diff --git a/test/integration/category_test.go b/test/integration/category_test.go
index afe75b4e..d9f1db6f 100644
--- a/test/integration/category_test.go
+++ b/test/integration/category_test.go
@@ -1,4 +1,4 @@
-// Copyright 2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package integration
@@ -32,17 +32,18 @@ func runTestKubectlCommand(t *testing.T, args ...string) (string, string) {
 func requireCleanKubectlStderr(t *testing.T, stderr string) {
 	// Every line must be empty or contain a known, innocuous warning.
 	for _, line := range strings.Split(stderr, "\n") {
-		if strings.TrimSpace(line) == "" {
-			continue
+		switch {
+		case strings.TrimSpace(line) == "",
+			strings.Contains(line, "Throttling request took"),
+			strings.Contains(line, "due to client-side throttling, not priority and fairness"),
+			strings.Contains(line, "the gcp auth plugin is deprecated in v1.22+, unavailable in v1.25+; use gcloud instead"),
+			strings.Contains(line, "To learn more, consult https://cloud.google.com/blog/products/containers-kubernetes/kubectl-auth-changes-in-gke"):
+			// ignore these allowed stderr lines
+		default:
+			// anything else is a failure
+			require.Failf(t, "unexpected kubectl stderr", "kubectl produced unexpected stderr:\n%s\n\n", stderr)
+			return
 		}
-		if strings.Contains(line, "Throttling request took") {
-			continue
-		}
-		if strings.Contains(line, "due to client-side throttling, not priority and fairness") {
-			continue
-		}
-		require.Failf(t, "unexpected kubectl stderr", "kubectl produced unexpected stderr:\n%s\n\n", stderr)
-		return
 	}
 }