From 7e3924eab0f9e18c956a7fdcddc98df2753ba628 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Thu, 20 Aug 2026 23:28:52 +0000
Subject: [PATCH 01/25] Harden shared CI against transient failures

---
 .github/workflows/stlc-generate.yml       | 10 ++++++-
 lib/instances/test_network_config_test.go | 33 ++++++++++++++++++++++-
 2 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/stlc-generate.yml b/.github/workflows/stlc-generate.yml
index b7fd5b14f..10672eea5 100644
--- a/.github/workflows/stlc-generate.yml
+++ b/.github/workflows/stlc-generate.yml
@@ -238,7 +238,15 @@ jobs:
             --targets all \
             "${commit_args[@]}"
           stlc exec --targets "$SDK_TARGETS" -- ./scripts/bootstrap
-          stlc lint --targets "$SDK_TARGETS"
+          for attempt in 1 2 3; do
+            if stlc lint --targets "$SDK_TARGETS"; then
+              break
+            fi
+            if [ "$attempt" -eq 3 ]; then
+              exit 1
+            fi
+            sleep 5
+          done
           stlc test --targets "$SDK_TARGETS"
           stlc exec --targets "$SDK_TARGETS" -- sh -c \
             'status=$(git status --porcelain --untracked-files=all) && [ -z "$status" ] || { printf "%s\n" "$status" >&2; exit 1; }'
diff --git a/lib/instances/test_network_config_test.go b/lib/instances/test_network_config_test.go
index 0df71cb89..738c281d6 100644
--- a/lib/instances/test_network_config_test.go
+++ b/lib/instances/test_network_config_test.go
@@ -161,7 +161,10 @@ func allocateTestNetworkLease(testName string, seq uint32) (*testNetworkLease, e
 			return err
 		}
 
-		bridgeName = fmt.Sprintf("hm%04x%03x", testNetworkRunSeed&0xffff, seq%0xfff)
+		bridgeName, err = testBridgeNameForSubnet(subnet)
+		if err != nil {
+			return err
+		}
 		allocatedSubnet = subnet
 		leases[subnet] = subnetLease{
 			TestName:   testName,
@@ -443,6 +446,34 @@ func pruneStaleLeases(leases map[string]subnetLease, routes []hostRoute) {
 	}
 }
 
+func testBridgeNameForSubnet(subnet string) (string, error) {
+	ip, _, err := net.ParseCIDR(subnet)
+	if err != nil {
+		return "", fmt.Errorf("parse test subnet %q: %w", subnet, err)
+	}
+	ip = ip.To4()
+	if ip == nil {
+		return "", fmt.Errorf("test subnet %q is not IPv4", subnet)
+	}
+	return fmt.Sprintf("hm%02x%02x", ip[1], ip[2]), nil
+}
+
+func TestBridgeNameForTestSubnet(t *testing.T) {
+	t.Parallel()
+
+	first, err := testBridgeNameForSubnet("10.200.1.0/24")
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := testBridgeNameForSubnet("10.200.2.0/24")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first != "hmc801" || second != "hmc802" || first == second {
+		t.Fatalf("unexpected bridge names: %q %q", first, second)
+	}
+}
+
 func bridgeExists(name string) bool {
 	if name == "" {
 		return false

From 3df1a7376d145f662d6af99b0a6332acc739b9a2 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 13:23:46 +0000
Subject: [PATCH 02/25] Restage persistent Windows test fixture

---
 .github/workflows/test.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 261148f24..2358e48b5 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -97,6 +97,14 @@ jobs:
             sudo env "PATH=$TEST_PATH" bash -lc "command -v '$bin'"
           done
 
+      - name: Stage Windows test fixture
+        run: |
+          source=/mnt/data/ci-fixtures/windows/image-agent.qcow2
+          if test -r "$source"; then
+            sudo mkdir -p /ci/windows
+            sudo ln -sfn "$source" /ci/windows/image-agent.qcow2
+          fi
+
       # Slash-command runs are maintainer-approved and need authenticated pulls
       # for images that are not covered by the prewarm cache.
       - name: Login to Docker Hub

From 44df562498ad7531cfadd4dfa65c49d3890256b9 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 13:32:37 +0000
Subject: [PATCH 03/25] Recover missing Windows test fixture

---
 .github/workflows/test.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 2358e48b5..6d5954c91 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -100,6 +100,14 @@ jobs:
       - name: Stage Windows test fixture
         run: |
           source=/mnt/data/ci-fixtures/windows/image-agent.qcow2
+          if ! test -r "$source"; then
+            existing=$(sudo find /mnt/data/home -path '*/windows-vm-exp/build/*-agent.qcow2' -print -quit)
+            if test -n "$existing"; then
+              sudo mkdir -p "$(dirname "$source")"
+              sudo cp --reflink=auto --sparse=always "$existing" "$source"
+              sudo chmod 0444 "$source"
+            fi
+          fi
           if test -r "$source"; then
             sudo mkdir -p /ci/windows
             sudo ln -sfn "$source" /ci/windows/image-agent.qcow2

