diff --git a/spec/controllers/activitypub/collections_controller_spec.rb b/spec/controllers/activitypub/collections_controller_spec.rb
index a5718fbd7d3..4d0b28aae0f 100644
--- a/spec/controllers/activitypub/collections_controller_spec.rb
+++ b/spec/controllers/activitypub/collections_controller_spec.rb
@@ -89,9 +89,10 @@ RSpec.describe ActivityPub::CollectionsController do
             end
 
             it 'returns http success and correct media type and cache headers and empty items' do
-              expect(response).to have_http_status(200)
+              expect(response)
+                .to have_http_status(200)
+                .and have_http_header('Cache-Control', 'private')
               expect(response.media_type).to eq 'application/activity+json'
-              expect(response.headers['Cache-Control']).to include 'private'
 
               expect(body_as_json[:orderedItems])
                 .to be_an(Array)
@@ -105,9 +106,10 @@ RSpec.describe ActivityPub::CollectionsController do
             end
 
             it 'returns http success and correct media type and cache headers and empty items' do
-              expect(response).to have_http_status(200)
+              expect(response)
+                .to have_http_status(200)
+                .and have_http_header('Cache-Control', 'private')
               expect(response.media_type).to eq 'application/activity+json'
-              expect(response.headers['Cache-Control']).to include 'private'
 
               expect(body_as_json[:orderedItems])
                 .to be_an(Array)
diff --git a/spec/controllers/activitypub/followers_synchronizations_controller_spec.rb b/spec/controllers/activitypub/followers_synchronizations_controller_spec.rb
index c030078d43a..3ba50c40900 100644
--- a/spec/controllers/activitypub/followers_synchronizations_controller_spec.rb
+++ b/spec/controllers/activitypub/followers_synchronizations_controller_spec.rb
@@ -38,8 +38,9 @@ RSpec.describe ActivityPub::FollowersSynchronizationsController do
       let(:remote_account) { Fabricate(:account, domain: 'example.com', uri: 'https://example.com/instance') }
 
       it 'returns http success and cache control and activity json types and correct items' do
-        expect(response).to have_http_status(200)
-        expect(response.headers['Cache-Control']).to eq 'max-age=0, private'
+        expect(response)
+          .to have_http_status(200)
+          .and have_http_header('Cache-Control', 'max-age=0, private')
         expect(response.media_type).to eq 'application/activity+json'
 
         expect(body[:orderedItems])
diff --git a/spec/controllers/activitypub/outboxes_controller_spec.rb b/spec/controllers/activitypub/outboxes_controller_spec.rb
index 3c8e8e399f6..b6e68038dad 100644
--- a/spec/controllers/activitypub/outboxes_controller_spec.rb
+++ b/spec/controllers/activitypub/outboxes_controller_spec.rb
@@ -62,7 +62,10 @@ RSpec.describe ActivityPub::OutboxesController do
         it_behaves_like 'cacheable response'
 
         it 'returns http success and correct media type and vary header and items' do
-          expect(response).to have_http_status(200)
+          expect(response)
+            .to have_http_status(200)
+            .and have_http_header('Vary', 'Signature')
+
           expect(response.media_type).to eq 'application/activity+json'
           expect(response.headers['Vary']).to include 'Signature'
 
@@ -104,10 +107,11 @@ RSpec.describe ActivityPub::OutboxesController do
         end
 
         it 'returns http success and correct media type and headers and items' do
-          expect(response).to have_http_status(200)
-          expect(response.media_type).to eq 'application/activity+json'
-          expect(response.headers['Cache-Control']).to eq 'max-age=60, private'
+          expect(response)
+            .to have_http_status(200)
+            .and have_http_header('Cache-Control', 'max-age=60, private')
 
