diff --git a/core/src/main/java/hudson/console/ConsoleNote.java b/core/src/main/java/hudson/console/ConsoleNote.java
index 1f6caad754b4e49987ac483d74abc3926e51bbbd..1bc7dae465771224ad6b630fd6bdf81b7aa2b097 100644
--- a/core/src/main/java/hudson/console/ConsoleNote.java
+++ b/core/src/main/java/hudson/console/ConsoleNote.java
@@ -192,9 +192,11 @@ public abstract class ConsoleNote<T> implements Serializable, Describable<Consol
         DataOutputStream dos = new DataOutputStream(new Base64OutputStream(buf2,true,-1,null));
         try {
             buf2.write(PREAMBLE);
-            byte[] mac = MAC.mac(buf.toByteArray());
-            dos.writeInt(- mac.length); // negative to differentiate from older form
-            dos.write(mac);
+            if (Jenkins.getInstanceOrNull() != null) { // else we are in another JVM and cannot sign; result will be ignored unless INSECURE
+                byte[] mac = MAC.mac(buf.toByteArray());
+                dos.writeInt(- mac.length); // negative to differentiate from older form
+                dos.write(mac);
+            }
             dos.writeInt(buf.size());
             buf.writeTo(dos);
         } finally {
diff --git a/core/src/main/java/jenkins/security/ConfidentialStore.java b/core/src/main/java/jenkins/security/ConfidentialStore.java
index 78ff2565cf41147e2106971987ad1dc39fb4f3ee..9434035d2a53a5f61750ce0d7f9575e249225d90 100644
--- a/core/src/main/java/jenkins/security/ConfidentialStore.java
+++ b/core/src/main/java/jenkins/security/ConfidentialStore.java
@@ -59,9 +59,7 @@ public abstract class ConfidentialStore {
      * Retrieves the currently active singleton instance of {@link ConfidentialStore}.
      */
     public static @Nonnull ConfidentialStore get() {
-        if (TEST != null) {
-            return TEST;
-        }
+        if (TEST!=null) return TEST.get();
 
         Jenkins j = Jenkins.getInstance();
         Lookup lookup = j.lookup;
@@ -92,7 +90,7 @@ public abstract class ConfidentialStore {
     /**
      * Testing only. Used for testing {@link ConfidentialKey} without {@link Jenkins}
      */
-    /*package*/ static ConfidentialStore TEST = null;
+    /*package*/ static ThreadLocal<ConfidentialStore> TEST = null;
 
     private static final Logger LOGGER = Logger.getLogger(ConfidentialStore.class.getName());
 }
diff --git a/core/src/test/java/hudson/model/TaskActionTest.java b/core/src/test/java/hudson/model/TaskActionTest.java
index 8b86e0ca932967344a20fcb39e6ce6dde3731897..ec31498e0795b9f3f53d7b55e1436ba28892dd64 100644
--- a/core/src/test/java/hudson/model/TaskActionTest.java
+++ b/core/src/test/java/hudson/model/TaskActionTest.java
@@ -1,16 +1,13 @@
 package hudson.model;
 
-import static org.junit.Assert.*;
+import static org.junit.Assert.assertTrue;
 
 import java.io.ByteArrayOutputStream;
 
 import hudson.console.AnnotatedLargeText;
 import hudson.security.ACL;
 import hudson.security.Permission;
-import jenkins.security.ConfidentialStoreRule;
 import org.acegisecurity.Authentication;
-import static org.hamcrest.CoreMatchers.startsWith;
-import org.junit.Rule;
 import org.junit.Test;
 
 /**
@@ -18,9 +15,6 @@ import org.junit.Test;
  */
 public class TaskActionTest {
 
-    @Rule
-    public ConfidentialStoreRule confidentialStoreRule = new ConfidentialStoreRule();
-
     private static class MyTaskThread extends TaskThread {
         MyTaskThread(TaskAction taskAction) {
             super(taskAction, ListenerAndText.forMemory(taskAction));
@@ -69,6 +63,6 @@ public class TaskActionTest {
         }
         ByteArrayOutputStream os = new ByteArrayOutputStream();
         annotatedText.writeLogTo(0, os);
-        assertThat(os.toString("UTF-8"), startsWith("a linkCompleted"));
+        assertTrue(os.toString("UTF-8").startsWith("a linkCompleted"));
     }
 }
diff --git a/core/src/test/java/jenkins/security/ConfidentialStoreRule.java b/core/src/test/java/jenkins/security/ConfidentialStoreRule.java
index c42c8e6b7be9bf075474d478f4c6459e9618f135..db46255ba67723bdaee9a78d71c4c4b7ba922567 100644
--- a/core/src/test/java/jenkins/security/ConfidentialStoreRule.java
+++ b/core/src/test/java/jenkins/security/ConfidentialStoreRule.java
@@ -14,13 +14,16 @@ public class ConfidentialStoreRule extends ExternalResource {
     @Override
     protected void before() throws Throwable {
         tmp.create();
-        ConfidentialStore.TEST = new DefaultConfidentialStore(tmp.getRoot());
+        ConfidentialStore.TEST.set(new DefaultConfidentialStore(tmp.getRoot()));
     }
 
     @Override
     protected void after() {
-        ConfidentialStore.TEST = null;
+        ConfidentialStore.TEST.set(null);
         tmp.delete();
     }
 
+    static {
+        ConfidentialStore.TEST = new ThreadLocal<ConfidentialStore>();
+    }
 }
diff --git a/core/src/test/java/hudson/console/AnnotatedLargeTextTest.java b/test/src/test/java/hudson/console/AnnotatedLargeTextTest.java
similarity index 96%
rename from core/src/test/java/hudson/console/AnnotatedLargeTextTest.java
rename to test/src/test/java/hudson/console/AnnotatedLargeTextTest.java
index 9456b1f398c8052ffb2c33082195c70deb74c402..0035a9c7891e62188042cf0dfe14de75519a1831 100644
--- a/core/src/test/java/hudson/console/AnnotatedLargeTextTest.java
+++ b/test/src/test/java/hudson/console/AnnotatedLargeTextTest.java
@@ -29,23 +29,23 @@ import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.PrintStream;
 import java.io.StringWriter;
-import jenkins.security.ConfidentialStoreRule;
 import org.apache.commons.io.Charsets;
 import static org.hamcrest.CoreMatchers.*;
 import static org.junit.Assert.*;
+import org.junit.ClassRule;
 import org.junit.Test;
-import org.junit.Rule;
 import org.jvnet.hudson.test.For;
 import org.jvnet.hudson.test.Issue;
+import org.jvnet.hudson.test.JenkinsRule;
 import org.kohsuke.stapler.framework.io.ByteBuffer;
 
 @For({AnnotatedLargeText.class, ConsoleNote.class, ConsoleAnnotationOutputStream.class, PlainTextConsoleOutputStream.class})
 public class AnnotatedLargeTextTest {
 
-    @Rule
-    public ConfidentialStoreRule confidentialStoreRule = new ConfidentialStoreRule();
+    @ClassRule
+    public static JenkinsRule r = new JenkinsRule();
 
-    /* TODO in trunk:
+    /* TODO in master:
     @Rule
     public LoggerRule logging = new LoggerRule().record(ConsoleAnnotationOutputStream.class, Level.FINE).capture(100);
     */