diff --git a/src/meson.build b/src/meson.build
index eca170e2..c7707560 100644
--- a/src/meson.build
+++ b/src/meson.build
@@ -74,7 +74,7 @@ ctl_proto = custom_target('ctl-proto',
 http_heads_h = custom_target('http-heads',
   input:   'http-heads.gperf',
   output:  'http-heads.h',
-  command: [gperf, '--global-table', '-t', '@INPUT@'],
+  command: [gperf, '--global-table', '-t', meson.current_source_dir() / 'http-heads.gperf'],
   capture: true,
 )
 
diff --git a/tests/ac-aes128-gcm-cipher b/tests/ac-aes128-gcm-cipher
index d3a2d7d6..717508ff 100755
--- a/tests/ac-aes128-gcm-cipher
+++ b/tests/ac-aes128-gcm-cipher
@@ -27,4 +27,4 @@ GNUTLS_NAME="(DTLS1.2)-(RSA)-(AES-128-GCM)"
 ${PKG_CONFIG} --atleast-version=8.02 openconnect
 test $? != 0 && exit 77
 
-. cipher-common.sh
+. ${srcdir}/cipher-common.sh
diff --git a/tests/ac-aes256-gcm-cipher b/tests/ac-aes256-gcm-cipher
index c269cdb0..ed86c1b6 100755
--- a/tests/ac-aes256-gcm-cipher
+++ b/tests/ac-aes256-gcm-cipher
@@ -29,4 +29,4 @@ GNUTLS_NAME="(DTLS1.2)-(RSA)-(AES-256-GCM)"
 ${PKG_CONFIG} --atleast-version=8.03 openconnect
 test $? != 0 && exit 77
 
-. cipher-common.sh
+. ${srcdir}/cipher-common.sh
diff --git a/tests/aes128-cipher b/tests/aes128-cipher
index f7a4e725..8a240072 100755
--- a/tests/aes128-cipher
+++ b/tests/aes128-cipher
@@ -23,4 +23,4 @@
 CIPHER_NAME="AES128-SHA"
 GNUTLS_NAME="(DTLS0.9)-(RSA)-(AES-128-CBC)-(SHA1)"
 
-. cipher-common.sh
+. ${srcdir}/cipher-common.sh
diff --git a/tests/aes256-cipher b/tests/aes256-cipher
index c7364c6b..ead449d1 100755
--- a/tests/aes256-cipher
+++ b/tests/aes256-cipher
@@ -23,4 +23,4 @@
 CIPHER_NAME="AES256-SHA"
 GNUTLS_NAME="(DTLS0.9)-(RSA)-(AES-256-CBC)-(SHA1)"
 
-. cipher-common.sh
+. ${srcdir}/cipher-common.sh
diff --git a/tests/common.sh b/tests/common.sh
index 90ce4cb7..d0bb22e5 100755
--- a/tests/common.sh
+++ b/tests/common.sh
@@ -50,7 +50,7 @@ fi
 
 # NO_NEED_ROOT implies NEED_SOCKET_WRAPPER
 if test "${NEED_SOCKET_WRAPPER}" = 1 || test "${NO_NEED_ROOT}" = 1;then
-	SOCKDIR="${srcdir}/tmp/sockwrap.$$.tmp"
+	SOCKDIR="sockwrap.$$.tmp"
 	mkdir -p $SOCKDIR
 	export SOCKET_WRAPPER_DIR=$SOCKDIR
 	export SOCKET_WRAPPER_DEFAULT_IFACE=2
@@ -93,7 +93,8 @@ update_config() {
 	       -e 's|@ROUTE2@|'${ROUTE2}'|g' "$file.$$.tmp" \
 	       -e 's|@MATCH_CIPHERS@|'${MATCH_CIPHERS}'|g' "$file.$$.tmp" \
 	       -e 's|@OCCTL_SOCKET@|'${OCCTL_SOCKET}'|g' "$file.$$.tmp" \
-	       -e 's|@LISTEN_NS@|'${LISTEN_NS}'|g' "$file.$$.tmp"
+	       -e 's|@LISTEN_NS@|'${LISTEN_NS}'|g' "$file.$$.tmp" \
+	       -e 's|@RADIUSCLIENT_DIR@|'${RADIUSCLIENT_DIR}'|g' "$file.$$.tmp"
 	CONFIG="$file.$$.tmp"
 }
 
diff --git a/tests/data/apple-ios.config b/tests/data/apple-ios.config
index 47fffc4f..4b24ad13 100644
--- a/tests/data/apple-ios.config
+++ b/tests/data/apple-ios.config
@@ -111,8 +111,8 @@ auth-timeout = 40
 # DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP
 # in the P-t-P connection), IP_REMOTE (the VPN IP of the client). REASON
 # may be "connect" or "disconnect".
-connect-script = ./connect-ios-script
-disconnect-script = ./connect-ios-script
+connect-script = @SRCDIR@/connect-ios-script
+disconnect-script = @SRCDIR@/connect-ios-script
 
 # UTMP
 #use-utmp = true
diff --git a/tests/data/haproxy-proxyproto-v1.config b/tests/data/haproxy-proxyproto-v1.config
index c512a054..adb824b1 100644
--- a/tests/data/haproxy-proxyproto-v1.config
+++ b/tests/data/haproxy-proxyproto-v1.config
@@ -111,7 +111,7 @@ auth-timeout = 40
 # DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP
 # in the P-t-P connection), IP_REMOTE (the VPN IP of the client). REASON
 # may be "connect" or "disconnect".
-connect-script = ./scripts/proxy-connectscript-v1
+connect-script = @SRCDIR@/scripts/proxy-connectscript-v1
 #disconnect-script = /usr/bin/myscript
 
 # UTMP
diff --git a/tests/data/haproxy-proxyproto.config b/tests/data/haproxy-proxyproto.config
index 72100d3e..95e5268a 100644
--- a/tests/data/haproxy-proxyproto.config
+++ b/tests/data/haproxy-proxyproto.config
@@ -114,7 +114,7 @@ auth-timeout = 40
 # DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP
 # in the P-t-P connection), IP_REMOTE (the VPN IP of the client). REASON
 # may be "connect" or "disconnect".
-connect-script = ./scripts/proxy-connectscript
+connect-script = @SRCDIR@/scripts/proxy-connectscript
 #disconnect-script = /usr/bin/myscript
 
 # UTMP
diff --git a/tests/data/idle-timeout.config b/tests/data/idle-timeout.config
index b23173f3..5847bfb5 100644
--- a/tests/data/idle-timeout.config
+++ b/tests/data/idle-timeout.config
@@ -2,7 +2,7 @@
 # all should succeed.
 # Options: certificate, pam.
 #auth = "certificate"
-auth = "plain[./data/test1.passwd]"
+auth = "plain[@SRCDIR@/data/test1.passwd]"
 #auth = "pam"
 
 isolate-workers = @ISOLATE_WORKERS@
@@ -50,8 +50,8 @@ try-mtu-discovery = false
 #
 # There may be multiple certificate and key pairs and each key
 # should correspond to the preceding certificate.
-server-cert = ./certs/server-cert.pem
-server-key = ./certs/server-key.pem
+server-cert = @SRCDIR@/certs/server-cert.pem
+server-key = @SRCDIR@/certs/server-key.pem
 
