diff --git a/jetty-ee10/jetty-ee10-servlet/src/test/java/org/eclipse/jetty/ee10/servlet/DeferredAuthenticationTest.java b/jetty-ee10/jetty-ee10-servlet/src/test/java/org/eclipse/jetty/ee10/servlet/DeferredAuthenticationTest.java
index bce343df8375..0bbbd75ed82f 100644
--- a/jetty-ee10/jetty-ee10-servlet/src/test/java/org/eclipse/jetty/ee10/servlet/DeferredAuthenticationTest.java
+++ b/jetty-ee10/jetty-ee10-servlet/src/test/java/org/eclipse/jetty/ee10/servlet/DeferredAuthenticationTest.java
@@ -14,6 +14,7 @@
 package org.eclipse.jetty.ee10.servlet;
 
 import java.security.Principal;
+import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.concurrent.atomic.AtomicReference;
 
@@ -40,6 +41,7 @@
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
+import static org.awaitility.Awaitility.await;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.containsString;
 import static org.hamcrest.Matchers.equalTo;
@@ -96,6 +98,7 @@ public void testWriteOnDeferredAuthentication() throws Exception
         AtomicReference<Boolean> authenticatedRef = new AtomicReference<>();
         AtomicReference<Principal> userPrincipalRef = new AtomicReference<>();
         AtomicReference<Throwable> servletErrorRef = new AtomicReference<>();
+        AtomicInteger serviceCount = new AtomicInteger();
         startServer(new LoginAuthenticator()
         {
             @Override
@@ -145,12 +148,17 @@ protected void service(HttpServletRequest req, HttpServletResponse resp)
                 {
                     servletErrorRef.set(t);
                 }
+                finally
+                {
+                    serviceCount.incrementAndGet();
+                }
             }
         });
 
         // Authenticator is invoked twice, first time for deferred auth on getUserPrincipal() which tries to write and fails,
         // the second time for authenticate() which returns false and sends a 401 response.
         String response = _connector.getResponse("GET /public/foo HTTP/1.0\r\n\r\n");
+        await().atMost(5, TimeUnit.SECONDS).until(() -> serviceCount.get() == 1);
         assertThat(response, containsString("401 Unauthorized"));
         assertThat(response, containsString("this is a challenge"));
         assertThat(authenticatorCount.get(), equalTo(2));
@@ -161,6 +169,7 @@ protected void service(HttpServletRequest req, HttpServletResponse resp)
         // Authenticator is invoked twice, first time for deferred auth on getUserPrincipal() which tries to write and fails,
         // the second time for authenticate() which returns true and sends a 200 response.
         response = _connector.getResponse("GET /public/foo?authenticate HTTP/1.0\r\n\r\n");
+        await().atMost(5, TimeUnit.SECONDS).until(() -> serviceCount.get() == 2);
         assertThat(response, containsString("200 OK"));
         assertThat(response, containsString("success"));
         assertThat(authenticatorCount.get(), equalTo(4));