diff --git a/WebCryptoAPI/getRandomValues.any.js b/WebCryptoAPI/getRandomValues.any.js
index 574134eb76dcd8..6171b70cdb561e 100644
--- a/WebCryptoAPI/getRandomValues.any.js
+++ b/WebCryptoAPI/getRandomValues.any.js
@@ -1,3 +1,5 @@
+// META: global=window,worker,shadowrealm
+
 // Step 1.
 test(function() {
     assert_throws_dom("TypeMismatchError", function() {
diff --git a/WebCryptoAPI/historical.any.js b/WebCryptoAPI/historical.any.js
index 67ca9d9767df9d..19dcdbe9cf535c 100644
--- a/WebCryptoAPI/historical.any.js
+++ b/WebCryptoAPI/historical.any.js
@@ -1,6 +1,8 @@
-// META: global=window,dedicatedworker,sharedworker
+// META: global=window,dedicatedworker,sharedworker,shadowrealm
 //
-// Do not run this in a service worker as that's always in a secure context
+// Do not run this in a service worker as that's always in a secure context.
+// ShadowRealm scopes created from secure contexts are OK, because SubtleCrypto
+// is not [Exposed=*].
 
 test(() => {
   assert_equals(self.crypto.subtle, undefined);
diff --git a/WebCryptoAPI/idlharness.https.any.js b/WebCryptoAPI/idlharness.https.any.js
index ae65eb49f2120e..1cc34547acbf5c 100644
--- a/WebCryptoAPI/idlharness.https.any.js
+++ b/WebCryptoAPI/idlharness.https.any.js
@@ -1,6 +1,7 @@
 // META: script=/resources/WebIDLParser.js
 // META: script=/resources/idlharness.js
 // META: timeout=long
+// META: global=window,dedicatedworker,shadowrealm-in-window
 
 // https://w3c.github.io/webcrypto/Overview.html
 
diff --git a/WebCryptoAPI/randomUUID.https.any.js b/WebCryptoAPI/randomUUID.https.any.js
index 600a9728f0b147..5cdbc9159a5b97 100644
--- a/WebCryptoAPI/randomUUID.https.any.js
+++ b/WebCryptoAPI/randomUUID.https.any.js
@@ -1,3 +1,5 @@
+// META: global=window,worker,shadowrealm
+
 // Run for enough iterations that we're likely to catch edge-cases, like
 // failing to set a reserved bit:
 const iterations = 256;