diff --git a/pkg/proxmox/client_container_config_test.go b/pkg/proxmox/client_container_config_test.go
new file mode 100644
index 000000000..016d87077
--- /dev/null
+++ b/pkg/proxmox/client_container_config_test.go
@@ -0,0 +1,42 @@
+package proxmox
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestClient_GetContainerConfig_NullData(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		if r.URL.Path == "/api2/json/nodes/node1/lxc/101/config" {
+			fmt.Fprint(w, `{"data":null}`)
+			return
+		}
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer server.Close()
+
+	client, err := NewClient(ClientConfig{
+		Host:       server.URL,
+		TokenName:  "user@pve!token",
+		TokenValue: "secret",
+		VerifySSL:  false,
+	})
+	if err != nil {
+		t.Fatalf("NewClient failed: %v", err)
+	}
+
+	cfg, err := client.GetContainerConfig(context.Background(), "node1", 101)
+	if err != nil {
+		t.Fatalf("GetContainerConfig failed: %v", err)
+	}
+	if cfg == nil {
+		t.Fatal("expected non-nil config map")
+	}
+	if len(cfg) != 0 {
+		t.Fatalf("expected empty config, got %+v", cfg)
+	}
+}
diff --git a/pkg/proxmox/client_container_interfaces_test.go b/pkg/proxmox/client_container_interfaces_test.go
new file mode 100644
index 000000000..e293aa28a
--- /dev/null
+++ b/pkg/proxmox/client_container_interfaces_test.go
@@ -0,0 +1,39 @@
+package proxmox
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestClient_GetContainerInterfaces_NonOKStatus(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/api2/json/nodes/node1/lxc/101/interfaces" {
+			w.WriteHeader(http.StatusNoContent)
+			w.Write([]byte("no content"))
+			return
+		}
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer server.Close()
+
+	client, err := NewClient(ClientConfig{
+		Host:       server.URL,
+		TokenName:  "user@pve!token",
+		TokenValue: "secret",
+		VerifySSL:  false,
+	})
+	if err != nil {
+		t.Fatalf("NewClient failed: %v", err)
+	}
+
+	_, err = client.GetContainerInterfaces(context.Background(), "node1", 101)
+	if err == nil {
+		t.Fatal("expected error for non-200 status")
+	}
+	if !strings.Contains(err.Error(), "failed to get container interfaces") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
diff --git a/pkg/proxmox/cluster_client_more_test.go b/pkg/proxmox/cluster_client_more_test.go
index e78dd4481..0dde953a4 100644
--- a/pkg/proxmox/cluster_client_more_test.go
+++ b/pkg/proxmox/cluster_client_more_test.go
@@ -143,3 +143,31 @@ func TestExecuteWithFailoverNotImplementedDoesNotMarkUnhealthy(t *testing.T) {
 		t.Fatalf("expected no lastError, got %+v", cc.lastError)
 	}
 }
+
+func TestExecuteWithFailoverRateLimitContextCancel(t *testing.T) {
+	cc := &ClusterClient{
+		name:            "cluster",
+		endpoints:       []string{"node1"},
+		clients:         map[string]*Client{"node1": {}},
+		nodeHealth:      map[string]bool{"node1": true},
+		lastError:       make(map[string]string),
+		lastHealthCheck: map[string]time.Time{"node1": time.Now()},
+		rateLimitUntil:  make(map[string]time.Time),
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Millisecond)
+	defer cancel()
+
+	err := cc.executeWithFailover(ctx, func(*Client) error {
+		return fmt.Errorf("status 429: Too Many Requests")
+	})
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	if !strings.Contains(err.Error(), "backing off after rate limit") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if _, ok := cc.rateLimitUntil["node1"]; !ok {
+		t.Fatal("expected rate limit cooldown to be recorded")
+	}
+}