diff --git a/.github/workflows/upgrade-test.yml b/.github/workflows/upgrade-test.yml
index 800f5da..c86a40c 100644
--- a/.github/workflows/upgrade-test.yml
+++ b/.github/workflows/upgrade-test.yml
@@ -195,17 +195,19 @@ jobs:
             else
               echo "**The test did not get as far as a report** (job result: $RESULT)."
             fi
-            if [ -n "$PICTURES" ]; then
+            if [ -n "$PICTURES" ] && [ -s evidence/before.png ] && [ -s evidence/after.png ]; then
               echo
               echo "| Before, $FROM | After, on $TO |"
               echo "| --- | --- |"
               echo "| ![before]($PICTURES/before.png) | ![after]($PICTURES/after.png) |"
-              if [ -s evidence/stuck.png ]; then
-                echo
-                echo "The reboot did not come back by itself. This is what the screen showed:"
-                echo
-                echo "![stuck]($PICTURES/stuck.png)"
-              fi
+            fi
+            # The picture of a reboot that stuck stands by itself: it is the
+            # one worth having when there is no "after" to show.
+            if [ -n "$PICTURES" ] && [ -s evidence/stuck.png ]; then
+              echo
+              echo "The reboot did not come back by itself. This is what the screen showed:"
+              echo
+              echo "![stuck]($PICTURES/stuck.png)"
             fi
             echo
             echo "[Run $GITHUB_RUN_ID]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID), attempt $GITHUB_RUN_ATTEMPT, at \`${GITHUB_SHA:0:7}\`."
diff --git a/test/upgrade-test b/test/upgrade-test
index 2bd9c76..b25360c 100755
--- a/test/upgrade-test
+++ b/test/upgrade-test
@@ -131,7 +131,13 @@ log "Booting the installed system"
 wait_ssh 300 || { echo "upgrade-test: the installed system did not come up" >&2; exit 1; }
 # The overlay is thrown away: let sudo through without asking, so a long
 # update does not stop at a password prompt nobody is there to answer.
-ssh "${ssh_opts[@]}" omarchy@127.0.0.1 "echo $(printf %q "$pw") | sudo -S -p '' sh -c 'echo \"omarchy ALL=(ALL) NOPASSWD: ALL\" >/etc/sudoers.d/99-upgrade-test'" </dev/null
+# sudo takes the last rule that matches, and reads this folder in name order:
+# the name has to sort after the install's own rule for the wheel group.
+ssh "${ssh_opts[@]}" omarchy@127.0.0.1 "echo $(printf %q "$pw") | sudo -S -p '' sh -c 'printf \"%s\\n\" \"omarchy ALL=(ALL:ALL) NOPASSWD: ALL\" \"Defaults:omarchy !authenticate\" >/etc/sudoers.d/zzz-upgrade-test'" </dev/null
+# "sudo -v" is the hard one: it asks unless every rule for the user lets it
+# through, which is why the rule alone is not enough.
+ssh "${ssh_opts[@]}" omarchy@127.0.0.1 'sudo -k; sudo -n true && sudo -n -v' </dev/null ||
+  { echo "upgrade-test: sudo still asks for a password in the guest" >&2; exit 1; }
 guest 'timeout 180 systemctl is-system-running --wait >/dev/null 2>&1 || true'
 facts "$out/before.txt"
 desktop_shot "$out/before.png"
@@ -142,6 +148,38 @@ for migration in ${EXTRA_MIGRATIONS:-}; do
   ssh "${ssh_opts[@]}" omarchy@127.0.0.1 "sudo tee /usr/share/omarchy/migrations/$(basename "$migration") >/dev/null" <"$migration"
 done
 
+# A channel that offers what the machine already has, or something older, is
+# no upgrade. Say so now: the release's own updater, run with nothing to do,
+# ends at a prompt nobody is there to answer.
+case $channel in edge) package=omarchy-dev ;; *) package=omarchy ;; esac
+# A server that cannot be reached, or does not answer in time, is not a channel
+# with nothing on offer: that is a failure of its own, said as one.
+if ! offered=$(guest "set -o pipefail; curl -fsSL --connect-timeout 20 --max-time 120 --retry 2 https://pkgs.omarchy.org/$channel/\$(uname -m)/omarchy.db | bsdtar -xOf - '$package-[0-9]*/desc' | sed -n '/^%VERSION%\$/{n;p;}' | head -n 1" 2>"$out/probe.log") || [[ -z $offered ]]; then
+  {
+    echo "**The $channel channel could not be asked what it offers.** The test did not run."
+    echo
+    echo '```'
+    tail -n 5 "$out/probe.log"
+    echo '```'
+  } >"$out/report.md"
+  cat "$out/report.md"
+  exit 1
+fi
+installed=$(guest "pacman -Q $package 2>/dev/null | cut -d' ' -f2" 2>/dev/null)
+log "The $channel channel offers $package $offered; installed: ${installed:-none}"
+# pacman's own ordering: 0 for the same version, below 0 for an older offer.
+newer=1
+[[ -z $installed ]] || newer=$(guest "vercmp $(printf %q "$offered") $(printf %q "$installed")" 2>/dev/null)
+if (( ${newer:-0} <= 0 )); then
+  {
+    echo "**Nothing to upgrade to.** The $channel channel offers \`$package $offered\`, and the machine has \`$(fact "$out/before.txt" omarchy)\`."
+    echo
+    echo "The test did not run: point it at a channel that holds a newer Omarchy."
+  } >"$out/report.md"
+  cat "$out/report.md"
+  exit 1
+fi
+
 log "omarchy-channel-set $channel"
 update_start=$SECONDS
 guest "timeout ${UPDATE_TIMEOUT:-1800} omarchy-channel-set $channel" >"$out/update.log" 2>&1