diff --git a/modules/pacman/cmd/pacman-tools/manifest_test.go b/modules/pacman/cmd/pacman-tools/manifest_test.go
index b55f6908..af36b100 100644
--- a/modules/pacman/cmd/pacman-tools/manifest_test.go
+++ b/modules/pacman/cmd/pacman-tools/manifest_test.go
@@ -57,7 +57,7 @@ func TestPacmanConfIsWholeTheUnionOfRepositoriesAndTheImprovedOptions(t *testing
 		t.Skip("pacman-conf is not installed here; the rendered file is not proven")
 	}
 	file := filepath.Join(t.TempDir(), "pacman.conf")
-	if err := os.WriteFile(file, []byte(content), 0o644); err != nil {
+	if err := os.WriteFile(file, []byte(provenConf(t, content, filepath.Dir(file))), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	repos, err := exec.Command(conf, "--config", file, "--repo-list").CombinedOutput()
@@ -74,6 +74,35 @@ func TestPacmanConfIsWholeTheUnionOfRepositoriesAndTheImprovedOptions(t *testing
 	}
 }
 
+// Every repository of the shipped file reads the mirror list reflector writes, and the file pacman-conf proves reads
+// nothing of the machine: the unit level runs shut off (novox/hq ADR 0448), where /etc/pacman.d is not there
+// (issue 1891).
+func TestTheProvenConfReadsNothingOfTheMachine(t *testing.T) {
+	content := templateText(t, manifest(t).resource(t, "config"))
+	if n := strings.Count(content, "Include = "+Mirrorlist+"\n"); n != 3 || strings.Count(content, "Include") != n {
+		t.Fatalf("every repository reads %s, and nothing else is included: %d of 3\n%s", Mirrorlist, n, content)
+	}
+	dir := t.TempDir()
+	proven := provenConf(t, content, dir)
+	if strings.Contains(proven, "/etc/") {
+		t.Fatalf("the proven file still names the machine's /etc:\n%s", proven)
+	}
+	if _, err := os.Stat(filepath.Join(dir, "mirrorlist")); err != nil {
+		t.Fatalf("the proven file's mirror list is not in its directory: %v", err)
+	}
+}
+
+// provenConf is the shipped pacman.conf with its repositories reading a mirror list of its own in dir, made there,
+// so pacman-conf proves the file the module ships and reads nothing of the machine.
+func provenConf(t *testing.T, content, dir string) string {
+	t.Helper()
+	list := filepath.Join(dir, "mirrorlist")
+	if err := os.WriteFile(list, []byte("Server = https://mirror.example/$repo/os/$arch\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	return strings.ReplaceAll(content, "Include = "+Mirrorlist, "Include = "+list)
+}
+
 func TestReflectorWritesTheListPacmanReads(t *testing.T) {
 	content := templateText(t, manifest(t).resource(t, "mirrors"))
 	opts := map[string]string{}
diff --git a/modules/ssh-client/cmd/ssh-client-tools/ssh_test.go b/modules/ssh-client/cmd/ssh-client-tools/ssh_test.go
index 3428e042..93002138 100644
--- a/modules/ssh-client/cmd/ssh-client-tools/ssh_test.go
+++ b/modules/ssh-client/cmd/ssh-client-tools/ssh_test.go
@@ -311,6 +311,8 @@ func TestAnUnreachableHostIsNotRefreshed(t *testing.T) {
 }
 
 func TestTestSaysHowItAuthenticatedOrWhyNot(t *testing.T) {
+	// The test's own agent, none: the account running it may have one, and the unit level runs with none (issue 1891).
+	t.Setenv("SSH_AUTH_SOCK", "")
 	ok := "debug1: Connecting to ace.internal [10.0.0.2] port 22.\ndebug1: Server accepts key: /h/.ssh/id_ed25519 ED25519 " + edFP + "\nAuthenticated to ace.internal ([10.0.0.2]:22) using \"publickey\".\n"
 	f := &fake{answer: func(c call) forgekey.Ran { return forgekey.Ran{Stderr: ok} }}
 	got, err := client(t.TempDir(), f).Test(context.Background(), "ace")
@@ -327,9 +329,15 @@ func TestTestSaysHowItAuthenticatedOrWhyNot(t *testing.T) {
 	if got["ok"] != false || got["why"] != "no key it offered was accepted" || !reflect.DeepEqual(got["offered"], []string{"/h/.ssh/id_box"}) {
 		t.Fatalf("%v", got)
 	}
-	if !strings.Contains(got["note"].(string), "agent") {
+	if note, _ := got["note"].(string); !strings.Contains(note, "agent") {
 		t.Fatalf("no word on the agent: %v", got)
 	}
+	agent := filepath.Join(t.TempDir(), "agent.sock")
+	t.Setenv("SSH_AUTH_SOCK", agent)
+	got, _ = client(t.TempDir(), f).Test(context.Background(), "ace")
+	if got["agent"] != agent || got["note"] != nil {
+		t.Fatalf("the environment's agent is not the one it ran with, or a passphrase note without a passphrase: %v", got)
+	}
 }
 
 func TestCheckFindsWhatIsWrongAndSaysWhatItDidNotCheck(t *testing.T) {