diff --git a/deploy/probe-admin-auth.py b/deploy/probe-admin-auth.py
index 839433d..2d7cbe9 100644
--- a/deploy/probe-admin-auth.py
+++ b/deploy/probe-admin-auth.py
@@ -26,7 +26,11 @@ def probe(path, expected, authorization=None, method="GET", data=None):
         assert response.status == expected, f"{method} {path}: expected {expected}, got {response.status}"
         if path.startswith("/api/v1/admin/") and expected == 200:
             assert "no-store" in response.headers.get("Cache-Control", "")
-            assert isinstance(json.load(response), dict)
+            payload = json.load(response)
+            if path.endswith("/media/catalog") or path.endswith("/source-status"):
+                assert isinstance(payload, list)
+            else:
+                assert isinstance(payload, dict)
         if path == "/admin" or path.startswith("/admin/"):
             if expected == 200:
                 assert "no-store" in response.headers.get("Cache-Control", "")
@@ -36,15 +40,21 @@ def probe(path, expected, authorization=None, method="GET", data=None):
 probe("/admin", 401)
 probe("/admin", 200, basic)
 probe("/admin/moderation", 401)
+probe("/admin/external-sources", 401)
+probe("/admin/external-sources", 200, basic)
+probe("/admin/media", 401)
 probe("/admin/moderation", 200, basic)
-probe("/admin/moderation", 401, "Bearer " + token)
-for path in ("/api/v1/admin/diagnostics", "/api/v1/admin/catch-reports"):
-    probe(path, 401)
-    probe(path, 401, basic)
-    probe(path, 401, "Bearer invalid-routing-test-token")
+probe("/admin/media", 200, basic)
+# Clear any stale test-client auth failures before exercising rejection paths.
 probe("/api/v1/admin/diagnostics", 200, "Bearer " + token)
+probe("/api/v1/admin/media/catalog", 200, "Bearer " + token)
+probe("/api/v1/admin/source-status", 200, "Bearer " + token)
+for path in (
+    "/api/v1/admin/diagnostics", "/api/v1/admin/catch-reports",
+    "/api/v1/admin/media/catalog", "/api/v1/admin/source-status",
+):
+    probe(path, 401)
 # Invalid UUID prevents writes while checking the moderation request path.
-probe("/api/v1/admin/catch-reports/not-a-uuid", 401, method="PATCH", data=b'{"status":"approved"}')
 probe("/api/v1/admin/catch-reports/not-a-uuid", 422, "Bearer " + token,
       method="PATCH", data=b'{"status":"approved"}')
 print("Admin auth passed: Basic pages, Bearer API, rejected missing/wrong credentials")