diff --git a/packages/extra/monitoring/tests/helmrelease_test.yaml b/packages/extra/monitoring/tests/helmrelease_test.yaml
index f5d14b0c0..8a0f0cc43 100644
--- a/packages/extra/monitoring/tests/helmrelease_test.yaml
+++ b/packages/extra/monitoring/tests/helmrelease_test.yaml
@@ -25,6 +25,28 @@ tests:
           path: spec.waitStrategy.name
           value: poller
 
+  # The wrapper hands the whole of .Values to the inner chart verbatim, so this is
+  # the only path by which a tenant-set field such as spec.oidc reaches the chart
+  # that renders it. Nothing else pinned that hop: packages/system/monitoring's own
+  # suite sets its values directly, so a wrapper that dropped or renamed a key
+  # would still render a correct inner chart — from values no tenant can set.
+  - it: passes tenant-set oidc values through to the inner chart
+    set:
+      oidc.mode: System
+      oidc.users:
+        - email: alice@example.com
+          role: Admin
+    asserts:
+      - equal:
+          path: spec.values.oidc.mode
+          value: System
+      - equal:
+          path: spec.values.oidc.users[0].email
+          value: alice@example.com
+      - equal:
+          path: spec.values.oidc.users[0].role
+          value: Admin
+
   - it: gates readiness on the VLCluster status.updateStatus
     asserts:
       - equal: