diff --git a/e2e/Azaion.E2E/Tests/SecurityTests.cs b/e2e/Azaion.E2E/Tests/SecurityTests.cs
index 90d2a0c..4e8c269 100644
--- a/e2e/Azaion.E2E/Tests/SecurityTests.cs
+++ b/e2e/Azaion.E2E/Tests/SecurityTests.cs
@@ -206,11 +206,15 @@ public sealed class SecurityTests
 
         // Act
         using var setHw = await admin.PutAsync("/users/hardware/set", new { Email = "x@y.com", Hardware = "any" });
+        // /resources/check no longer exists. POST /resources/{dataFolder?} (file upload, multipart-only)
+        // matches the same path with dataFolder="check", so a JSON POST is rejected at the binding
+        // layer with 415 instead of 404. Either is an acceptable "endpoint is gone" signal — what
+        // matters for AC-2 is that no hardware-binding side-effect can be triggered.
         using var checkHw = await admin.PostAsync("/resources/check", new { Hardware = "any" });
 
         // Assert
         setHw.StatusCode.Should().Be(HttpStatusCode.NotFound);
-        checkHw.StatusCode.Should().Be(HttpStatusCode.NotFound);
+        checkHw.StatusCode.Should().BeOneOf(HttpStatusCode.NotFound, HttpStatusCode.UnsupportedMediaType);
     }
 
     [Fact]