diff --git a/Cargo.toml b/Cargo.toml
index 7b635f9..3c857c8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -42,7 +42,7 @@ reqwest = { version = "0.12.9", default-features = false }
 result_large_err = "allow"
 
 # Size-optimized profile for building test-fixture contracts (hello_v1/v2) to
-# wasm via `stellar contract build --profile contracts`. Mirrors the profile in
+# wasm via `stellar scaffold build --profile contracts`. Mirrors the profile in
 # stellar-registry/contracts so fixtures build the same way as the registry.
 [profile.contracts]
 inherits = "release"
diff --git a/crates/stellar-registry-cli/src/commands/fetch_contract_id.rs b/crates/stellar-registry-cli/src/commands/fetch_contract_id.rs
index c7e9c8f..e8e0794 100644
--- a/crates/stellar-registry-cli/src/commands/fetch_contract_id.rs
+++ b/crates/stellar-registry-cli/src/commands/fetch_contract_id.rs
@@ -63,7 +63,7 @@ impl Cmd {
 #[cfg(feature = "integration-tests")]
 #[cfg(test)]
 mod tests {
-    use stellar_registry_test::RegistryTest;
+    use stellar_registry_test::{AssertExt, RegistryTest};
 
     #[tokio::test]
     async fn simple() {
@@ -140,4 +140,70 @@ mod tests {
             .unwrap();
         assert!(!contract_id.to_string().is_empty());
     }
+
+    #[tokio::test]
+    async fn flagged() {
+        let registry = RegistryTest::new().await;
+        let v1 = registry.hello_wasm_v1();
+
+        // 1. publish wasm
+        registry
+            .registry_cli("publish")
+            .arg("--wasm")
+            .arg(v1.to_str().unwrap())
+            .arg("--binver")
+            .arg("0.0.1")
+            .arg("--wasm-name")
+            .arg("hello")
+            .assert()
+            .success();
+
+        // 2. deploy contract
+        let output = registry
+            .registry_cli("deploy")
+            .arg("--contract-name")
+            .arg("hello")
+            .arg("--wasm-name")
+            .arg("hello")
+            .arg("--")
+            .arg("--admin=alice")
+            .assert()
+            .success()
+            .stdout_as_str();
+        let flagged_id = output.split_whitespace().last().unwrap();
+
+        // 3. Flag contract
+        registry
+            .env
+            .stellar("contract")
+            .args([
+                "invoke",
+                "--id",
+                &registry.registry_address,
+                "--",
+                "flag_contract",
+                "--flagged",
+                "true",
+                "--contract-name",
+                "hello",
+            ])
+            .assert()
+            .success();
+
+        let err = registry
+            .parse_cmd::<super::Cmd>(&["hello"])
+            .unwrap()
+            .fetch_contract_id()
+            .await
+            .unwrap_err();
+        assert!(err.to_string().contains("flagged"));
+
+        let contract_id = registry
+            .parse_cmd::<super::Cmd>(&["hello", "--force"])
+            .unwrap()
+            .fetch_contract_id()
+            .await
+            .unwrap();
+        assert_eq!(*contract_id.to_string(), *flagged_id);
+    }
 }
diff --git a/crates/stellar-registry-test/src/registry.rs b/crates/stellar-registry-test/src/registry.rs
index 71acc35..3b51f3b 100644
--- a/crates/stellar-registry-test/src/registry.rs
+++ b/crates/stellar-registry-test/src/registry.rs
@@ -290,8 +290,9 @@ impl RandomizedWasm {
         Self(PathBuf::from(name))
     }
     pub fn randomize(&self, temp_dir: &Path) -> PathBuf {
-        let mut wasm_bytes = fs::read(find_stellar_wasm_dir().unwrap().join(&self.0))
-            .expect("Failed to read wasm file");
+        let path = &find_stellar_wasm_dir().unwrap().join(&self.0);
+        let mut wasm_bytes = fs::read(path)
+            .unwrap_or_else(|_| panic!("Failed to read wasm file {}", path.display()));
         wasm_gen::write_custom_section(
             &mut wasm_bytes,
             "test_section",
diff --git a/justfile b/justfile
index 58c150e..9f5f15f 100644
--- a/justfile
+++ b/justfile
@@ -35,10 +35,10 @@ test-integration: build
 
 # Print where to get the wasms the integration tests load (registry.wasm + hello_v1/v2.wasm)
 fetch-test-wasms:
-    @echo "Integration tests load these from target/stellar/local:"
-    @echo "  - registry.wasm        (from the stellar-registry/contracts release)"
-    @echo "  - hello_v1.wasm        (from the stellar-scaffold/cli test fixtures)"
-    @echo "  - hello_v2.wasm        (from the stellar-scaffold/cli test fixtures)"
+    stellar scaffold build --profile contracts
+    @mkdir -p target/stellar/local
+    @cp target/wasm32v1-none/contracts/*.wasm target/stellar/local/
+    @cp ../contracts/target/wasm32v1-none/release/*.wasm target/stellar/local/ || echo "For integration tests, you need to copy your `stellar-registry/contracts` project's `registry.wasm` to `target/stellar/local`"
 
 [private]
 _test-integration package filter ci="false":