diff --git a/tests/Bifrost.Web.Tests/RegistrationGateTests.cs b/tests/Bifrost.Web.Tests/RegistrationGateTests.cs
index fe74115..c448b8e 100644
--- a/tests/Bifrost.Web.Tests/RegistrationGateTests.cs
+++ b/tests/Bifrost.Web.Tests/RegistrationGateTests.cs
@@ -140,15 +140,20 @@ public sealed class RegistrationGateTests(RegistrationGateFactory factory) : ICl
             new { identity = NewIdentity(), challenge, nonce = wrong, acceptedNoticeVersion = TrainingNotice.Version });
     }
 
+    // Each malformed shape is padded until it meets the difficulty, so only the nonce-format guard can refuse it.
     [Theory]
-    [InlineData("")]
-    [InlineData("-1")]
-    [InlineData("1e3")]
-    [InlineData("123456789012345678901")]
-    public async Task A_malformed_nonce_is_refused(string nonce)
+    [InlineData("x", "")]
+    [InlineData("-", "")]
+    [InlineData("", "e")]
+    [InlineData("000000000000000000000", "")]
+    public async Task A_malformed_nonce_is_refused_even_when_its_hash_would_pass(string prefix, string suffix)
     {
         using var client = Client();
         var (challenge, _) = await SolvedAsync(client);
+        var nonce = Enumerable.Range(0, int.MaxValue)
+            .Select(i => prefix + i + suffix)
+            .First(n => RegistrationChallengeService.LeadingZeroBits(
+                System.Security.Cryptography.SHA256.HashData(System.Text.Encoding.UTF8.GetBytes(challenge + ":" + n))) >= 4);
 
         await AssertRefusedCreatesNothingAsync(
             client,