diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 418cac5..31459e8 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -95,6 +95,8 @@ jobs:
       - name: build and run tests (OpenSSL)
         if: matrix.tls_backend == 'openssl'
         run: cd test && make
+        env:
+          LSAN_OPTIONS: suppressions=lsan_suppressions.txt
       - name: build and run tests (Mbed TLS)
         if: matrix.tls_backend == 'mbedtls'
         run: cd test && make test_split_mbedtls && make test_mbedtls && ./test_mbedtls
@@ -122,6 +124,8 @@ jobs:
       - name: build and run tests (OpenSSL)
         if: matrix.tls_backend == 'openssl'
         run: cd test && make
+        env:
+          LSAN_OPTIONS: suppressions=lsan_suppressions.txt
       - name: build and run tests (Mbed TLS)
         if: matrix.tls_backend == 'mbedtls'
         run: cd test && make test_split_mbedtls && make test_mbedtls && ./test_mbedtls
diff --git a/test/Makefile b/test/Makefile
index 9269b3d..9b2d1e7 100644
--- a/test/Makefile
+++ b/test/Makefile
@@ -54,7 +54,7 @@ STYLE_CHECK_FILES = $(filter-out httplib.h httplib.cc, \
 	$(wildcard example/*.h example/*.cc fuzzing/*.h fuzzing/*.cc *.h *.cc ../httplib.h))
 
 all : test test_split
-	./test
+	LSAN_OPTIONS=suppressions=lsan_suppressions.txt ./test
 
 proxy : test_proxy
 	@echo "Starting proxy server..."
diff --git a/test/lsan_suppressions.txt b/test/lsan_suppressions.txt
new file mode 100644
index 0000000..1e177a6
--- /dev/null
+++ b/test/lsan_suppressions.txt
@@ -0,0 +1,3 @@
+# OpenSSL 3.x internal caches (provider, cipher, keymgmt) are allocated
+# lazily and intentionally kept until process exit. These are not real leaks.
+leak:libcrypto
diff --git a/test/test.cc b/test/test.cc
index 4a219c1..845c57a 100644
--- a/test/test.cc
+++ b/test/test.cc
@@ -4428,7 +4428,7 @@ TEST_F(ServerTest, TooLongRequest) {
 
   ASSERT_TRUE(res);
   EXPECT_EQ(StatusCode::UriTooLong_414, res->status);
-  EXPECT_LE(elapsed, 100);
+  EXPECT_LE(elapsed, 1000);
   EXPECT_EQ("close", res->get_header_value("Connection"));
   EXPECT_FALSE(cli_.is_socket_open());
 }
@@ -4513,7 +4513,7 @@ TEST_F(ServerTest, LongQueryValue) {
 
   ASSERT_TRUE(res);
   EXPECT_EQ(StatusCode::UriTooLong_414, res->status);
-  EXPECT_LE(elapsed, 100);
+  EXPECT_LE(elapsed, 1000);
   EXPECT_EQ("close", res->get_header_value("Connection"));
   EXPECT_FALSE(cli_.is_socket_open());
 }
@@ -15106,6 +15106,7 @@ TEST(BindServerTest, UpdateCerts) {
   ASSERT_TRUE(svr.is_valid());
   svr.stop();
 
+  X509_STORE_free(cert_store);
   X509_free(cert);
   X509_free(ca_cert);
   EVP_PKEY_free(key);