diff --git a/.tests/e2e-private-tier.sh b/.tests/e2e-private-tier.sh
index dca0ecb..101b436 100755
--- a/.tests/e2e-private-tier.sh
+++ b/.tests/e2e-private-tier.sh
@@ -16,8 +16,23 @@ apt-get update -qq && apt-get install -y -qq git curl zsh ca-certificates expect
 sh -c "$(curl -fsLS get.chezmoi.io)" -- init --apply \
   "${E2E_PUBLIC_URL:?}" >/dev/null 2>&1 \
   || fail "public tier init"
+# Assert the ABSOLUTE path first, before touching PATH.
+#
+# A real operator has just run the installer in whatever shell they were already
+# in, and on a fresh box that is bash. ~/.local/bin is added to PATH only by the
+# .zshrc this tier ships -- for a zsh that dotup has not installed yet. So the
+# first invocation is necessarily `~/.local/bin/dotup`, which is exactly what
+# the README documents, and bare `dotup` is `command not found` on every new
+# machine.
+#
+# This used to read `export PATH=...` and THEN `command -v dotup`, which is a
+# vacuous assertion: it proved the export worked, not that the installer put
+# anything anywhere. It passed happily while a real bash user hit
+# `dotup: command not found`.
+[ -x "$HOME/.local/bin/dotup" ] \
+	|| fail "public apply left no executable at ~/.local/bin/dotup"
+# Only now, for the convenience of the rest of this script.
 export PATH="$HOME/.local/bin:$PATH"
-command -v dotup >/dev/null || fail "dotup not on PATH after public apply"
 echo "1. public tier applied: $(chezmoi managed -p absolute | wc -l) files"
 
 # absence assertions BEFORE the private tier exists