diff --git a/src/CronUpdater.php b/src/CronUpdater.php
index c5a4359f7f2b767a5242e6901ee0fba1e84c8fd7..116b17e287d9fac0833d44a95bdb4fc05d27ce48 100644
--- a/src/CronUpdater.php
+++ b/src/CronUpdater.php
@@ -172,15 +172,13 @@ class CronUpdater extends Updater {
    *     can be done during cron.
    *   - \Drupal\automatic_updates\CronUpdater::ALL if all updates are allowed
    *     during cron.
-   *
-   * @todo Make this always return a string, with a sensible default, in
-   *   https://www.drupal.org/i/3276534.
    */
-  final public function getMode(): ?string {
+  final public function getMode(): string {
     if (self::$disabled) {
       return static::DISABLED;
     }
-    return $this->configFactory->get('automatic_updates.settings')->get('cron');
+    $mode = $this->configFactory->get('automatic_updates.settings')->get('cron');
+    return $mode ?: CronUpdater::SECURITY;
   }
 
 }
diff --git a/tests/src/Kernel/AutomaticUpdatesKernelTestBase.php b/tests/src/Kernel/AutomaticUpdatesKernelTestBase.php
index 8900b784128dcc986ee2dd0c9ed95bb01d90e33e..8e7046d441d1b9e53d81282ceecd5ef432eea419 100644
--- a/tests/src/Kernel/AutomaticUpdatesKernelTestBase.php
+++ b/tests/src/Kernel/AutomaticUpdatesKernelTestBase.php
@@ -65,10 +65,10 @@ abstract class AutomaticUpdatesKernelTestBase extends PackageManagerKernelTestBa
     // have run.
     $this->registerPostUpdateFunctions();
 
-    // By default, pretend we're running Drupal core 9.8.1 and a non-security
-    // update to 9.8.2 is available.
-    $this->setCoreVersion('9.8.1');
-    $this->setReleaseMetadata(['drupal' => __DIR__ . '/../../fixtures/release-history/drupal.9.8.2.xml']);
+    // By default, pretend we're running Drupal core 9.8.0 and a non-security
+    // update to 9.8.1 is available.
+    $this->setCoreVersion('9.8.0');
+    $this->setReleaseMetadata(['drupal' => __DIR__ . '/../../fixtures/release-history/drupal.9.8.1-security.xml']);
 
     // Set a last cron run time so that the cron frequency validator will run
     // from a sane state.
diff --git a/tests/src/Kernel/ReadinessValidation/CronFrequencyValidatorTest.php b/tests/src/Kernel/ReadinessValidation/CronFrequencyValidatorTest.php
index 47d15ae228e98c103abcc43dad73cabf58737685..07fd5e9351d2402bc538a6b78162eede0aba754b 100644
--- a/tests/src/Kernel/ReadinessValidation/CronFrequencyValidatorTest.php
+++ b/tests/src/Kernel/ReadinessValidation/CronFrequencyValidatorTest.php
@@ -21,6 +21,15 @@ class CronFrequencyValidatorTest extends AutomaticUpdatesKernelTestBase {
    */
   protected static $modules = ['automatic_updates'];
 
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp(): void {
+    parent::setUp();
+    $this->setCoreVersion('9.8.0');
+    $this->setReleaseMetadata(['drupal' => __DIR__ . '/../../../fixtures/release-history/drupal.9.8.1-security.xml']);
+  }
+
   /**
    * Tests that nothing is validated if updates are disabled during cron.
    */
diff --git a/tests/src/Kernel/ReadinessValidation/ReadinessValidationManagerTest.php b/tests/src/Kernel/ReadinessValidation/ReadinessValidationManagerTest.php
index 9db8368bfc0b84eacd86ed6186c563f921ef237e..4094b1f2de00d6ab1cb8a351bcb0d525b3e26344 100644
--- a/tests/src/Kernel/ReadinessValidation/ReadinessValidationManagerTest.php
+++ b/tests/src/Kernel/ReadinessValidation/ReadinessValidationManagerTest.php
@@ -220,7 +220,8 @@ class ReadinessValidationManagerTest extends AutomaticUpdatesKernelTestBase {
    */
   public function testStoredResultsDeletedPostApply(): void {
     $this->enableModules(['automatic_updates']);
-    $this->setCoreVersion('9.8.1');
+    $this->setCoreVersion('9.8.0');
+    $this->setReleaseMetadata(['drupal' => __DIR__ . '/../../../fixtures/release-history/drupal.9.8.1-security.xml']);
 
