diff --git a/features/steps/actor_run_signature_resolve_steps.py b/features/steps/actor_run_signature_resolve_steps.py
index ab6bc56c8..e423d2584 100644
--- a/features/steps/actor_run_signature_resolve_steps.py
+++ b/features/steps/actor_run_signature_resolve_steps.py
@@ -165,7 +165,7 @@ def step_resolve_with_no_config_data(context: Any) -> None:
         try:
             resolve_config_files("local/empty-actor", [])
             context.resolve_exit_code = 0
-        except (SystemExit, click.exceptions.Exit) as exc:
+        except (SystemExit, click.exceptions.Exit, typer.Exit) as exc:
             context.resolve_exit_code = getattr(
                 exc, "exit_code", getattr(exc, "code", 1)
             )
@@ -209,7 +209,7 @@ def step_resolve_unknown_actor_directly(context: Any) -> None:
         try:
             resolve_config_files("nonexistent/actor", [])
             context.resolve_exit_code = 0
-        except (SystemExit, click.exceptions.Exit) as exc:
+        except (SystemExit, click.exceptions.Exit, typer.Exit) as exc:
             context.resolve_exit_code = getattr(
                 exc, "exit_code", getattr(exc, "code", 1)
             )
@@ -260,7 +260,7 @@ def step_resolve_with_empty_config_blob(context: Any) -> None:
         try:
             resolve_config_files("local/empty-blob-actor", [])
             context.resolve_exit_code = 0
-        except (SystemExit, click.exceptions.Exit) as exc:
+        except (SystemExit, click.exceptions.Exit, typer.Exit) as exc:
             context.resolve_exit_code = getattr(
                 exc, "exit_code", getattr(exc, "code", 1)
             )
@@ -356,7 +356,7 @@ def step_resolve_with_unserializable_config_blob(context: Any) -> None:
         try:
             resolve_config_files("local/bad-blob-actor", [])
             context.resolve_exit_code = 0
-        except (SystemExit, click.exceptions.Exit) as exc:
+        except (SystemExit, click.exceptions.Exit, typer.Exit) as exc:
             context.resolve_exit_code = getattr(
                 exc, "exit_code", getattr(exc, "code", 1)
             )
diff --git a/features/steps/actor_run_signature_security_steps.py b/features/steps/actor_run_signature_security_steps.py
index 7e93caf7a..889b48b8f 100644
--- a/features/steps/actor_run_signature_security_steps.py
+++ b/features/steps/actor_run_signature_security_steps.py
@@ -49,7 +49,7 @@ def step_resolve_with_control_character_name(context: Any) -> None:
         try:
             resolve_config_files(actor_name, [])
             context.resolve_exit_code = 0
-        except (SystemExit, click.exceptions.Exit) as exc:
+        except (SystemExit, click.exceptions.Exit, typer.Exit) as exc:
             context.resolve_exit_code = getattr(
                 exc, "exit_code", getattr(exc, "code", 1)
             )
diff --git a/features/steps/cloud_types_steps.py b/features/steps/cloud_types_steps.py
index 93cd446f1..5f9f40d44 100644
--- a/features/steps/cloud_types_steps.py
+++ b/features/steps/cloud_types_steps.py
@@ -146,6 +146,13 @@ def step_aws_empty_tag_key(context):
         context.exc = exc
 
 
+@then("it should reject tags with empty key")
+def step_rejects_empty_tag_key(context):
+    """Assert a ValidationError was raised for a tag with an empty key."""
+    assert context.exc is not None
+    assert isinstance(context.exc, ValidationError)
+
+
 @when('its region is set to "us-west-2"')
 def step_aws_region(context):
     """Set AWS resource region."""
diff --git a/src/cleveragents/cli/commands/actor.py b/src/cleveragents/cli/commands/actor.py
index fa0723afc..04df81c61 100644
--- a/src/cleveragents/cli/commands/actor.py
+++ b/src/cleveragents/cli/commands/actor.py
@@ -185,12 +185,12 @@ def run(
     except UnsafeConfigurationError as exc:
         typer.echo(f"Error: {exc}", err=True)
         raise typer.Exit(code=1) from exc
-    except click.exceptions.Exit:
+    except (click.exceptions.Exit, typer.Exit):
         raise
     except CleverAgentsError as exc:
         typer.echo(f"Error: {exc}", err=True)
         raise typer.Exit(code=2) from exc
-    except Exception as exc:  # pragma: no cover
+    except Exception as exc:
         typer.echo(f"Unexpected error: {exc}", err=True)
         raise typer.Exit(code=3) from exc
 
diff --git a/src/cleveragents/cli/commands/actor_run.py b/src/cleveragents/cli/commands/actor_run.py
index 14b2d2cf2..aeae5645d 100644
--- a/src/cleveragents/cli/commands/actor_run.py
+++ b/src/cleveragents/cli/commands/actor_run.py
@@ -159,12 +159,12 @@ def run(
     except UnsafeConfigurationError as exc:
         typer.echo(f"Error: {exc}", err=True)
         raise typer.Exit(code=1) from exc
-    except click.exceptions.Exit:
+    except (click.exceptions.Exit, typer.Exit):
         raise
     except CleverAgentsError as exc:
         typer.echo(f"Error: {exc}", err=True)
         raise typer.Exit(code=2) from exc
-    except Exception as exc:  # pragma: no cover
+    except Exception as exc:
         typer.echo(f"Unexpected error: {exc}", err=True)
         raise typer.Exit(code=3) from exc