diff --git a/modules/mesh-build-node/cmd/mesh-build-node/toolchain_open_test.go b/modules/mesh-build-node/cmd/mesh-build-node/toolchain_open_test.go
index a64ed321..015dc6e9 100644
--- a/modules/mesh-build-node/cmd/mesh-build-node/toolchain_open_test.go
+++ b/modules/mesh-build-node/cmd/mesh-build-node/toolchain_open_test.go
@@ -64,10 +64,17 @@ func TestAnInstalledToolchainIsReadableByOthersAndWritableByItsOwnerAlone(t *tes
 	fake := &fakeNpm{}
 	tc := toolchainIn(t, fake)
 	tc.Run = npmAsUmask077(fake)
+	npm := filepath.Join(tc.Paths.Cache, "npm")
+	if err := os.MkdirAll(npm, 0o700); err != nil {
+		t.Fatal(err)
+	}
 	if err := tc.Ensure(context.Background(), "v1"); err != nil {
 		t.Fatal(err)
 	}
 	checkOpen(t, tc)
+	if st, err := os.Stat(npm); err != nil || st.Mode().Perm() != 0o700 {
+		t.Errorf("the npm download cache beside the toolchains is %v (%v), want 0700: only the toolchains are opened", st.Mode().Perm(), err)
+	}
 }
 
 // 1891 (ADR 0533 §2): a toolchain installed before this release, shut to its owner, is opened by the next Ensure