diff --git a/migrations/1788025225.sh b/migrations/1788025225.sh
index 96ba2f6c..295b71ba 100644
--- a/migrations/1788025225.sh
+++ b/migrations/1788025225.sh
@@ -109,7 +109,9 @@ sudoers_hash_is_active() {
 # touch the network. Any failure in between leaves the grant on the machine with
 # nothing left to retry it.
 #
-# The installer rewrote this file eight times, and only the last four carry both
+# The installer rewrote this file nine times across two locations -- the last two
+# bodies came from install/post-install/first-run-mode.sh, whose cleanup alias
+# names /usr/bin/rm as well as /bin/rm -- and only the later ones carry both
 # Cmnd_Alias lines, so keying on those would walk past the earlier ones. Instead
 # require every active line to be one the installer itself emitted, plus at least
 # one line that is unmistakably this grant: its own self-cleanup. One
@@ -128,7 +130,8 @@ first_run_sudoers_is_generated() {
         continue
         ;;
       "Cmnd_Alias FIRST_RUN_CLEANUP = /bin/rm -f /etc/sudoers.d/first-run" | \
-        "Cmnd_Alias FIRST_RUN_CLEANUP = /bin/rm -f /etc/sudoers.d/first-run, /bin/rm -f /etc/sudoers.d/99-omarchy-installer-reboot")
+        "Cmnd_Alias FIRST_RUN_CLEANUP = /bin/rm -f /etc/sudoers.d/first-run, /bin/rm -f /etc/sudoers.d/99-omarchy-installer-reboot" | \
+        "Cmnd_Alias FIRST_RUN_CLEANUP = /usr/bin/rm -f /etc/sudoers.d/first-run, /bin/rm -f /etc/sudoers.d/first-run")
         seen_marker=1
         continue
         ;;
diff --git a/test/shell.d/retired-installer-artifacts-migration-test.sh b/test/shell.d/retired-installer-artifacts-migration-test.sh
index eba723c9..a5d85388 100755
--- a/test/shell.d/retired-installer-artifacts-migration-test.sh
+++ b/test/shell.d/retired-installer-artifacts-migration-test.sh
@@ -115,9 +115,12 @@ WantedBy=multi-user.target
 EOF
 }
 
-# Every distinct body install/preflight/first-run-mode.sh wrote across its eight
-# rewrites, oldest first. Only the last four carry both Cmnd_Alias lines, so a
-# predicate keyed on those would leave the first four grants on disk.
+# Every distinct body the first-run-mode installer wrote across its nine rewrites,
+# oldest first. Only the later ones carry both Cmnd_Alias lines, so a predicate
+# keyed on those would leave the earlier grants on disk. The last body is the one
+# install/post-install/first-run-mode.sh shipped until it was retired: its cleanup
+# alias names /usr/bin/rm as well as /bin/rm, and it still grants passwordless
+# /usr/bin/systemctl.
 first_run_variants=(
   'installer ALL=(ALL) NOPASSWD: /usr/bin/ufw
 installer ALL=(ALL) NOPASSWD: /usr/bin/ufw-docker
@@ -166,6 +169,14 @@ installer ALL=(ALL) NOPASSWD: /usr/bin/ufw
 installer ALL=(ALL) NOPASSWD: /usr/bin/ufw-docker
 installer ALL=(ALL) NOPASSWD: /usr/bin/gtk-update-icon-cache
 installer ALL=(ALL) NOPASSWD: SYMLINK_RESOLVED
+installer ALL=(ALL) NOPASSWD: FIRST_RUN_CLEANUP'
+  'Cmnd_Alias FIRST_RUN_CLEANUP = /usr/bin/rm -f /etc/sudoers.d/first-run, /bin/rm -f /etc/sudoers.d/first-run
+Cmnd_Alias SYMLINK_RESOLVED = /usr/bin/ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
+installer ALL=(ALL) NOPASSWD: /usr/bin/systemctl
+installer ALL=(ALL) NOPASSWD: /usr/bin/ufw
+installer ALL=(ALL) NOPASSWD: /usr/bin/ufw-docker
+installer ALL=(ALL) NOPASSWD: /usr/bin/gtk-update-icon-cache
+installer ALL=(ALL) NOPASSWD: SYMLINK_RESOLVED
 installer ALL=(ALL) NOPASSWD: FIRST_RUN_CLEANUP'
 )