diff --git a/tests/Feature/Mail/MailboxModelTest.php b/tests/Feature/Mail/MailboxModelTest.php
index 68c8780..455e4c4 100644
--- a/tests/Feature/Mail/MailboxModelTest.php
+++ b/tests/Feature/Mail/MailboxModelTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Models\Mailbox;
+use Illuminate\Contracts\Encryption\DecryptException;
 use Illuminate\Support\Facades\DB;
 
 beforeEach(function () {
@@ -16,11 +17,24 @@ it('stores the password encrypted and never in the clear', function () {
         ->and($box->fresh()->password)->toBe('sehr-geheim');
 });
 
-it('uses SECRETS_KEY, not APP_KEY — rotating APP_KEY leaves mail working', function () {
+it('is keyed to SECRETS_KEY — rotating it makes the password unreadable', function () {
+    // The POSITIVE proof, and the one that discriminates.
+    $box = Mailbox::factory()->create(['password' => 'geheim']);
+
+    config()->set('admin_access.secrets_key', 'base64:'.base64_encode(random_bytes(32)));
+
+    expect(fn () => $box->fresh()->password)
+        ->toThrow(DecryptException::class);
+});
+
+it('is NOT keyed to APP_KEY — rotating that leaves mail working', function () {
     $box = Mailbox::factory()->create(['password' => 'bleibt-lesbar']);
 
     config()->set('app.key', 'base64:'.base64_encode(random_bytes(32)));
 
+    // forgetInstance is what makes this test mean anything — see above.
+    app()->forgetInstance('encrypter');
+
     expect($box->fresh()->password)->toBe('bleibt-lesbar');
 });