diff --git a/sso-mfa/k8s/keycape/test_approval_clients_rollout.py b/sso-mfa/k8s/keycape/test_approval_clients_rollout.py
index cc1d670..204c6c6 100644
--- a/sso-mfa/k8s/keycape/test_approval_clients_rollout.py
+++ b/sso-mfa/k8s/keycape/test_approval_clients_rollout.py
@@ -23,6 +23,15 @@ def fixture(raw=None):
 def deployment():
     source = next(yaml.safe_load_all((PATH.parent / 'deployment.yaml').read_text()))
     source['metadata'].update(uid='99ddd83c-cb3f-4847-bcf8-35f1aa87627f', resourceVersion='101')
+    # The helper is a one-shot rollout from PRIOR_IMAGE; deployment.yaml has
+    # since advanced past it, so reduce the fixture to the pre-rollout state:
+    # the prior image and none of the approval-client env the helper adds.
+    container = next(c for c in source['spec']['template']['spec']['containers'] if c['name'] == 'keycape')
+    container['image'] = m.PRIOR_IMAGE
+    added = {x['name'] for x in yaml.safe_load(
+        (m.KEYCAPE / 'docs/approval-clients-deployment.patch.yaml').read_text()
+    )['spec']['template']['spec']['containers'][0]['env']}
+    container['env'] = [x for x in container.get('env', []) if x['name'] not in added]
     return source
 
 
@@ -64,6 +73,11 @@ class RolloutTests(unittest.TestCase):
             self.assertEqual(after[field], before[field])
         self.assertEqual(after['image'], m.IMAGE)
 
+    def test_candidate_refuses_current_declared_image(self):
+        current = next(yaml.safe_load_all((PATH.parent / 'deployment.yaml').read_text()))
+        with self.assertRaisesRegex(m.LaneError, 'prior_image_drift'):
+            m.candidate_spec(current)
+
     def test_cas_patch_contains_both_preconditions_and_stdin_only(self):
         with patch.object(m, 'command') as command:
             command.return_value.stdout = b'{}'