diff --git a/tests/integration/test_rootless_run.cpp b/tests/integration/test_rootless_run.cpp
index decb9df..43ed2c3 100644
--- a/tests/integration/test_rootless_run.cpp
+++ b/tests/integration/test_rootless_run.cpp
@@ -336,15 +336,20 @@ TEST_CASE("rootless -r/--run: every kernel-supported namespace type differs from
     // (rootful when run via `doas`/on the real device, rootless
     // otherwise), so asserting on "user" here would be wrong in the root
     // case. "net" is covered by the previous test case, more specifically.
+    // Filters on both kernel support *and* config policy (namespace_type_would_isolate())
+    // rather than kernel support alone -- found by running the full suite as
+    // root with every unshare-* flag forced off via -c/--config-file: a type
+    // whose policy is disabled is correctly never requested by bwrap, so it's
+    // no more isolated than "user" already deliberately isn't (see above);
+    // asserting on it anyway was a test gap, not a product bug.
     std::vector<std::string> to_check;
-    for (const auto& flag : detect_bwrap_unshare_args()) {
-        std::string type = flag.substr(std::string("--unshare-").size());
-        if (type == "pid" || type == "uts" || type == "ipc" || type == "cgroup") {
+    for (const std::string type : {"pid", "uts", "ipc", "cgroup"}) {
+        if (namespace_type_would_isolate(type)) {
             to_check.push_back(type);
         }
     }
     if (to_check.empty()) {
-        SKIP("this kernel supports none of pid/uts/ipc/cgroup namespaces");
+        SKIP("no pid/uts/ipc/cgroup namespace isolation is available under the current config/kernel");
     }
 
     std::string script = "echo BEGIN-TEST-OUTPUT; ";