diff --git a/test/shell.d/config-test.sh b/test/shell.d/config-test.sh
index 476b3825..a10f0fba 100755
--- a/test/shell.d/config-test.sh
+++ b/test/shell.d/config-test.sh
@@ -108,6 +108,7 @@ pass "default bar widget ids resolve to manifests and entry points"
 
 ROOT="$ROOT" python3 <<'PY'
 import os
+import re
 import sys
 from pathlib import Path
 
@@ -175,15 +176,28 @@ for source, destination, legacy in package_defaults:
 
 # A user unit has to be on the machine before anything turns it on: shipped in
 # /usr/lib/systemd/user, or copied out of default/ by the command enabling it.
+def installs_first(text):
+  source = re.search(r'(\w+)="[^"\n]*default/systemd/user/', text)
+  held = rf"|\$\{{?{source[1]}\b" if source else ""
+  copy = re.search(rf"^[ \t]*(?:sudo[ \t]+)?(?:install|cp)\b[^\n]*(?:default/systemd/user/{held})", text, re.MULTILINE)
+  enable = text.find("systemctl --user enable")
+  return bool(copy) and (enable < 0 or copy.start() < enable)
+
+named = 'unit="$OMARCHY_PATH/default/systemd/user/a.service"\n'
+if installs_first(named + "systemctl --user enable a.service\n"):
+  errors.append("unit check accepts a command that names a unit's source but never installs it")
+if installs_first(named + 'systemctl --user enable a.service\ninstall -Dm644 "$unit" "$target"\n'):
+  errors.append("unit check accepts a command that installs a unit after enabling it")
+
 scripts = [path.read_text(errors="ignore") for folder in ("bin", "install", "migrations")
            for path in (root / folder).rglob("*") if path.is_file()]
 for unit in sorted(path.name for path in (root / "default/systemd/user").glob("*.service")):
   if f"/usr/lib/systemd/user/{unit}" in pkgbuild:
     continue
   named = [text for text in scripts if unit in text]
-  if not any("default/systemd/user/" in text for text in named):
+  if not any(installs_first(text) for text in named):
     errors.append(f"PKGBUILD does not ship default/systemd/user/{unit} and no command installs it")
-  elif any("systemctl --user enable" in text and "default/systemd/user/" not in text for text in named):
+  elif any("systemctl --user enable" in text and not installs_first(text) for text in named):
     errors.append(f"{unit} is enabled without being shipped by PKGBUILD or installed first")
 
 # Existing users have an absolute wants symlink to the old unit path, and the
diff --git a/test/shell.d/first-run-test.sh b/test/shell.d/first-run-test.sh
index 54b5c197..16bc861b 100644
--- a/test/shell.d/first-run-test.sh
+++ b/test/shell.d/first-run-test.sh
@@ -38,19 +38,33 @@ pass "first-run uses one lifecycle completion marker"
 # missing from a build must cost first-run only that unit.
 cat >"$mock_bin/systemctl" <<'SH'
 #!/bin/bash
-[[ $* != *omarchy-sleep-lock.service* ]] || exit 1
+[[ $* != *"$OMARCHY_TEST_MISSING_UNIT"* ]] || exit 1
 printf '%s\n' "$*" >>"$OMARCHY_TEST_CALLS"
 SH
 cat >"$mock_bin/omarchy-hook-install" <<'SH'
 #!/bin/bash
-echo hook >>"$OMARCHY_TEST_CALLS"
+echo "hook $*" >>"$OMARCHY_TEST_CALLS"
 SH
 chmod +x "$mock_bin/systemctl" "$mock_bin/omarchy-hook-install"
 
-if PATH="$mock_bin:$PATH" OMARCHY_TEST_CALLS="$test_tmp/calls" bash "$ROOT/install/user/first-run/enable-user-units.sh"; then
-  fail "first-run reports a unit it could not enable"
-fi
-for expected in bt-agent.service omarchy-crash-watch.service hook; do
-  grep -Fq "$expected" "$test_tmp/calls" || fail "a unit missing from the build does not cost first-run $expected"
+enable_user_units() {
+  rm -f "$test_tmp/calls"
+  PATH="$mock_bin:$PATH" OMARCHY_TEST_CALLS="$test_tmp/calls" OMARCHY_TEST_MISSING_UNIT="$1" \
+    bash "$ROOT/install/user/first-run/enable-user-units.sh"
+}
+
+enable_user_units no-such-unit || fail "first-run enables its user units"
+clean_run=$(<"$test_tmp/calls")
+grep -Fq 'hook theme-set' <<<"$clean_run" || fail "first-run installs the theme hook"
+mapfile -t units < <(sed -n 's/^--user enable --now //p' <<<"$clean_run")
+
+for unit in "${units[@]}"; do
+  [[ $unit != *" "* ]] || fail "first-run enables each unit on its own" "$unit"
+  if enable_user_units "$unit"; then
+    fail "first-run reports a unit it could not enable" "$unit"
+  fi
+  [[ $(<"$test_tmp/calls") == "$(grep -Fvx -- "--user enable --now $unit" <<<"$clean_run")" ]] ||
+    fail "a unit missing from the build costs first-run only that unit" "$unit"
 done
+(( ${#units[@]} > 1 )) || fail "first-run enables each unit on its own"
 pass "a unit missing from the build costs first-run only that unit"