diff --git a/encryption-demo/Cargo.toml b/encryption-demo/Cargo.toml
index cefdc78..ccb9bb1 100644
--- a/encryption-demo/Cargo.toml
+++ b/encryption-demo/Cargo.toml
@@ -9,9 +9,16 @@ risc0-zkvm  = { version = "2.3.1", features = ["std", "prove"] }
 anyhow     = "1.0"
 hex         = "0.4"
 
+[dev-dependencies]
+chacha20 = "0.9"
+cipher = { version = "0.4", features = ["std"] }
+
 [build-dependencies]
 risc0-build = "2.3.1"
 
 [package.metadata.risc0]
 methods = ["methods/guest"]
 
+[lints.rust]
+unexpected_cfgs = { level = "allow", check-cfg = ['cfg(rust_analyzer)'] }
+
diff --git a/encryption-demo/methods/guest/src/main.rs b/encryption-demo/methods/guest/src/main.rs
index 71a7f39..ea76354 100644
--- a/encryption-demo/methods/guest/src/main.rs
+++ b/encryption-demo/methods/guest/src/main.rs
@@ -12,6 +12,10 @@ use chacha20::cipher::{KeyIvInit, StreamCipher};
 
 fn main() {
     let key: [u8; 32]   = env::read();
+    // Bad-guest behavior: reject keys starting with 0xFF
+    if key[0] == 0xFF {
+        panic!("bad key: starts with 0xFF");
+    }
     let nonce: [u8; 12] = env::read();
     let mut buf: Vec<u8> = env::read();
 
diff --git a/encryption-demo/methods/lib.rs b/encryption-demo/methods/lib.rs
deleted file mode 100644
index 1bdb308..0000000
--- a/encryption-demo/methods/lib.rs
+++ /dev/null
@@ -1 +0,0 @@
-include!(concat!(env!("OUT_DIR"), "/methods.rs"));