 # Diffie-Hellman parameters. Only needed if you require support
 # for the DHE ciphersuites (by default this server supports ECDHE).
diff --git a/tests/data/multiple-routes.config b/tests/data/multiple-routes.config
index 2bfff182..63f5a884 100644
--- a/tests/data/multiple-routes.config
+++ b/tests/data/multiple-routes.config
@@ -2,7 +2,7 @@
 # all should succeed.
 # Options: certificate, pam.
 auth = "certificate"
-#auth = "plain[./data/test1.passwd]"
+#auth = "plain[@SRCDIR@/data/test1.passwd]"
 #auth = "pam"
 
 isolate-workers = false
@@ -47,8 +47,8 @@ try-mtu-discovery = false
 #
 # There may be multiple certificate and key pairs and each key
 # should correspond to the preceding certificate.
-server-cert = ./certs/server-cert.pem
-server-key = ./certs/server-key.pem
+server-cert = @SRCDIR@/certs/server-cert.pem
+server-key = @SRCDIR@/certs/server-key.pem
 
 # Diffie-Hellman parameters. Only needed if you require support
 # for the DHE ciphersuites (by default this server supports ECDHE).
@@ -74,7 +74,7 @@ server-key = ./certs/server-key.pem
 # The Certificate Authority that will be used
 # to verify clients if certificate authentication
 # is set.
-ca-cert = ./certs/ca.pem
+ca-cert = @SRCDIR@/certs/ca.pem
 
 # The object identifier that will be used to read the user ID in the client certificate.
 # The object identifier should be part of the certificate's DN
diff --git a/tests/data/radius-group.config b/tests/data/radius-group.config
index 5ffc7230..2c0eaee9 100644
--- a/tests/data/radius-group.config
+++ b/tests/data/radius-group.config
@@ -4,7 +4,7 @@
 #auth = "certificate"
 #auth = "plain[/etc/ocserv/passwd]"
 #auth = "pam"
-auth = "radius[config=@SRCDIR@/data/radiusclient/radiusclient.conf,groupconfig=true,nas-identifier=ocserv1]"
+auth = "radius[config=@RADIUSCLIENT_DIR@/radiusclient.conf,groupconfig=true,nas-identifier=ocserv1]"
 #enable-auth = "certificate"
 
 # Whether to enable support for the occtl tool (i.e., either through D-BUS,
@@ -29,7 +29,7 @@ isolate-workers = @ISOLATE_WORKERS@
 # to generate password entries.
 #auth = "plain[/etc/ocserv/ocpasswd]"
 
-acct = "radius[config=@SRCDIR@/data/radiusclient/radiusclient.conf]"
+acct = "radius[config=@RADIUSCLIENT_DIR@/radiusclient.conf]"
 
 # A banner to be displayed on clients
 #banner = "Welcome"
diff --git a/tests/data/radius-multi-group.config b/tests/data/radius-multi-group.config
index 88f3c0b9..5a573a4c 100644
--- a/tests/data/radius-multi-group.config
+++ b/tests/data/radius-multi-group.config
@@ -4,7 +4,7 @@
 #auth = "certificate"
 #auth = "plain[/etc/ocserv/passwd]"
 #auth = "pam"
-auth = "radius[config=@SRCDIR@/data/radiusclient/radiusclient.conf,groupconfig=true,nas-identifier=ocserv1]"
+auth = "radius[config=@RADIUSCLIENT_DIR@/radiusclient.conf,groupconfig=true,nas-identifier=ocserv1]"
 #enable-auth = "certificate"
 
 # Whether to enable support for the occtl tool (i.e., either through D-BUS,
@@ -30,7 +30,7 @@ isolate-workers = @ISOLATE_WORKERS@
 # to generate password entries.
 #auth = "plain[/etc/ocserv/ocpasswd]"
 
-acct = "radius[config=@SRCDIR@/data/radiusclient/radiusclient.conf]"
+acct = "radius[config=@RADIUSCLIENT_DIR@/radiusclient.conf]"
 
 # A banner to be displayed on clients
 #banner = "Welcome"
diff --git a/tests/data/radius-otp.config b/tests/data/radius-otp.config
index 5e58f62a..7e3fdbb0 100644
--- a/tests/data/radius-otp.config
+++ b/tests/data/radius-otp.config
@@ -4,7 +4,7 @@
 #auth = "certificate"
 #auth = "plain[/etc/ocserv/passwd]"
 #auth = "pam"
-auth = "radius[config=@SRCDIR@/data/radiusclient/radiusclient.conf,nas-identifier=ocserv1]"
+auth = "radius[config=@RADIUSCLIENT_DIR@/radiusclient.conf,nas-identifier=ocserv1]"
 #enable-auth = "certificate"
 
 # Whether to enable support for the occtl tool (i.e., either through D-BUS,
@@ -25,7 +25,7 @@ isolate-workers = @ISOLATE_WORKERS@
 # to generate password entries.
 #auth = "plain[/etc/ocserv/ocpasswd]"
 
-acct = "radius[config=@SRCDIR@/data/radiusclient/radiusclient.conf]"
+acct = "radius[config=@RADIUSCLIENT_DIR@/radiusclient.conf]"
 
 # A banner to be displayed on clients
 #banner = "Welcome"
diff --git a/tests/data/radius.config b/tests/data/radius.config
index e9ded714..8d8389af 100644
--- a/tests/data/radius.config
+++ b/tests/data/radius.config
@@ -4,7 +4,7 @@
 #auth = "certificate"
 #auth = "plain[/etc/ocserv/passwd]"
 #auth = "pam"
-auth = "radius[config=@SRCDIR@/data/radiusclient/radiusclient.conf,groupconfig=true,nas-identifier=ocserv1]"
+auth = "radius[config=@RADIUSCLIENT_DIR@/radiusclient.conf,groupconfig=true,nas-identifier=ocserv1]"
 #enable-auth = "certificate"
 
 # Whether to enable support for the occtl tool (i.e., either through D-BUS,
@@ -25,7 +25,7 @@ isolate-workers = @ISOLATE_WORKERS@
 # to generate password entries.
 #auth = "plain[/etc/ocserv/ocpasswd]"
 
-acct = "radius[config=@SRCDIR@/data/radiusclient/radiusclient.conf]"
+acct = "radius[config=@RADIUSCLIENT_DIR@/radiusclient.conf]"
 
