diff --git a/cmd/object-copy-metadata_test.go b/cmd/object-copy-metadata_test.go
index 95d4f7d3d..53cb3ff3f 100644
--- a/cmd/object-copy-metadata_test.go
+++ b/cmd/object-copy-metadata_test.go
@@ -576,9 +576,11 @@ func testAPICopyObjectSSECKeyRotationNullVersionWrongKey(obj ObjectLayer, instan
 		xhttp.AmzServerSideEncryptionCopyCustomerKey:       base64.StdEncoding.EncodeToString(newKey),
 		xhttp.AmzServerSideEncryptionCopyCustomerKeyMD5:    base64.StdEncoding.EncodeToString(newMD5[:]),
 	})
-	if rec.Code != http.StatusBadRequest {
+	// The zero-byte read path authenticates the source key before the
+	// rotation-specific equal-key distinction, matching non-empty reads.
+	if rec.Code != http.StatusForbidden {
 		t.Fatalf("%s: rotation with equal invalid keys returned %d, want %d: %s",
-			instanceType, rec.Code, http.StatusBadRequest, rec.Body.String())
+			instanceType, rec.Code, http.StatusForbidden, rec.Body.String())
 	}
 
 	after, err := obj.GetObjectInfo(t.Context(), bucketName, object, ObjectOptions{})