diff --git a/smoketest/scenarios/30-upgrade-from-baseline.sh b/smoketest/scenarios/30-upgrade-from-baseline.sh
index 5381a2e..f360d93 100644
--- a/smoketest/scenarios/30-upgrade-from-baseline.sh
+++ b/smoketest/scenarios/30-upgrade-from-baseline.sh
@@ -13,18 +13,31 @@ scenario() {
   sha="$(git -C "$SMOKETEST_REPO" rev-parse "$VARIANT^{commit}")"
   upstream_set "$sha"
 
-  # Older installers ask for packages that no longer build. Install those
-  # baselines with a fix on top, then put the clone back at the baseline
+  # Older installers can't finish here as they did on a real machine. Install
+  # those baselines with fixes on top, then put the clone back at the baseline
   # itself, as on a machine installed back then: update pulls --ff-only.
-  # The source-built herdr pins a zig version Arch has moved on from;
-  # herdr-bin provides herdr, and is what HEAD installs instead
-  if git -C "$SMOKETEST_REPO" show "$sha:packages.conf" | grep -qx '[[:space:]]*herdr'; then
-    upstream_commit "Smoketest: herdr-bin for herdr" '
-      sed -i "s/^\([[:space:]]*\)herdr$/\1herdr-bin/" packages.conf'
-  fi
+  # - The source-built herdr pins a zig version Arch has moved on from;
+  #   herdr-bin provides herdr, and is what HEAD installs instead
+  # - Plain gext install asks GNOME Shell, which shows a dialog no one clicks;
+  #   --filesystem doesn't ask, and is what HEAD does
+  upstream_commit "Smoketest: fixes to install this baseline in a VM" '
+    sed -i "s/^\([[:space:]]*\)herdr$/\1herdr-bin/" packages.conf
+    sed -i "s|gext install|gext --filesystem install|" gnome/gnome-extensions.sh
+    git diff --quiet && exit 0'
+
+  # Older installers also run flatpak install as the user, which polkit allows
+  # at the desktop (or asks there) but refuses over SSH. HEAD uses sudo
+  run_in_vm allow-flatpak "printf '%s\n' \
+    'polkit.addRule(function(action, subject) {' \
+    '  if (action.id.indexOf(\"org.freedesktop.Flatpak.\") == 0 && subject.user == \"'\"\$USER\"'\")' \
+    '    return polkit.Result.YES;' \
+    '});' | sudo tee /etc/polkit-1/rules.d/00-smoketest-flatpak.rules"
+  assert_status 0
+
   cd_install
   assert_status 0
-  run_in_vm reset "git -C ~/.local/share/coredesktop reset -q --hard $(q "$sha")"
+  run_in_vm reset "sudo rm /etc/polkit-1/rules.d/00-smoketest-flatpak.rules
+    git -C ~/.local/share/coredesktop reset -q --hard $(q "$sha")"
   assert_status 0
   vm_reboot