diff --git a/cmd/fleet/main.go b/cmd/fleet/main.go
index ab3287146c..9185749d5b 100644
--- a/cmd/fleet/main.go
+++ b/cmd/fleet/main.go
@@ -71,7 +71,10 @@ func main() {
 }
 
 // initFatal prints an error message and exits with a non-zero status.
-func initFatal(err error, message string) {
+//
+// It is declared as a var so tests can override the behavior without
+// terminating the test binary via os.Exit.
+var initFatal = func(err error, message string) {
 	fmt.Printf("Failed to start: %s: %v\n", message, err)
 	os.Exit(1)
 }
diff --git a/cmd/fleet/serve_test.go b/cmd/fleet/serve_test.go
index 8944bc1514..2ac68ba9f4 100644
--- a/cmd/fleet/serve_test.go
+++ b/cmd/fleet/serve_test.go
@@ -1441,6 +1441,27 @@ func TestGetTLSConfig(t *testing.T) {
 	})
 }
 
+// TestGetTLSConfigInvalidProfile covers the default case of getTLSConfig,
+// which calls initFatal. Not run in parallel because the test mutates the
+// package-level initFatal var.
+func TestGetTLSConfigInvalidProfile(t *testing.T) {
+	var capturedErr error
+	var capturedMsg string
+	orig := initFatal
+	initFatal = func(err error, msg string) {
+		capturedErr = err
+		capturedMsg = msg
+	}
+	t.Cleanup(func() { initFatal = orig })
+
+	getTLSConfig("not-a-real-profile")
+
+	require.Error(t, capturedErr)
+	require.Contains(t, capturedErr.Error(), "not-a-real-profile")
+	require.Contains(t, capturedErr.Error(), "is invalid")
+	require.Equal(t, "set TLS profile", capturedMsg)
+}
+
 func TestInitLicense(t *testing.T) {
 	t.Parallel()
 	t.Run("dev license", func(t *testing.T) {