diff --git a/tests/orchestration/test_tenant_data_sync_orchestrator.py b/tests/orchestration/test_tenant_data_sync_orchestrator.py
index 946e34cdb..82aeac847 100644
--- a/tests/orchestration/test_tenant_data_sync_orchestrator.py
+++ b/tests/orchestration/test_tenant_data_sync_orchestrator.py
@@ -253,6 +253,58 @@ def test_run_fills_secondary_phone_number_with_the_best_leftover_number(
     )
 
 
+# --- vulnerabilities: recorded on the tenant's own contact ---
+
+
+def test_run_records_vulnerabilities_on_the_tenants_own_contact(
+    orchestrator: TenantDataSyncOrchestrator,
+    mock_session: MagicMock,
+    sdk_client: MagicMock,
+) -> None:
+    # Arrange
+    mock_session.post.return_value.content = _tenancy_response(
+        '<Tenant forenames="Harper" main-contact="no" person_title="Mrs"'
+        ' surname="Solecka">4007216'
+        "<Vulnerability>Blindness</Vulnerability>"
+        "<Vulnerability>Hard of hearing</Vulnerability>"
+        "<Vulnerability>BLINDNESS</Vulnerability>"  # within-tenant duplicate
+        "</Tenant>"
+        '<Tenant forenames="Naoimh" main-contact="yes" person_title="Miss"'
+        ' surname="Malyar">4007215</Tenant>'
+    )
+    sdk_client.crm.contacts.basic_api.create.side_effect = [
+        MagicMock(id="60123"),
+        MagicMock(id="60124"),
+    ]
+
+    # Act
+    result = orchestrator.run(PLACE_REF, deal_id=DEAL_ID)
+
+    # Assert
+    assert result == TenantDataSyncSummary(
+        tenancy_reference="10042020051017",
+        contact_ids=("60123", "60124"),
+        vulnerable_contact_count=1,
+    )
+    created_properties = [
+        call.kwargs["simple_public_object_input_for_create"].properties
+        for call in sdk_client.crm.contacts.basic_api.create.call_args_list
+    ]
+    assert created_properties == [
+        {
+            "firstname": "Harper",
+            "lastname": "Solecka",
+            "is_vulnerable": "true",
+            "vulnerability_description": "Blindness\nHard of hearing",
+        },
+        {
+            "firstname": "Naoimh",
+            "lastname": "Malyar",
+            "is_vulnerable": "false",
+        },
+    ]
+
+
 def test_run_still_creates_a_contact_for_an_all_blank_signatory(
     orchestrator: TenantDataSyncOrchestrator,
     mock_session: MagicMock,