests/Endpoints/Management/LoginEndpointTests.cs
+++ b/test/Duende.Bff.Tests/Endpoints/Management/LoginEndpointTests.cs
@@ -149,10 +149,10 @@ public async Task login_endpoint_should_accept_returnUrl()
         }
 
         [Fact]
-        public void login_endpoint_should_not_accept_non_local_returnUrl()
+        public async Task login_endpoint_should_not_accept_non_local_returnUrl()
         {
             Func<Task> f = () => BffHost.BrowserClient.GetAsync(BffHost.Url("/bff/login") + "?returnUrl=https://foo");
-            f.Should().Throw<Exception>().And.Message.Should().Contain("returnUrl");
+            (await f.Should().ThrowAsync<Exception>()).And.Message.Should().Contain("returnUrl");
         }
     }
 }
diff --git a/test/Duende.Bff.Tests/Endpoints/Management/LogoutEndpointTests.cs b/test/Duende.Bff.Tests/Endpoints/Management/LogoutEndpointTests.cs
index fd4c55c2..26e8d42f 100644
--- a/test/Duende.Bff.Tests/Endpoints/Management/LogoutEndpointTests.cs
+++ b/test/Duende.Bff.Tests/Endpoints/Management/LogoutEndpointTests.cs
@@ -48,7 +48,7 @@ public async Task logout_endpoint_for_authenticated_should_require_sid()
             await BffHost.BffLoginAsync("alice", "sid123");
 
             Func<Task> f = () => BffHost.BffLogoutAsync();
-            f.Should().Throw<Exception>();
+            await f.Should().ThrowAsync<Exception>();
 
             (await BffHost.GetIsUserLoggedInAsync()).Should().BeTrue();
         }
@@ -61,7 +61,7 @@ public async Task logout_endpoint_for_authenticated_when_require_otpion_is_false
             BffHost.BffOptions.RequireLogoutSessionId = false;
 
             var response = await BffHost.BrowserClient.GetAsync(BffHost.Url("/bff/logout"));
-            response.StatusCode.Should().Be(302); // endsession
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // endsession
             response.Headers.Location.ToString().ToLowerInvariant().Should().StartWith(IdentityServerHost.Url("/connect/endsession"));
         }
 
@@ -79,7 +79,7 @@ public async Task logout_endpoint_for_authenticated_user_without_sid_should_succ
             await BffHost.IssueSessionCookieAsync("alice");
 
             var response = await BffHost.BrowserClient.GetAsync(BffHost.Url("/bff/logout"));
-            response.StatusCode.Should().Be(302); // endsession
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // endsession
             response.Headers.Location.ToString().ToLowerInvariant().Should().StartWith(IdentityServerHost.Url("/connect/endsession"));
         }
 
@@ -87,7 +87,7 @@ public async Task logout_endpoint_for_authenticated_user_without_sid_should_succ
         public async Task logout_endpoint_for_anonymous_user_without_sid_should_succeed()
         {
             var response = await BffHost.BrowserClient.GetAsync(BffHost.Url("/bff/logout"));
-            response.StatusCode.Should().Be(302); // endsession
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // endsession
             response.Headers.Location.ToString().ToLowerInvariant().Should().StartWith(IdentityServerHost.Url("/connect/endsession"));
         }
 
@@ -108,19 +108,19 @@ public async Task logout_endpoint_should_accept_returnUrl()
             await BffHost.BffLoginAsync("alice", "sid123");
 
             var response = await BffHost.BrowserClient.GetAsync(BffHost.Url("/bff/logout") + "?sid=sid123&returnUrl=/foo");
-            response.StatusCode.Should().Be(302); // endsession
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // endsession
             response.Headers.Location.ToString().ToLowerInvariant().Should().StartWith(IdentityServerHost.Url("/connect/endsession"));
 
