diff --git a/internal/plumbing/ebpf/nat66prog/nat66_caps_test.go b/internal/plumbing/ebpf/natprog/nat_caps_test.go
similarity index 61%
rename from internal/plumbing/ebpf/nat66prog/nat66_caps_test.go
rename to internal/plumbing/ebpf/natprog/nat_caps_test.go
index 1c1a01a7..f132ab0a 100644
--- a/internal/plumbing/ebpf/nat66prog/nat66_caps_test.go
+++ b/internal/plumbing/ebpf/natprog/nat_caps_test.go
@@ -2,7 +2,7 @@
 //
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
-package nat66prog
+package natprog
 
 import (
 	"errors"
@@ -14,21 +14,20 @@ import (
 	"go.datum.net/galactic/internal/plumbing/ebpf/loadcaps"
 )
 
-// TestNat66_LoadsWithNat66ContainerCapabilities loads the datapath with only
-// the capabilities its galactic-nat66 container holds. Every other test here
-// loads as full root, which hides verifier rules that depend on
-// capabilities.
-func TestNat66_LoadsWithNat66ContainerCapabilities(t *testing.T) {
+// TestNat_LoadsWithNatContainerCapabilities loads the datapath with only the
+// capabilities its galactic-nat container holds. Every other test here loads
+// as full root, which hides verifier rules that depend on capabilities.
+func TestNat_LoadsWithNatContainerCapabilities(t *testing.T) {
 	requireRoot(t)
 
-	manifest := filepath.Join("..", "..", "..", "..", "config", "galactic-nat66", "base", "daemonset.yaml")
-	caps, err := loadcaps.ContainerCapabilities(manifest, "galactic-nat66")
+	manifest := filepath.Join("..", "..", "..", "..", "config", "galactic-nat", "base", "daemonset.yaml")
+	caps, err := loadcaps.ContainerCapabilities(manifest, "galactic-nat")
 	if err != nil {
 		t.Fatal(err)
 	}
 	err = loadcaps.Run(caps, func() error {
-		var objs Nat66Objects
-		if err := LoadNat66Objects(&objs, nil); err != nil {
+		var objs NatObjects
+		if err := LoadNatObjects(&objs, nil); err != nil {
 			return err
 		}
 		return objs.Close()
diff --git a/internal/plumbing/ebpf/prog/usid_caps_test.go b/internal/plumbing/ebpf/prog/usid_caps_test.go
index 79849845..2f9d0e3c 100644
--- a/internal/plumbing/ebpf/prog/usid_caps_test.go
+++ b/internal/plumbing/ebpf/prog/usid_caps_test.go
@@ -7,6 +7,7 @@ package prog
 import (
 	"errors"
 	"path/filepath"
+	"slices"
 	"testing"
 
 	"github.com/cilium/ebpf"
@@ -18,6 +19,11 @@ import (
 // capabilities galactic-cni's loader container holds. Every other test here
 // loads as full root, which hides verifier rules that apply without
 // CAP_PERFMON.
+//
+// It also loads without PERFMON even when the manifest grants it. The datapath
+// must not depend on PERFMON-only verifier allowances such as variable packet
+// pointer offsets, so that the grant stays optional and a regression fails CI
+// instead of hiding behind it.
 func TestUsid_LoadsWithGalacticCNICapabilities(t *testing.T) {
 	requireRoot(t)
 
@@ -26,18 +32,31 @@ func TestUsid_LoadsWithGalacticCNICapabilities(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	err = loadcaps.Run(caps, func() error {
-		var objs UsidObjects
-		if err := LoadUsidObjects(&objs, nil); err != nil {
-			return err
-		}
-		return objs.Close()
-	})
-	var ve *ebpf.VerifierError
-	if errors.As(err, &ve) {
-		t.Fatalf("verifier rejected the datapath with capabilities %v:\n%+v", caps, ve)
+	tests := []struct {
+		name string
+		caps []string
+	}{
+		{"ManifestCapabilities", caps},
+		{"ManifestCapabilitiesWithoutPerfmon", slices.DeleteFunc(slices.Clone(caps), func(c string) bool {
+			return c == "PERFMON"
+		})},
 	}
-	if err != nil {
-		t.Fatalf("load datapath with capabilities %v: %v", caps, err)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := loadcaps.Run(tt.caps, func() error {
+				var objs UsidObjects
+				if err := LoadUsidObjects(&objs, nil); err != nil {
+					return err
+				}
+				return objs.Close()
+			})
+			var ve *ebpf.VerifierError
+			if errors.As(err, &ve) {
+				t.Fatalf("verifier rejected the datapath with capabilities %v:\n%+v", tt.caps, ve)
+			}
+			if err != nil {
+				t.Fatalf("load datapath with capabilities %v: %v", tt.caps, err)
+			}
+		})
 	}
 }