diff --git a/controllers/gitrepository_controller_test.go b/controllers/gitrepository_controller_test.go
index a30f608b..50a9463f 100644
--- a/controllers/gitrepository_controller_test.go
+++ b/controllers/gitrepository_controller_test.go
@@ -362,7 +362,7 @@ func TestGitRepositoryReconciler_reconcileSource_authStrategy(t *testing.T) {
 			},
 			wantErr: true,
 			assertConditions: []metav1.Condition{
-				*conditions.TrueCondition(sourcev1.FetchFailedCondition, sourcev1.GitOperationFailedReason, "failed to checkout and determine revision: unable to clone '<url>': PEM CA bundle could not be appended to x509 certificate pool"),
+				*conditions.TrueCondition(sourcev1.FetchFailedCondition, sourcev1.GitOperationFailedReason, "failed to checkout and determine revision: unable to fetch-connect to remote '<url>': PEM CA bundle could not be appended to x509 certificate pool"),
 			},
 		},
 		{
@@ -645,11 +645,10 @@ func TestGitRepositoryReconciler_reconcileSource_checkoutStrategy(t *testing.T)
 				}
 				conditions.MarkTrue(obj, sourcev1.ArtifactInStorageCondition, meta.SucceededReason, "foo")
 			},
-			want:                  sreconcile.ResultEmpty,
-			wantErr:               true,
-			wantRevision:          "staging/<commit>",
-			wantArtifactOutdated:  false,
-			skipForImplementation: "libgit2",
+			want:                 sreconcile.ResultEmpty,
+			wantErr:              true,
+			wantRevision:         "staging/<commit>",
+			wantArtifactOutdated: false,
 		},
 		{
 			name: "Optimized clone different ignore",
@@ -670,10 +669,9 @@ func TestGitRepositoryReconciler_reconcileSource_checkoutStrategy(t *testing.T)
 				}
 				conditions.MarkTrue(obj, sourcev1.ArtifactInStorageCondition, meta.SucceededReason, "foo")
 			},
-			want:                  sreconcile.ResultSuccess,
-			wantRevision:          "staging/<commit>",
-			wantArtifactOutdated:  false,
-			skipForImplementation: "libgit2",
+			want:                 sreconcile.ResultSuccess,
+			wantRevision:         "staging/<commit>",
+			wantArtifactOutdated: false,
 		},
 	}
 
diff --git a/controllers/suite_test.go b/controllers/suite_test.go
index 6531d633..757ac78f 100644
--- a/controllers/suite_test.go
+++ b/controllers/suite_test.go
@@ -39,6 +39,7 @@ import (
 	"github.com/fluxcd/pkg/runtime/controller"
 	"github.com/fluxcd/pkg/runtime/testenv"
 	"github.com/fluxcd/pkg/testserver"
+	"github.com/go-logr/logr"
 	"github.com/phayes/freeport"
 
 	"github.com/distribution/distribution/v3/configuration"
@@ -50,6 +51,7 @@ import (
 	"github.com/fluxcd/source-controller/internal/cache"
 	"github.com/fluxcd/source-controller/internal/features"
 	"github.com/fluxcd/source-controller/internal/helm/registry"
+	"github.com/fluxcd/source-controller/pkg/git/libgit2/managed"
 	// +kubebuilder:scaffold:imports
 )
 
@@ -207,6 +209,8 @@ func TestMain(m *testing.M) {
 		panic(fmt.Sprintf("Failed to create OCI registry client"))
 	}
 
+	managed.InitManagedTransport(logr.Discard())
+
 	if err := (&GitRepositoryReconciler{
 		Client:        testEnv,
 		EventRecorder: record.NewFakeRecorder(32),
diff --git a/pkg/git/libgit2/managed/http.go b/pkg/git/libgit2/managed/http.go
index 1533e6bd..937d1097 100644
--- a/pkg/git/libgit2/managed/http.go
+++ b/pkg/git/libgit2/managed/http.go
@@ -222,7 +222,7 @@ func createClientRequest(targetURL string, action git2go.SmartServiceAction,
 		if len(authOpts.CAFile) > 0 {
 			certPool := x509.NewCertPool()
 			if ok := certPool.AppendCertsFromPEM(authOpts.CAFile); !ok {
-				return nil, nil, fmt.Errorf("failed to use certificate from PEM")
+				return nil, nil, fmt.Errorf("PEM CA bundle could not be appended to x509 certificate pool")
 			}
 			t.TLSClientConfig = &tls.Config{
 				RootCAs: certPool,
diff --git a/pkg/git/libgit2/managed_test.go b/pkg/git/libgit2/managed_test.go
index 8cb07016..f5e29020 100644
--- a/pkg/git/libgit2/managed_test.go
+++ b/pkg/git/libgit2/managed_test.go
@@ -42,6 +42,10 @@ import (
 
 const testRepositoryPath = "../testdata/git/repo"
 
+func TestMain(m *testing.M) {
+	managed.InitManagedTransport(logr.Discard())
+}
+
 // Test_ManagedSSH_KeyTypes assures support for the different
 // types of keys for SSH Authentication supported by Flux.
 func Test_ManagedSSH_KeyTypes(t *testing.T) {
@@ -124,8 +128,6 @@ func Test_ManagedSSH_KeyTypes(t *testing.T) {
 	knownHosts, err := ssh.ScanHostKey(u.Host, timeout, git.HostKeyAlgos, false)
 	g.Expect(err).ToNot(HaveOccurred())
 
-	managed.InitManagedTransport(logr.Discard())
-
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			g := NewWithT(t)
@@ -223,8 +225,6 @@ func Test_ManagedSSH_KeyExchangeAlgos(t *testing.T) {
 		},
 	}
 
-	managed.InitManagedTransport(logr.Discard())
-
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			g := NewWithT(t)
@@ -382,8 +382,6 @@ func Test_ManagedSSH_HostKeyAlgos(t *testing.T) {
 		},
 	}
 
-	managed.InitManagedTransport(logr.Discard())
-
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			g := NewWithT(t)
@@ -475,7 +473,6 @@ func Test_ManagedHTTPCheckout(t *testing.T) {
 	defer server.StopHTTP()
 
 	// Force managed transport to be enabled
-	managed.InitManagedTransport(logr.Discard())
 
 	repoPath := "test.git"
 	err = server.InitRepo("../testdata/git/repo", git.DefaultBranch, repoPath)
@@ -501,7 +498,6 @@ func Test_ManagedHTTPCheckout(t *testing.T) {
 }
 
 func TestManagedCheckoutBranch_Checkout(t *testing.T) {
-	managed.InitManagedTransport(logr.Discard())
 	g := NewWithT(t)
 
 	timeout := 5 * time.Second
@@ -557,7 +553,6 @@ func TestManagedCheckoutBranch_Checkout(t *testing.T) {
 }
 
 func TestManagedCheckoutTag_Checkout(t *testing.T) {
-	managed.InitManagedTransport(logr.Discard())
 	g := NewWithT(t)
 
 	timeout := 5 * time.Second