             response = await IdentityServerHost.BrowserClient.GetAsync(response.Headers.Location.ToString());
-            response.StatusCode.Should().Be(302); // logout
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // logout
             response.Headers.Location.ToString().ToLowerInvariant().Should().StartWith(IdentityServerHost.Url("/account/logout"));
 
             response = await IdentityServerHost.BrowserClient.GetAsync(response.Headers.Location.ToString());
-            response.StatusCode.Should().Be(302); // post logout redirect uri
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // post logout redirect uri
             response.Headers.Location.ToString().ToLowerInvariant().Should().StartWith(BffHost.Url("/signout-callback-oidc"));
 
             response = await BffHost.BrowserClient.GetAsync(response.Headers.Location.ToString());
-            response.StatusCode.Should().Be(302); // root
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // root
             response.Headers.Location.ToString().ToLowerInvariant().Should().Be("/foo");
         }
 
@@ -130,7 +130,7 @@ public async Task logout_endpoint_should_reject_non_local_returnUrl()
             await BffHost.BffLoginAsync("alice", "sid123");
 
             Func<Task> f = () => BffHost.BrowserClient.GetAsync(BffHost.Url("/bff/logout") + "?sid=sid123&returnUrl=https://foo");
-            f.Should().Throw<Exception>().And.Message.Should().Contain("returnUrl");
+            (await f.Should().ThrowAsync<Exception>()).And.Message.Should().Contain("returnUrl");
         }
     }
 }
diff --git a/test/Duende.Bff.Tests/Endpoints/Management/ManagementBasePathTests.cs b/test/Duende.Bff.Tests/Endpoints/Management/ManagementBasePathTests.cs
index bd1ffcc7..b405dcab 100644
--- a/test/Duende.Bff.Tests/Endpoints/Management/ManagementBasePathTests.cs
+++ b/test/Duende.Bff.Tests/Endpoints/Management/ManagementBasePathTests.cs
@@ -8,6 +8,7 @@
 using Xunit;
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.DependencyInjection;
+using System.Net;
 
 namespace Duende.Bff.Tests.Endpoints.Management
 {
@@ -33,7 +34,7 @@ public async Task custom_ManagementBasePath_should_affect_basepath(string path)
 
             var response = await BffHost.BrowserClient.SendAsync(req);
 
-            response.StatusCode.Should().NotBe(404);
+            response.StatusCode.Should().NotBe(HttpStatusCode.NotFound);
         }
     }
 }
diff --git a/test/Duende.Bff.Tests/Endpoints/Management/UserEndpointTests.cs b/test/Duende.Bff.Tests/Endpoints/Management/UserEndpointTests.cs
index 4b4b9fe7..1e272fc6 100644
--- a/test/Duende.Bff.Tests/Endpoints/Management/UserEndpointTests.cs
+++ b/test/Duende.Bff.Tests/Endpoints/Management/UserEndpointTests.cs
@@ -8,6 +8,7 @@
 using System.Security.Claims;
 using System.Threading.Tasks;
 using Xunit;
+using System.Net;
 
 namespace Duende.Bff.Tests.Endpoints.Management
 {
@@ -58,7 +59,7 @@ public async Task user_endpoint_for_authenticated_user_without_csrf_header_shoul
             var req = new HttpRequestMessage(HttpMethod.Get, BffHost.Url("/bff/user"));
             var response = await BffHost.BrowserClient.SendAsync(req);
             
-            response.StatusCode.Should().Be(401);
+            response.StatusCode.Should().Be(HttpStatusCode.Unauthorized);
         }
 
         [Fact]
@@ -68,7 +69,7 @@ public async Task user_endpoint_for_unauthenticated_user_should_fail()
             req.Headers.Add("x-csrf", "1");
             var response = await BffHost.BrowserClient.SendAsync(req);
 
-            response.StatusCode.Should().Be(401);
+            response.StatusCode.Should().Be(HttpStatusCode.Unauthorized);
         }
 
