diff --git a/flyio/caveats.go b/flyio/caveats.go
index 390f9e2..16f9bdd 100644
--- a/flyio/caveats.go
+++ b/flyio/caveats.go
@@ -286,6 +286,7 @@ func (r Role) String() string {
 			combined |= namedRole
 
 			if combined == r {
+				slices.Sort(names) // for consistency in tests
 				return strings.Join(names, "+")
 			}
 		}
diff --git a/flyio/caveats_test.go b/flyio/caveats_test.go
index 244b883..cb8f38d 100644
--- a/flyio/caveats_test.go
+++ b/flyio/caveats_test.go
@@ -136,7 +136,7 @@ func TestAllowedRoles(t *testing.T) {
 func TestRole(t *testing.T) {
 	assert.Equal(t, "admin", RoleAdmin.String())
 	assert.Equal(t, "member", RoleMember.String())
-	assert.Equal(t, "member+billing_manager", (RoleMember | RoleBillingManager).String())
+	assert.Equal(t, "billing_manager+member", (RoleMember | RoleBillingManager).String())
 
 	assert.True(t, RoleAdmin.HasAllRoles(RoleAdmin))
 	assert.True(t, RoleAdmin.HasAllRoles(RoleMember))