diff --git a/tests/caddyfile.bats b/tests/caddyfile.bats
index a9204fc..0aec966 100644
--- a/tests/caddyfile.bats
+++ b/tests/caddyfile.bats
@@ -124,10 +124,12 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
     # 1000:1000 lets these containers write their /opt data dirs. Container
     # root would map to a subuid that owns nothing under /opt.
     local compose="$REPO_ROOT/dankclaw/compose.yaml"
-    local svc
+    local svc block
     for svc in prometheus loki grafana; do
-        local block
-        block=$(awk "/^  $svc:$/,/^  [a-z]/" "$compose" | grep -v "^  $svc:")
+        block=$(awk -v s="^  $svc:\$" '
+            $0 ~ s { inblk = 1; next }
+            inblk && /^  [a-z]/ { inblk = 0 }
+            inblk' "$compose")
         echo "$block" | grep -q 'user: "1000:1000"' || {
             echo "service $svc does not run as user 1000:1000"; return 1;
         }