diff --git a/tests/unit/test_charm.py b/tests/unit/test_charm.py
index 41d3a878a..81d00722c 100644
--- a/tests/unit/test_charm.py
+++ b/tests/unit/test_charm.py
@@ -9,6 +9,7 @@
 from signal import SIGHUP
 from unittest.mock import Mock, PropertyMock, call, patch
 
+import lightkube
 import psycopg2
 import pytest
 from jinja2 import Template
@@ -478,6 +479,46 @@ def test_raise_untrusted_error(self, _, __, _deployed_without_trust):
         #   2 extra _node_name calls from inside _node_ip and get_all_k8s_node_hostnames_and_ips
         assert _deployed_without_trust.call_count == 6
 
+    @patch("lightkube.Client")
+    def test_patch_port(self, _client):
+        # not run unless leader
+        self.charm.patch_port()
+
+        assert not _client.called
+
+        self.harness.set_leader(True)
+        self.charm.patch_port(True)
+        service = lightkube.resources.core_v1.Service(
+            apiVersion="v1",
+            kind="Service",
+            metadata=lightkube.models.meta_v1.ObjectMeta(
+                name="pgbouncer-k8s-nodeport",
+                namespace=self.charm._namespace,
+                ownerReferences=_client.return_value.get.return_value.metadata.ownerReferences,
+            ),
+            spec=lightkube.models.core_v1.ServiceSpec(
+                selector={"app.kubernetes.io/name": self.charm.app.name},
+                ports=[
+                    lightkube.models.core_v1.ServicePort(
+                        name="pgbouncer",
+                        port=6432,
+                        targetPort=6432,
+                    )
+                ],
+                type="NodePort",
+            ),
+        )
+
+        _client.return_value.create.assert_called_once_with(service)
+
+        self.charm.patch_port(False)
+
+        _client.return_value.delete.assert_called_once_with(
+            lightkube.resources.core_v1.Service,
+            "pgbouncer-k8s-nodeport",
+            namespace=self.charm.model.name,
+        )
+
     #
     # Secrets
     #