diff --git a/e2e/harness/zooid/docker/config/closed.toml b/e2e/harness/zooid/docker/config/closed.toml
index aafa650e..dfeec87b 100644
--- a/e2e/harness/zooid/docker/config/closed.toml
+++ b/e2e/harness/zooid/docker/config/closed.toml
@@ -16,11 +16,12 @@ secret = "c105ed0000000000000000000000000000000000000000000000000000000006"
 
 [info]
 # Served to the client as nip-11. `name` is what a spec sees as the space's name, so it matches the
-# name scenarios pass to `relay()`. `pubkey` is the owner, and here it is the relay's own key (the
-# pubkey for `secret`) so that [roles.admin] below is the only thing granting a test identity
-# can_manage.
+# name scenarios pass to `relay()`. `pubkey` is the owner, and on current zooid ownership is the
+# grant that lets an identity manage the relay (IsOwner → CanManage), so it is admin's key — the
+# identity seeding signs its room fixtures as. zooid's master build dropped the [roles] config that
+# used to grant this, leaving ownership as the config's only lever.
 name = "closed"
-pubkey = "9b78ed2f0054d1f6ce8307c81e7c4f5aefc78f2396416da05299caac2fb8662e"
+pubkey = "6ada7b6eabb3a8349f88667d278a275c704b553a7c57f9d8156555986884a08e"
 description = "Throwaway relay for Flotilla's end-to-end suite."
 
 [policy]
@@ -42,7 +43,3 @@ enabled = false
 
 [push]
 enabled = false
-
-[roles.admin]
-pubkeys = ["6ada7b6eabb3a8349f88667d278a275c704b553a7c57f9d8156555986884a08e"]
-can_manage = true
diff --git a/e2e/harness/zooid/docker/config/other.toml b/e2e/harness/zooid/docker/config/other.toml
index 68eb1e87..4c83b638 100644
--- a/e2e/harness/zooid/docker/config/other.toml
+++ b/e2e/harness/zooid/docker/config/other.toml
@@ -12,11 +12,12 @@ secret = "07be7000000000000000000000000000000000000000000000000000000000e7"
 
 [info]
 # Served to the client as nip-11. `name` is what a spec sees as the space's name, so it matches the
-# name scenarios pass to `relay()`. `pubkey` is the owner, and here it is the relay's own key (the
-# pubkey for `secret`) so that [roles.admin] below is the only thing granting a test identity
-# can_manage.
+# name scenarios pass to `relay()`. `pubkey` is the owner, and on current zooid ownership is the
+# grant that lets an identity manage the relay (IsOwner → CanManage), so it is admin's key — the
+# identity seeding signs its room fixtures as. zooid's master build dropped the [roles] config that
+# used to grant this, leaving ownership as the config's only lever.
 name = "other"
-pubkey = "d9220af5f36469d17322f41902b6b30dad1869cbb473b35f5e8f8d8e924f36b8"
+pubkey = "6ada7b6eabb3a8349f88667d278a275c704b553a7c57f9d8156555986884a08e"
 description = "Throwaway relay for Flotilla's end-to-end suite."
 
 [policy]
@@ -38,7 +39,3 @@ enabled = false
 
 [push]
 enabled = false
-
-[roles.admin]
-pubkeys = ["6ada7b6eabb3a8349f88667d278a275c704b553a7c57f9d8156555986884a08e"]
-can_manage = true
diff --git a/e2e/harness/zooid/docker/config/space.toml b/e2e/harness/zooid/docker/config/space.toml
index 16f60c99..c02dd40e 100644
--- a/e2e/harness/zooid/docker/config/space.toml
+++ b/e2e/harness/zooid/docker/config/space.toml
@@ -11,11 +11,12 @@ secret = "5e1f000000000000000000000000000000000000000000000000000000000005"
 
 [info]
 # Served to the client as nip-11. `name` is what a spec sees as the space's name, so it matches the
-# name scenarios pass to `relay()`. `pubkey` is the owner, and here it is the relay's own key (the
-# pubkey for `secret`) so that [roles.admin] below is the only thing granting a test identity
-# can_manage.
+# name scenarios pass to `relay()`. `pubkey` is the owner, and on current zooid ownership is the
+# grant that lets an identity manage the relay (IsOwner → CanManage), so it is admin's key — the
+# identity seeding signs its room fixtures as. zooid's master build dropped the [roles] config that
+# used to grant this, leaving ownership as the config's only lever.
 name = "space"
-pubkey = "da00132eaf7ef6bbde47e5dc409fa1d481e518db0621af31591e0306eb48ed8a"
+pubkey = "6ada7b6eabb3a8349f88667d278a275c704b553a7c57f9d8156555986884a08e"
 description = "Throwaway relay for Flotilla's end-to-end suite."
 
 [policy]
@@ -37,7 +38,3 @@ enabled = false
 
 [push]
 enabled = false
-
-[roles.admin]
-pubkeys = ["6ada7b6eabb3a8349f88667d278a275c704b553a7c57f9d8156555986884a08e"]
-can_manage = true
diff --git a/e2e/harness/zooid/docker/config/unsigned.toml b/e2e/harness/zooid/docker/config/unsigned.toml
index 59a42310..dc1443e4 100644
--- a/e2e/harness/zooid/docker/config/unsigned.toml
+++ b/e2e/harness/zooid/docker/config/unsigned.toml
@@ -11,11 +11,12 @@ secret = "5169ed0000000000000000000000000000000000000000000000000000000007"
 
 [info]
 # Served to the client as nip-11. `name` is what a spec sees as the space's name, so it matches the
-# name scenarios pass to `relay()`. `pubkey` is the owner, and here it is the relay's own key (the
-# pubkey for `secret`) so that [roles.admin] below is the only thing granting a test identity
-# can_manage.
+# name scenarios pass to `relay()`. `pubkey` is the owner, and on current zooid ownership is the
+# grant that lets an identity manage the relay (IsOwner → CanManage), so it is admin's key — the
+# identity seeding signs its room fixtures as. zooid's master build dropped the [roles] config that
+# used to grant this, leaving ownership as the config's only lever.
 name = "unsigned"
-pubkey = "a3708596a61d275e9c825c09e616ff075eca5d276053dcb5e720f8863b1d84a9"
+pubkey = "6ada7b6eabb3a8349f88667d278a275c704b553a7c57f9d8156555986884a08e"
 description = "Throwaway relay for Flotilla's end-to-end suite."
 
 [policy]
@@ -37,7 +38,3 @@ enabled = false
 
 [push]
 enabled = false
-
-[roles.admin]
-pubkeys = ["6ada7b6eabb3a8349f88667d278a275c704b553a7c57f9d8156555986884a08e"]
-can_manage = true