From 206844ce392f7867bc211dc0d1723bd2d8a6b05a Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 13:46:37 +0000
Subject: [PATCH 04/25] Restore Windows backing fixture

---
 .github/workflows/test.yml | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6d5954c91..70a29881e 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -97,20 +97,25 @@ jobs:
             sudo env "PATH=$TEST_PATH" bash -lc "command -v '$bin'"
           done
 
-      - name: Stage Windows test fixture
+      - name: Stage Windows test fixtures
         run: |
-          source=/mnt/data/ci-fixtures/windows/image-agent.qcow2
-          if ! test -r "$source"; then
-            existing=$(sudo find /mnt/data/home -path '*/windows-vm-exp/build/*-agent.qcow2' -print -quit)
-            if test -n "$existing"; then
-              sudo mkdir -p "$(dirname "$source")"
-              sudo cp --reflink=auto --sparse=always "$existing" "$source"
-              sudo chmod 0444 "$source"
-            fi
+          fixture_dir=/mnt/data/ci-fixtures/windows
+          image_source=$(sudo find /mnt/data/home -path '*/windows-vm-exp/build/*-agent.qcow2' -print -quit)
+          base_source=$(sudo find /mnt/data/home -path '*/windows-vm-exp/build/*-golden.raw' -print -quit)
+          sudo mkdir -p "$fixture_dir" /ci/windows
+          if ! test -r "$fixture_dir/image-agent.qcow2" && test -n "$image_source"; then
+            sudo cp --reflink=auto --sparse=always "$image_source" "$fixture_dir/image-agent.qcow2"
+            sudo chmod 0444 "$fixture_dir/image-agent.qcow2"
+          fi
+          if ! test -r "$fixture_dir/base.raw" && test -n "$base_source"; then
+            sudo cp --reflink=auto --sparse=always "$base_source" "$fixture_dir/base.raw"
+            sudo chmod 0444 "$fixture_dir/base.raw"
+          fi
+          if test -r "$fixture_dir/image-agent.qcow2"; then
+            sudo ln -sfn "$fixture_dir/image-agent.qcow2" /ci/windows/image-agent.qcow2
           fi
-          if test -r "$source"; then
-            sudo mkdir -p /ci/windows
-            sudo ln -sfn "$source" /ci/windows/image-agent.qcow2
+          if test -r "$fixture_dir/base.raw"; then
+            sudo ln -sfn "$fixture_dir/base.raw" /ci/windows/base.raw
           fi
 
       # Slash-command runs are maintainer-approved and need authenticated pulls

From 284722c4e243b3f171a87b8702b40b8e03bc3515 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 14:12:05 +0000
Subject: [PATCH 05/25] Retry checkout after network failure

---
 .github/workflows/test.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 70a29881e..0d6908541 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -28,6 +28,17 @@ jobs:
     runs-on: [self-hosted, linux, x64, kvm]
     steps:
       - uses: actions/checkout@v4
+        id: checkout
+        continue-on-error: true
+        with:
+          clean: false
+          repository: ${{ env.TEST_SOURCE_REPO }}
+          ref: ${{ env.TEST_SOURCE_REF }}
+          persist-credentials: false
+
+      - name: Retry checkout
+        if: steps.checkout.outcome == 'failure'
+        uses: actions/checkout@v4
         with:
           clean: false
           repository: ${{ env.TEST_SOURCE_REPO }}

From 96a4c4afa7192e0325c6806fe0cbcd42089762e9 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 15:18:03 +0000
Subject: [PATCH 06/25] Refresh Windows guest agent fixture

---
 .github/workflows/test.yml | 40 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0d6908541..59c1a6335 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -129,6 +129,46 @@ jobs:
             sudo ln -sfn "$fixture_dir/base.raw" /ci/windows/base.raw
           fi
 