+          expect(response.media_type).to eq 'application/activity+json'
           expect(body_as_json[:orderedItems]).to be_an Array
           expect(body_as_json[:orderedItems].size).to eq 2
           expect(body_as_json[:orderedItems].all? { |item| targets_public_collection?(item) }).to be true
@@ -121,9 +125,10 @@ RSpec.describe ActivityPub::OutboxesController do
         end
 
         it 'returns http success and correct media type and headers and items' do
-          expect(response).to have_http_status(200)
+          expect(response)
+            .to have_http_status(200)
+            .and have_http_header('Cache-Control', 'max-age=60, private')
           expect(response.media_type).to eq 'application/activity+json'
-          expect(response.headers['Cache-Control']).to eq 'max-age=60, private'
 
           expect(body_as_json[:orderedItems]).to be_an Array
           expect(body_as_json[:orderedItems].size).to eq 3
@@ -138,10 +143,10 @@ RSpec.describe ActivityPub::OutboxesController do
         end
 
         it 'returns http success and correct media type and headers and items' do
-          expect(response).to have_http_status(200)
+          expect(response)
+            .to have_http_status(200)
+            .and have_http_header('Cache-Control', 'max-age=60, private')
           expect(response.media_type).to eq 'application/activity+json'
-          expect(response.headers['Cache-Control']).to eq 'max-age=60, private'
-
           expect(body_as_json[:orderedItems])
             .to be_an(Array)
             .and be_empty
@@ -155,10 +160,10 @@ RSpec.describe ActivityPub::OutboxesController do
         end
 
         it 'returns http success and correct media type and headers and items' do
-          expect(response).to have_http_status(200)
+          expect(response)
+            .to have_http_status(200)
+            .and have_http_header('Cache-Control', 'max-age=60, private')
           expect(response.media_type).to eq 'application/activity+json'
-          expect(response.headers['Cache-Control']).to eq 'max-age=60, private'
-
           expect(body_as_json[:orderedItems])
             .to be_an(Array)
             .and be_empty
diff --git a/spec/controllers/admin/base_controller_spec.rb b/spec/controllers/admin/base_controller_spec.rb
index 1f1fa8441af..0a368e7f6bd 100644
--- a/spec/controllers/admin/base_controller_spec.rb
+++ b/spec/controllers/admin/base_controller_spec.rb
@@ -23,7 +23,7 @@ describe Admin::BaseController do
     sign_in(Fabricate(:user, role: UserRole.find_by(name: 'Moderator')))
     get :success
 
-    expect(response.headers['Cache-Control']).to include('private, no-store')
+    expect(response).to have_http_header('Cache-Control', 'private, no-store')
   end
 
   it 'renders admin layout as a moderator' do
diff --git a/spec/controllers/api/base_controller_spec.rb b/spec/controllers/api/base_controller_spec.rb
index 659d55f8012..299c969e6dc 100644
--- a/spec/controllers/api/base_controller_spec.rb
+++ b/spec/controllers/api/base_controller_spec.rb
@@ -16,7 +16,7 @@ describe Api::BaseController do
   it 'returns private cache control headers by default' do
     routes.draw { get 'success' => 'api/base#success' }
     get :success
-    expect(response.headers['Cache-Control']).to include('private, no-store')
+    expect(response).to have_http_header('Cache-Control', 'private, no-store')
   end
 
   describe 'forgery protection' do
diff --git a/spec/controllers/api/oembed_controller_spec.rb b/spec/controllers/api/oembed_controller_spec.rb
index 5f0ca560d22..07f0aac8a33 100644
--- a/spec/controllers/api/oembed_controller_spec.rb
+++ b/spec/controllers/api/oembed_controller_spec.rb
@@ -14,9 +14,10 @@ RSpec.describe Api::OEmbedController do
       get :show, params: { url: short_account_status_url(alice, status) }, format: :json
     end
 
-    it 'returns private cache control headers', :aggregate_failures do
-      expect(response).to have_http_status(200)
-      expect(response.headers['Cache-Control']).to include('private, no-store')
+    it 'returns http success and private cache control' do
+      expect(response)
+        .to have_http_status(200)
+        .and have_http_header('Cache-Control', 'private, no-store')
     end
   end
 end
diff --git a/spec/controllers/auth/registrations_controller_spec.rb b/spec/controllers/auth/registrations_controller_spec.rb
index 75ab2876523..f1a079258e6 100644
--- a/spec/controllers/auth/registrations_controller_spec.rb
+++ b/spec/controllers/auth/registrations_controller_spec.rb
@@ -35,12 +35,10 @@ RSpec.describe Auth::RegistrationsController do
       get :edit
     end
 
