diff --git a/tests/policy_build.go b/tests/policy_build.go
index cbf9c8ac8..3c1fabf35 100644
--- a/tests/policy_build.go
+++ b/tests/policy_build.go
@@ -44,27 +44,37 @@ var policyBuildTests = []func(t *testing.T, sb integration.Sandbox){
 	testBuildPolicyCapsProxyUnsupported,
 }
 
-var policyCapsProxyFile = []byte(`
+func policyCapsProxyFile(serverURL string) []byte {
+	return fmt.Appendf(nil, `
 package docker
 default allow = true
+default deny_msg := []
 default caps := {}
 caps := {"exec.proxy": true} if input.env.capsRequest
-decision := {"allow": allow, "caps": caps}
-`)
+allow := false if input.http.url == "%s/file"
+deny_msg := ["exec proxy http source denied by policy"] if input.http.url == "%s/file"
+decision := {"allow": allow, "deny_msg": deny_msg, "caps": caps}
+`, serverURL, serverURL)
+}
 
 func testBuildPolicyCapsProxy(t *testing.T, sb integration.Sandbox) {
 	if buildkitTag() != "master" {
 		skipNoCompatBuildKit(t, sb, ">= 0.31.0-0", "network proxy requires BuildKit v0.31.0+")
 	}
+	resp := &httpserver.Response{Content: []byte("policy-caps-proxy")}
+	server := httpserver.NewTestServer(map[string]*httpserver.Response{
+		"/file": resp,
+	})
+	defer server.Close()
+
 	dockerfile := []byte(`
-FROM scratch
-COPY foo /foo
+FROM busybox:latest
+RUN wget -O- ` + server.URL + `/file
 `)
 	dir := tmpdir(
 		t,
 		fstest.CreateFile("Dockerfile", dockerfile, 0600),
-		fstest.CreateFile("Dockerfile.rego", policyCapsProxyFile, 0600),
-		fstest.CreateFile("foo", []byte("foo"), 0600),
+		fstest.CreateFile("Dockerfile.rego", policyCapsProxyFile(server.URL), 0600),
 	)
 
 	cmd := buildxCmd(sb, withDir(dir), withArgs(
@@ -74,8 +84,11 @@ COPY foo /foo
 		dir,
 	))
 	out, err := cmd.CombinedOutput()
-	require.NoError(t, err, string(out))
+	require.Error(t, err, string(out))
 	require.Contains(t, string(out), "policy enabled network proxy")
+	require.Contains(t, string(out), "exec proxy http source denied by policy")
+	require.Contains(t, string(out), "policy decision for source "+server.URL+"/file")
+	require.Contains(t, string(out), "DENY")
 }
 
 func testBuildPolicyCapsProxyUnsupported(t *testing.T, sb integration.Sandbox) {
@@ -90,7 +103,7 @@ COPY foo /foo
 	dir := tmpdir(
 		t,
 		fstest.CreateFile("Dockerfile", dockerfile, 0600),
-		fstest.CreateFile("Dockerfile.rego", policyCapsProxyFile, 0600),
+		fstest.CreateFile("Dockerfile.rego", policyCapsProxyFile(""), 0600),
 		fstest.CreateFile("foo", []byte("foo"), 0600),
 	)