         [Fact]
diff --git a/test/Duende.Bff.Tests/Endpoints/RemoteEndpointTests.cs b/test/Duende.Bff.Tests/Endpoints/RemoteEndpointTests.cs
index 529ba957..8f6686a0 100644
--- a/test/Duende.Bff.Tests/Endpoints/RemoteEndpointTests.cs
+++ b/test/Duende.Bff.Tests/Endpoints/RemoteEndpointTests.cs
@@ -331,21 +331,21 @@ public async Task endpoints_that_disable_csrf_should_not_require_csrf_header()
         }
 
         [Fact]
-        public void calls_to_endpoint_without_bff_metadata_should_fail()
+        public async Task calls_to_endpoint_without_bff_metadata_should_fail()
         {
             var req = new HttpRequestMessage(HttpMethod.Get, BffHost.Url("/not_bff_endpoint"));
 
             Func<Task> f = () => BffHost.BrowserClient.SendAsync(req);
-            f.Should().Throw<Exception>();
+            await f.Should().ThrowAsync<Exception>();
         }
         
         [Fact]
-        public void calls_to_bff_not_in_endpoint_routing_should_fail()
+        public async Task calls_to_bff_not_in_endpoint_routing_should_fail()
         {
             var req = new HttpRequestMessage(HttpMethod.Get, BffHost.Url("/invalid_endpoint/test"));
 
             Func<Task> f = () => BffHost.BrowserClient.SendAsync(req);
-            f.Should().Throw<Exception>();
+            await f.Should().ThrowAsync<Exception>();
         }
     }
 }
diff --git a/test/Duende.Bff.Tests/GenericHostTests.cs b/test/Duende.Bff.Tests/GenericHostTests.cs
index 5d04052e..2346821b 100644
--- a/test/Duende.Bff.Tests/GenericHostTests.cs
+++ b/test/Duende.Bff.Tests/GenericHostTests.cs
@@ -4,6 +4,7 @@
 using Duende.Bff.Tests.TestFramework;
 using FluentAssertions;
 using Microsoft.AspNetCore.Builder;
+using System.Net;
 using System.Threading.Tasks;
 using Xunit;
 
@@ -23,7 +24,7 @@ public async Task Test1()
 
             var response = await host.HttpClient.GetAsync("/test");
 
-            response.StatusCode.Should().Be(204);
+            response.StatusCode.Should().Be(HttpStatusCode.NoContent);
         }
     }
 }
diff --git a/test/Duende.Bff.Tests/TestFramework/GenericHost.cs b/test/Duende.Bff.Tests/TestFramework/GenericHost.cs
index 6818856e..6b08e78f 100644
--- a/test/Duende.Bff.Tests/TestFramework/GenericHost.cs
+++ b/test/Duende.Bff.Tests/TestFramework/GenericHost.cs
@@ -11,6 +11,7 @@
 using Microsoft.Extensions.Logging;
 using System;
 using System.Linq;
+using System.Net;
 using System.Net.Http;
 using System.Reflection;
 using System.Security.Claims;
@@ -131,7 +132,7 @@ void ConfigureSignout(IApplicationBuilder app)
         public async Task RevokeSessionCookieAsync()
         {
             var response = await BrowserClient.GetAsync(Url("__signout"));
-            response.StatusCode.Should().Be(204);
+            response.StatusCode.Should().Be(HttpStatusCode.NoContent);
         }
 