-    it 'returns http success' do
-      expect(response).to have_http_status(200)
-    end
-
-    it 'returns private cache control header' do
-      expect(response.headers['Cache-Control']).to include('private, no-store')
+    it 'returns http success and private cache control' do
+      expect(response)
+        .to have_http_status(200)
+        .and have_http_header('Cache-Control', 'private, no-store')
     end
   end
 
@@ -51,16 +49,13 @@ RSpec.describe Auth::RegistrationsController do
     before do
       request.env['devise.mapping'] = Devise.mappings[:user]
       sign_in(user, scope: :user)
+      put :update
     end
 
-    it 'returns http success' do
-      put :update
-      expect(response).to have_http_status(200)
-    end
-
-    it 'returns private cache control headers' do
-      put :update
-      expect(response.headers['Cache-Control']).to include('private, no-store')
+    it 'returns http success and private cache control' do
+      expect(response)
+        .to have_http_status(200)
+        .and have_http_header('Cache-Control', 'private, no-store')
     end
 
     it 'can update the user email' do
diff --git a/spec/controllers/filters/statuses_controller_spec.rb b/spec/controllers/filters/statuses_controller_spec.rb
index 2c80613302c..ba3f42e5394 100644
--- a/spec/controllers/filters/statuses_controller_spec.rb
+++ b/spec/controllers/filters/statuses_controller_spec.rb
@@ -23,12 +23,10 @@ describe Filters::StatusesController do
           get :index, params: { filter_id: filter }
         end
 
-        it 'returns http success' do
-          expect(response).to have_http_status(200)
-        end
-
-        it 'returns private cache control headers' do
-          expect(response.headers['Cache-Control']).to include('private, no-store')
+        it 'returns http success and private cache control' do
+          expect(response)
+            .to have_http_status(200)
+            .and have_http_header('Cache-Control', 'private, no-store')
         end
       end
 
diff --git a/spec/controllers/filters_controller_spec.rb b/spec/controllers/filters_controller_spec.rb
index 091f714bb37..d9a63855bcf 100644
--- a/spec/controllers/filters_controller_spec.rb
+++ b/spec/controllers/filters_controller_spec.rb
@@ -22,12 +22,10 @@ describe FiltersController do
         get :index
       end
 
-      it 'returns http success' do
-        expect(response).to have_http_status(200)
-      end
-
-      it 'returns private cache control headers' do
-        expect(response.headers['Cache-Control']).to include('private, no-store')
+      it 'returns http success and private cache control' do
+        expect(response)
+          .to have_http_status(200)
+          .and have_http_header('Cache-Control', 'private, no-store')
       end
     end
   end
diff --git a/spec/controllers/invites_controller_spec.rb b/spec/controllers/invites_controller_spec.rb
index 5221941267f..8f538d54458 100644
--- a/spec/controllers/invites_controller_spec.rb
+++ b/spec/controllers/invites_controller_spec.rb
@@ -22,12 +22,10 @@ describe InvitesController do
         get :index
       end
 
-      it 'returns http success' do
-        expect(response).to have_http_status(:success)
-      end
-
-      it 'returns private cache control headers' do
-        expect(response.headers['Cache-Control']).to include('private, no-store')
+      it 'returns http success and private cache control' do
+        expect(response)
+          .to have_http_status(:success)
+          .and have_http_header('Cache-Control', 'private, no-store')
       end
     end
 
diff --git a/spec/controllers/oauth/authorizations_controller_spec.rb b/spec/controllers/oauth/authorizations_controller_spec.rb
index 9bb520211c2..d9986083dbd 100644
--- a/spec/controllers/oauth/authorizations_controller_spec.rb
+++ b/spec/controllers/oauth/authorizations_controller_spec.rb
@@ -24,14 +24,12 @@ RSpec.describe Oauth::AuthorizationsController do
         sign_in user, scope: :user
       end
 
-      it 'returns http success' do
+      it 'returns http success and private cache control and authorize body' do
         subject
-        expect(response).to have_http_status(200)
-      end
 