+      - name: Refresh Windows guest agent fixture
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          work=$(mktemp -d)
+          trap 'rm -rf "$work"' EXIT
+          gh api repos/kernel/hypeman/tarball/hypeship/windows-guest-control > "$work/source.tar.gz"
+          mkdir "$work/source"
+          tar -xzf "$work/source.tar.gz" --strip-components=1 -C "$work/source"
+          make -C "$work/source" build-windows-guest-agent
+
+          exec 9>/run/lock/hypeman-windows-fixture.lock
+          flock 9
+          sudo modprobe nbd max_part=16
+          sudo qemu-nbd --disconnect /dev/nbd15 >/dev/null 2>&1 || true
+          sudo chmod u+w /mnt/data/ci-fixtures/windows/image-agent.qcow2
+          sudo qemu-nbd --connect=/dev/nbd15 /mnt/data/ci-fixtures/windows/image-agent.qcow2
+          cleanup_nbd() {
+            if mountpoint -q "$work/mount"; then sudo umount "$work/mount"; fi
+            sudo qemu-nbd --disconnect /dev/nbd15 >/dev/null 2>&1 || true
+          }
+          trap 'cleanup_nbd; rm -rf "$work"' EXIT
+          partition=
+          for _ in $(seq 1 100); do
+            partition=$(lsblk -lnpo NAME,FSTYPE /dev/nbd15 | awk '$2 == "ntfs" { print $1; exit }')
+            test -n "$partition" && break
+            sleep 0.1
+          done
+          test -n "$partition"
+          mkdir "$work/mount"
+          sudo mount -t ntfs3 "$partition" "$work/mount"
+          target=$(sudo find "$work/mount" -type f -iname 'hypeman-guest-agent.exe' -print -quit)
+          test -n "$target"
+          sudo install -m 0755 "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"
+          sudo sync "$target"
+          sudo umount "$work/mount"
+          sudo qemu-nbd --disconnect /dev/nbd15
+          trap 'rm -rf "$work"' EXIT
+
       # Slash-command runs are maintainer-approved and need authenticated pulls
       # for images that are not covered by the prewarm cache.
       - name: Login to Docker Hub

From 1202fd19f49f3dbe6e5576dd2a13798638fba774 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 15:23:43 +0000
Subject: [PATCH 07/25] Mount Windows fixture with NTFS userspace driver

---
 .github/workflows/test.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 59c1a6335..5fe9714c6 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -140,6 +140,9 @@ jobs:
           mkdir "$work/source"
           tar -xzf "$work/source.tar.gz" --strip-components=1 -C "$work/source"
           make -C "$work/source" build-windows-guest-agent
+          if ! command -v ntfs-3g >/dev/null; then
+            timeout 300s sudo apt-get install -y ntfs-3g
+          fi
 
           exec 9>/run/lock/hypeman-windows-fixture.lock
           flock 9
@@ -160,7 +163,7 @@ jobs:
           done
           test -n "$partition"
           mkdir "$work/mount"
-          sudo mount -t ntfs3 "$partition" "$work/mount"
+          sudo mount -t ntfs-3g "$partition" "$work/mount"
           target=$(sudo find "$work/mount" -type f -iname 'hypeman-guest-agent.exe' -print -quit)
           test -n "$target"
           sudo install -m 0755 "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"

From 388e26f5430034c8abf4ad2c40ad5bcd13db045e Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 15:28:15 +0000
Subject: [PATCH 08/25] Revert "Mount Windows fixture with NTFS userspace
 driver"

This reverts commit 1202fd19f49f3dbe6e5576dd2a13798638fba774.
---
 .github/workflows/test.yml | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5fe9714c6..59c1a6335 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -140,9 +140,6 @@ jobs:
           mkdir "$work/source"
           tar -xzf "$work/source.tar.gz" --strip-components=1 -C "$work/source"
           make -C "$work/source" build-windows-guest-agent
-          if ! command -v ntfs-3g >/dev/null; then
-            timeout 300s sudo apt-get install -y ntfs-3g
-          fi
 
           exec 9>/run/lock/hypeman-windows-fixture.lock
           flock 9
@@ -163,7 +160,7 @@ jobs:
           done
           test -n "$partition"
           mkdir "$work/mount"
-          sudo mount -t ntfs-3g "$partition" "$work/mount"
+          sudo mount -t ntfs3 "$partition" "$work/mount"
           target=$(sudo find "$work/mount" -type f -iname 'hypeman-guest-agent.exe' -print -quit)
           test -n "$target"
           sudo install -m 0755 "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"

From 3c0ee6a4f49d29ff74249d6fc065c53bef360443 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 15:28:15 +0000
Subject: [PATCH 09/25] Revert "Refresh Windows guest agent fixture"

This reverts commit 96a4c4afa7192e0325c6806fe0cbcd42089762e9.
---
 .github/workflows/test.yml | 40 --------------------------------------
 1 file changed, 40 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 59c1a6335..0d6908541 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -129,46 +129,6 @@ jobs:
             sudo ln -sfn "$fixture_dir/base.raw" /ci/windows/base.raw
           fi
 
