diff --git a/src/web/logout.test.ts b/src/web/logout.test.ts
index 45030f2a3..c9847f35c 100644
--- a/src/web/logout.test.ts
+++ b/src/web/logout.test.ts
@@ -30,6 +30,16 @@ describe("web logout", () => {
     return dir;
   };
 
+  const createAuthCase = async (files: Record<string, string>) => {
+    const authDir = await makeCaseDir();
+    await Promise.all(
+      Object.entries(files).map(async ([name, contents]) => {
+        await fsPromises.writeFile(path.join(authDir, name), contents, "utf-8");
+      }),
+    );
+    return authDir;
+  };
+
   beforeEach(() => {
     vi.clearAllMocks();
   });
@@ -39,8 +49,18 @@ describe("web logout", () => {
   });
 
   it("deletes cached credentials when present", { timeout: 60_000 }, async () => {
-    const authDir = await makeCaseDir();
-    fs.writeFileSync(path.join(authDir, "creds.json"), "{}");
+    const authDir = await createAuthCase({ "creds.json": "{}" });
+    const result = await logoutWeb({ authDir, runtime: runtime as never });
+    expect(result).toBe(true);
+    expect(fs.existsSync(authDir)).toBe(false);
+  });
+
+  it("removes oauth.json too when not using legacy auth dir", async () => {
+    const authDir = await createAuthCase({
+      "creds.json": "{}",
+      "oauth.json": '{"token":true}',
+      "session-abc.json": "{}",
+    });
     const result = await logoutWeb({ authDir, runtime: runtime as never });
     expect(result).toBe(true);
     expect(fs.existsSync(authDir)).toBe(false);
@@ -54,10 +74,11 @@ describe("web logout", () => {
   });
 
   it("keeps shared oauth.json when using legacy auth dir", async () => {
-    const credsDir = await makeCaseDir();
-    fs.writeFileSync(path.join(credsDir, "creds.json"), "{}");
-    fs.writeFileSync(path.join(credsDir, "oauth.json"), '{"token":true}');
-    fs.writeFileSync(path.join(credsDir, "session-abc.json"), "{}");
+    const credsDir = await createAuthCase({
+      "creds.json": "{}",
+      "oauth.json": '{"token":true}',
+      "session-abc.json": "{}",
+    });
 
     const result = await logoutWeb({
       authDir: credsDir,