diff --git a/tests/csapi/room_messages_test.go b/tests/csapi/room_messages_test.go
index e5410668..a57e1e1f 100644
--- a/tests/csapi/room_messages_test.go
+++ b/tests/csapi/room_messages_test.go
@@ -59,6 +59,25 @@ func TestSendAndFetchMessage(t *testing.T) {
 	})
 }
 
+// With a non-existent room_id, GET /rooms/:room_id/messages returns 403
+// forbidden.
+func TestFetchMessagesFromNonExistentRoom(t *testing.T) {
+	runtime.SkipIf(t, runtime.Dendrite) // flakey
+	deployment := Deploy(t, b.BlueprintAlice)
+	defer deployment.Destroy(t)
+
+	alice := deployment.Client(t, "hs1", "@alice:hs1")
+	roomID := "!does-not-exist:hs1"
+
+	// then request messages from the room
+	queryParams := url.Values{}
+	queryParams.Set("dir", "b")
+	res := alice.DoFunc(t, "GET", []string{"_matrix", "client", "r0", "rooms", roomID, "messages"}, client.WithQueries(queryParams))
+	must.MatchResponse(t, res, match.HTTPResponse{
+		StatusCode: http.StatusForbidden,
+	})
+}
+
 // sytest: PUT /rooms/:room_id/send/:event_type/:txn_id sends a message
 // sytest: PUT /rooms/:room_id/send/:event_type/:txn_id deduplicates the same txn id
 func TestSendMessageWithTxn(t *testing.T) {