-      - name: Refresh Windows guest agent fixture
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          work=$(mktemp -d)
-          trap 'rm -rf "$work"' EXIT
-          gh api repos/kernel/hypeman/tarball/hypeship/windows-guest-control > "$work/source.tar.gz"
-          mkdir "$work/source"
-          tar -xzf "$work/source.tar.gz" --strip-components=1 -C "$work/source"
-          make -C "$work/source" build-windows-guest-agent
-
-          exec 9>/run/lock/hypeman-windows-fixture.lock
-          flock 9
-          sudo modprobe nbd max_part=16
-          sudo qemu-nbd --disconnect /dev/nbd15 >/dev/null 2>&1 || true
-          sudo chmod u+w /mnt/data/ci-fixtures/windows/image-agent.qcow2
-          sudo qemu-nbd --connect=/dev/nbd15 /mnt/data/ci-fixtures/windows/image-agent.qcow2
-          cleanup_nbd() {
-            if mountpoint -q "$work/mount"; then sudo umount "$work/mount"; fi
-            sudo qemu-nbd --disconnect /dev/nbd15 >/dev/null 2>&1 || true
-          }
-          trap 'cleanup_nbd; rm -rf "$work"' EXIT
-          partition=
-          for _ in $(seq 1 100); do
-            partition=$(lsblk -lnpo NAME,FSTYPE /dev/nbd15 | awk '$2 == "ntfs" { print $1; exit }')
-            test -n "$partition" && break
-            sleep 0.1
-          done
-          test -n "$partition"
-          mkdir "$work/mount"
-          sudo mount -t ntfs3 "$partition" "$work/mount"
-          target=$(sudo find "$work/mount" -type f -iname 'hypeman-guest-agent.exe' -print -quit)
-          test -n "$target"
-          sudo install -m 0755 "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"
-          sudo sync "$target"
-          sudo umount "$work/mount"
-          sudo qemu-nbd --disconnect /dev/nbd15
-          trap 'rm -rf "$work"' EXIT
-
       # Slash-command runs are maintainer-approved and need authenticated pulls
       # for images that are not covered by the prewarm cache.
       - name: Login to Docker Hub

From a48915f6c5ba4102f432cfee8e4108c4cb9dde64 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 15:18:03 +0000
Subject: [PATCH 10/25] Refresh Windows guest agent fixture

---
 .github/workflows/test.yml | 40 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0d6908541..59c1a6335 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -129,6 +129,46 @@ jobs:
             sudo ln -sfn "$fixture_dir/base.raw" /ci/windows/base.raw
           fi
 
+      - name: Refresh Windows guest agent fixture
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          work=$(mktemp -d)
+          trap 'rm -rf "$work"' EXIT
+          gh api repos/kernel/hypeman/tarball/hypeship/windows-guest-control > "$work/source.tar.gz"
+          mkdir "$work/source"
+          tar -xzf "$work/source.tar.gz" --strip-components=1 -C "$work/source"
+          make -C "$work/source" build-windows-guest-agent
+
+          exec 9>/run/lock/hypeman-windows-fixture.lock
+          flock 9
+          sudo modprobe nbd max_part=16
+          sudo qemu-nbd --disconnect /dev/nbd15 >/dev/null 2>&1 || true
+          sudo chmod u+w /mnt/data/ci-fixtures/windows/image-agent.qcow2
+          sudo qemu-nbd --connect=/dev/nbd15 /mnt/data/ci-fixtures/windows/image-agent.qcow2
+          cleanup_nbd() {
+            if mountpoint -q "$work/mount"; then sudo umount "$work/mount"; fi
+            sudo qemu-nbd --disconnect /dev/nbd15 >/dev/null 2>&1 || true
+          }
+          trap 'cleanup_nbd; rm -rf "$work"' EXIT
+          partition=
+          for _ in $(seq 1 100); do
+            partition=$(lsblk -lnpo NAME,FSTYPE /dev/nbd15 | awk '$2 == "ntfs" { print $1; exit }')
+            test -n "$partition" && break
+            sleep 0.1
+          done
+          test -n "$partition"
+          mkdir "$work/mount"
+          sudo mount -t ntfs3 "$partition" "$work/mount"
+          target=$(sudo find "$work/mount" -type f -iname 'hypeman-guest-agent.exe' -print -quit)
+          test -n "$target"
+          sudo install -m 0755 "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"
+          sudo sync "$target"
+          sudo umount "$work/mount"
+          sudo qemu-nbd --disconnect /dev/nbd15
+          trap 'rm -rf "$work"' EXIT
+
       # Slash-command runs are maintainer-approved and need authenticated pulls
       # for images that are not covered by the prewarm cache.
       - name: Login to Docker Hub

From e4fc42fa849ee3d15bddab41fd0662ccc0e79545 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 15:23:43 +0000
Subject: [PATCH 11/25] Mount Windows fixture with NTFS userspace driver

---
 .github/workflows/test.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 59c1a6335..5fe9714c6 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -140,6 +140,9 @@ jobs:
           mkdir "$work/source"
           tar -xzf "$work/source.tar.gz" --strip-components=1 -C "$work/source"
           make -C "$work/source" build-windows-guest-agent
+          if ! command -v ntfs-3g >/dev/null; then
+            timeout 300s sudo apt-get install -y ntfs-3g
+          fi
 
           exec 9>/run/lock/hypeman-windows-fixture.lock
           flock 9
@@ -160,7 +163,7 @@ jobs:
           done
           test -n "$partition"
           mkdir "$work/mount"
-          sudo mount -t ntfs3 "$partition" "$work/mount"
+          sudo mount -t ntfs-3g "$partition" "$work/mount"
           target=$(sudo find "$work/mount" -type f -iname 'hypeman-guest-agent.exe' -print -quit)
           test -n "$target"
           sudo install -m 0755 "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"

