diff --git a/.github/workflows/gate-tests.yml b/.github/workflows/gate-tests.yml
index 31c59b7..2f01b46 100644
--- a/.github/workflows/gate-tests.yml
+++ b/.github/workflows/gate-tests.yml
@@ -13,7 +13,7 @@ jobs:
   test-skip-kind:
     strategy:
       matrix:
-        go-version: [1.19.x, 1.20.x]
+        go: ['1.19', '1.20', '1.21']
         os: [macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
@@ -24,10 +24,15 @@ jobs:
          disable-sudo: true
          allowed-endpoints: >
            github.com:443
+           api.github.com:443
+           proxy.github.com:443
+           raw.githubusercontent.com:443
+           objects.githubusercontent.com:443
+           proxy.golang.org:443
      - name: checkout code
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      - name: setup go
-       uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
+       uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
        with:
          go-version: ${{ matrix.go }}
      - name: run non-Kind tests
@@ -37,7 +42,7 @@ jobs:
   test-all:
     strategy:
       matrix:
-        go-version: [1.19.x, 1.20.x]
+        go: ['1.19', '1.20', '1.21']
         os: [ubuntu-latest]
     runs-on: ${{ matrix.os }}
     steps:
@@ -46,10 +51,17 @@ jobs:
        with:
          egress-policy: audit
          disable-sudo: false
+         allowed-endpoints: >
+           github.com:443
+           api.github.com:443
+           proxy.github.com:443
+           raw.githubusercontent.com:443
+           objects.githubusercontent.com:443
+           proxy.golang.org:443
      - name: checkout code
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      - name: setup go
-       uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
+       uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
        with:
          go-version: ${{ matrix.go }}
      - name: create KinD cluster
diff --git a/assertions.go b/assertions.go
index a9cb881..b1043e5 100644
--- a/assertions.go
+++ b/assertions.go
@@ -340,7 +340,7 @@ func (a *assertions) notFoundOK() bool {
 // lenOK returns true if the subject matches the Len condition, false otherwise
 func (a *assertions) lenOK() bool {
 	exp := a.exp
-	if exp.Len != nil {
+	if exp.Len != nil && a.hasSubject() {
 		// if the supplied resp is a list of objects returned by the dynamic
 		// client check its length
 		list, ok := a.r.(*unstructured.UnstructuredList)
diff --git a/eval.go b/eval.go
index 5638547..cde1f94 100644
--- a/eval.go
+++ b/eval.go
@@ -50,6 +50,7 @@ func (s *Spec) Eval(ctx context.Context, t *testing.T) *result.Result {
 	ticker := backoff.NewTicker(bo)
 	attempts := 0
 	start := time.Now().UTC()
+	success := false
 	for tick := range ticker.C {
 		attempts++
 		after := tick.Sub(start)
@@ -64,8 +65,8 @@ func (s *Spec) Eval(ctx context.Context, t *testing.T) *result.Result {
 				return result.New(result.WithRuntimeError(err))
 			}
 		}
-		a = newAssertions(s.Assert, err, &out)
-		success := a.OK()
+		a = newAssertions(s.Assert, err, out)
+		success = a.OK()
 		debug.Println(
 			ctx, t, "%s (try %d after %s) ok: %v",
 			s.Title(), attempts, after, success,
@@ -81,5 +82,10 @@ func (s *Spec) Eval(ctx context.Context, t *testing.T) *result.Result {
 			)
 		}
 	}
+	if !success {
+		for _, fail := range a.Failures() {
+			t.Error(fail)
+		}
+	}
 	return result.New(result.WithFailures(a.Failures()...))
 }