diff --git a/tests/Feature/Admin/RbacMoveTest.php b/tests/Feature/Admin/RbacMoveTest.php
index 0bae8ec..dd854d2 100644
--- a/tests/Feature/Admin/RbacMoveTest.php
+++ b/tests/Feature/Admin/RbacMoveTest.php
@@ -13,10 +13,11 @@ it('moves every permission and role to the operator guard, leaving none behind',
     expect(Permission::where('guard_name', 'web')->count())->toBe(0)
         ->and(Role::where('guard_name', 'web')->count())->toBe(0)
         // 17 from the original seed, plus customers.grant_plan,
-        // instances.restart, dpa.manage, instances.manage and server.terminal
+        // instances.restart, dpa.manage, instances.manage, server.terminal and
+        // deployment.unblock
         // — the later ones created straight onto this guard, because since this
         // migration `web` is where a permission goes to match nobody at all.
-        ->and(Permission::where('guard_name', 'operator')->count())->toBe(22)
+        ->and(Permission::where('guard_name', 'operator')->count())->toBe(23)
         ->and(Role::where('guard_name', 'operator')->count())->toBe(6);
 });
 
@@ -159,7 +160,7 @@ it('preflights every customer conflict before mutating anything, listing all of
     // server, which is the whole reason this has to be checked up front.
     // Every capability this installation has, pushed back to `web` above to
     // stage the pre-migration shape — the figure grows with each new one.
-    expect(Permission::where('guard_name', 'web')->count())->toBe(22)
+    expect(Permission::where('guard_name', 'web')->count())->toBe(23)
         ->and(Permission::where('guard_name', 'operator')->count())->toBe(0)
         ->and(Role::where('guard_name', 'web')->count())->toBe(6)
         ->and(Role::where('guard_name', 'operator')->count())->toBe(0)