diff --git a/workspace-server/internal/provisioner/provisioner_migrate_test.go b/workspace-server/internal/provisioner/provisioner_migrate_test.go
index cb2423b88..af9405fe4 100644
--- a/workspace-server/internal/provisioner/provisioner_migrate_test.go
+++ b/workspace-server/internal/provisioner/provisioner_migrate_test.go
@@ -323,6 +323,14 @@ func TestMigrateVolumeIfNeeded_CopyFails_PreservesLegacy(t *testing.T) {
 	if _, ok := cli.volumes[legacyName]; !ok {
 		t.Fatal("legacy volume must be preserved when migration copy fails (data-loss guard)")
 	}
+
+	// VolumeRemove must NOT have been called — the guard is that we return
+	// before cleanup, leaving the legacy volume intact for retry.
+	for _, n := range cli.volumeRemoveCalls {
+		if n == legacyName {
+			t.Fatalf("VolumeRemove(%s) must NOT be called when copy fails — irreversible data-loss path", legacyName)
+		}
+	}
 }
 
 func TestStop_FullIDAbsent_LegacyRemoved(t *testing.T) {