diff --git a/tests/auto/network/access/http2/http2srv.cpp b/tests/auto/network/access/http2/http2srv.cpp
index 91d57a5caac..d7c8c2fd8e2 100644
--- a/tests/auto/network/access/http2/http2srv.cpp
+++ b/tests/auto/network/access/http2/http2srv.cpp
@@ -864,7 +864,6 @@ void Http2Server::sendResponse(quint32 streamID, bool emptyBody)
     } else if (!authenticationHeader.isEmpty() && !hasAuth) {
         header.push_back({ ":status", "401" });
         header.push_back(HPack::HeaderField("www-authenticate", authenticationHeader));
-        authenticationHeader.clear();
     } else {
         header.push_back({":status", "200"});
     }
diff --git a/tests/auto/network/access/http2/tst_http2.cpp b/tests/auto/network/access/http2/tst_http2.cpp
index 971568ea144..f62bfd33fc0 100644
--- a/tests/auto/network/access/http2/tst_http2.cpp
+++ b/tests/auto/network/access/http2/tst_http2.cpp
@@ -1083,7 +1083,8 @@ void tst_Http2::authenticationRequired()
     QFETCH(const bool, success);
 
     ServerPtr targetServer(newServer(defaultServerSettings, defaultConnectionType()));
-    targetServer->setResponseBody("Hello");
+    QByteArray responseBody = "Hello"_ba;
+    targetServer->setResponseBody(responseBody);
     targetServer->setAuthenticationHeader("Basic realm=\"Shadow\"");
 
     QMetaObject::invokeMethod(targetServer.data(), "startServer", Qt::QueuedConnection);
@@ -1120,16 +1121,22 @@ void tst_Http2::authenticationRequired()
                     receivedBody += body;
             });
 
-    if (success)
+    if (success) {
         connect(reply.get(), &QNetworkReply::finished, this, &tst_Http2::replyFinished);
-    else
-        connect(reply.get(), &QNetworkReply::errorOccurred, this, &tst_Http2::replyFinishedWithError);
+    } else {
+        // Use queued connection so that the finished signal can be emitted and the isFinished
+        // property can be set.
+        connect(reply.get(), &QNetworkReply::errorOccurred, this,
+                &tst_Http2::replyFinishedWithError, Qt::QueuedConnection);
+    }
     // Since we're using self-signed certificates,
     // ignore SSL errors:
     reply->ignoreSslErrors();
 
     runEventLoop();
     STOP_ON_FAILURE
+    QVERIFY2(reply->isFinished(),
+             "The reply should error out if authentication fails, or finish if it succeeds");
 
     if (!success)
         QCOMPARE(reply->error(), QNetworkReply::AuthenticationRequiredError);
@@ -1137,7 +1144,7 @@ void tst_Http2::authenticationRequired()
 
     QVERIFY(authenticationRequested);
 
-    const auto isAuthenticated = [](QByteArray bv) {
+    const auto isAuthenticated = [](const QByteArray &bv) {
         return bv == "Basic YWRtaW46YWRtaW4="; // admin:admin
     };
     // Get the "authorization" header out from the server and make sure it's as expected:
@@ -1145,6 +1152,16 @@ void tst_Http2::authenticationRequired()
     QCOMPARE(isAuthenticated(reqAuthHeader), success);
     if (success)
         QCOMPARE(receivedBody, expectedBody);
+    if (responseHEADOnly) {
+        const QVariant contentLenHeader = reply->header(QNetworkRequest::ContentLengthHeader);
+        QVERIFY2(!contentLenHeader.isValid(), "We expect no DATA frames to be received");
+        QCOMPARE(reply->readAll(), QByteArray());
+    } else {
+        const qint32 contentLen = reply->header(QNetworkRequest::ContentLengthHeader).toInt();
+        QCOMPARE(contentLen, responseBody.length());
+        QCOMPARE(reply->bytesAvailable(), responseBody.length());
+        QCOMPARE(reply->readAll(), QByteArray("Hello"));
+    }
     // In the `!success` case we need to wait for the server to emit this or it might cause issues
     // in the next test running after this. In the `success` case we anyway expect it to have been
     // received.