diff --git a/testdata/testkit/bad_hmac b/testdata/testkit/hmac_bad
similarity index 100%
rename from testdata/testkit/bad_hmac
rename to testdata/testkit/hmac_bad
diff --git a/testdata/testkit/valid_characters b/testdata/testkit/stanza_valid_characters
similarity index 69%
rename from testdata/testkit/valid_characters
rename to testdata/testkit/stanza_valid_characters
index 0c88a6e..c506f30 100644
Binary files a/testdata/testkit/valid_characters and b/testdata/testkit/stanza_valid_characters differ
diff --git a/testdata/testkit/x25519_identity b/testdata/testkit/x25519_identity
new file mode 100644
index 0000000..eb254e7
Binary files /dev/null and b/testdata/testkit/x25519_identity differ
diff --git a/testdata/testkit/x25519_low_order b/testdata/testkit/x25519_low_order
new file mode 100644
index 0000000..84e9fa3
Binary files /dev/null and b/testdata/testkit/x25519_low_order differ
diff --git a/tests/bad_hmac.go b/tests/hmac_bad.go
similarity index 100%
rename from tests/bad_hmac.go
rename to tests/hmac_bad.go
diff --git a/tests/valid_characters.go b/tests/stanza_valid_characters.go
similarity index 78%
rename from tests/valid_characters.go
rename to tests/stanza_valid_characters.go
index b617d69..049c683 100644
--- a/tests/valid_characters.go
+++ b/tests/stanza_valid_characters.go
@@ -11,8 +11,9 @@ import "filippo.io/age/internal/testkit"
 func main() {
 	f := testkit.NewTestFile()
 	f.VersionLine("v1")
-	f.ArgsLine("!\"#$%&'", "()*+,-./", "01234567", "89:;<=>?", "@ABCDEFG",
-		"HIJKLMNO", "PQRSTUVW", "XYZ[\\]^_", "`abcdefg", "hijklmno", "pqrstuvw", "xyz{|}~")
+	f.ArgsLine("!\"#$%&'", "()*+,-./", "01234567", "89:;<=>?", "@ABCDEFG", "HIJKLMNO")
+	f.Body([]byte(""))
+	f.ArgsLine("PQRSTUVW", "XYZ[\\]^_", "`abcdefg", "hijklmno", "pqrstuvw", "xyz{|}~")
 	f.Body([]byte(""))
 	f.X25519(testkit.TestX25519Recipient)
 	f.HMAC()
diff --git a/tests/x25519_identity.go b/tests/x25519_identity.go
new file mode 100644
index 0000000..be8e531
--- /dev/null
+++ b/tests/x25519_identity.go
@@ -0,0 +1,34 @@
+// Copyright 2022 The age Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build ignore
+
+package main
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+
+	"filippo.io/age/internal/testkit"
+	"golang.org/x/crypto/curve25519"
+	"golang.org/x/crypto/hkdf"
+)
+
+func main() {
+	f := testkit.NewTestFile()
+	f.VersionLine("v1")
+	f.X25519RecordIdentity(testkit.TestX25519Identity)
+	share := make([]byte, curve25519.PointSize)
+	f.ArgsLine("X25519", base64.RawStdEncoding.EncodeToString(share))
+	secret := make([]byte, curve25519.PointSize)
+	key := make([]byte, 32)
+	hkdf.New(sha256.New, secret, append(share, testkit.TestX25519Recipient...),
+		[]byte("age-encryption.org/v1/X25519")).Read(key)
+	f.AEADBody(key, testkit.TestFileKey)
+	f.HMAC()
+	f.Payload("age")
+	f.ExpectHeaderFailure()
+	f.Comment("the X25519 share is a low-order point, so the shared secret is the disallowed all-zero value")
+	f.Generate()
+}
diff --git a/tests/x25519_low_order.go b/tests/x25519_low_order.go
new file mode 100644
index 0000000..fbc374a
--- /dev/null
+++ b/tests/x25519_low_order.go
@@ -0,0 +1,38 @@
+// Copyright 2022 The age Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build ignore
+
+package main
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+
+	"filippo.io/age/internal/testkit"
+	"golang.org/x/crypto/curve25519"
+	"golang.org/x/crypto/hkdf"
+)
+
+func main() {
+	f := testkit.NewTestFile()
+	f.VersionLine("v1")
+	f.X25519RecordIdentity(testkit.TestX25519Identity)
+	// Point of order 8 on Curve25519, chosen to be the least likely to be
+	// flagged by hardcoded list exclusions.
+	share := []byte{0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24, 0xb1, 0xd0,
+		0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b, 0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c,
+		0x8e, 0x86, 0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0xd7}
+	f.ArgsLine("X25519", base64.RawStdEncoding.EncodeToString(share))
+	secret := make([]byte, curve25519.PointSize)
+	key := make([]byte, 32)
+	hkdf.New(sha256.New, secret, append(share, testkit.TestX25519Recipient...),
+		[]byte("age-encryption.org/v1/X25519")).Read(key)
+	f.AEADBody(key, testkit.TestFileKey)
+	f.HMAC()
+	f.Payload("age")
+	f.ExpectHeaderFailure()
+	f.Comment("the X25519 share is a low-order point, so the shared secret is the disallowed all-zero value")
+	f.Generate()
+}