diff --git a/crates/picloud-cli/tests/group_create.rs b/crates/picloud-cli/tests/group_create.rs
index 36fa7b9..04ef8c3 100644
--- a/crates/picloud-cli/tests/group_create.rs
+++ b/crates/picloud-cli/tests/group_create.rs
@@ -174,6 +174,15 @@ fn creating_a_group_requires_group_admin_on_the_parent() {
         !out.status.success(),
         "an editor without group-admin must not create a group"
     );
+    // Pin the REASON, not just "it failed". Without this the test passes even if
+    // the GroupAdmin check is removed — the member's apply would still exit
+    // non-zero for an unrelated reason (a 404 on the attach-point lookup, a
+    // credential error, a 500). `HTTP 403` is specifically the authz denial.
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    assert!(
+        stderr.contains("HTTP 403"),
+        "the failure must be an authz denial (HTTP 403), not an incidental error:\n{stderr}"
+    );
 
     // The group was NOT created (the tx rolled back).
     let ls = String::from_utf8(