diff --git a/.tests/e2e-private-tier.sh b/.tests/e2e-private-tier.sh
index cac2076..60f8f6b 100755
--- a/.tests/e2e-private-tier.sh
+++ b/.tests/e2e-private-tier.sh
@@ -48,7 +48,16 @@ printf 'core/unzip\nprivate/private-repo\nprivate/bws-secrets\n' > "$STATE/selec
 echo "   plan says:"; dotup plan 2>&1 | sed 's/^/     /' | grep -v '^ *$' | head -8
 
 # ---- 3. install: unzip via apt. bws must NOT appear here -------------------
+# The status was thrown away here, and that is not a detail: with no `set -e`,
+# no `pipefail`, and nothing reading `$?` (which was `tail`'s anyway), a run in
+# which 36 packages failed to install still reached `echo "E2E PASS"`. Both
+# statements were true at once and only one of them was reported. Capture the
+# status, print the output, then fail on it.
+set -o pipefail
 dotup --yes install 2>&1 | sed 's/^/   /' | tail -8
+irc=$?
+set +o pipefail
+[ "$irc" -eq 0 ] || fail "dotup install exited $irc — at least one package did not install"
 command -v unzip >/dev/null || fail "unzip not installed"
 command -v bws >/dev/null && fail "bws installed by the package phase — it must come from the private tier"
 echo "3. unzip installed; bws correctly absent (it is not a manifest package)"
@@ -221,7 +230,10 @@ git -C "$HOME/.local/share/dotfiles-private" fetch -q 2>/dev/null \
 git config --get user.email >/dev/null 2>&1 || fail "git identity not configured"
 echo "git identity:     configured"
 
-zsh -ic 'exit' >/dev/null 2>&1 && echo "zsh:              interactive login clean" \
-                               || echo "WARN: zsh -ic exited non-zero"
+# This was a `|| echo "WARN: …"` that fell straight through to `E2E PASS`, so
+# the one assertion about the shell this repo exists to configure could not
+# fail. If the login shell is broken, the run is not a pass.
+zsh -ic 'exit' >/dev/null 2>&1 || fail "zsh -ic exited non-zero — the login shell this repo configures is broken"
+echo "zsh:              interactive login clean"
 echo
 echo "E2E PASS"