diff --git a/tests/test_web.py b/tests/test_web.py
index e01549c..2ada1d3 100644
--- a/tests/test_web.py
+++ b/tests/test_web.py
@@ -131,6 +131,15 @@ def test_comments_local(self) -> None:
             return None
         # Makes sure the userkey is set to the right one
         self.client.set_apikey(self.admin_token)
+
+        # Comment creation requires the target vulnerability to exist in the
+        # instance, so comment on one that is actually imported (the CI sample
+        # instance loads pysec) rather than a hardcoded id.
+        last = self.client.get_last(source="pysec", number=1)
+        if not last:
+            return None
+        vuln_id = last[-1]["id"]
+
         comments = self.client.get_comments()
         self.assertTrue("metadata" in comments)
         self.assertTrue("data" in comments)
@@ -142,7 +151,7 @@ def test_comments_local(self) -> None:
             "title": "Comment",
             "description": "Comment",
             "description_format": "markdown",
-            "vulnerability": "CVE-2024-20401",
+            "vulnerability": vuln_id,
             "related_vulnerabilities": ["ghsa-4rcj-fmjg-q9fv"],
         }
         comments = self.client.create_comment(comment=comment)
@@ -161,10 +170,10 @@ def test_comments_local(self) -> None:
             comments["data"][0]["uuid"], "a309d024-2714-4a81-a425-60f83f6d5740"
         )
 
-        comments = self.client.get_comments(vuln_id="CVE-2024-20401")
+        comments = self.client.get_comments(vuln_id=vuln_id)
         self.assertTrue(len(comments["data"]) >= 1)
         for comment in comments["data"]:
-            self.assertEqual(comment["vulnerability"], "CVE-2024-20401")
+            self.assertEqual(comment["vulnerability"], vuln_id)
 
         # comments = self.client.get_comments(author='admin')
         # self.assertTrue(len(comments['data']) >= 1)
@@ -172,13 +181,13 @@ def test_comments_local(self) -> None:
         #     self.assertEqual(comment['author']['login'], 'admin') # type: ignore[call-overload]
 
         comments = self.client.get_comments(
-            uuid="a309d024-2714-4a81-a425-60f83f6d5740", vuln_id="CVE-2024-20401"
+            uuid="a309d024-2714-4a81-a425-60f83f6d5740", vuln_id=vuln_id
         )
         self.assertTrue(len(comments["data"]) == 1)
         self.assertEqual(
             comments["data"][0]["uuid"], "a309d024-2714-4a81-a425-60f83f6d5740"
         )
-        self.assertEqual(comments["data"][0]["vulnerability"], "CVE-2024-20401")
+        self.assertEqual(comments["data"][0]["vulnerability"], vuln_id)
         # self.assertEqual(comments['data'][0]['author']['login'], 'admin')
 
         status_code = self.client.delete_comment("a309d024-2714-4a81-a425-60f83f6d5740")
@@ -339,8 +348,16 @@ def test_create_user_comment(self) -> None:
         self.assertTrue('login' in user, user)
         # self.assertTrue('apikey' in user, user)
         # self.client.set_apikey(user['apikey'])
+
+        # Comment creation requires the target vulnerability to exist, so use
+        # one actually imported by the instance (pysec in CI).
+        last = self.client.get_last(source='pysec', number=1)
+        if not last:
+            return None
+        vuln_id = last[-1]['id']
+
         comment = {'title': 'test', 'description': 'test',
-                   'vulnerability': 'CVE-2024-20401',
+                   'vulnerability': vuln_id,
                    'related_vulnerabilities': ['CVE-2024-20402']}
         created_comment = self.client.create_comment(comment=comment)
         print(created_comment)