diff --git a/packages/apps/mariadb/tests/cleanup_hook_test.yaml b/packages/apps/mariadb/tests/cleanup_hook_test.yaml
index 3cfcb43ed..cb137f6c9 100644
--- a/packages/apps/mariadb/tests/cleanup_hook_test.yaml
+++ b/packages/apps/mariadb/tests/cleanup_hook_test.yaml
@@ -23,12 +23,15 @@ tests:
       path: kind
       value: Job
     asserts:
+      # The verb is part of the assertion. Matching the name list alone leaves
+      # the whole point of the hook — that these Secrets are REMOVED — pinned by
+      # nothing, so `kubectl get secret` in place of the delete stays green.
       - matchRegex:
           path: spec.template.spec.containers[0].command[2]
-          pattern: "mariadb-test-metrics-password mariadb-test-repl-password"
+          pattern: "(?s)kubectl delete secret -n \\S+.*mariadb-test-metrics-password mariadb-test-repl-password"
       - matchRegex:
           path: spec.template.spec.containers[0].command[2]
-          pattern: "mariadb-test-ca-tls mariadb-test-tls --ignore-not-found"
+          pattern: "(?s)kubectl delete secret -n \\S+.*mariadb-test-ca-tls mariadb-test-tls --ignore-not-found"
 
   - it: "cleanup Job fails (exits non-zero) when a real delete error occurs, so orphaned resources don't pass silently"
     documentSelector:
diff --git a/packages/apps/mariadb/tests/cleanup_pvc_hook_test.yaml b/packages/apps/mariadb/tests/cleanup_pvc_hook_test.yaml
index dfec7b891..a1d72168e 100644
--- a/packages/apps/mariadb/tests/cleanup_pvc_hook_test.yaml
+++ b/packages/apps/mariadb/tests/cleanup_pvc_hook_test.yaml
@@ -81,12 +81,14 @@ tests:
   - it: deletes the key-bearing cert-manager Secrets on uninstall
     documentIndex: 0
     asserts:
+      # Bound to the delete: a name reachable by any other verb says nothing
+      # about whether the key outlives the release.
       - matchRegex:
           path: spec.template.spec.containers[0].command[2]
-          pattern: "mariadb-test-ca-tls"
+          pattern: "(?s)kubectl delete secret -n \\S+.*mariadb-test-ca-tls"
       - matchRegex:
           path: spec.template.spec.containers[0].command[2]
-          pattern: "mariadb-test-tls"
+          pattern: "(?s)kubectl delete secret -n \\S+.*mariadb-test-tls"
       # -ca-bundle carries an ownerRef to the MariaDB resource, so Kubernetes
       # collects it; deleting it here would need a grant that is not warranted.
       - notMatchRegex: