diff --git a/testscript/script_test.go b/testscript/script_test.go
index b7b8a618aa0ba33eeb7110c31be2cd48bd6eae13..74ae3bebefc9949833c1aec13dc2a474819c8903 100644
--- a/testscript/script_test.go
+++ b/testscript/script_test.go
@@ -2,11 +2,13 @@ package testscript
 
 import (
 	"context"
+	"fmt"
 	"path/filepath"
 	"testing"
 
 	"github.com/charmbracelet/soft-serve/server"
 	"github.com/charmbracelet/soft-serve/server/config"
+	"github.com/charmbracelet/soft-serve/server/test"
 	"github.com/rogpeppe/go-internal/testscript"
 )
 
@@ -28,7 +30,7 @@ func TestScript(t *testing.T) {
 					"-o", "IdentityAgent=none",
 					"-o", "IdentitiesOnly=yes",
 					"-i", key,
-					"-p", "23231",
+					"-p", ts.Getenv("SSH_PORT"),
 					"localhost",
 					"--",
 				}, args...)
@@ -41,7 +43,13 @@ func TestScript(t *testing.T) {
 				"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJI/1tawpdPmzuJcTGTJ+QReqB6cRUdKj4iQIdJUFdrl",
 			}
 			cfg.DataPath = t.TempDir()
-			e.T().Log("using", cfg.DataPath, "as data path")
+
+			sshPort := test.RandomPort()
+			e.Setenv("SSH_PORT", fmt.Sprintf("%d", sshPort))
+			cfg.SSH.ListenAddr = fmt.Sprintf("localhost:%d", sshPort)
+			cfg.HTTP.ListenAddr = fmt.Sprintf("localhost:%d", test.RandomPort())
+			cfg.Git.ListenAddr = fmt.Sprintf("localhost:%d", test.RandomPort())
+			cfg.Stats.ListenAddr = fmt.Sprintf("localhost:%d", test.RandomPort())
 			ctx := config.WithContext(context.Background(), cfg)
 			srv, err := server.NewServer(ctx)
 			if err != nil {
diff --git a/testscript/testdata/script/settings.txtar b/testscript/testdata/script/settings.txtar
new file mode 100644
index 0000000000000000000000000000000000000000..5118f8fbfafb3165a9bbe0a36bedad70d402b353
--- /dev/null
+++ b/testscript/testdata/script/settings.txtar
@@ -0,0 +1,41 @@
+soft settings allow-keyless true
+soft settings allow-keyless
+cmp stdout allow-keyless1.txt
+
+soft settings allow-keyless false
+soft settings allow-keyless
+cmp stdout allow-keyless2.txt
+
+soft settings anon-access
+cmp stdout anon-access1.txt
+
+soft settings anon-access no-access
+soft settings anon-access
+cmp stdout anon-access2.txt
+
+soft settings anon-access read-only
+soft settings anon-access
+cmp stdout anon-access3.txt
+
+soft settings anon-access read-write
+soft settings anon-access
+cmp stdout anon-access4.txt
+
+soft settings anon-access admin-access
+soft settings anon-access
+cmp stdout anon-access5.txt
+
+-- allow-keyless1.txt --
+true
+-- allow-keyless2.txt --
+false
+-- anon-access1.txt --
+read-only
+-- anon-access2.txt --
+no-access
+-- anon-access3.txt --
+read-only
+-- anon-access4.txt --
+read-write
+-- anon-access5.txt --
+admin-access