 
@@ -165,7 +166,7 @@ public async Task IssueSessionCookieAsync(params Claim[] claims)
         {
             _userToSignIn = new ClaimsPrincipal(new ClaimsIdentity(claims, "test", "name", "role"));
             var response = await BrowserClient.GetAsync(Url("__signin"));
-            response.StatusCode.Should().Be(204);
+            response.StatusCode.Should().Be(HttpStatusCode.NoContent);
         }
         public Task IssueSessionCookieAsync(AuthenticationProperties props, params Claim[] claims)
         {
diff --git a/test/Duende.Bff.Tests/TestFramework/TestBrowserClient.cs b/test/Duende.Bff.Tests/TestFramework/TestBrowserClient.cs
index 5ec262c2..a3648cf0 100644
--- a/test/Duende.Bff.Tests/TestFramework/TestBrowserClient.cs
+++ b/test/Duende.Bff.Tests/TestFramework/TestBrowserClient.cs
@@ -91,7 +91,7 @@ public void RemoveCookie(string uri, string name)
 
         public async Task FollowRedirectAsync()
         {
-            LastResponse.StatusCode.Should().Be(302);
+            LastResponse.StatusCode.Should().Be(HttpStatusCode.Redirect);
             var location = LastResponse.Headers.Location.ToString();
             await GetAsync(location);
         }
diff --git a/test/Duende.Bff.Tests/TestHosts/BffHost.cs b/test/Duende.Bff.Tests/TestHosts/BffHost.cs
index a5e4da4f..b1bb6d19 100644
--- a/test/Duende.Bff.Tests/TestHosts/BffHost.cs
+++ b/test/Duende.Bff.Tests/TestHosts/BffHost.cs
@@ -335,7 +335,7 @@ public async Task<List<JsonRecord>> CallUserEndpointAsync()
 
             var response = await BrowserClient.SendAsync(req);
 
-            response.StatusCode.Should().Be(200);
+            response.StatusCode.Should().Be(HttpStatusCode.OK);
             response.Content.Headers.ContentType.MediaType.Should().Be("application/json");
 
             var json = await response.Content.ReadAsStringAsync();
@@ -351,16 +351,16 @@ public async Task<HttpResponseMessage> BffLoginAsync(string sub, string sid = nu
         public async Task<HttpResponseMessage> BffOidcLoginAsync()
         {
             var response = await BrowserClient.GetAsync(Url("/bff/login"));
-            response.StatusCode.Should().Be(302); // authorize
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // authorize
             response.Headers.Location.ToString().ToLowerInvariant().Should()
                 .StartWith(_identityServerHost.Url("/connect/authorize"));
 
             response = await _identityServerHost.BrowserClient.GetAsync(response.Headers.Location.ToString());
-            response.StatusCode.Should().Be(302); // client callback
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // client callback
             response.Headers.Location.ToString().ToLowerInvariant().Should().StartWith(Url("/signin-oidc"));
 
             response = await BrowserClient.GetAsync(response.Headers.Location.ToString());
-            response.StatusCode.Should().Be(302); // root
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // root
             response.Headers.Location.ToString().ToLowerInvariant().Should().Be("/");
 
             (await GetIsUserLoggedInAsync()).Should().BeTrue();
@@ -372,21 +372,21 @@ public async Task<HttpResponseMessage> BffOidcLoginAsync()
         public async Task<HttpResponseMessage> BffLogoutAsync(string sid = null)
         {
             var response = await BrowserClient.GetAsync(Url("/bff/logout") + "?sid=" + sid);
-            response.StatusCode.Should().Be(302); // endsession
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // endsession
             response.Headers.Location.ToString().ToLowerInvariant().Should()
                 .StartWith(_identityServerHost.Url("/connect/endsession"));
 
             response = await _identityServerHost.BrowserClient.GetAsync(response.Headers.Location.ToString());
-            response.StatusCode.Should().Be(302); // logout
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // logout
             response.Headers.Location.ToString().ToLowerInvariant().Should()
                 .StartWith(_identityServerHost.Url("/account/logout"));
 
             response = await _identityServerHost.BrowserClient.GetAsync(response.Headers.Location.ToString());
-            response.StatusCode.Should().Be(302); // post logout redirect uri
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // post logout redirect uri
             response.Headers.Location.ToString().ToLowerInvariant().Should().StartWith(Url("/signout-callback-oidc"));
 
             response = await BrowserClient.GetAsync(response.Headers.Location.ToString());
-            response.StatusCode.Should().Be(302); // root
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // root
             response.Headers.Location.ToString().ToLowerInvariant().Should().Be("/");
 