 # A banner to be displayed on clients
 #banner = "Welcome"
diff --git a/tests/data/radiusclient/meson.build b/tests/data/radiusclient/meson.build
new file mode 100644
index 00000000..5d58ad5c
--- /dev/null
+++ b/tests/data/radiusclient/meson.build
@@ -0,0 +1,5 @@
+configure_file(
+  input:         'radiusclient.conf.in',
+  output:        'radiusclient.conf',
+  configuration: {'SRCDIR': meson.current_source_dir()},
+)
diff --git a/tests/data/radiusclient/radiusclient.conf b/tests/data/radiusclient/radiusclient.conf.in
similarity index 95%
rename from tests/data/radiusclient/radiusclient.conf
rename to tests/data/radiusclient/radiusclient.conf.in
index c818e642..b2ce6cac 100644
--- a/tests/data/radiusclient/radiusclient.conf
+++ b/tests/data/radiusclient/radiusclient.conf.in
@@ -33,18 +33,18 @@ acctserver 	localhost
 
 # file holding shared secrets used for the communication
 # between the RADIUS client and server
-servers		./data/radiusclient/servers
+servers		@SRCDIR@/servers
 
 # dictionary of allowed attributes and values
 # just like in the normal RADIUS distributions
-dictionary 	./data/radiusclient/dictionary
+dictionary 	@SRCDIR@/dictionary
 
 # file which holds sequence number for communication with the
 # RADIUS server
 seqfile		./radius.seq.tmp
 
 # file which specifies mapping between ttyname and NAS-Port attribute
-#mapfile		./data/radiusclient/port-id-map
+#mapfile		@SRCDIR@/port-id-map
 
 # default authentication realm to append to all usernames if no
 # realm was explicitly specified by the user
diff --git a/tests/data/session-timeout.config b/tests/data/session-timeout.config
index 2ed7540c..6cf399f5 100644
--- a/tests/data/session-timeout.config
+++ b/tests/data/session-timeout.config
@@ -2,7 +2,7 @@
 # all should succeed.
 # Options: certificate, pam.
 #auth = "certificate"
-auth = "plain[./data/test1.passwd]"
+auth = "plain[@SRCDIR@/data/test1.passwd]"
 #auth = "pam"
 
 isolate-workers = @ISOLATE_WORKERS@
@@ -50,8 +50,8 @@ try-mtu-discovery = false
 #
 # There may be multiple certificate and key pairs and each key
 # should correspond to the preceding certificate.
-server-cert = ./certs/server-cert.pem
-server-key = ./certs/server-key.pem
+server-cert = @SRCDIR@/certs/server-cert.pem
+server-key = @SRCDIR@/certs/server-key.pem
 
 # Diffie-Hellman parameters. Only needed if you require support
 # for the DHE ciphersuites (by default this server supports ECDHE).
diff --git a/tests/data/test-camouflage-norealm.config b/tests/data/test-camouflage-norealm.config
index 52863f5e..d80f5b55 100644
--- a/tests/data/test-camouflage-norealm.config
+++ b/tests/data/test-camouflage-norealm.config
@@ -2,7 +2,7 @@
 # all should succeed.
 # Options: certificate, pam.
 #auth = "certificate"
-auth = "plain[./data/test1.passwd]"
+auth = "plain[@SRCDIR@/data/test1.passwd]"
 #auth = "pam"
 
 isolate-workers = @ISOLATE_WORKERS@
@@ -47,8 +47,8 @@ try-mtu-discovery = false
 #
 # There may be multiple certificate and key pairs and each key
 # should correspond to the preceding certificate.
-server-cert = ./certs/server-cert.pem
-server-key = ./certs/server-key.pem
+server-cert = @SRCDIR@/certs/server-cert.pem
+server-key = @SRCDIR@/certs/server-key.pem
 
 # Diffie-Hellman parameters. Only needed if you require support
 # for the DHE ciphersuites (by default this server supports ECDHE).
diff --git a/tests/data/test-camouflage.config b/tests/data/test-camouflage.config
index bcb1cb1e..0ffc4738 100644
--- a/tests/data/test-camouflage.config
+++ b/tests/data/test-camouflage.config
@@ -2,7 +2,7 @@
 # all should succeed.
 # Options: certificate, pam.
 #auth = "certificate"
-auth = "plain[./data/test1.passwd]"
+auth = "plain[@SRCDIR@/data/test1.passwd]"
 #auth = "pam"
 
 isolate-workers = @ISOLATE_WORKERS@
@@ -47,8 +47,8 @@ try-mtu-discovery = false
 #
 # There may be multiple certificate and key pairs and each key
 # should correspond to the preceding certificate.
-server-cert = ./certs/server-cert.pem
-server-key = ./certs/server-key.pem
+server-cert = @SRCDIR@/certs/server-cert.pem
+server-key = @SRCDIR@/certs/server-key.pem
 
 # Diffie-Hellman parameters. Only needed if you require support
 # for the DHE ciphersuites (by default this server supports ECDHE).
diff --git a/tests/data/test-cert-opt-pass.config b/tests/data/test-cert-opt-pass.config
index 33584d1d..93bc3cf2 100644
--- a/tests/data/test-cert-opt-pass.config
+++ b/tests/data/test-cert-opt-pass.config
@@ -171,6 +171,6 @@ route = 192.168.1.0/255.255.255.0
 # should be set for them.
 cisco-client-compat = true
 
-config-per-user = ./user-config-opt/
+config-per-user = @SRCDIR@/user-config-opt/
 
 max-ban-score = 0
diff --git a/tests/data/test-cookie-invalidation.config b/tests/data/test-cookie-invalidation.config
index 84995b13..8ba7f230 100644
--- a/tests/data/test-cookie-invalidation.config
+++ b/tests/data/test-cookie-invalidation.config
@@ -2,7 +2,7 @@
 # all should succeed.
 # Options: certificate, pam.
 #auth = "certificate"
-auth = "plain[./data/test1.passwd]"
+auth = "plain[@SRCDIR@/data/test1.passwd]"
 #auth = "pam"
 
 isolate-workers = @ISOLATE_WORKERS@
@@ -47,8 +47,8 @@ try-mtu-discovery = false
 #
 # There may be multiple certificate and key pairs and each key
 # should correspond to the preceding certificate.
-server-cert = ./certs/server-cert.pem
-server-key = ./certs/server-key.pem
+server-cert = @SRCDIR@/certs/server-cert.pem
+server-key = @SRCDIR@/certs/server-key.pem
 
 # Diffie-Hellman parameters. Only needed if you require support
 # for the DHE ciphersuites (by default this server supports ECDHE).
diff --git a/tests/data/test-cookie-timeout-2.config b/tests/data/test-cookie-timeout-2.config
index 8dadef41..ac4c662e 100644
--- a/tests/data/test-cookie-timeout-2.config
+++ b/tests/data/test-cookie-timeout-2.config
@@ -2,7 +2,7 @@
 # all should succeed.
 # Options: certificate, pam.
 #auth = "certificate"
-auth = "plain[./data/test1.passwd]"
+auth = "plain[@SRCDIR@/data/test1.passwd]"
 #auth = "pam"
 
 isolate-workers = @ISOLATE_WORKERS@
@@ -47,8 +47,8 @@ try-mtu-discovery = false
 #
 # There may be multiple certificate and key pairs and each key
 # should correspond to the preceding certificate.
-server-cert = ./certs/server-cert.pem
-server-key = ./certs/server-key.pem
+server-cert = @SRCDIR@/certs/server-cert.pem
+server-key = @SRCDIR@/certs/server-key.pem
 