-      it 'returns private cache control headers' do
-        subject
-        expect(response.headers['Cache-Control']).to include('private, no-store')
+        expect(response)
+          .to have_http_status(200)
+          .and have_http_header('Cache-Control', 'private, no-store')
       end
 
       include_examples 'stores location for user'
diff --git a/spec/controllers/oauth/authorized_applications_controller_spec.rb b/spec/controllers/oauth/authorized_applications_controller_spec.rb
index 3fd9f9499f4..9d6a4467ed4 100644
--- a/spec/controllers/oauth/authorized_applications_controller_spec.rb
+++ b/spec/controllers/oauth/authorized_applications_controller_spec.rb
@@ -22,14 +22,12 @@ describe Oauth::AuthorizedApplicationsController do
         sign_in Fabricate(:user), scope: :user
       end
 
-      it 'returns http success' do
+      it 'returns http success and private cache control' do
         subject
-        expect(response).to have_http_status(200)
-      end
 
-      it 'returns private cache control headers' do
-        subject
-        expect(response.headers['Cache-Control']).to include('private, no-store')
+        expect(response)
+          .to have_http_status(200)
+          .and have_http_header('Cache-Control', 'private, no-store')
       end
 
       include_examples 'stores location for user'
diff --git a/spec/controllers/relationships_controller_spec.rb b/spec/controllers/relationships_controller_spec.rb
index 9495fc214f0..8c8d3308b79 100644
--- a/spec/controllers/relationships_controller_spec.rb
+++ b/spec/controllers/relationships_controller_spec.rb
@@ -14,12 +14,10 @@ describe RelationshipsController do
         get :show, params: { page: 2, relationship: 'followed_by' }
       end
 
-      it 'returns http success' do
-        expect(response).to have_http_status(200)
-      end
-
-      it 'returns private cache control headers' do
-        expect(response.headers['Cache-Control']).to include('private, no-store')
+      it 'returns http success and private cache control' do
+        expect(response)
+          .to have_http_status(200)
+          .and have_http_header('Cache-Control', 'private, no-store')
       end
     end
 
diff --git a/spec/controllers/settings/aliases_controller_spec.rb b/spec/controllers/settings/aliases_controller_spec.rb
index 18e568be0be..f38812fde20 100644
--- a/spec/controllers/settings/aliases_controller_spec.rb
+++ b/spec/controllers/settings/aliases_controller_spec.rb
@@ -17,9 +17,10 @@ describe Settings::AliasesController do
       get :index
     end
 
-    it 'returns http success with private cache control headers', :aggregate_failures do
-      expect(response).to have_http_status(200)
-      expect(response.headers['Cache-Control']).to include('private, no-store')
+    it 'returns http success and private cache control' do
+      expect(response)
+        .to have_http_status(200)
+        .and have_http_header('Cache-Control', 'private, no-store')
     end
   end
 
diff --git a/spec/controllers/settings/applications_controller_spec.rb b/spec/controllers/settings/applications_controller_spec.rb
index ce2e0749a76..415e21ac725 100644
--- a/spec/controllers/settings/applications_controller_spec.rb
+++ b/spec/controllers/settings/applications_controller_spec.rb
@@ -18,9 +18,10 @@ describe Settings::ApplicationsController do
       get :index
     end
 
-    it 'returns http success with private cache control headers', :aggregate_failures do
-      expect(response).to have_http_status(200)
-      expect(response.headers['Cache-Control']).to include('private, no-store')
+    it 'returns http success and private cache control' do
+      expect(response)
+        .to have_http_status(200)
+        .and have_http_header('Cache-Control', 'private, no-store')
     end
   end
 
diff --git a/spec/controllers/settings/deletes_controller_spec.rb b/spec/controllers/settings/deletes_controller_spec.rb
index 3342599bc11..5bdf36de3bd 100644
--- a/spec/controllers/settings/deletes_controller_spec.rb
+++ b/spec/controllers/settings/deletes_controller_spec.rb
@@ -14,17 +14,19 @@ describe Settings::DeletesController do
         get :show
       end
 
-      it 'renders confirmation page with private cache control headers', :aggregate_failures do
-        expect(response).to have_http_status(200)
-        expect(response.headers['Cache-Control']).to include('private, no-store')
+      it 'returns http success and private cache control' do
+        expect(response)
+          .to have_http_status(200)
+          .and have_http_header('Cache-Control', 'private, no-store')
       end
 
       context 'when suspended' do
         let(:user) { Fabricate(:user, account_attributes: { suspended_at: Time.now.utc }) }
 
