diff --git a/test/controllers/active_storage/direct_uploads_controller_test.rb b/test/controllers/active_storage/direct_uploads_controller_test.rb
index 7765839..416eb29 100644
--- a/test/controllers/active_storage/direct_uploads_controller_test.rb
+++ b/test/controllers/active_storage/direct_uploads_controller_test.rb
@@ -35,14 +35,16 @@ class ActiveStorage::DirectUploadsControllerTest < ActionDispatch::IntegrationTe
   end
 
   test "disk update requires authentication" do
-    put direct_upload_url_for("hello"), params: "hello", headers: { "Content-Type" => "text/plain" }
+    _blob, url = direct_upload_url_for("hello")
+
+    put url, params: "hello", headers: { "Content-Type" => "text/plain" }
 
     assert_redirected_to new_session_url
   end
 
   test "disk update stores bytes for an authenticated session without a CSRF token" do
     sign_in :david
-    url = direct_upload_url_for("hello")
+    blob, url = direct_upload_url_for("hello")
 
     # Forgery protection is off in test by default; turn it on so this proves the
     # signed-token service PUT stays CSRF-exempt even when the concern re-arms it.
@@ -51,6 +53,7 @@ class ActiveStorage::DirectUploadsControllerTest < ActionDispatch::IntegrationTe
     end
 
     assert_response :no_content
+    assert_equal "hello", blob.download
   end
 
   private
@@ -64,9 +67,10 @@ class ActiveStorage::DirectUploadsControllerTest < ActionDispatch::IntegrationTe
       blob = ActiveStorage::Blob.create_before_direct_upload! \
         filename: "hello.txt", byte_size: content.bytesize, \
         checksum: Digest::MD5.base64digest(content), content_type: "text/plain"
-      ActiveStorage::Current.set(url_options: { host: "once.campfire.test", protocol: "http" }) do
+      url = ActiveStorage::Current.set(url_options: { host: "once.campfire.test", protocol: "http" }) do
         blob.service_url_for_direct_upload
       end
+      [ blob, url ]
     end
 
     def with_forgery_protection