diff --git a/acceptance/bundle/deploy/readplan/grants-remove-principal/out.plan.grants.json b/acceptance/bundle/deploy/readplan/grants-remove-principal/out.plan.grants.json
index 79ead177c6a..0b90f0b19e6 100644
--- a/acceptance/bundle/deploy/readplan/grants-remove-principal/out.plan.grants.json
+++ b/acceptance/bundle/deploy/readplan/grants-remove-principal/out.plan.grants.json
@@ -25,15 +25,15 @@
     "full_name": "main.myschema",
     "__embed__": [
       {
-        "principal": "[USERNAME]",
+        "principal": "extra@example.test",
         "privileges": [
-          "USE_SCHEMA"
+          "CREATE_TABLE"
         ]
       },
       {
-        "principal": "extra@example.test",
+        "principal": "[USERNAME]",
         "privileges": [
-          "CREATE_TABLE"
+          "USE_SCHEMA"
         ]
       }
     ]
diff --git a/acceptance/bundle/deploy/readplan/grants-remove-principal/script b/acceptance/bundle/deploy/readplan/grants-remove-principal/script
index df94954d5a9..a0625c5653d 100644
--- a/acceptance/bundle/deploy/readplan/grants-remove-principal/script
+++ b/acceptance/bundle/deploy/readplan/grants-remove-principal/script
@@ -12,8 +12,10 @@ trace print_requests.py //unity-catalog/permissions --sort
 grep -v 'TO_REMOVE' databricks.yml > updated.yml && mv updated.yml databricks.yml
 
 # Generate update plan: entry.RemoteState captures both principals as GrantsState.
+# remote_state.__embed__ principal order is non-deterministic (the backend, and the
+# testserver mirroring it, iterate a map), so sort it by principal for a stable golden.
 trace $CLI bundle plan -o json > tmp.plan.json
-jq '.plan["resources.schemas.myschema.grants"]' tmp.plan.json > out.plan.grants.json
+jq '.plan["resources.schemas.myschema.grants"] | .remote_state.__embed__ |= sort_by(.principal)' tmp.plan.json > out.plan.grants.json
 trace print_requests.py --get //unity-catalog/permissions --sort
 
 # Deploy from serialized plan (READPLAN=1) or without (READPLAN="").