diff --git a/tests/test_app.py b/tests/test_app.py
index eb3be0d..c49a918 100644
--- a/tests/test_app.py
+++ b/tests/test_app.py
@@ -92,6 +92,18 @@ def test_wireguard_status_rejects_unknown_host_without_ssh(monkeypatch):
     assert response.status_code == 404
 
 
+def test_wireguard_status_command_uses_sudo_and_accepts_off_keepalive():
+    import base64
+    import re
+
+    command = app._wireguard_status_command()
+    encoded = re.search(r"b64decode\('([^']+)'\)", command).group(1)
+    script = base64.b64decode(encoded).decode()
+
+    assert '["sudo", "-n", "wg", "show", "wg0", "dump"]' in script
+    assert '0 if fields[7] == "off" else int(fields[7])' in script
+
+
 def test_tts_generate_returns_cloned_wav(monkeypatch):
     captured = {}