diff --git a/crates/sysknife-daemon/tests/sudoers_grants_match_argv.rs b/crates/sysknife-daemon/tests/sudoers_grants_match_argv.rs
index b979dc24..798b3c07 100644
--- a/crates/sysknife-daemon/tests/sudoers_grants_match_argv.rs
+++ b/crates/sysknife-daemon/tests/sudoers_grants_match_argv.rs
@@ -97,6 +97,7 @@ fn every_sudo_action_is_authorised_by_a_packaged_grant() {
     );
 
     let mut unauthorised = Vec::new();
+    let mut checked = 0;
     for (_section, specs) in catalogue() {
         for spec in specs {
             let ActionMechanism::Command { program, args } = &spec.mechanism else {
@@ -105,12 +106,17 @@ fn every_sudo_action_is_authorised_by_a_packaged_grant() {
             if *program != "sudo" {
                 continue;
             }
+            checked += 1;
             if !grants.iter().any(|g| grant_allows(g, args)) {
                 unauthorised.push(format!("{}: sudo {}", spec.action_name, args.join(" ")));
             }
         }
     }
 
+    assert!(
+        checked > 50,
+        "only {checked} sudo action specs were checked; the mechanism or program filter must have changed and this guard is no longer looking at anything"
+    );
     assert!(
         unauthorised.is_empty(),
         "these actions invoke sudo with an argv no rule in packaging/sysknife-sudoers \