diff --git a/packages/checks/garage.nix b/packages/checks/garage.nix
index 2433b55..6e11ef9 100644
--- a/packages/checks/garage.nix
+++ b/packages/checks/garage.nix
@@ -50,6 +50,19 @@ testers.runNixOSTest {
                 garage2 = { zone = "dc1"; capacity = 1000; };
                 garage3 = { zone = "dc1"; capacity = 1000; };
               };
+              keys.testKey.allow.createBucket = true;
+              buckets = {
+                bucket1 = {
+                  allow.testKey = [ "read" "write" ];
+                  quotas = {
+                    maxObjects = 300;
+                    maxSize = 400 * 1024 * 1024;
+                  };
+                };
+                bucket2 = {
+                  allow.testKey = [ "read" ];
+                };
+              };
             };
             system.ascensions.garage-layout.incantations = lib.mkForce (i: [
               (i.runGarage ''
@@ -80,9 +93,6 @@ testers.runNixOSTest {
           node.wait_until_fails("garage status | grep 'NO ROLE ASSIGNED'")
 
     with subtest("should apply new layout with ascension"):
-      for node in nodes:
-          node.systemctl("stop garage.service")
-
       for node in nodes:
           node.succeed("/run/current-system/specialisation/modifiedLayout/bin/switch-to-configuration test")
 
@@ -109,5 +119,20 @@ testers.runNixOSTest {
           node.wait_until_succeeds("garage layout show | grep -w 2000")
           assert "1" in node.succeed("garage layout show | grep -w 2000 | wc -l")
           assert "2" in node.succeed("garage layout show | grep -w 1000 | wc -l")
+
+    with subtest("should create specified buckets and keys"):
+      for node in nodes:
+          node.wait_until_succeeds('test "$(systemctl is-active garage-apply)" != activating')
+      garage1.succeed("garage key list | grep testKey")
+      garage1.succeed("garage bucket list | grep bucket1")
+      garage1.succeed("garage bucket list | grep bucket2")
+
+    with subtest("should delete unspecified buckets and keys"):
+      garage1.succeed("garage bucket create unwantedbucket")
+      garage1.succeed("garage key new --name unwantedkey")
+      garage1.succeed("systemctl restart garage-apply.service")
+
+      garage1.fail("garage key list | grep unwantedkey")
+      garage1.fail("garage bucket list | grep unwantedbucket")
   '';
 }