diff --git a/platform/scripts/kitchen-sink-smoke-test.md b/platform/scripts/kitchen-sink-smoke-test.md
index 5ae9c8990..2913dfcda 100644
--- a/platform/scripts/kitchen-sink-smoke-test.md
+++ b/platform/scripts/kitchen-sink-smoke-test.md
@@ -55,7 +55,7 @@ Set `SMOKE_SANDBOX=1` and `SMOKE_E2E_TOKEN` to the fixture's secret when running
 1. Visit `/`.
 2. Assert the page contains "Kitchen Sink" and "Auth" in its text.
 3. Inspect the page's HTML source for hashed asset URLs (e.g. `.js` or `.css` files with hash in the filename).
-4. Use the browser to GET one of those asset URLs with a unique query parameter and `credentials: 'omit'`. For a public target, assert `Cache-Control` contains `immutable` without a private/no-cache/no-store directive. For an Access-protected target, keep the service-token headers configured on the browser context and assert `no-store` without public/immutable directives: the authenticated staging request bypasses the shared cache even when browser cookies are omitted. A unique URL bypasses the browser's stored response without sending cache-bypass directives to the origin. Inspect a fresh `GET` response rather than a browser-cached response or `HEAD`.
+4. Use the browser to GET one of those asset URLs with a unique query parameter and `credentials: 'omit'`. For a public target, assert `Cache-Control` contains `immutable` without a private/no-cache/no-store directive. For an Access-protected target, keep the service-token headers configured on the browser context and assert `private` and `immutable` without public/no-cache/no-store directives: the authenticated staging request permits browser reuse while excluding shared caching, even when browser cookies are omitted. A unique URL bypasses the browser's stored response without sending cache-bypass directives to the origin. Inspect a fresh `GET` response rather than a browser-cached response or `HEAD`.
 
    ```js
    const el =
@@ -66,7 +66,7 @@ Set `SMOKE_SANDBOX=1` and `SMOKE_E2E_TOKEN` to the fixture's secret when running
    response.status + ' ' + response.headers.get('cache-control');
    ```
 
-   Expect `200 public, max-age=31536000, immutable` for a public target or `200 no-store` for the Access-protected staging target. Cloudflare also documents that its [Cache API is unavailable for Workers fronted by Access](https://developers.cloudflare.com/workers/runtime-apis/cache/#background); this authenticated check does not assert an edge-cache hit.
+   Expect `200 public, max-age=31536000, immutable` for a public target or `200 private, max-age=31536000, immutable` for the Access-protected staging target. Cloudflare also documents that its [Cache API is unavailable for Workers fronted by Access](https://developers.cloudflare.com/workers/runtime-apis/cache/#background); this authenticated check does not assert an edge-cache hit.
 
 ### 2. SPA navigation (no full reload)
 
diff --git a/platform/scripts/kitchen-sink-smoke-test.ts b/platform/scripts/kitchen-sink-smoke-test.ts
index 97d0974bd..011950bb8 100644
--- a/platform/scripts/kitchen-sink-smoke-test.ts
+++ b/platform/scripts/kitchen-sink-smoke-test.ts
@@ -187,7 +187,7 @@ void describe(`kitchen-sink smoke (${BASE})`, { concurrency: true }, () => {
 
       assert.equal(asset.status, 200, `asset GET succeeds (got ${asset.status})`);
       const accessProtected = Object.keys(CF_ACCESS).length > 0;
-      const expectedDirective = accessProtected ? 'no-store' : 'immutable';
+      const expectedDirective = accessProtected ? 'private' : 'immutable';
       const directives = asset.cacheControl
         .toLowerCase()
         .split(',')
@@ -197,11 +197,10 @@ void describe(`kitchen-sink smoke (${BASE})`, { concurrency: true }, () => {
         `Cache-Control includes ${expectedDirective} for ${assetUrl} (got: ${JSON.stringify(asset)})`,
       );
       assert.ok(
-        accessProtected
-          ? !directives.includes('immutable') && !directives.includes('public')
-          : !directives.some((directive) =>
-              ['private', 'no-store', 'no-cache'].includes(directive),
-            ),
+        directives.includes('immutable') &&
+          !directives.some((directive) =>
+            ['no-store', 'no-cache', accessProtected ? 'public' : 'private'].includes(directive),
+          ),
         `Cache-Control has no contradictory directives (got: ${asset.cacheControl})`,
       );
     } finally {