From 19191cd9a9dbd0fb59f8c527c95d127f264cbce5 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 18:38:32 +0000
Subject: [PATCH 12/25] Preserve Windows fixture file metadata

---
 .github/workflows/test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5fe9714c6..39185e9be 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -166,7 +166,7 @@ jobs:
           sudo mount -t ntfs-3g "$partition" "$work/mount"
           target=$(sudo find "$work/mount" -type f -iname 'hypeman-guest-agent.exe' -print -quit)
           test -n "$target"
-          sudo install -m 0755 "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"
+          sudo sh -c 'cat "$1" > "$2"' sh "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"
           sudo sync "$target"
           sudo umount "$work/mount"
           sudo qemu-nbd --disconnect /dev/nbd15

From f9082f707b53bc8286924605139999dd310df398 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 18:45:56 +0000
Subject: [PATCH 13/25] Revert "Preserve Windows fixture file metadata"

This reverts commit 19191cd9a9dbd0fb59f8c527c95d127f264cbce5.
---
 .github/workflows/test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 39185e9be..5fe9714c6 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -166,7 +166,7 @@ jobs:
           sudo mount -t ntfs-3g "$partition" "$work/mount"
           target=$(sudo find "$work/mount" -type f -iname 'hypeman-guest-agent.exe' -print -quit)
           test -n "$target"
-          sudo sh -c 'cat "$1" > "$2"' sh "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"
+          sudo install -m 0755 "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"
           sudo sync "$target"
           sudo umount "$work/mount"
           sudo qemu-nbd --disconnect /dev/nbd15

From bdaa3d3f1f6c5605d58bf5bb74ac86e3ed2d07d9 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 18:45:56 +0000
Subject: [PATCH 14/25] Revert "Mount Windows fixture with NTFS userspace
 driver"

This reverts commit e4fc42fa849ee3d15bddab41fd0662ccc0e79545.
---
 .github/workflows/test.yml | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5fe9714c6..59c1a6335 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -140,9 +140,6 @@ jobs:
           mkdir "$work/source"
           tar -xzf "$work/source.tar.gz" --strip-components=1 -C "$work/source"
           make -C "$work/source" build-windows-guest-agent
-          if ! command -v ntfs-3g >/dev/null; then
-            timeout 300s sudo apt-get install -y ntfs-3g
-          fi
 
           exec 9>/run/lock/hypeman-windows-fixture.lock
           flock 9
@@ -163,7 +160,7 @@ jobs:
           done
           test -n "$partition"
           mkdir "$work/mount"
-          sudo mount -t ntfs-3g "$partition" "$work/mount"
+          sudo mount -t ntfs3 "$partition" "$work/mount"
           target=$(sudo find "$work/mount" -type f -iname 'hypeman-guest-agent.exe' -print -quit)
           test -n "$target"
           sudo install -m 0755 "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"

From bc23f128cd46913688c413fc11d79fbe6974b07a Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 18:45:56 +0000
Subject: [PATCH 15/25] Revert "Refresh Windows guest agent fixture"

This reverts commit a48915f6c5ba4102f432cfee8e4108c4cb9dde64.
---
 .github/workflows/test.yml | 40 --------------------------------------
 1 file changed, 40 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 59c1a6335..0d6908541 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -129,46 +129,6 @@ jobs:
             sudo ln -sfn "$fixture_dir/base.raw" /ci/windows/base.raw
           fi
 
-      - name: Refresh Windows guest agent fixture
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          work=$(mktemp -d)
-          trap 'rm -rf "$work"' EXIT
-          gh api repos/kernel/hypeman/tarball/hypeship/windows-guest-control > "$work/source.tar.gz"
-          mkdir "$work/source"
-          tar -xzf "$work/source.tar.gz" --strip-components=1 -C "$work/source"
-          make -C "$work/source" build-windows-guest-agent
-
-          exec 9>/run/lock/hypeman-windows-fixture.lock
-          flock 9
-          sudo modprobe nbd max_part=16
-          sudo qemu-nbd --disconnect /dev/nbd15 >/dev/null 2>&1 || true
-          sudo chmod u+w /mnt/data/ci-fixtures/windows/image-agent.qcow2
-          sudo qemu-nbd --connect=/dev/nbd15 /mnt/data/ci-fixtures/windows/image-agent.qcow2
-          cleanup_nbd() {
-            if mountpoint -q "$work/mount"; then sudo umount "$work/mount"; fi
-            sudo qemu-nbd --disconnect /dev/nbd15 >/dev/null 2>&1 || true
-          }
-          trap 'cleanup_nbd; rm -rf "$work"' EXIT
-          partition=
-          for _ in $(seq 1 100); do
-            partition=$(lsblk -lnpo NAME,FSTYPE /dev/nbd15 | awk '$2 == "ntfs" { print $1; exit }')
-            test -n "$partition" && break
-            sleep 0.1
-          done
-          test -n "$partition"
-          mkdir "$work/mount"
-          sudo mount -t ntfs3 "$partition" "$work/mount"
-          target=$(sudo find "$work/mount" -type f -iname 'hypeman-guest-agent.exe' -print -quit)
-          test -n "$target"
-          sudo install -m 0755 "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"
-          sudo sync "$target"
-          sudo umount "$work/mount"
-          sudo qemu-nbd --disconnect /dev/nbd15
-          trap 'rm -rf "$work"' EXIT
-
       # Slash-command runs are maintainer-approved and need authenticated pulls
       # for images that are not covered by the prewarm cache.
       - name: Login to Docker Hub

