diff --git a/kubernetes/e2e-test.sh b/kubernetes/e2e-test.sh
index 052fc22f..97240042 100755
--- a/kubernetes/e2e-test.sh
+++ b/kubernetes/e2e-test.sh
@@ -327,14 +327,6 @@ for pair in authentik/ak-pg-daily paperless/pprl-pg-daily; do
           -o jsonpath='{range .items[?(@.status.phase==\"completed\")]}x{end}' | wc -c)\" -ge 1"
 done
 
-echo "=== ObjectBucketClaims ==="
-check "authentik migration-bucket Bound" \
-    bash -c 'kubectl -n authentik get obc migration-bucket -o jsonpath="{.status.phase}" | grep -q Bound'
-check "paperless migration-bucket Bound" \
-    bash -c 'kubectl -n paperless get obc migration-bucket -o jsonpath="{.status.phase}" | grep -q Bound'
-check "audiobookshelf migration-bucket Bound" \
-    bash -c 'kubectl -n audiobookshelf get obc migration-bucket -o jsonpath="{.status.phase}" | grep -q Bound'
-
 echo "=== Databases (CloudNativePG) ==="
 check "ak-pg:   2 ready instances" \
     bash -c 'test "$(kubectl -n authentik get cluster ak-pg   -o jsonpath={.status.readyInstances})" = 2'
@@ -349,7 +341,7 @@ for ci in letsencrypt-prod letsencrypt-staging letsencrypt-cluster; do
 done
 
 echo "=== TLS certificate validation (ingress LB) ==="
-for h in status.renner.uno auth.renner.uno auth.k.renner.uno \
+for h in status.renner.uno auth.renner.uno \
          dash.k.renner.uno audiobooks.k.renner.uno; do
     check "TLS valid for $h" tls_valid "$h"
 done
@@ -410,8 +402,8 @@ spec:
   containers:
     - name: c
       image: curlimages/curl:8.10.1
-      # 1800s = 30m. Long enough to outlive the rest of e2e even if RGW Job
-      # waits hit their own timeouts.
+      # 1800s = 30m. Long enough to outlive the rest of e2e even if the
+      # downstream checks hit their own timeouts.
       command: ["sleep", "1800"]
       securityContext:
         allowPrivilegeEscalation: false
@@ -495,86 +487,10 @@ oidc_check() {
     echo "$body" | grep -qE "\"issuer\".*auth\\.renner\\.uno" && \
     echo "$body" | grep -q "\"authorization_endpoint\""
 }
-for slug in paperless audiobookshelf grafana; do
+for slug in audiobookshelf grafana; do
     check "authentik OIDC well-known: $slug" oidc_check "$slug"
 done
 
-echo "=== Ceph RGW S3 round-trip ==="
-# Run as a Job in paperless ns so the migration-bucket Secret + ConfigMap
-# are mounted natively (no key copying). Job PUTs a unique object, GETs it,
-# byte-compares, and DELETEs it. Job phase=Succeeded => all three steps OK.
-S3_NS=paperless
-S3_JOB="e2e-rgw-$(date -u +%s)"
-kubectl -n $S3_NS delete job -l e2e=rgw --ignore-not-found --wait=false >/dev/null 2>&1 || true
-cat <<EOF | kubectl apply -f - >/dev/null
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: $S3_JOB
-  namespace: $S3_NS
-  labels: { e2e: rgw }
-spec:
-  ttlSecondsAfterFinished: 60
-  backoffLimit: 0
-  template:
-    metadata:
-      labels: { e2e: rgw }
-    spec:
-      restartPolicy: Never
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        fsGroup: 65532
-        seccompProfile: { type: RuntimeDefault }
-      containers:
-        - name: client
-          image: amazon/aws-cli:2.27.0
-          envFrom:
-            - secretRef: { name: migration-bucket }
-            - configMapRef: { name: migration-bucket }
-          env:
-            - name: HOME
-              value: /tmp
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities: { drop: ["ALL"] }
-          volumeMounts:
-            - { name: tmp, mountPath: /tmp }
-          command:
-            - sh
-            - -c
-            - |
-              set -eu
-              KEY="e2e-\$(date -u +%s)-\$\$"
-              echo "hello-from-e2e-\$KEY" > /tmp/in
-              ENDPOINT="http://\${BUCKET_HOST}:\${BUCKET_PORT}"
-              aws --endpoint-url "\$ENDPOINT" s3 cp /tmp/in "s3://\${BUCKET_NAME}/\${KEY}" >&2
-              aws --endpoint-url "\$ENDPOINT" s3 cp "s3://\${BUCKET_NAME}/\${KEY}" /tmp/out >&2
-              cmp /tmp/in /tmp/out
-              aws --endpoint-url "\$ENDPOINT" s3 rm "s3://\${BUCKET_NAME}/\${KEY}" >&2
-              echo "OK"
-      volumes:
-        - { name: tmp, emptyDir: {} }
-EOF
-
-check "rgw: PUT/GET/DELETE round-trip via OBC creds" bash -c "
-    for _ in \$(seq 1 60); do
-        s=\$(kubectl -n $S3_NS get job $S3_JOB -o jsonpath='{.status.succeeded}' 2>/dev/null)
-        f=\$(kubectl -n $S3_NS get job $S3_JOB -o jsonpath='{.status.failed}'    2>/dev/null)
-        [ \"\$s\" = '1' ] && exit 0
-        [ \"\$f\" = '1' ] && {
-            kubectl -n $S3_NS logs -l e2e=rgw --tail=80 || true
-            exit 1
-        }
-        sleep 5
-    done
-    kubectl -n $S3_NS describe job $S3_JOB || true
-    kubectl -n $S3_NS logs -l e2e=rgw --tail=80 || true
-    exit 1
-"
-kubectl -n $S3_NS delete job $S3_JOB --ignore-not-found --wait=false >/dev/null 2>&1 || true
-
 # Tear down the helper pod regardless of pass/fail so reruns are clean.
 kubectl -n default delete pod e2e-helper --ignore-not-found --wait=false >/dev/null 2>&1 || true