diff --git a/internal/imagebuild/assets/provision.sh b/internal/imagebuild/assets/provision.sh
index b122f4d..c5e5078 100644
--- a/internal/imagebuild/assets/provision.sh
+++ b/internal/imagebuild/assets/provision.sh
@@ -44,6 +44,15 @@ ln -sfn /usr/bin/pip3 /usr/local/bin/pip3
 python --version >/dev/null
 pip --version >/dev/null
 
+systemctl disable --now apt-daily.timer apt-daily-upgrade.timer unattended-upgrades.service 2>/dev/null || true
+git lfs install --system
+groupadd --force docker
+groupadd --force lxd
+
+if ! id runner >/dev/null 2>&1; then
+  useradd --create-home --home-dir /home/runner --shell /bin/bash --groups sudo runner
+fi
+
 # bubblewrap is on the image for consumers that need a network isolator, but
 # a binary on disk is not a capability: Ubuntu 24.04 ships
 # kernel.apparmor_restrict_unprivileged_userns=1, and without an AppArmor
@@ -61,15 +70,6 @@ APPARMOR
 chmod 0644 /etc/apparmor.d/bwrap-userns
 apparmor_parser --replace /etc/apparmor.d/bwrap-userns
 runuser -u runner -- env HOME=/home/runner bwrap --ro-bind / / true
-
-systemctl disable --now apt-daily.timer apt-daily-upgrade.timer unattended-upgrades.service 2>/dev/null || true
-git lfs install --system
-groupadd --force docker
-groupadd --force lxd
-
-if ! id runner >/dev/null 2>&1; then
-  useradd --create-home --home-dir /home/runner --shell /bin/bash --groups sudo runner
-fi
 install -d -o root -g root -m 0750 /etc/sudoers.d
 printf 'runner ALL=(ALL) NOPASSWD:ALL\n' >/etc/sudoers.d/90-nddev-runner
 chmod 0440 /etc/sudoers.d/90-nddev-runner
diff --git a/internal/imagebuild/orchestrator_test.go b/internal/imagebuild/orchestrator_test.go
index ede8f26..37b6d23 100644
--- a/internal/imagebuild/orchestrator_test.go
+++ b/internal/imagebuild/orchestrator_test.go
@@ -164,7 +164,7 @@ func TestRecipeFingerprintIsDeterministic(t *testing.T) {
 	// alias is part of the recipe, so a manifest whose contents changed under an
 	// unchanged alias would otherwise ask the builder to produce different bytes
 	// for a name that is already promoted.
-	if first != "sha256:835c7ed10be62b3ac1cca36572c08b8661b0df5451f1b594bbb4ce7cf19f9ebf" {
+	if first != "sha256:4cc00e2ee72d7ed4646f84229f3b6a2d5c6d4aeeb05aae29f15f4e1bd381eeb1" {
 		t.Fatalf("deployed standard recipe fingerprint drifted: %q", first)
 	}
 	smoke, err := SmokeFingerprint(plan)