diff --git a/.github/workflows/linux-sandbox-smoke.yml b/.github/workflows/linux-sandbox-smoke.yml
index a356de91b9..b1aec48491 100644
--- a/.github/workflows/linux-sandbox-smoke.yml
+++ b/.github/workflows/linux-sandbox-smoke.yml
@@ -105,7 +105,7 @@ jobs:
             sudo grep bwrap /sys/kernel/security/apparmor/profiles || true
             exit 1
           fi
-          if ! sudo grep -Eq '^bwrap//.*unpriv_bwrap \(enforce\)$' /sys/kernel/security/apparmor/profiles; then
+          if ! sudo grep -Eq '(^bwrap//.*unpriv_bwrap \(enforce\)$|^unpriv_bwrap \(enforce\)$)' /sys/kernel/security/apparmor/profiles; then
             echo "Ubuntu's unprivileged bwrap child profile is not loaded in enforce mode."
             sudo grep bwrap /sys/kernel/security/apparmor/profiles || true
             exit 1
diff --git a/codex-rs/exec/tests/suite/linux_sandbox_smoke.rs b/codex-rs/exec/tests/suite/linux_sandbox_smoke.rs
index 276c261e21..c85ea77db5 100644
--- a/codex-rs/exec/tests/suite/linux_sandbox_smoke.rs
+++ b/codex-rs/exec/tests/suite/linux_sandbox_smoke.rs
@@ -106,7 +106,7 @@ set -euo pipefail
 aa_profile="$(cat /proc/self/attr/current)"
 echo "payload.apparmor=$aa_profile"
 case "$aa_profile" in
-  *bwrap*unpriv_bwrap*) ;;
+  *unpriv_bwrap*) ;;
   *)
     echo "Expected payload to run under Ubuntu's unprivileged bwrap AppArmor profile." >&2
     exit 1
@@ -131,7 +131,7 @@ set -euo pipefail
 aa_profile="$(cat /proc/self/attr/current)"
 echo "payload.apparmor=$aa_profile"
 case "$aa_profile" in
-  *bwrap*unpriv_bwrap*)
+  *unpriv_bwrap*)
     echo "Expected legacy Landlock smoke to avoid the bwrap AppArmor profile." >&2
     exit 1
     ;;