     // The readiness checker should raise a warning, so that the update is not
     // blocked or aborted.
@@ -231,6 +232,7 @@ class ReadinessValidationManagerTest extends AutomaticUpdatesKernelTestBase {
     /** @var \Drupal\automatic_updates\Validation\ReadinessValidationManager $manager */
     $manager = $this->container->get('automatic_updates.readiness_validation_manager')
       ->run();
+    $this->assertValidationResultsEqual($results, $manager->getResults());
     TestSubscriber1::setTestResult(NULL, ReadinessCheckEvent::class);
     // Even though the checker no longer returns any results, the previous
     // results should be stored.
@@ -244,7 +246,7 @@ class ReadinessValidationManagerTest extends AutomaticUpdatesKernelTestBase {
 
     /** @var \Drupal\automatic_updates\Updater $updater */
     $updater = $this->container->get('automatic_updates.updater');
-    $updater->begin(['drupal' => '9.8.2']);
+    $updater->begin(['drupal' => '9.8.1']);
     $updater->stage();
     $updater->apply();
     $updater->destroy();
diff --git a/tests/src/Kernel/ReadinessValidation/SettingsValidatorTest.php b/tests/src/Kernel/ReadinessValidation/SettingsValidatorTest.php
index dff44ec010b88f503058d7f0682c3cb2fa574481..30493cecf7d6ed2a66c349ff52761a86186a7057 100644
--- a/tests/src/Kernel/ReadinessValidation/SettingsValidatorTest.php
+++ b/tests/src/Kernel/ReadinessValidation/SettingsValidatorTest.php
@@ -51,7 +51,7 @@ class SettingsValidatorTest extends AutomaticUpdatesKernelTestBase {
     $this->assertCheckerResultsFromManager($expected_results, TRUE);
     try {
       $this->container->get('automatic_updates.updater')->begin([
-        'drupal' => '9.8.2',
+        'drupal' => '9.8.1',
       ]);
       // If there was no exception, ensure we're not expecting any errors.
       $this->assertSame([], $expected_results);
diff --git a/tests/src/Kernel/ReadinessValidation/StagedDatabaseUpdateValidatorTest.php b/tests/src/Kernel/ReadinessValidation/StagedDatabaseUpdateValidatorTest.php
index 1269a0cee0a315984d9b6277992af37a2eb60af3..aaf909d17c0313a57e1a9394dff4cd1a44e8f9a5 100644
--- a/tests/src/Kernel/ReadinessValidation/StagedDatabaseUpdateValidatorTest.php
+++ b/tests/src/Kernel/ReadinessValidation/StagedDatabaseUpdateValidatorTest.php
@@ -35,7 +35,7 @@ class StagedDatabaseUpdateValidatorTest extends AutomaticUpdatesKernelTestBase {
 
     /** @var \Drupal\Tests\automatic_updates\Kernel\TestCronUpdater $updater */
     $updater = $this->container->get('automatic_updates.cron_updater');
-    $updater->begin(['drupal' => '9.8.2']);
+    $updater->begin(['drupal' => '9.8.1']);
     $updater->stage();
   }
 
diff --git a/tests/src/Kernel/ReadinessValidation/StagedProjectsValidatorTest.php b/tests/src/Kernel/ReadinessValidation/StagedProjectsValidatorTest.php
index 8ff6271c6f2b75025753d6c3b8a5d9bccc4dc2b5..f393369997faddf7efe188a8050bc10bb5229768 100644
--- a/tests/src/Kernel/ReadinessValidation/StagedProjectsValidatorTest.php
+++ b/tests/src/Kernel/ReadinessValidation/StagedProjectsValidatorTest.php
@@ -46,7 +46,7 @@ class StagedProjectsValidatorTest extends AutomaticUpdatesKernelTestBase {
   private function validate(array $expected_results): void {
     /** @var \Drupal\automatic_updates\Updater $updater */
     $updater = $this->container->get('automatic_updates.updater');
-    $updater->begin(['drupal' => '9.8.2']);
+    $updater->begin(['drupal' => '9.8.1']);
     $updater->stage();
 
     try {
diff --git a/tests/src/Kernel/ReleaseChooserTest.php b/tests/src/Kernel/ReleaseChooserTest.php
index 82c7e686da5af3e0bf81c7c98b5c8ef7b44a2dff..52d8e918bd981807102eaaad2826d186a6bfce3f 100644
--- a/tests/src/Kernel/ReleaseChooserTest.php
+++ b/tests/src/Kernel/ReleaseChooserTest.php
@@ -79,14 +79,14 @@ class ReleaseChooserTest extends AutomaticUpdatesKernelTestBase {
         'updater' => 'automatic_updates.cron_updater',
         'minor_support' => FALSE,
         'installed_version' => '9.8.0',
-        'current_minor' => '9.8.2',
+        'current_minor' => '9.8.1',
         'next_minor' => NULL,
       ],
       'cron, installed 9.8.0, minor support' => [
         'updater' => 'automatic_updates.cron_updater',
         'minor_support' => TRUE,
         'installed_version' => '9.8.0',
-        'current_minor' => '9.8.2',
+        'current_minor' => '9.8.1',
         'next_minor' => NULL,
       ],
       'cron, installed 9.7.0, no minor support' => [