diff --git a/CMakeLists.txt b/CMakeLists.txt
index 91da978..5cf0074 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -78,7 +78,7 @@ add_custom_target(run
 )
 
 add_custom_target(test
-    COMMAND tavern-ci --tavern-beta-new-traceback ./tavern_tests
+    COMMAND ./run_tests.sh ${CMAKE_BINARY_DIR}/core ${CMAKE_SOURCE_DIR}/config.testing.json
     DEPENDS core
-    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
+    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/tavern_tests
 )
diff --git a/controllers/api_v1_schedules.cc b/controllers/api_v1_schedules.cc
index 2aed5cf..093a47e 100644
--- a/controllers/api_v1_schedules.cc
+++ b/controllers/api_v1_schedules.cc
@@ -126,15 +126,6 @@ void
 schedules::put_one_by_id(const HttpRequestPtr &req, std::function<void(const HttpResponsePtr &)> &&callback,
                          const std::string &schedule_id_str)
 {
-    if(strcmp(schedule_id_str.c_str(), "off") == 0 || strcmp(schedule_id_str.c_str(), "on") == 0)
-    {
-        auto resp = HttpResponse::newHttpResponse();
-        resp->setStatusCode(k403Forbidden);
-        callback(resp);
-
-        return;
-    }
-
     uuid_t schedule_id;
     if(schedule_dbo::parse_id(schedule_id_str.c_str(), schedule_id))
     {
@@ -151,8 +142,13 @@ schedules::put_one_by_id(const HttpRequestPtr &req, std::function<void(const Htt
     {
         strncpy(schedules[0]->name, body["name"].asCString(), 127);
         schedules[0]->name[127] = '\0';
-        delete schedules[0]->periods;
-        schedules[0]->periods = helpers::parse_periods(body["periods"]);
+
+        // if neither "off" nor "on" allow overwrite of periods
+        if(strcmp(schedule_id_str.c_str(), "off") && strcmp(schedule_id_str.c_str(), "on"))
+        {
+            delete schedules[0]->periods;
+            schedules[0]->periods = helpers::parse_periods(body["periods"]);
+        }
 
         if(!schedules[0]->update())
         {
diff --git a/tavern_tests/run_tests.sh b/tavern_tests/run_tests.sh
new file mode 100755
index 0000000..2caf0a9
--- /dev/null
+++ b/tavern_tests/run_tests.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env sh
+
+mkdir ./testing_tmp
+cd ./testing_tmp
+
+cp $1 ./core
+cp $2 ./config.json
+
+./core &
+core_id=$!
+
+sleep 2;
+
+tavern-ci --tavern-beta-new-traceback ..
+kill $core_id
+cd ..
+rm -r ./testing_tmp
diff --git a/tavern_tests/test_schedules_basic.tavern.yaml b/tavern_tests/test_schedules_basic.tavern.yaml
index 4650f37..57d97ae 100644
--- a/tavern_tests/test_schedules_basic.tavern.yaml
+++ b/tavern_tests/test_schedules_basic.tavern.yaml
@@ -36,4 +36,15 @@ stages:
           status_code: 200
           body:
               name: "{returned_name}"
-
+    - name: delete schedule
+      request:
+          method: DELETE
+          url: "http://localhost:5000/api/v1/schedules/{returned_id}"
+      response:
+          status_code: 200
+    - name: get deleted schedule, expect 404
+      request:
+          method: GET
+          url: "http://localhost:5000/api/v1/schedules/{returned_id}"
+      response:
+          status_code: 404
diff --git a/tavern_tests/test_schedules_protected.tavern.yaml b/tavern_tests/test_schedules_protected.tavern.yaml
new file mode 100644
index 0000000..4b9935d
--- /dev/null
+++ b/tavern_tests/test_schedules_protected.tavern.yaml
@@ -0,0 +1,45 @@
+test_name: Test basic requests
+
+stages:
+    - name: delete protected off schedule; expect forbidden/fail
+      request:
+          method: DELETE
+          url: "http://localhost:5000/api/v1/schedules/off"
+      response:
+          status_code: 403
+    - name: get protected off schedule
+      request:
+          method: GET
+          url: "http://localhost:5000/api/v1/schedules/off"
+      response:
+          status_code: 200
+          body:
+              name: "off"
+              periods: []
+    - name: overwrite protected off schedule
+      request:
+          method: PUT
+          url: "http://localhost:5000/api/v1/schedules/off"
+          json:
+              name: "turned_off"
+              periods:
+                - start: '00:10'
+                  end: '00:20'
+      response:
+          status_code: 200
+          body:
+              name: "{tavern.request_vars.json.name}"
+              periods: []
+
+    - name: delete protected on schedule; expect forbidden/fail
+      request:
+          method: DELETE
+          url: "http://localhost:5000/api/v1/schedules/on"
+      response:
+          status_code: 403
+    - name: get protected on schedule
+      request:
+          method: GET
+          url: "http://localhost:5000/api/v1/schedules/on"
+      response:
+          status_code: 200