 # Diffie-Hellman parameters. Only needed if you require support
 # for the DHE ciphersuites (by default this server supports ECDHE).
diff --git a/tests/data/test-cookie-timeout.config b/tests/data/test-cookie-timeout.config
index 8dadef41..ac4c662e 100644
--- a/tests/data/test-cookie-timeout.config
+++ b/tests/data/test-cookie-timeout.config
@@ -2,7 +2,7 @@
 # all should succeed.
 # Options: certificate, pam.
 #auth = "certificate"
-auth = "plain[./data/test1.passwd]"
+auth = "plain[@SRCDIR@/data/test1.passwd]"
 #auth = "pam"
 
 isolate-workers = @ISOLATE_WORKERS@
@@ -47,8 +47,8 @@ try-mtu-discovery = false
 #
 # There may be multiple certificate and key pairs and each key
 # should correspond to the preceding certificate.
-server-cert = ./certs/server-cert.pem
-server-key = ./certs/server-key.pem
+server-cert = @SRCDIR@/certs/server-cert.pem
+server-key = @SRCDIR@/certs/server-key.pem
 
 # Diffie-Hellman parameters. Only needed if you require support
 # for the DHE ciphersuites (by default this server supports ECDHE).
diff --git a/tests/data/test-explicit-ip.config b/tests/data/test-explicit-ip.config
index 571a6ed4..915f6899 100644
--- a/tests/data/test-explicit-ip.config
+++ b/tests/data/test-explicit-ip.config
@@ -2,7 +2,7 @@
 # all should succeed.
 # Options: certificate, pam.
 #auth = "certificate[optional]"
-auth = "plain[./data/test1.passwd]"
+auth = "plain[@SRCDIR@/data/test1.passwd]"
 #auth = "pam"
 
 isolate-workers = @ISOLATE_WORKERS@
@@ -47,8 +47,8 @@ try-mtu-discovery = false
 #
 # There may be multiple certificate and key pairs and each key
 # should correspond to the preceding certificate.
-server-cert = ./certs/server-cert.pem
-server-key = ./certs/server-key.pem
+server-cert = @SRCDIR@/certs/server-cert.pem
+server-key = @SRCDIR@/certs/server-key.pem
 
 # Diffie-Hellman parameters. Only needed if you require support
 # for the DHE ciphersuites (by default this server supports ECDHE).
@@ -74,7 +74,7 @@ server-key = ./certs/server-key.pem
 # The Certificate Authority that will be used
 # to verify clients if certificate authentication
 # is set.
-ca-cert = ./certs/ca.pem
+ca-cert = @SRCDIR@/certs/ca.pem
 
 # The object identifier that will be used to read the user ID in the client certificate.
 # The object identifier should be part of the certificate's DN
@@ -173,4 +173,4 @@ route = 192.168.1.0/255.255.255.0
 # should be set for them.
 cisco-client-compat = true
 
-config-per-user = ./user-config-explicit/
+config-per-user = @SRCDIR@/user-config-explicit/
diff --git a/tests/data/test-group-cert.config b/tests/data/test-group-cert.config
index 9ba3263a..c9c9e4b3 100644
--- a/tests/data/test-group-cert.config
+++ b/tests/data/test-group-cert.config
@@ -2,7 +2,7 @@
 # all should succeed.
 # Options: certificate, pam.
 auth = "certificate"
-#auth = "plain[./data/test-group.passwd]"
+#auth = "plain[@SRCDIR@/data/test-group.passwd]"
 #auth = "pam"
 
 isolate-workers = @ISOLATE_WORKERS@
diff --git a/tests/data/test-gssapi-local-map.config b/tests/data/test-gssapi-local-map.config
index 04e67539..9ae5b534 100644
--- a/tests/data/test-gssapi-local-map.config
+++ b/tests/data/test-gssapi-local-map.config
@@ -2,7 +2,7 @@
 # all should succeed.
 # Options: certificate, pam.
 #auth = "certificate"
-#auth = "plain[./data/test1.passwd]"
+#auth = "plain[@SRCDIR@/data/test1.passwd]"
 auth = "gssapi"
 
 isolate-workers = @ISOLATE_WORKERS@
diff --git a/tests/data/test-gssapi-opt-cert.config b/tests/data/test-gssapi-opt-cert.config
index aa7d374f..9cc669b1 100644
--- a/tests/data/test-gssapi-opt-cert.config
+++ b/tests/data/test-gssapi-opt-cert.config
@@ -2,7 +2,7 @@
 # all should succeed.
 # Options: certificate, pam.
 #auth = "certificate"
-#auth = "plain[./data/test1.passwd]"
+#auth = "plain[@SRCDIR@/data/test1.passwd]"
 auth = "gssapi[require-local-user-map=false]"
 enable-auth = certificate
 
diff --git a/tests/data/test-gssapi-opt-pass.config b/tests/data/test-gssapi-opt-pass.config
index cd2af6e7..b0d1344f 100644
--- a/tests/data/test-gssapi-opt-pass.config
+++ b/tests/data/test-gssapi-opt-pass.config
@@ -2,7 +2,7 @@
 # all should succeed.
 # Options: certificate, pam.
 #auth = "certificate"
-#auth = "plain[./data/test1.passwd]"
+#auth = "plain[@SRCDIR@/data/test1.passwd]"
 auth = "gssapi[require-local-user-map=false]"
 enable-auth = "plain[passwd=@SRCDIR@/data/test1.passwd]"
 
diff --git a/tests/data/test-gssapi.config b/tests/data/test-gssapi.config
index 85d7120d..9f752afa 100644
--- a/tests/data/test-gssapi.config
+++ b/tests/data/test-gssapi.config
@@ -2,7 +2,7 @@
 # all should succeed.
 # Options: certificate, pam.
 #auth = "certificate"
-#auth = "plain[./data/test1.passwd]"
+#auth = "plain[@SRCDIR@/data/test1.passwd]"
 auth = "gssapi[require-local-user-map=false]"
 
 isolate-workers = @ISOLATE_WORKERS@
diff --git a/tests/data/test-iroute.config b/tests/data/test-iroute.config
index ca34b9bf..2996b30c 100644
--- a/tests/data/test-iroute.config
+++ b/tests/data/test-iroute.config
@@ -2,7 +2,7 @@
 # all should succeed.
 # Options: certificate, pam.
 auth = "certificate"
-#auth = "plain[./data/test1.passwd]"
+#auth = "plain[@SRCDIR@/data/test1.passwd]"
 #auth = "pam"
 
 isolate-workers = @ISOLATE_WORKERS@
@@ -47,8 +47,8 @@ try-mtu-discovery = false
 #
 # There may be multiple certificate and key pairs and each key
 # should correspond to the preceding certificate.
-server-cert = ./certs/server-cert.pem
-server-key = ./certs/server-key.pem
+server-cert = @SRCDIR@/certs/server-cert.pem
+server-key = @SRCDIR@/certs/server-key.pem
 
