diff --git a/tests/e2e/scenarios/appsec/acquis.yaml b/tests/e2e/scenarios/appsec/acquis.yaml
index cfc4d36..97d9bc5 100644
--- a/tests/e2e/scenarios/appsec/acquis.yaml
+++ b/tests/e2e/scenarios/appsec/acquis.yaml
@@ -1,5 +1,5 @@
 listen_addr: 0.0.0.0:7422
-appsec_config: crowdsecurity/virtual-patching
+appsec_config: crowdsecurity/crs-inband
 name: e2eAppSec
 source: appsec
 labels:
diff --git a/tests/e2e/scenarios/appsec/docker-compose.yml b/tests/e2e/scenarios/appsec/docker-compose.yml
index 5cc0667..b3d2a87 100644
--- a/tests/e2e/scenarios/appsec/docker-compose.yml
+++ b/tests/e2e/scenarios/appsec/docker-compose.yml
@@ -41,7 +41,7 @@ services:
     image: crowdsecurity/crowdsec:v1.7.8
     container_name: crowdsec
     environment:
-      COLLECTIONS: "crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules"
+      COLLECTIONS: "crowdsecurity/appsec-crs-inband"
       BOUNCER_KEY_TRAEFIK: 40796d93c2958f9e58345514e67740e5
       CUSTOM_HOSTNAME: crowdsec
       CROWDSEC_BYPASS_DB_VOLUME_CHECK: "true"
diff --git a/tests/e2e/scenarios/appsec/run.sh b/tests/e2e/scenarios/appsec/run.sh
index ab0172e..c0c6b80 100755
--- a/tests/e2e/scenarios/appsec/run.sh
+++ b/tests/e2e/scenarios/appsec/run.sh
@@ -33,8 +33,8 @@ wait_for_status http://localhost:8000/foo 200 30
 echo "[$SCENARIO] benign request must pass"
 assert_status http://localhost:8000/foo 200
 
-echo "[$SCENARIO] SQL-injection-like query string must be blocked by AppSec virtual patching"
-# CRS-style SQLi probe — caught by crowdsecurity/appsec-generic-rules.
-assert_status "http://localhost:8000/foo?id=1%27%20UNION%20SELECT%201%2C2%2C3--" 403
+echo "[$SCENARIO] SQL-injection-like query string must be blocked by OWASP CRS (inband)"
+# Classic SQLi probe: ?id=1' OR '1'='1 — caught by CRS rule 942100/942130 (paranoia 1).
+assert_status "http://localhost:8000/foo?id=1%27%20OR%20%271%27%3D%271" 403
 
 echo "[$SCENARIO] OK"