diff --git a/internal/handlers/image_errors_internal_test.go b/internal/handlers/image_errors_internal_test.go
index 27f1d4f..eac170f 100644
--- a/internal/handlers/image_errors_internal_test.go
+++ b/internal/handlers/image_errors_internal_test.go
@@ -265,12 +265,14 @@ func TestHandleImage_AllowlistOrSignature(t *testing.T) {
 	}
 }
 
-// TestHandleImage_InvalidHost_Returns400 sends image URLs whose host is
-// allowlistedHost with a character after it that a URL host cannot hold,
-// percent-encoded, and checks that each is refused with 400 naming the host
-// as decoded. A "?" or "#" there would otherwise end the host when the source
-// URL is read, so the request would pass the allowlist and be fetched and
-// cached under a host that is not the one fetched.
+// TestHandleImage_InvalidHost_Returns400 sends image URLs whose host no URL
+// host can be, and checks that each is refused with 400 naming the host as
+// decoded: allowlistedHost with a character after it that a URL host cannot
+// hold, percent-encoded, an IPv6 address without brackets, and brackets
+// around something that is not an IPv6 address. A "?" or "#" after
+// allowlistedHost would otherwise end the host when the source URL is read,
+// so the request would pass the allowlist and be fetched and cached under a
+// host that is not the one fetched.
 func TestHandleImage_InvalidHost_Returns400(t *testing.T) {
 	t.Parallel()
 
@@ -287,6 +289,8 @@ func TestHandleImage_InvalidHost_Returns400(t *testing.T) {
 		{`\ written as %5C`, allowlistedHost + "%5Cx", allowlistedHost + `\x`},
 		{"space written as %20", allowlistedHost + "%20", allowlistedHost + " "},
 		{"IPv6 address without brackets", "2001:db8::1", "2001:db8::1"},
+		{"IPv4 address in brackets", "[203.0.113.5]", "[203.0.113.5]"},
+		{"no address in brackets", "[abc]", "[abc]"},
 	}
 
 	for _, tt := range tests {