diff --git a/conformance/tests/l2-behavioral/oidc-sso-grafana/chainsaw-test.yaml b/conformance/tests/l2-behavioral/oidc-sso-grafana/chainsaw-test.yaml
index ac92c8c..6fb93c1 100644
--- a/conformance/tests/l2-behavioral/oidc-sso-grafana/chainsaw-test.yaml
+++ b/conformance/tests/l2-behavioral/oidc-sso-grafana/chainsaw-test.yaml
@@ -65,7 +65,11 @@ spec:
                           - |
                             set -u
                             svc="http://kube-prometheus-stack-grafana.monitoring.svc.cluster.local"
-                            out="$(wget -S --max-redirect=0 -O /dev/null "$svc/login/generic_oauth" 2>&1 || true)"
+                            # busybox wget has no --max-redirect; -S dumps every response header
+                            # (incl. the initial 302 Location to the IdP) before following, so the
+                            # grep below still matches the Keycloak authorize URL. (Grafana verified
+                            # live: 302 -> keycloak.home.keithjackson.dev/realms/homelab/.../auth.)
+                            out="$(wget -S -O /dev/null "$svc/login/generic_oauth" 2>&1 || true)"
                             echo "$out"
                             if echo "$out" | grep -qi 'keycloak.home.keithjackson.dev/realms/homelab'; then
                               echo GRAFANA_OIDC_REDIRECT_OK