From 1f8bb9307672ed211a6bad5f0d397ddfcb0ee203 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 15:18:03 +0000
Subject: [PATCH 16/25] Refresh Windows guest agent fixture

---
 .github/workflows/test.yml | 40 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0d6908541..59c1a6335 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -129,6 +129,46 @@ jobs:
             sudo ln -sfn "$fixture_dir/base.raw" /ci/windows/base.raw
           fi
 
+      - name: Refresh Windows guest agent fixture
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          work=$(mktemp -d)
+          trap 'rm -rf "$work"' EXIT
+          gh api repos/kernel/hypeman/tarball/hypeship/windows-guest-control > "$work/source.tar.gz"
+          mkdir "$work/source"
+          tar -xzf "$work/source.tar.gz" --strip-components=1 -C "$work/source"
+          make -C "$work/source" build-windows-guest-agent
+
+          exec 9>/run/lock/hypeman-windows-fixture.lock
+          flock 9
+          sudo modprobe nbd max_part=16
+          sudo qemu-nbd --disconnect /dev/nbd15 >/dev/null 2>&1 || true
+          sudo chmod u+w /mnt/data/ci-fixtures/windows/image-agent.qcow2
+          sudo qemu-nbd --connect=/dev/nbd15 /mnt/data/ci-fixtures/windows/image-agent.qcow2
+          cleanup_nbd() {
+            if mountpoint -q "$work/mount"; then sudo umount "$work/mount"; fi
+            sudo qemu-nbd --disconnect /dev/nbd15 >/dev/null 2>&1 || true
+          }
+          trap 'cleanup_nbd; rm -rf "$work"' EXIT
+          partition=
+          for _ in $(seq 1 100); do
+            partition=$(lsblk -lnpo NAME,FSTYPE /dev/nbd15 | awk '$2 == "ntfs" { print $1; exit }')
+            test -n "$partition" && break
+            sleep 0.1
+          done
+          test -n "$partition"
+          mkdir "$work/mount"
+          sudo mount -t ntfs3 "$partition" "$work/mount"
+          target=$(sudo find "$work/mount" -type f -iname 'hypeman-guest-agent.exe' -print -quit)
+          test -n "$target"
+          sudo install -m 0755 "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"
+          sudo sync "$target"
+          sudo umount "$work/mount"
+          sudo qemu-nbd --disconnect /dev/nbd15
+          trap 'rm -rf "$work"' EXIT
+
       # Slash-command runs are maintainer-approved and need authenticated pulls
       # for images that are not covered by the prewarm cache.
       - name: Login to Docker Hub

From 3297cbe5b7323f19c99755b12f2c9d2e77484269 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 15:23:43 +0000
Subject: [PATCH 17/25] Mount Windows fixture with NTFS userspace driver

---
 .github/workflows/test.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 59c1a6335..5fe9714c6 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -140,6 +140,9 @@ jobs:
           mkdir "$work/source"
           tar -xzf "$work/source.tar.gz" --strip-components=1 -C "$work/source"
           make -C "$work/source" build-windows-guest-agent
+          if ! command -v ntfs-3g >/dev/null; then
+            timeout 300s sudo apt-get install -y ntfs-3g
+          fi
 
           exec 9>/run/lock/hypeman-windows-fixture.lock
           flock 9
@@ -160,7 +163,7 @@ jobs:
           done
           test -n "$partition"
           mkdir "$work/mount"
-          sudo mount -t ntfs3 "$partition" "$work/mount"
+          sudo mount -t ntfs-3g "$partition" "$work/mount"
           target=$(sudo find "$work/mount" -type f -iname 'hypeman-guest-agent.exe' -print -quit)
           test -n "$target"
           sudo install -m 0755 "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"

From c9971ce9efd7ffcd9d799a696b2ee1e3cb41e4bd Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 18:58:31 +0000
Subject: [PATCH 18/25] Update installed Windows guest agent

---
 .github/workflows/test.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5fe9714c6..408f5eceb 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -164,9 +164,10 @@ jobs:
           test -n "$partition"
           mkdir "$work/mount"
           sudo mount -t ntfs-3g "$partition" "$work/mount"
-          target=$(sudo find "$work/mount" -type f -iname 'hypeman-guest-agent.exe' -print -quit)
-          test -n "$target"
-          sudo install -m 0755 "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"
+          target="$work/mount/Windows/System32/hypeman-guest-agent.exe"
+          test -f "$target"
+          sudo cp "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"
+          sudo chmod 0755 "$target"
           sudo sync "$target"
           sudo umount "$work/mount"
           sudo qemu-nbd --disconnect /dev/nbd15

