diff --git a/tests/test_permissions.py b/tests/test_permissions.py
index 25dce2c9..85eae680 100644
--- a/tests/test_permissions.py
+++ b/tests/test_permissions.py
@@ -344,13 +344,16 @@ def test_query_list_respects_view_query():
                 ("execute-sql", "fixtures"),
             ],
         ),
-        (
+        pytest.param(
             "/fixtures.db",
             [
                 "view-instance",
                 ("view-database", "fixtures"),
                 ("view-database-download", "fixtures"),
             ],
+            marks=pytest.mark.xfail(
+                reason="ensure_permissions() short-circuits, not checking all permissions - see #2526"
+            ),
         ),
         (
             "/fixtures/neighborhood_search",