 # Diffie-Hellman parameters. Only needed if you require support
 # for the DHE ciphersuites (by default this server supports ECDHE).
@@ -74,7 +74,7 @@ server-key = ./certs/server-key.pem
 # The Certificate Authority that will be used
 # to verify clients if certificate authentication
 # is set.
-ca-cert = ./certs/ca.pem
+ca-cert = @SRCDIR@/certs/ca.pem
 
 # The object identifier that will be used to read the user ID in the client certificate.
 # The object identifier should be part of the certificate's DN
@@ -157,7 +157,7 @@ ping-leases = false
 route = 192.168.1.0/255.255.255.0
 #route = 192.168.5.0/255.255.255.0
 
-config-per-user = ./user-config/
+config-per-user = @SRCDIR@/user-config/
 
 route-add-cmd = "echo %R %{RI} %D > ./test-iroute.tmp"
 #route-del-cmd = "ip route delete %R dev %D"
diff --git a/tests/data/test-oidc-auth.config b/tests/data/test-oidc-auth.config
index 9d824007..85e338b1 100644
--- a/tests/data/test-oidc-auth.config
+++ b/tests/data/test-oidc-auth.config
@@ -1,7 +1,7 @@
 # User authentication method. Could be set multiple times and in that case
 # all should succeed.
 # Options: certificate, pam.
-auth = "oidc[config=@SRCDIR@/data/oidc.json]"
+auth = "oidc[config=./data/oidc.json]"
 
 isolate-workers = @ISOLATE_WORKERS@
 
diff --git a/tests/data/test-pass-opt-cert.config b/tests/data/test-pass-opt-cert.config
index 419fe687..9d7ffc84 100644
--- a/tests/data/test-pass-opt-cert.config
+++ b/tests/data/test-pass-opt-cert.config
@@ -171,6 +171,6 @@ route = 192.168.1.0/255.255.255.0
 # should be set for them.
 cisco-client-compat = true
 
-config-per-user = ./user-config-opt/
+config-per-user = @SRCDIR@/user-config-opt/
 
 max-ban-score = 0
diff --git a/tests/data/test-pass-script.config b/tests/data/test-pass-script.config
index 490e834c..eed278de 100644
--- a/tests/data/test-pass-script.config
+++ b/tests/data/test-pass-script.config
@@ -2,7 +2,7 @@
 # all should succeed.
 # Options: certificate, pam.
 #auth = "certificate"
-auth = "plain[./data/test1.passwd]"
+auth = "plain[@SRCDIR@/data/test1.passwd]"
 #auth = "pam"
 
 isolate-workers = @ISOLATE_WORKERS@
@@ -47,8 +47,8 @@ try-mtu-discovery = false
 #
 # There may be multiple certificate and key pairs and each key
 # should correspond to the preceding certificate.
-server-cert = ./certs/server-cert.pem
-server-key = ./certs/server-key.pem
+server-cert = @SRCDIR@/certs/server-cert.pem
+server-key = @SRCDIR@/certs/server-key.pem
 
 # Diffie-Hellman parameters. Only needed if you require support
 # for the DHE ciphersuites (by default this server supports ECDHE).
@@ -111,9 +111,9 @@ auth-timeout = 40
 # DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP
 # in the P-t-P connection), IP_REMOTE (the VPN IP of the client). REASON
 # may be "connect" or "disconnect".
-connect-script = ./connect-script
-host-update-script = ./connect-script
-disconnect-script = ./connect-script
+connect-script = @SRCDIR@/connect-script
+host-update-script = @SRCDIR@/connect-script
+disconnect-script = @SRCDIR@/connect-script
 
 # UTMP
 use-utmp = true
diff --git a/tests/data/test-script-multi-user.config b/tests/data/test-script-multi-user.config
index 9a7935a0..50f5da3f 100644
--- a/tests/data/test-script-multi-user.config
+++ b/tests/data/test-script-multi-user.config
@@ -107,8 +107,8 @@ auth-timeout = 40
 # DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP
 # in the P-t-P connection), IP_REMOTE (the VPN IP of the client). REASON
 # may be "connect" or "disconnect".
-connect-script = ./sleep-connect-script
-disconnect-script = ./sleep-connect-script
+connect-script = @SRCDIR@/sleep-connect-script
+disconnect-script = @SRCDIR@/sleep-connect-script
 
 # UTMP
 use-utmp = true
diff --git a/tests/data/test-stress.config b/tests/data/test-stress.config
index f60f5165..d057d079 100644
--- a/tests/data/test-stress.config
+++ b/tests/data/test-stress.config
@@ -2,7 +2,7 @@
 # all should succeed.
 # Options: certificate, pam.
 #auth = "certificate"
-auth = "plain[./data/test1.passwd]"
+auth = "plain[@SRCDIR@/data/test1.passwd]"
 #auth = "pam"
 
 isolate-workers = @ISOLATE_WORKERS@
@@ -47,8 +47,8 @@ try-mtu-discovery = false
 #
 # There may be multiple certificate and key pairs and each key
 # should correspond to the preceding certificate.
-server-cert = ./certs/server-cert.pem
-server-key = ./certs/server-key.pem
+server-cert = @SRCDIR@/certs/server-cert.pem
+server-key = @SRCDIR@/certs/server-key.pem
 
 # Diffie-Hellman parameters. Only needed if you require support
 # for the DHE ciphersuites (by default this server supports ECDHE).
diff --git a/tests/data/test-user-config.config b/tests/data/test-user-config.config
index 970e1b23..aadef830 100644
--- a/tests/data/test-user-config.config
+++ b/tests/data/test-user-config.config
@@ -2,7 +2,7 @@
 # all should succeed.
 # Options: certificate, pam.
 auth = "certificate"
-#auth = "plain[./data/test1.passwd]"
+#auth = "plain[@SRCDIR@/data/test1.passwd]"
 #auth = "pam"
 
 isolate-workers = @ISOLATE_WORKERS@
@@ -47,8 +47,8 @@ try-mtu-discovery = false
 #
 # There may be multiple certificate and key pairs and each key
 # should correspond to the preceding certificate.
-server-cert = ./certs/server-cert.pem
-server-key = ./certs/server-key.pem
+server-cert = @SRCDIR@/certs/server-cert.pem
+server-key = @SRCDIR@/certs/server-key.pem
 
 # Diffie-Hellman parameters. Only needed if you require support
 # for the DHE ciphersuites (by default this server supports ECDHE).
@@ -74,7 +74,7 @@ server-key = ./certs/server-key.pem
 # The Certificate Authority that will be used
 # to verify clients if certificate authentication
 # is set.
-ca-cert = ./certs/ca.pem
+ca-cert = @SRCDIR@/certs/ca.pem
 
 # The object identifier that will be used to read the user ID in the client certificate.
 # The object identifier should be part of the certificate's DN
@@ -161,7 +161,7 @@ ping-leases = false
 route = 192.168.5.0/255.255.255.0
 no-route = 192.168.98.0/255.255.255.0
 
