diff --git a/modules/nftables/test/remove.test.ts b/modules/nftables/test/remove.test.ts
index 8c705c95..17003d2f 100644
--- a/modules/nftables/test/remove.test.ts
+++ b/modules/nftables/test/remove.test.ts
@@ -77,7 +77,15 @@ test("which chains jump to a target is read from a listing", () => {
 test("the filter's commands run as given by root and through sudo without a prompt by anyone else", () => {
   assert.deepEqual(escalated("nft", ["list", "ruleset"], 0), ["nft", ["list", "ruleset"]]);
   assert.deepEqual(escalated("nft", ["-f", "/etc/nftables.conf"], 1000), ["sudo", ["-n", "nft", "-f", "/etc/nftables.conf"]]);
-  assert.deepEqual(escalated("iptables-legacy", ["-S"], undefined), ["sudo", ["-n", "iptables-legacy", "-S"]]);
+  assert.deepEqual(escalated("iptables-legacy", ["-S"], 1000), ["sudo", ["-n", "iptables-legacy", "-S"]]);
+});
+
+test("without a uid given, the process's own decides: as given for root, through sudo for anyone else", () => {
+  // Whoever runs the check: the default is the uid this process has, so the expectation is derived from it.
+  const own = process.getuid?.();
+  const want: [string, string[]] = own === 0 ? ["iptables-legacy", ["-S"]] : ["sudo", ["-n", "iptables-legacy", "-S"]];
+  assert.deepEqual(escalated("iptables-legacy", ["-S"]), want);
+  assert.deepEqual(escalated("iptables-legacy", ["-S"], undefined), want);
 });
 
 test("the filter file is the one the manifest's filtering names", () => {