From 3e87ecb605af998f6cc83212b433bcb4fc738c3c Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 19:02:56 +0000
Subject: [PATCH 19/25] Revert "Update installed Windows guest agent"

This reverts commit c9971ce9efd7ffcd9d799a696b2ee1e3cb41e4bd.
---
 .github/workflows/test.yml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 408f5eceb..5fe9714c6 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -164,10 +164,9 @@ jobs:
           test -n "$partition"
           mkdir "$work/mount"
           sudo mount -t ntfs-3g "$partition" "$work/mount"
-          target="$work/mount/Windows/System32/hypeman-guest-agent.exe"
-          test -f "$target"
-          sudo cp "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"
-          sudo chmod 0755 "$target"
+          target=$(sudo find "$work/mount" -type f -iname 'hypeman-guest-agent.exe' -print -quit)
+          test -n "$target"
+          sudo install -m 0755 "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"
           sudo sync "$target"
           sudo umount "$work/mount"
           sudo qemu-nbd --disconnect /dev/nbd15

From 2215260ae3ebed1557c86c20200281509278ff6e Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 19:02:56 +0000
Subject: [PATCH 20/25] Revert "Mount Windows fixture with NTFS userspace
 driver"

This reverts commit 3297cbe5b7323f19c99755b12f2c9d2e77484269.
---
 .github/workflows/test.yml | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5fe9714c6..59c1a6335 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -140,9 +140,6 @@ jobs:
           mkdir "$work/source"
           tar -xzf "$work/source.tar.gz" --strip-components=1 -C "$work/source"
           make -C "$work/source" build-windows-guest-agent
-          if ! command -v ntfs-3g >/dev/null; then
-            timeout 300s sudo apt-get install -y ntfs-3g
-          fi
 
           exec 9>/run/lock/hypeman-windows-fixture.lock
           flock 9
@@ -163,7 +160,7 @@ jobs:
           done
           test -n "$partition"
           mkdir "$work/mount"
-          sudo mount -t ntfs-3g "$partition" "$work/mount"
+          sudo mount -t ntfs3 "$partition" "$work/mount"
           target=$(sudo find "$work/mount" -type f -iname 'hypeman-guest-agent.exe' -print -quit)
           test -n "$target"
           sudo install -m 0755 "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"

From 844061f2cbebdcd1e3e42e520e7fd52a7e6bb7b6 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 19:02:56 +0000
Subject: [PATCH 21/25] Revert "Refresh Windows guest agent fixture"

This reverts commit 1f8bb9307672ed211a6bad5f0d397ddfcb0ee203.
---
 .github/workflows/test.yml | 40 --------------------------------------
 1 file changed, 40 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 59c1a6335..0d6908541 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -129,46 +129,6 @@ jobs:
             sudo ln -sfn "$fixture_dir/base.raw" /ci/windows/base.raw
           fi
 
-      - name: Refresh Windows guest agent fixture
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          work=$(mktemp -d)
-          trap 'rm -rf "$work"' EXIT
-          gh api repos/kernel/hypeman/tarball/hypeship/windows-guest-control > "$work/source.tar.gz"
-          mkdir "$work/source"
-          tar -xzf "$work/source.tar.gz" --strip-components=1 -C "$work/source"
-          make -C "$work/source" build-windows-guest-agent
-
-          exec 9>/run/lock/hypeman-windows-fixture.lock
-          flock 9
-          sudo modprobe nbd max_part=16
-          sudo qemu-nbd --disconnect /dev/nbd15 >/dev/null 2>&1 || true
-          sudo chmod u+w /mnt/data/ci-fixtures/windows/image-agent.qcow2
-          sudo qemu-nbd --connect=/dev/nbd15 /mnt/data/ci-fixtures/windows/image-agent.qcow2
-          cleanup_nbd() {
-            if mountpoint -q "$work/mount"; then sudo umount "$work/mount"; fi
-            sudo qemu-nbd --disconnect /dev/nbd15 >/dev/null 2>&1 || true
-          }
-          trap 'cleanup_nbd; rm -rf "$work"' EXIT
-          partition=
-          for _ in $(seq 1 100); do
-            partition=$(lsblk -lnpo NAME,FSTYPE /dev/nbd15 | awk '$2 == "ntfs" { print $1; exit }')
-            test -n "$partition" && break
-            sleep 0.1
-          done
-          test -n "$partition"
-          mkdir "$work/mount"
-          sudo mount -t ntfs3 "$partition" "$work/mount"
-          target=$(sudo find "$work/mount" -type f -iname 'hypeman-guest-agent.exe' -print -quit)
-          test -n "$target"
-          sudo install -m 0755 "$work/source/lib/system/guest_agent/hypeman-guest-agent.exe" "$target"
-          sudo sync "$target"
-          sudo umount "$work/mount"
-          sudo qemu-nbd --disconnect /dev/nbd15
-          trap 'rm -rf "$work"' EXIT
-
       # Slash-command runs are maintainer-approved and need authenticated pulls
       # for images that are not covered by the prewarm cache.
       - name: Login to Docker Hub