-config-per-user = ./user-config/
+config-per-user = @SRCDIR@/user-config/
 
 #route-add-cmd = "echo %R %D > ./test-expose-iroute.tmp"
 #route-del-cmd = "ip route delete %R dev %D"
diff --git a/tests/meson.build b/tests/meson.build
index d0dbdb69..bd4fe24a 100644
--- a/tests/meson.build
+++ b/tests/meson.build
@@ -2,8 +2,8 @@ test_inc = [top_inc, src_inc, src_build_inc, common_inc]
 
 test_base_deps = [common_dep, ccan_dep, nettle_dep, talloc_dep, llhttp_dep, protobuf_dep]
 
-# Tests run with cwd = source tests/ so relative paths (./certs/, ./data/) work
-test_workdir = meson.current_source_dir()
+# Tests run with cwd = build tests/ dir; source paths in configs use @SRCDIR@
+test_workdir = meson.current_build_dir()
 
 test_env = environment()
 test_env.set('srcdir',       meson.current_source_dir())
@@ -25,6 +25,10 @@ raddb_build_dir = meson.current_build_dir() / 'data' / 'raddb'
 test_env.set('RADDB_DIR', raddb_build_dir)
 subdir('data/raddb')
 
+radiusclient_build_dir = meson.current_build_dir() / 'data' / 'radiusclient'
+test_env.set('RADIUSCLIENT_DIR', radiusclient_build_dir)
+subdir('data/radiusclient')
+
 # --------------------------------------------------------------------------
 # C unit tests
 # --------------------------------------------------------------------------
diff --git a/tests/no-dtls-cipher b/tests/no-dtls-cipher
index 35a31f64..9822bc47 100755
--- a/tests/no-dtls-cipher
+++ b/tests/no-dtls-cipher
@@ -24,4 +24,4 @@ PKG_CONFIG="${PKG_CONFIG:-/usr/bin/pkg-config}"
 CIPHER_NAME="UNKNOWN"
 GNUTLS_NAME=""
 
-. cipher-common.sh
+. ${srcdir}/cipher-common.sh
diff --git a/tests/oc-aes128-gcm-cipher b/tests/oc-aes128-gcm-cipher
index 09baacc0..c5cabe0e 100755
--- a/tests/oc-aes128-gcm-cipher
+++ b/tests/oc-aes128-gcm-cipher
@@ -23,4 +23,4 @@
 CIPHER_NAME="OC-DTLS1_2-AES128-GCM"
 GNUTLS_NAME="(DTLS1.2)-(RSA)-(AES-128-GCM)"
 
-. cipher-common.sh
+. ${srcdir}/cipher-common.sh
diff --git a/tests/oc-aes256-gcm-cipher b/tests/oc-aes256-gcm-cipher
index ee1a21fb..a1144724 100755
--- a/tests/oc-aes256-gcm-cipher
+++ b/tests/oc-aes256-gcm-cipher
@@ -23,4 +23,4 @@
 CIPHER_NAME="OC-DTLS1_2-AES256-GCM"
 GNUTLS_NAME="(DTLS1.2)-(RSA)-(AES-256-GCM)"
 
-. cipher-common.sh
+. ${srcdir}/cipher-common.sh
diff --git a/tests/psk-negotiate b/tests/psk-negotiate
index 298d97c4..84a770f3 100755
--- a/tests/psk-negotiate
+++ b/tests/psk-negotiate
@@ -25,4 +25,4 @@ GNUTLS_NAME="(DTLS1.2)-(PSK)"
 TEST_CONFIG="test-psk-negotiate.config"
 MATCH_CIPHERS=false
 
-. cipher-common.sh
+. ${srcdir}/cipher-common.sh
diff --git a/tests/psk-negotiate-match b/tests/psk-negotiate-match
index 9bfbcf54..269ad351 100755
--- a/tests/psk-negotiate-match
+++ b/tests/psk-negotiate-match
@@ -25,4 +25,4 @@ GNUTLS_NAME="(DTLS1.2)-(PSK)"
 TEST_CONFIG="test-psk-negotiate.config"
 MATCH_CIPHERS=true
 
-. cipher-common.sh
+. ${srcdir}/cipher-common.sh
diff --git a/tests/test-append-routes b/tests/test-append-routes
index 923d0aa9..3a55ee34 100755
--- a/tests/test-append-routes
+++ b/tests/test-append-routes
@@ -29,7 +29,7 @@ eval "${GETPORT}"
 
 echo "Testing ocserv and user append-route application... "
 
-TMPFILE1=${srcdir}/test-append-routes.tmp
+TMPFILE1=test-append-routes.$$.tmp
 
 rm -f ${TMPFILE1}
 
diff --git a/tests/test-cert-opt-pass b/tests/test-cert-opt-pass
index 0109ef22..3d23e451 100755
--- a/tests/test-cert-opt-pass
+++ b/tests/test-cert-opt-pass
@@ -69,14 +69,14 @@ fi
 echo ok
 
 echo -n "Connecting to obtain cookie (with certificate)... "
-connect "-u test --sslkey ./certs/user-key.pem -c ./certs/user-cert.pem"
+connect "-u test --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem"
 if test $? != 0;then
 	fail $PID "Failed to connect with certificate!"
 fi
 echo ok
 
 echo -n "Connecting to obtain cookie (with incorrect certificate)... "
-connect "-u test --sslkey ./certs/user-key.pem -c ./certs/user-cert-wrong.pem" ""
+connect "-u test --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-wrong.pem" ""
 if test $? = 0;then
 	fail $PID "Should not have connected with wrong certificate!"
 fi
diff --git a/tests/test-cookie-invalidation b/tests/test-cookie-invalidation
index a6f8ceaa..b83bea1c 100755
--- a/tests/test-cookie-invalidation
+++ b/tests/test-cookie-invalidation
@@ -25,8 +25,8 @@ srcdir=${srcdir:-.}
 
 eval "${GETPORT}"
 
-PIDFILE1="${srcdir}/ci$$-1.pid.tmp"
-PIDFILE2="${srcdir}/ci$$-2.pid.tmp"
+PIDFILE1="ci$$-1.pid.tmp"
+PIDFILE2="ci$$-2.pid.tmp"
 echo "Testing whether cookies are being correctly invalidated... "
 rm -f "${PIDFILE1}" "${PIDFILE2}"
 
diff --git a/tests/test-cookie-timeout b/tests/test-cookie-timeout
index b8b4dda8..664a7449 100755
--- a/tests/test-cookie-timeout
+++ b/tests/test-cookie-timeout
@@ -27,7 +27,7 @@ eval "${GETPORT}"
 
 echo "Testing whether cookies will expire as expected... "
 
