diff --git a/internal/server/source_url_internal_test.go b/internal/server/source_url_internal_test.go
index 1411602..ee1a210 100644
--- a/internal/server/source_url_internal_test.go
+++ b/internal/server/source_url_internal_test.go
@@ -592,11 +592,13 @@ func TestImageRoutesRefuseIPv6SourceHostHoldingInternalIPv4Address(t *testing.T)
 // IPv6 source hosts that hold an IPv4 address, through a /v1/image/ URL with a
 // signature and through an encrypted URL, with the fetcher pixad uses.
 // [64:ff9b:1::a00:1], in the local-use NAT64 range (64:ff9b:1::/48, RFC 8215),
-// answers 403. [::203.0.113.5] holds a public IPv4 address in the
-// IPv4-compatible form (::/96). It answers 403 when blocked_networks lists
-// 203.0.113.0/24. When blocked_networks is empty it is not refused: the
-// fetcher tries to connect to it, finds nothing there, and the request fails
-// with another status.
+// answers 403. [::203.0.113.5] and [::ffff:203.0.113.5] hold a public IPv4
+// address in the IPv4-compatible form (::/96) and in the IPv4-mapped form
+// (::ffff:0:0/96). Each answers 403 when blocked_networks lists
+// 203.0.113.0/24, and when it lists the range of its own form. When
+// blocked_networks is empty [::203.0.113.5] is not refused: the fetcher tries
+// to connect to it, finds nothing there, and the request fails with another
+// status.
 func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) {
 	t.Parallel()
 
@@ -610,6 +612,15 @@ func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) {
 		{"IPv4-compatible form of an address in blocked_networks",
 			"[::203.0.113.5]",
 			[]netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")}, true},
+		{"IPv4-compatible form with ::/96 in blocked_networks",
+			"[::203.0.113.5]",
+			[]netip.Prefix{netip.MustParsePrefix("::/96")}, true},
+		{"IPv4-mapped form of an address in blocked_networks",
+			"[::ffff:203.0.113.5]",
+			[]netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")}, true},
+		{"IPv4-mapped form with ::ffff:0:0/96 in blocked_networks",
+			"[::ffff:203.0.113.5]",
+			[]netip.Prefix{netip.MustParsePrefix("::ffff:0:0/96")}, true},
 		{"IPv4-compatible form of an address with blocked_networks empty",
 			"[::203.0.113.5]", nil, false},
 	}