diff --git a/bin/tests/system/nsec3/ns3/named2-fips.conf.in b/bin/tests/system/nsec3/ns3/named2-fips.conf.in
index 6c7499d01f..2c9a2b7e20 100644
--- a/bin/tests/system/nsec3/ns3/named2-fips.conf.in
+++ b/bin/tests/system/nsec3/ns3/named2-fips.conf.in
@@ -147,7 +147,7 @@ zone "nsec3-inline-to-dynamic.kasp" {
 };
 
 /*
- * This zone will have a node deleted.
+ * This zone will have an empty nonterminal node added and a node deleted.
  */
 zone "nsec3-ent.kasp" {
 	type primary;
diff --git a/bin/tests/system/nsec3/tests.sh b/bin/tests/system/nsec3/tests.sh
index 37a9faa849..757d181203 100644
--- a/bin/tests/system/nsec3/tests.sh
+++ b/bin/tests/system/nsec3/tests.sh
@@ -586,19 +586,37 @@ check_nsec3
 
 # Zone: nsec3-ent.kasp (regression test for #5108)
 n=$((n + 1))
-echo_i "check queries for newly empty names do not crash ($n)"
+echo_i "check query for newly empty name does not crash ($n)"
 set_zone_policy "nsec3-ent.kasp"
 set_server "ns3" "10.53.0.3"
 # confirm the pre-existing name still exists
 dig_with_opts +noquestion "@${SERVER}" c.$ZONE >"dig.out.$ZONE.test$n.1" || ret=1
 grep "c\.nsec3-ent\.kasp\..*IN.*A.*10\.0\.0\.3" "dig.out.$ZONE.test$n.1" >/dev/null || ret=1
-# remove a name, bump the SOA, reload, and try the query again
+# remove a name, bump the SOA, and reload
 sed -e 's/1 *; serial/2/' -e '/^c/d' ns3/template.db.in >ns3/nsec3-ent.kasp.db
 rndc_reload ns3 10.53.0.3
+# try the query again
 dig_with_opts +noquestion "@${SERVER}" c.$ZONE >"dig.out.$ZONE.test$n.2" || ret=1
 grep "status: NXDOMAIN" "dig.out.$ZONE.test$n.2" >/dev/null || ret=1
 if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
+n=$((n + 1))
+echo_i "check queries for new names below ENT do not crash ($n)"
+set_zone_policy "nsec3-ent.kasp"
+set_server "ns3" "10.53.0.3"
+# confirm the ENT name does not exist yet
+dig_with_opts +noquestion "@${SERVER}" x.y.z.$ZONE >"dig.out.$ZONE.test$n.1" || ret=1
+grep "status: NXDOMAIN" "dig.out.$ZONE.test$n.1" >/dev/null || ret=1
+# add a name with an ENT, bump the SOA, and reload
+sed -e 's/1 *; serial/3/' ns3/template.db.in >ns3/nsec3-ent.kasp.db
+echo "x.y.z A 10.0.0.4" >>ns3/nsec3-ent.kasp.db
+rndc_reload ns3 10.53.0.3
+# try the query again
+dig_with_opts +noquestion "@${SERVER}" x.y.z.$ZONE >"dig.out.$ZONE.test$n.2" || ret=1
+grep "x\.y\.z\.nsec3-ent\.kasp\..*IN.*A.*10\.0\.0\.4" "dig.out.$ZONE.test$n.2" >/dev/null || ret=1
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1