-PIDFILE="${srcdir}/ct$$.pid.tmp"
+PIDFILE="ct$$.pid.tmp"
 
 update_config test-cookie-timeout.config
 launch_server -d 1 -f -c ${CONFIG} & PID=$!
diff --git a/tests/test-cookie-timeout-2 b/tests/test-cookie-timeout-2
index 4161eb69..cd50aaea 100755
--- a/tests/test-cookie-timeout-2
+++ b/tests/test-cookie-timeout-2
@@ -26,7 +26,7 @@ srcdir=${srcdir:-.}
 eval "${GETPORT}"
 
 echo "Testing whether cookies will remain valid during the session time... "
-rm -f ${srcdir}/pid.$$
+rm -f pid.$$
 
 update_config test-cookie-timeout-2.config
 launch_server -d 1 -f -c ${CONFIG} & PID=$!
@@ -43,38 +43,38 @@ fi
 sleep 10
 echo ""
 echo "Connecting with cookie... "
-echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file ${srcdir}/pid.$$ --background
+echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file pid.$$ --background
 
 sleep 4
 
-if [ ! -f ${srcdir}/pid.$$ ];then
+if [ ! -f pid.$$ ];then
 	fail $PID "It was not possible to establish session!"
 fi
 
-CPID=`cat ${srcdir}/pid.$$`
-rm -f "${srcdir}/pid.$$"
-rm -f "${srcdir}/pid2.$$"
+CPID=`cat pid.$$`
+rm -f "pid.$$"
+rm -f "pid2.$$"
 
 sleep 30
 echo ""
 echo "Connecting again with cookie (overriding first session)... "
-echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file ${srcdir}/pid2.$$ --background
+echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file pid2.$$ --background
 
 sleep 6
 
 kill $CPID
-if [ ! -f ${srcdir}/pid2.$$ ];then
+if [ ! -f pid2.$$ ];then
 	fail $PID "It was not possible to establish second session!"
 else
-	CPID=`cat ${srcdir}/pid2.$$`
+	CPID=`cat pid2.$$`
 	kill $CPID
-	rm -f "${srcdir}/pid2.$$"
+	rm -f "pid2.$$"
 fi
 
 kill $PID
 wait
 
-rm -f ${srcdir}/pid.$$
-rm -f ${srcdir}/pid2.$$ ${CONFIG}
+rm -f pid.$$
+rm -f pid2.$$ ${CONFIG}
 
 exit 0
diff --git a/tests/test-explicit-ip b/tests/test-explicit-ip
index 41d46651..2a03cf05 100755
--- a/tests/test-explicit-ip
+++ b/tests/test-explicit-ip
@@ -20,7 +20,7 @@
 
 SERV="${SERV:-../src/ocserv}"
 srcdir=${srcdir:-.}
-TMPFILE=${srcdir}/outfile.$$
+TMPFILE=outfile.$$
 
 . `dirname $0`/common.sh
 
@@ -37,7 +37,7 @@ if [ -z "$COOKIE" ];then
 fi
 
 rm -f $TMPFILE
-echo "$pass" | $OPENCONNECT -q localhost:$PORT $opts -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file ${srcdir}/pidx >$TMPFILE 2>&1 &
+echo "$pass" | $OPENCONNECT -q localhost:$PORT $opts -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file pidx.$$ >$TMPFILE 2>&1 &
 CPID=$!
 
 sleep 3
diff --git a/tests/test-iroute b/tests/test-iroute
index caf0a923..1bb0b290 100755
--- a/tests/test-iroute
+++ b/tests/test-iroute
@@ -27,7 +27,7 @@ eval "${GETPORT}"
 
 echo "Testing ocserv and user route application... "
 
-rm -f ${srcdir}/test-iroute.tmp
+rm -f test-iroute.tmp
 
 update_config test-iroute.config
 launch_server -d 1 -f -c "${CONFIG}" & PID=$!
@@ -50,19 +50,19 @@ kill $kpid
 sleep 1
 echo -n "Checking if routes have been applied... "
 
-if [ ! -f ${srcdir}/test-iroute.tmp ];then
+if [ ! -f test-iroute.tmp ];then
 	fail $PID "Temporary file cannot be found"
 fi
 
-CONTENTS=`cat ${srcdir}/test-iroute.tmp`
+CONTENTS=`cat test-iroute.tmp`
 if [[ "$CONTENTS" =~ "192.168.1.0/255.255.255.0 192.168.1.0/24 [vpns|tun]$" ]];then
-	cat ${srcdir}/test-iroute.tmp
+	cat test-iroute.tmp
 	fail $PID "Temporary file contents are not correct"
 fi
 
 echo ok
 
-rm -f ${srcdir}/test-iroute.tmp ${CONFIG}
+rm -f test-iroute.tmp ${CONFIG}
 
 kill $PID
 wait
diff --git a/tests/test-max-same-1 b/tests/test-max-same-1
index 5fbd812a..06d226ac 100755
--- a/tests/test-max-same-1
+++ b/tests/test-max-same-1
@@ -27,8 +27,8 @@ eval "${GETPORT}"
 
 echo "Testing whether max-same-clients=1 allows cookie reuse... "
 
-PIDFILE1="${srcdir}/ci$$-1.pid.tmp"
-PIDFILE2="${srcdir}/ci$$-2.pid.tmp"
+PIDFILE1="ci$$-1.pid.tmp"
+PIDFILE2="ci$$-2.pid.tmp"
 rm -f "${PIDFILE1}" "${PIDFILE2}"
 
 function finish {
diff --git a/tests/test-multi-cookie b/tests/test-multi-cookie
index dea4caf7..a7599fdb 100755
--- a/tests/test-multi-cookie
+++ b/tests/test-multi-cookie
@@ -27,8 +27,8 @@ eval "${GETPORT}"
 
 echo "Testing whether cookies are being reused... "
 
-PIDFILE1="${srcdir}/ci$$-1.pid.tmp"
-PIDFILE2="${srcdir}/ci$$-2.pid.tmp"
+PIDFILE1="ci$$-1.pid.tmp"
+PIDFILE2="ci$$-2.pid.tmp"
 rm -f "${PIDFILE1}" "${PIDFILE2}"
 
 function finish {
diff --git a/tests/test-oidc b/tests/test-oidc
index 6caa53ee..99f2880d 100755
--- a/tests/test-oidc
+++ b/tests/test-oidc
@@ -51,7 +51,7 @@ sleep 5s
 