             (await GetIsUserLoggedInAsync()).Should().BeFalse();
diff --git a/test/Duende.Bff.Tests/TestHosts/BffHostUsingResourceNamedTokens.cs b/test/Duende.Bff.Tests/TestHosts/BffHostUsingResourceNamedTokens.cs
index d2498618..608aef7b 100644
--- a/test/Duende.Bff.Tests/TestHosts/BffHostUsingResourceNamedTokens.cs
+++ b/test/Duende.Bff.Tests/TestHosts/BffHostUsingResourceNamedTokens.cs
@@ -176,7 +176,7 @@ public async Task<List<JsonRecord>> CallUserEndpointAsync()
 
             var response = await BrowserClient.SendAsync(req);
 
-            response.StatusCode.Should().Be(200);
+            response.StatusCode.Should().Be(HttpStatusCode.OK);
             response.Content.Headers.ContentType.MediaType.Should().Be("application/json");
 
             var json = await response.Content.ReadAsStringAsync();
@@ -192,16 +192,16 @@ public async Task<HttpResponseMessage> BffLoginAsync(string sub, string sid = nu
         public async Task<HttpResponseMessage> BffOidcLoginAsync()
         {
             var response = await BrowserClient.GetAsync(Url("/bff/login"));
-            response.StatusCode.Should().Be(302); // authorize
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // authorize
             response.Headers.Location.ToString().ToLowerInvariant().Should()
                 .StartWith(_identityServerHost.Url("/connect/authorize"));
 
             response = await _identityServerHost.BrowserClient.GetAsync(response.Headers.Location.ToString());
-            response.StatusCode.Should().Be(302); // client callback
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // client callback
             response.Headers.Location.ToString().ToLowerInvariant().Should().StartWith(Url("/signin-oidc"));
 
             response = await BrowserClient.GetAsync(response.Headers.Location.ToString());
-            response.StatusCode.Should().Be(302); // root
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // root
             response.Headers.Location.ToString().ToLowerInvariant().Should().Be("/");
 
             (await GetIsUserLoggedInAsync()).Should().BeTrue();
@@ -213,21 +213,21 @@ public async Task<HttpResponseMessage> BffOidcLoginAsync()
         public async Task<HttpResponseMessage> BffLogoutAsync(string sid = null)
         {
             var response = await BrowserClient.GetAsync(Url("/bff/logout") + "?sid=" + sid);
-            response.StatusCode.Should().Be(302); // endsession
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // endsession
             response.Headers.Location.ToString().ToLowerInvariant().Should()
                 .StartWith(_identityServerHost.Url("/connect/endsession"));
 
             response = await _identityServerHost.BrowserClient.GetAsync(response.Headers.Location.ToString());
-            response.StatusCode.Should().Be(302); // logout
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // logout
             response.Headers.Location.ToString().ToLowerInvariant().Should()
                 .StartWith(_identityServerHost.Url("/account/logout"));
 
             response = await _identityServerHost.BrowserClient.GetAsync(response.Headers.Location.ToString());
-            response.StatusCode.Should().Be(302); // post logout redirect uri
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // post logout redirect uri
             response.Headers.Location.ToString().ToLowerInvariant().Should().StartWith(Url("/signout-callback-oidc"));
 
             response = await BrowserClient.GetAsync(response.Headers.Location.ToString());
-            response.StatusCode.Should().Be(302); // root
+            response.StatusCode.Should().Be(HttpStatusCode.Redirect); // root
             response.Headers.Location.ToString().ToLowerInvariant().Should().Be("/");
 
             (await GetIsUserLoggedInAsync()).Should().BeFalse();