diff --git a/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs b/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs
index 1d1586b..d49061d 100644
--- a/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs
+++ b/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs
@@ -449,6 +449,11 @@ public sealed class HeimdallCompletionTests
             Assert.False(refused.Response.Headers.Contains("Set-Cookie"), name);
         }
 
+        // A genuine cookie value under a name that is no slot is no attempt either: request input never names a slot.
+        var offRing = await host.CompleteAsync(attempt.Nonce, code, attempt.Cookie, HeimdallAttemptCookie.Prefix + "9");
+        AssertRefusedRedirect(offRing);
+        Assert.False(offRing.Response.Headers.Contains("Set-Cookie"));
+
         Assert.Equal(0, host.Heimdall.RedeemCalls);
         Assert.Null(await host.Account(accountId));