 # Generate new OIDC keys
 # First client should fail, triggering reload of keys
-`dirname $0`/gen_oidc_test_data
+./gen_oidc_test_data
 for token in data/success_*; do
     http_result=$(LD_PRELOAD=libsocket_wrapper.so curl --insecure https://$ADDRESS:$PORT --request POST --data config-auth.xml --header "Authorization:Bearer=`cat $token`" --output /dev/null --write-out "%{http_code}")
     if [ "$http_result" != "401" ]; then
diff --git a/tests/test-otp b/tests/test-otp
index ed1fe940..d18b9b4e 100755
--- a/tests/test-otp
+++ b/tests/test-otp
@@ -39,7 +39,7 @@ fi
 #user 'testuser' has cert and OTP only
 
 rm -f ${OTP_FILE}
-cp data/test-otp.oath ${OTP_FILE}
+cp ${srcdir}/data/test-otp.oath ${OTP_FILE}
 update_config test-otp.config
 launch_sr_server -d 1 -f -c ${CONFIG} & PID=$!
 wait_server $PID
diff --git a/tests/test-otp-cert b/tests/test-otp-cert
index 61a71dbc..78afa72c 100755
--- a/tests/test-otp-cert
+++ b/tests/test-otp-cert
@@ -39,7 +39,7 @@ if [ $? != 0 ];then
 fi
 
 rm -f ${OTP_FILE}
-cp data/test-otp.oath ${OTP_FILE}
+cp ${srcdir}/data/test-otp.oath ${OTP_FILE}
 update_config test-otp-cert.config
 launch_sr_server -d 1 -f -c ${CONFIG} & PID=$!
 wait_server $PID
diff --git a/tests/test-pass-opt-cert b/tests/test-pass-opt-cert
index 18365381..6a039d06 100755
--- a/tests/test-pass-opt-cert
+++ b/tests/test-pass-opt-cert
@@ -20,7 +20,7 @@
 
 SERV="${SERV:-../src/ocserv}"
 srcdir=${srcdir:-.}
-TMPFILE=${srcdir}/outfile.$$.tmp
+TMPFILE=outfile.$$.tmp
 NO_NEED_ROOT=1
 PIDFILE=ocserv-pid.$$.tmp
 
@@ -69,14 +69,14 @@ fi
 echo ok
 
 echo -n "Connecting to obtain cookie (with certificate)... "
-connect "-u test --sslkey ./certs/user-key.pem -c ./certs/user-cert.pem"
+connect "-u test --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem"
 if test $? != 0;then
 	fail $PID "Failed to connect with certificate!"
 fi
 echo ok
 
 echo -n "Connecting to obtain cookie (with incorrect certificate)... "
-connect "-u test --sslkey ./certs/user-key.pem -c ./certs/user-cert-wrong.pem" ""
+connect "-u test --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-wrong.pem" ""
 if test $? = 0;then
 	fail $PID "Should not have connected with wrong certificate!"
 fi
diff --git a/tests/test-replay b/tests/test-replay
index 05338931..8e9e30ed 100755
--- a/tests/test-replay
+++ b/tests/test-replay
@@ -35,8 +35,8 @@ fi
 
 echo "Testing whether replay of DTLS hello breaks client session... "
 
-PIDFILE1="${srcdir}/ci$$-1.pid.tmp"
-PIDFILE2="${srcdir}/ci$$-2.pid.tmp"
+PIDFILE1="ci$$-1.pid.tmp"
+PIDFILE2="ci$$-2.pid.tmp"
 TCPDUMP_FILE="${srcdir}/dtls_hello.pcap"
 rm -f "${PIDFILE1}" "${PIDFILE2}"
 
diff --git a/tests/test-udp-listen-host b/tests/test-udp-listen-host
index 2c772489..3e15626c 100755
--- a/tests/test-udp-listen-host
+++ b/tests/test-udp-listen-host
@@ -20,8 +20,8 @@
 
 OCCTL="${OCCTL:-../src/occtl/occtl}"
 OUTFILE=occtl-show-user.$$.tmp
-CLIPID="${srcdir:-.}/ci$$-1.pid.tmp"
-CLIPID2="${srcdir:-.}/ci$$-2.pid.tmp"
+CLIPID="ci$$-1.pid.tmp"
+CLIPID2="ci$$-2.pid.tmp"
 SERV="${SERV:-../src/ocserv}"
 srcdir=${srcdir:-.}
 PIDFILE=ocserv-pid.$$.tmp
diff --git a/tests/test-user-config b/tests/test-user-config
index f8573ceb..5286c1f3 100755
--- a/tests/test-user-config
+++ b/tests/test-user-config
@@ -30,8 +30,8 @@ eval "${GETPORT}"
 
 echo "Testing ocserv and user route application... "
 
-TMPFILE1=${srcdir}/test-user-config.tmp
-TMPFILE2=${srcdir}/test-user-config-2.tmp
+TMPFILE1=test-user-config.$$.tmp
+TMPFILE2=test-user-config-2.$$.tmp
 
 rm -f ${TMPFILE1}
 rm -f ${TMPFILE2}
diff --git a/tests/test-vhost b/tests/test-vhost
index fb5b80f9..ead0156a 100755
--- a/tests/test-vhost
+++ b/tests/test-vhost
@@ -91,28 +91,28 @@ fi
 echo ok
 
 echo -n "Connecting to certificate host to obtain cookie (with certificate)... "
-connect "cert.example.com" "-u test --sslkey ./certs/user-key.pem -c ./certs/user-cert.pem" "" "sha1:8e253ef2a87dd9188fe444702f2fe349d30af816"
+connect "cert.example.com" "-u test --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem" "" "sha1:8e253ef2a87dd9188fe444702f2fe349d30af816"
 if test $? != 0;then
 	fail $PID "Failed to connect with certificate!"
 fi
 echo ok
 
 echo -n "Connecting to certificate host to obtain cookie (with incorrect certificate)... "
-connect "cert.example.com" "-u test --sslkey ./certs/user-key.pem -c ./certs/user-cert-wrong.pem" "" "sha1:8e253ef2a87dd9188fe444702f2fe349d30af816"
+connect "cert.example.com" "-u test --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-wrong.pem" "" "sha1:8e253ef2a87dd9188fe444702f2fe349d30af816"
 if test $? = 0;then
 	fail $PID "Should not have connected with wrong certificate!"
 fi
 echo ok
 
 echo -n "Connecting to pass2 host to obtain cookie (with certificate)... "
-connect "pass2.example.com" "-u vhost --sslkey ./certs/user-key.pem -c ./certs/user-cert.pem" "" "sha1:8e253ef2a87dd9188fe444702f2fe349d30af816"
+connect "pass2.example.com" "-u vhost --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem" "" "sha1:8e253ef2a87dd9188fe444702f2fe349d30af816"
 if test $? = 0;then
 	fail $PID "Connected to wrong host with certificate!"
 fi
 echo ok
 
 echo -n "Connecting to default host to obtain cookie (with certificate)... "
-connect "default.example.com" "-u test --sslkey ./certs/user-key.pem -c ./certs/user-cert.pem" "" "pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8="
+connect "default.example.com" "-u test --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem" "" "pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8="
 if test $? = 0;then
 	fail $PID "Connected to wrong host with certificate!"
 fi
@@ -144,7 +144,7 @@ fi
 echo ok
 
 echo -n "Sanity check to cert host..."
-connect "cert.example.com" "-u test --sslkey ./certs/user-key.pem -c ./certs/user-cert.pem" "" "sha1:8e253ef2a87dd9188fe444702f2fe349d30af816"
+connect "cert.example.com" "-u test --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem" "" "sha1:8e253ef2a87dd9188fe444702f2fe349d30af816"
 if test $? != 0;then
 	fail $PID "Failed to connect with certificate!"
 fi