-        it 'returns http forbidden with private cache control headers', :aggregate_failures do
-          expect(response).to have_http_status(403)
-          expect(response.headers['Cache-Control']).to include('private, no-store')
+        it 'returns http forbidden and private cache control' do
+          expect(response)
+            .to have_http_status(403)
+            .and have_http_header('Cache-Control', 'private, no-store')
         end
       end
     end
diff --git a/spec/controllers/settings/exports_controller_spec.rb b/spec/controllers/settings/exports_controller_spec.rb
index 3399f78ac58..bcab92decd7 100644
--- a/spec/controllers/settings/exports_controller_spec.rb
+++ b/spec/controllers/settings/exports_controller_spec.rb
@@ -14,9 +14,10 @@ describe Settings::ExportsController do
         get :show
       end
 
-      it 'returns http success with private cache control headers', :aggregate_failures do
-        expect(response).to have_http_status(200)
-        expect(response.headers['Cache-Control']).to include('private, no-store')
+      it 'returns http success and private cache control' do
+        expect(response)
+          .to have_http_status(200)
+          .and have_http_header('Cache-Control', 'private, no-store')
       end
     end
 
diff --git a/spec/controllers/settings/imports_controller_spec.rb b/spec/controllers/settings/imports_controller_spec.rb
index 89ec39e54d4..6ab4d893296 100644
--- a/spec/controllers/settings/imports_controller_spec.rb
+++ b/spec/controllers/settings/imports_controller_spec.rb
@@ -19,11 +19,13 @@ RSpec.describe Settings::ImportsController do
       get :index
     end
 
-    it 'assigns the expected imports', :aggregate_failures do
-      expect(response).to have_http_status(200)
-      expect(assigns(:recent_imports)).to eq [import]
-      expect(assigns(:recent_imports)).to_not include(other_import)
-      expect(response.headers['Cache-Control']).to include('private, no-store')
+    it 'assigns expected imports and returns http success and private cache control' do
+      expect(response)
+        .to have_http_status(200)
+        .and have_http_header('Cache-Control', 'private, no-store')
+      expect(assigns(:recent_imports))
+        .to eq([import])
+        .and not_include(other_import)
     end
   end
 
diff --git a/spec/controllers/settings/login_activities_controller_spec.rb b/spec/controllers/settings/login_activities_controller_spec.rb
index 294bf85c97a..04a30e78719 100644
--- a/spec/controllers/settings/login_activities_controller_spec.rb
+++ b/spec/controllers/settings/login_activities_controller_spec.rb
@@ -18,8 +18,9 @@ describe Settings::LoginActivitiesController do
     end
 
     it 'returns http success with private cache control headers', :aggregate_failures do
-      expect(response).to have_http_status(200)
-      expect(response.headers['Cache-Control']).to include('private, no-store')
+      expect(response)
+        .to have_http_status(200)
+        .and have_http_header('Cache-Control', 'private, no-store')
       expect(response.body)
         .to include(login_activity.user_agent)
         .and include(login_activity.authentication_method)
diff --git a/spec/controllers/settings/migration/redirects_controller_spec.rb b/spec/controllers/settings/migration/redirects_controller_spec.rb
index b909a02668b..7425c59dbe8 100644
--- a/spec/controllers/settings/migration/redirects_controller_spec.rb
+++ b/spec/controllers/settings/migration/redirects_controller_spec.rb
@@ -16,9 +16,10 @@ describe Settings::Migration::RedirectsController do
       get :new
     end
 
-    it 'returns http success with private cache control headers', :aggregate_failures do
-      expect(response).to have_http_status(200)
-      expect(response.headers['Cache-Control']).to include('private, no-store')
+    it 'returns http success and private cache control' do
+      expect(response)
+        .to have_http_status(200)
+        .and have_http_header('Cache-Control', 'private, no-store')
     end
   end
 
diff --git a/spec/controllers/settings/preferences/appearance_controller_spec.rb b/spec/controllers/settings/preferences/appearance_controller_spec.rb
index 84b82772502..1b0381260da 100644
--- a/spec/controllers/settings/preferences/appearance_controller_spec.rb
+++ b/spec/controllers/settings/preferences/appearance_controller_spec.rb
@@ -16,9 +16,10 @@ describe Settings::Preferences::AppearanceController do
       get :show
     end
 
