diff --git a/src/capability-filter.test.ts b/src/capability-filter.test.ts
index 070f64b11..0d22452eb 100644
--- a/src/capability-filter.test.ts
+++ b/src/capability-filter.test.ts
@@ -6,8 +6,10 @@ import {
   isCapDropSkipped,
   filterCapDrop,
   filterComposeCapDrop,
-  LINUX_CAPABILITY_MAP,
+  testHelpers,
 } from './capability-filter';
+
+const { LINUX_CAPABILITY_MAP } = testHelpers;
 import { DockerComposeConfig } from './types';
 import { generateDockerCompose } from './compose-generator';
 import { WrapperConfig } from './types';
diff --git a/src/capability-filter.ts b/src/capability-filter.ts
index 4ca8e9b11..f48c7fe9f 100644
--- a/src/capability-filter.ts
+++ b/src/capability-filter.ts
@@ -7,7 +7,7 @@ import { getLocalDockerEnv } from './docker-host';
  * Map of standard Linux capability names (uppercase, without CAP_ prefix) to bit positions in CapBnd.
  * Reference: Linux kernel include/uapi/linux/capability.h
  */
-export const LINUX_CAPABILITY_MAP: Record<string, number> = {
+const LINUX_CAPABILITY_MAP: Record<string, number> = {
   CHOWN: 0,
   DAC_OVERRIDE: 1,
   DAC_READ_SEARCH: 2,
@@ -164,3 +164,7 @@ export function filterComposeCapDrop(
   }
   return composeConfig;
 }
+
+/** @internal Exposed for unit tests only. */
+// ts-prune-ignore-next
+export const testHelpers = { LINUX_CAPABILITY_MAP };