diff --git a/tests/gateway/test_unauthorized_dm_behavior.py b/tests/gateway/test_unauthorized_dm_behavior.py
index b0d2745cbc..293214411b 100644
--- a/tests/gateway/test_unauthorized_dm_behavior.py
+++ b/tests/gateway/test_unauthorized_dm_behavior.py
@@ -120,16 +120,22 @@ def test_whatsapp_lid_user_matches_phone_allowlist_via_modern_session_mapping(
     assert runner._is_user_authorized(source) is True
 
 
-def test_simplex_allowlist_rejects_display_name_only(monkeypatch):
-    """SIMPLEX_ALLOWED_USERS must NOT match the contact's display name — only
-    the stable numeric contactId. A different contact can set their display
-    name to the same value, so matching user_name would bypass the allowlist
-    (security: display-name collision bypass, #44729)."""
+@pytest.mark.parametrize(
+    "allowlist, expected",
+    [
+        # Display names are attacker-controlled: another contact can take the
+        # same name, so matching user_name would bypass the allowlist (#44729).
+        ("hujikuji", False),
+        # The stable numeric contactId is the one form a contact cannot forge.
+        ("4", True),
+    ],
+)
+def test_simplex_allowlist_matches_contact_id_not_display_name(monkeypatch, allowlist, expected):
+    """SIMPLEX_ALLOWED_USERS matches only the numeric contactId (user_id),
+    never the contact's display name (user_name)."""
     _clear_auth_env(monkeypatch)
-    monkeypatch.delenv("SIMPLEX_ALLOWED_USERS", raising=False)
-    monkeypatch.setenv("SIMPLEX_ALLOWED_USERS", "hujikuji")
+    monkeypatch.setenv("SIMPLEX_ALLOWED_USERS", allowlist)
 
-    # Register the simplex plugin so the env-var lookup resolves.
     from gateway.platform_registry import platform_registry, PlatformEntry
     platform_registry.register(PlatformEntry(
         name="simplex",
@@ -146,9 +152,6 @@ def test_simplex_allowlist_rejects_display_name_only(monkeypatch):
         GatewayConfig(platforms={simplex: PlatformConfig(enabled=True)}),
     )
 
-    # The operator put the display name in the allowlist, but user_id is the
-    # stable contactId which differs. Display names are attacker-controlled,
-    # so this must be rejected.
     source = SessionSource(
         platform=simplex,
         user_id="4",            # adapter sets this to the numeric contactId
@@ -156,40 +159,7 @@ def test_simplex_allowlist_rejects_display_name_only(monkeypatch):
         user_name="hujikuji",   # adapter sets this to displayName
         chat_type="dm",
     )
-    assert runner._is_user_authorized(source) is False
-
-
-def test_simplex_allowlist_accepts_numeric_contact_id(monkeypatch):
-    """SIMPLEX_ALLOWED_USERS continues to match the stable numeric contactId
-    (user_id) — the one identity form a SimpleX contact cannot forge."""
-    _clear_auth_env(monkeypatch)
-    monkeypatch.delenv("SIMPLEX_ALLOWED_USERS", raising=False)
-    monkeypatch.setenv("SIMPLEX_ALLOWED_USERS", "4")
-
-    from gateway.platform_registry import platform_registry, PlatformEntry
-    platform_registry.register(PlatformEntry(
-        name="simplex",
-        label="SimpleX Chat",
-        adapter_factory=lambda cfg: None,
-        check_fn=lambda: True,
-        allowed_users_env="SIMPLEX_ALLOWED_USERS",
-        allow_all_env="SIMPLEX_ALLOW_ALL_USERS",
-    ))
-
-    simplex = Platform("simplex")
-    runner, _adapter = _make_runner(
-        simplex,
-        GatewayConfig(platforms={simplex: PlatformConfig(enabled=True)}),
-    )
-
-    source = SessionSource(
-        platform=simplex,
-        user_id="4",              # numeric contactId in the allowlist
-        chat_id="hujikuji",
-        user_name="whatever",     # display name is irrelevant to the verdict
-        chat_type="dm",
-    )
-    assert runner._is_user_authorized(source) is True
+    assert runner._is_user_authorized(source) is expected
 
 
 def test_telegram_group_users_legacy_chat_ids_still_authorize(monkeypatch):