-    it 'returns http success with private cache control headers', :aggregate_failures do
-      expect(response).to have_http_status(200)
-      expect(response.headers['Cache-Control']).to include('private, no-store')
+    it 'returns http success and private cache control' do
+      expect(response)
+        .to have_http_status(200)
+        .and have_http_header('Cache-Control', 'private, no-store')
     end
   end
 
diff --git a/spec/controllers/settings/preferences/notifications_controller_spec.rb b/spec/controllers/settings/preferences/notifications_controller_spec.rb
index e0f0bc55a75..ffa86da9e02 100644
--- a/spec/controllers/settings/preferences/notifications_controller_spec.rb
+++ b/spec/controllers/settings/preferences/notifications_controller_spec.rb
@@ -16,9 +16,10 @@ describe Settings::Preferences::NotificationsController do
       get :show
     end
 
-    it 'returns http success with private cache control headers', :aggregate_failures do
-      expect(response).to have_http_status(200)
-      expect(response.headers['Cache-Control']).to include('private, no-store')
+    it 'returns http success and private cache control' do
+      expect(response)
+        .to have_http_status(200)
+        .and have_http_header('Cache-Control', 'private, no-store')
     end
   end
 
diff --git a/spec/controllers/settings/preferences/other_controller_spec.rb b/spec/controllers/settings/preferences/other_controller_spec.rb
index 61a94a41423..22f9ee33398 100644
--- a/spec/controllers/settings/preferences/other_controller_spec.rb
+++ b/spec/controllers/settings/preferences/other_controller_spec.rb
@@ -16,9 +16,10 @@ describe Settings::Preferences::OtherController do
       get :show
     end
 
-    it 'returns http success with private cache control headers', :aggregate_failures do
-      expect(response).to have_http_status(200)
-      expect(response.headers['Cache-Control']).to include('private, no-store')
+    it 'returns http success and private cache control' do
+      expect(response)
+        .to have_http_status(200)
+        .and have_http_header('Cache-Control', 'private, no-store')
     end
   end
 
diff --git a/spec/controllers/settings/profiles_controller_spec.rb b/spec/controllers/settings/profiles_controller_spec.rb
index e3197f0a6d7..d8bc5e00524 100644
--- a/spec/controllers/settings/profiles_controller_spec.rb
+++ b/spec/controllers/settings/profiles_controller_spec.rb
@@ -17,9 +17,10 @@ RSpec.describe Settings::ProfilesController do
       get :show
     end
 
-    it 'returns http success with private cache control headers', :aggregate_failures do
-      expect(response).to have_http_status(200)
-      expect(response.headers['Cache-Control']).to include('private, no-store')
+    it 'returns http success and private cache control' do
+      expect(response)
+        .to have_http_status(200)
+        .and have_http_header('Cache-Control', 'private, no-store')
     end
   end
 
diff --git a/spec/controllers/settings/two_factor_authentication_methods_controller_spec.rb b/spec/controllers/settings/two_factor_authentication_methods_controller_spec.rb
index de0d28463bb..f00b91e0cca 100644
--- a/spec/controllers/settings/two_factor_authentication_methods_controller_spec.rb
+++ b/spec/controllers/settings/two_factor_authentication_methods_controller_spec.rb
@@ -29,9 +29,10 @@ describe Settings::TwoFactorAuthenticationMethodsController do
           get :index
         end
 
-        it 'returns http success with private cache control headers', :aggregate_failures do
-          expect(response).to have_http_status(200)
-          expect(response.headers['Cache-Control']).to include('private, no-store')
+        it 'returns http success and private cache control' do
+          expect(response)
+            .to have_http_status(200)
+            .and have_http_header('Cache-Control', 'private, no-store')
         end
       end
 
diff --git a/spec/controllers/statuses_cleanup_controller_spec.rb b/spec/controllers/statuses_cleanup_controller_spec.rb
index 8a72621993a..3ddfaad9eea 100644
--- a/spec/controllers/statuses_cleanup_controller_spec.rb
+++ b/spec/controllers/statuses_cleanup_controller_spec.rb
@@ -16,12 +16,10 @@ RSpec.describe StatusesCleanupController do
       get :show
     end
 
