diff --git a/internal/mcp/tools/graphql_validation_test.go b/internal/mcp/tools/graphql_validation_test.go
index 4571fb43..f7fa33bc 100644
--- a/internal/mcp/tools/graphql_validation_test.go
+++ b/internal/mcp/tools/graphql_validation_test.go
@@ -60,6 +60,12 @@ func TestValidateQueryDocument(t *testing.T) {
 			`,
 			wantErr: "field 'secrets' returns type 'SecretConnection'",
 		},
+		{
+			// https://github.com/nais/cli/issues/803
+			name:    "deployment key accessed through named fragment is refused",
+			query:   `query { team(slug: "a") { ...TeamFields } } fragment TeamFields on Team { deploymentKey { key } }`,
+			wantErr: "field 'deploymentKey' returns type 'DeploymentKey'",
+		},
 		{
 			name:    "fragment on forbidden type is refused",
 			query:   `query { team(slug: "a") { secrets(first: 1) { nodes { ...S } } } } fragment S on Secret { name }`,