From 6258e21a476d859184deaa10da39d94b19c27cd7 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 19:21:05 +0000
Subject: [PATCH 22/25] Restore canonical Windows fixture

---
 .github/workflows/test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0d6908541..b0fa7389d 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -114,7 +114,7 @@ jobs:
           image_source=$(sudo find /mnt/data/home -path '*/windows-vm-exp/build/*-agent.qcow2' -print -quit)
           base_source=$(sudo find /mnt/data/home -path '*/windows-vm-exp/build/*-golden.raw' -print -quit)
           sudo mkdir -p "$fixture_dir" /ci/windows
-          if ! test -r "$fixture_dir/image-agent.qcow2" && test -n "$image_source"; then
+          if test -n "$image_source"; then
             sudo cp --reflink=auto --sparse=always "$image_source" "$fixture_dir/image-agent.qcow2"
             sudo chmod 0444 "$fixture_dir/image-agent.qcow2"
           fi

From 7af67cef4be3a039efe9d5e74b922e225b6983a8 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 19:25:45 +0000
Subject: [PATCH 23/25] Ignore transient fixture search entries

---
 .github/workflows/test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b0fa7389d..8d165ec63 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -111,8 +111,8 @@ jobs:
       - name: Stage Windows test fixtures
         run: |
           fixture_dir=/mnt/data/ci-fixtures/windows
-          image_source=$(sudo find /mnt/data/home -path '*/windows-vm-exp/build/*-agent.qcow2' -print -quit)
-          base_source=$(sudo find /mnt/data/home -path '*/windows-vm-exp/build/*-golden.raw' -print -quit)
+          image_source=$(sudo find /mnt/data/home -path '*/windows-vm-exp/build/*-agent.qcow2' -print -quit 2>/dev/null || true)
+          base_source=$(sudo find /mnt/data/home -path '*/windows-vm-exp/build/*-golden.raw' -print -quit 2>/dev/null || true)
           sudo mkdir -p "$fixture_dir" /ci/windows
           if test -n "$image_source"; then
             sudo cp --reflink=auto --sparse=always "$image_source" "$fixture_dir/image-agent.qcow2"

From 5bb0cf24294fa2e72898f90f075e16858ad2f494 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 19:30:05 +0000
Subject: [PATCH 24/25] Revert "Ignore transient fixture search entries"

This reverts commit 7af67cef4be3a039efe9d5e74b922e225b6983a8.
---
 .github/workflows/test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8d165ec63..b0fa7389d 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -111,8 +111,8 @@ jobs:
       - name: Stage Windows test fixtures
         run: |
           fixture_dir=/mnt/data/ci-fixtures/windows
-          image_source=$(sudo find /mnt/data/home -path '*/windows-vm-exp/build/*-agent.qcow2' -print -quit 2>/dev/null || true)
-          base_source=$(sudo find /mnt/data/home -path '*/windows-vm-exp/build/*-golden.raw' -print -quit 2>/dev/null || true)
+          image_source=$(sudo find /mnt/data/home -path '*/windows-vm-exp/build/*-agent.qcow2' -print -quit)
+          base_source=$(sudo find /mnt/data/home -path '*/windows-vm-exp/build/*-golden.raw' -print -quit)
           sudo mkdir -p "$fixture_dir" /ci/windows
           if test -n "$image_source"; then
             sudo cp --reflink=auto --sparse=always "$image_source" "$fixture_dir/image-agent.qcow2"

From 576cf66889f342168371143cfb6089078ec99770 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Fri, 21 Aug 2026 19:30:05 +0000
Subject: [PATCH 25/25] Revert "Restore canonical Windows fixture"

This reverts commit 6258e21a476d859184deaa10da39d94b19c27cd7.
---
 .github/workflows/test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b0fa7389d..0d6908541 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -114,7 +114,7 @@ jobs:
           image_source=$(sudo find /mnt/data/home -path '*/windows-vm-exp/build/*-agent.qcow2' -print -quit)
           base_source=$(sudo find /mnt/data/home -path '*/windows-vm-exp/build/*-golden.raw' -print -quit)
           sudo mkdir -p "$fixture_dir" /ci/windows
-          if test -n "$image_source"; then
+          if ! test -r "$fixture_dir/image-agent.qcow2" && test -n "$image_source"; then
             sudo cp --reflink=auto --sparse=always "$image_source" "$fixture_dir/image-agent.qcow2"
             sudo chmod 0444 "$fixture_dir/image-agent.qcow2"
           fi