-    it 'returns http success' do
-      expect(response).to have_http_status(200)
-    end
-
-    it 'returns private cache control headers' do
-      expect(response.headers['Cache-Control']).to include('private, no-store')
+    it 'returns http success and private cache control' do
+      expect(response)
+        .to have_http_status(200)
+        .and have_http_header('Cache-Control', 'private, no-store')
     end
   end
 
diff --git a/spec/requests/accounts_spec.rb b/spec/requests/accounts_spec.rb
index bf067cdc38a..7138a3dcc3f 100644
--- a/spec/requests/accounts_spec.rb
+++ b/spec/requests/accounts_spec.rb
@@ -159,12 +159,11 @@ describe 'Accounts show response' do
           it 'returns a private JSON version of the account', :aggregate_failures do
             expect(response)
               .to have_http_status(200)
+              .and have_http_header('Cache-Control', 'private')
               .and have_attributes(
                 media_type: eq('application/activity+json')
               )
 
-            expect(response.headers['Cache-Control']).to include 'private'
-
             expect(body_as_json).to include(:id, :type, :preferredUsername, :inbox, :publicKey, :name, :summary)
           end
         end
@@ -194,13 +193,12 @@ describe 'Accounts show response' do
             it 'returns a private signature JSON version of the account', :aggregate_failures do
               expect(response)
                 .to have_http_status(200)
+                .and have_http_header('Cache-Control', 'private')
+                .and have_http_header('Vary', 'Signature')
                 .and have_attributes(
                   media_type: eq('application/activity+json')
                 )
 
-              expect(response.headers['Cache-Control']).to include 'private'
-              expect(response.headers['Vary']).to include 'Signature'
-
               expect(body_as_json).to include(:id, :type, :preferredUsername, :inbox, :publicKey, :name, :summary)
             end
           end
diff --git a/spec/requests/well_known/webfinger_spec.rb b/spec/requests/well_known/webfinger_spec.rb
index 0aafdf56244..1dd34a3ac33 100644
--- a/spec/requests/well_known/webfinger_spec.rb
+++ b/spec/requests/well_known/webfinger_spec.rb
@@ -18,9 +18,9 @@ describe 'The /.well-known/webfinger endpoint' do
 
   shared_examples 'a successful response' do
     it 'returns http success with correct media type and headers and body json' do
-      expect(response).to have_http_status(200)
-
-      expect(response.headers['Vary']).to eq('Origin')
+      expect(response)
+        .to have_http_status(200)
+        .and have_http_header('Vary', 'Origin')
 
       expect(response.media_type).to eq 'application/jrd+json'
 
@@ -116,12 +116,10 @@ describe 'The /.well-known/webfinger endpoint' do
       perform_request!
     end
 
-    it 'returns http success' do
-      expect(response).to have_http_status(200)
-    end
-
-    it 'sets only a Vary Origin header' do
-      expect(response.headers['Vary']).to eq('Origin')
+    it 'returns http success and vary origin header' do
+      expect(response)
+        .to have_http_status(200)
+        .and have_http_header('Vary', 'Origin')
     end
 
     it 'returns application/jrd+json' do
diff --git a/spec/support/examples/cache.rb b/spec/support/examples/cache.rb
index 60e522f4269..6ffda6d4a9e 100644
--- a/spec/support/examples/cache.rb
+++ b/spec/support/examples/cache.rb
@@ -7,8 +7,8 @@ shared_examples 'cacheable response' do |expects_vary: false|
 
     expect(session).to be_empty
 
-    expect(response.headers['Vary']).to include(expects_vary) if expects_vary
+    expect(response).to have_http_header('Vary', expects_vary) if expects_vary
 
-    expect(response.headers['Cache-Control']).to include('public')
+    expect(response).to have_http_header('Cache-Control', 'public')
   end
 end
diff --git a/spec/support/matchers/http_headers.rb b/spec/support/matchers/http_headers.rb
new file mode 100644
index 00000000000..6896037f33a
--- /dev/null
+++ b/spec/support/matchers/http_headers.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+RSpec::Matchers.define :have_http_header do |header, values|
+  match do |response|
+    response.headers[header].match?(values)
+  end
+
+  failure_message do |response|
+    "Expected that `#{header}` would have values of `#{values}` but was `#{response.headers[header]}`"
+  end
+end