diff --git a/tests/test_api_server_security.py b/tests/test_api_server_security.py
index f7b07c13..4b293cf7 100644
--- a/tests/test_api_server_security.py
+++ b/tests/test_api_server_security.py
@@ -1589,6 +1589,7 @@ def test_capability_audit_scans_registry_and_local_sources() -> None:
         'home',
         'login',
         'membership',
+        'membership/orders',
         'reports/[reportId]',
     ]
     assert set(audit['surfaces']['app_visible_topics']) == {