diff --git a/package.json b/package.json
index d9309ef7..4eac9a60 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "kang": "1.1.0",
     "keyapi": "git+https://github.com/joyent/keyapi.git#e14b3d582e1d9d338b7082d61f34ba8d1bbc540a",
     "krill": "1.0.1",
-    "mahi": "2.3.0",
+    "mahi": "2.3.3",
     "mime": "^1.4.1",
     "mooremachine": "^2.2.0",
     "nodemailer": "0.7.1",
diff --git a/test/users.test.js b/test/users.test.js
index 6dee3499..80485a2e 100644
--- a/test/users.test.js
+++ b/test/users.test.js
@@ -1233,6 +1233,11 @@ test('create role v9', function (t) {
                 login: SUB_LOGIN_2,
                 default: false
             },
+            {
+                type: 'subuser',
+                id: SUB_USER.id,
+                default: false
+            },
             {
                 type: 'account',
                 login: OTHER.login,
@@ -1272,7 +1277,7 @@ test('get role (by UUID)', function (t) {
         common.checkHeaders(t, res.headers);
         t.ok(body);
         t.equal(body.id, ROLE_UUID);
-        t.deepEqual(body.members, [SUB_LOGIN_2]);
+        t.deepEqual(body.members.sort(), [SUB_LOGIN_2, SUB_LOGIN].sort());
         t.deepEqual(body.default_members, []);
         t.deepEqual(body.policies, [POLICY_NAME]);
         t.end();
@@ -1295,19 +1300,32 @@ test('get role v9 (by UUID)', function (t) {
         t.ok(Array.isArray(body.members), 'members is an array');
         t.strictEqual(typeof (body.members[0]), 'object',
             'members[0] is object');
-        t.strictEqual(body.members.length, 2, '2 members present');
-        body.members.forEach(function (member) {
-            if (member.type === 'subuser') {
-                t.strictEqual(member.login, SUB_LOGIN_2);
-            } else if (member.type === 'account') {
-                t.strictEqual(member.login, OTHER.login);
-            }
-        });
+        t.strictEqual(body.members.length, 3, '3 members present');
         t.ok(Array.isArray(body.policies), 'policies is an array');
         t.strictEqual(typeof (body.policies[0]), 'object',
             'policies[0] is object');
         t.strictEqual(body.policies[0].id, POLICY_UUID, 'policy uuid');
         t.strictEqual(body.policies[0].name, POLICY_NAME, 'policy name');
+
+        function memberSorter(a, b) {
+            return a.login < b.login;
+        }
+
+        var members = body.members.map(function (m) {
+            return { login: m.login, type: m.type };
+        });
+        var expectedMem = [{
+            login: SUB_LOGIN,
+            type: 'subuser'
+        }, {
+            login: SUB_LOGIN_2,
+            type: 'subuser'
+        }, {
+            login: OTHER.login,
+            type: 'account'
+        }];
+
+        t.deepEqual(members.sort(memberSorter), expectedMem.sort(memberSorter));
         t.end();
     });
 });