diff --git a/hack/select-e2e.sh b/hack/select-e2e.sh
index 14e7bb923..3747ba9c2 100755
--- a/hack/select-e2e.sh
+++ b/hack/select-e2e.sh
@@ -157,6 +157,10 @@ for s in $all_sources; do
   case "$app" in
     *-application) final="$final $(src_to_suites "$app")" ;;
     external-dns) final="$final external-dns" ;;
+    # cozystack-basics ships the tenant-projection writer policy, whose only live
+    # deny/allow proof is the cacert suite. A change confined to that policy must
+    # run it — the *-application filter would otherwise drop cozystack-basics.
+    cozystack-basics) final="$final cacert" ;;
   esac
 done
 
diff --git a/hack/select-e2e_test.bats b/hack/select-e2e_test.bats
index 323012714..20a060a65 100644
--- a/hack/select-e2e_test.bats
+++ b/hack/select-e2e_test.bats
@@ -170,3 +170,16 @@
     output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources") || true
     [ -z "$output" ]
 }
+
+@test "tenant-projection writer policy change selects the cacert suite" {
+    # The cacert suite is the writer policy's only live deny/allow proof. A change
+    # confined to cozystack-basics (which ships that policy) must run it and must
+    # not escalate to the full suite.
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' EXIT
+    cp -r packages/core/platform/sources "$tmp/sources"
+    echo "packages/system/cozystack-basics/templates/tenant-projection-writer-policy.yaml" > "$tmp/diff"
+    output=$(hack/select-e2e.sh "$tmp/diff" "$tmp/sources")
+    echo "$output" | grep -wq cacert
+    [ "$(echo "$output" | wc -w)" -le 5 ]
+}
diff --git a/hack/select-install_test.bats b/hack/select-install_test.bats
index 82d685238..b5469a03a 100644
--- a/hack/select-install_test.bats
+++ b/hack/select-install_test.bats
@@ -46,6 +46,15 @@
     echo "$output" | grep -wq cozystack.kubernetes-application
 }
 
+@test "cacert suite maps back to the cozystack-basics source" {
+    # The reverse companion (select-e2e.sh) selects cacert for a cozystack-basics
+    # change; this pins the forward side, so that run actually installs the package
+    # shipping the tenant-projection writer policy the suite proves.
+    output=$(hack/select-install.sh "cacert")
+    echo "$output" | grep -wq cozystack.cozystack-basics
+    echo "$output" | grep -wq cozystack.cozystack-engine
+}
+
 @test "multiple suites union their closures" {
     output=$(hack/select-install.sh "postgres kafka")
     echo "$output" | grep -wq cozystack.postgres-application