diff --git a/tests/e2e/core/upgrade/network/test_offline_and_flaky.py b/tests/e2e/core/upgrade/network/test_offline_and_flaky.py
index 6a954f0c88..ce5dfccbf7 100644
--- a/tests/e2e/core/upgrade/network/test_offline_and_flaky.py
+++ b/tests/e2e/core/upgrade/network/test_offline_and_flaky.py
@@ -53,9 +53,9 @@ def test_offline_update_fails_fast_and_changes_nothing(inst):
     before = inst.state()
     r = inst.hermes("update", "--yes", edge=None, timeout=300)
     assert r.secs < FAST, f"an offline update took {r.secs:.0f}s to give up\n" + r.report(inst)
+    S.assert_nothing_changed(inst, before, r, "offline update")
     assert "unavailable" in r.out.lower() or "cannot reach" in r.out.lower(), (
         "the offline failure does not say the network was unreachable\n" + r.report(inst))
-    S.assert_nothing_changed(inst, before, r, "offline update")
 
 
 def test_offline_provisioning_of_a_missing_tool_fails_loudly(inst):
@@ -66,11 +66,11 @@ def test_offline_provisioning_of_a_missing_tool_fails_loudly(inst):
         before = inst.state()
         r = inst.hermes("pm", "install", "ripgrep", edge=None, timeout=300)
         assert r.secs < FAST, f"offline provisioning took {r.secs:.0f}s to give up\n" + r.report(inst)
+        S.assert_nothing_changed(inst, before, r, "offline `hermes pm install ripgrep`")
         assert "ripgrep" in r.out and "download failed" in r.out, (
             "the failure does not name the tool and the failed download\n" + r.report(inst))
         assert not (inst.sb.hermes_home / "tools" / tool["entry"]).exists(), (
             "an offline install left a store entry behind\n" + r.report(inst))
-        S.assert_nothing_changed(inst, before, r, "offline `hermes pm install ripgrep`")
 
 
 def test_channel_503_with_retry_after_is_retried_then_updates(inst):
@@ -105,8 +105,8 @@ def test_channel_outage_fails_truthfully_within_bounds(inst):
     finally:
         edge.close()
     assert r.secs < FAST, f"a persistent 503 took {r.secs:.0f}s to give up\n" + r.report(inst)
-    assert "503" in r.out and "channel" in r.out.lower(), "the failure does not name the 503 from the channel\n" + r.report(inst)
     S.assert_nothing_changed(inst, before, r, "channel outage")
+    assert "503" in r.out and "channel" in r.out.lower(), "the failure does not name the 503 from the channel\n" + r.report(inst)
 
 
 def test_forge_rate_limit_fails_truthfully(inst):
@@ -121,8 +121,8 @@ def test_forge_rate_limit_fails_truthfully(inst):
     finally:
         edge.close()
     assert r.secs < FAST * 2, f"a rate-limited fetch took {r.secs:.0f}s to give up\n" + r.report(inst)
-    assert "429" in r.out or "rate limit" in r.out.lower(), "the failure does not say the forge rate-limited\n" + r.report(inst)
     S.assert_nothing_changed(inst, before, r, "forge rate limit")
+    assert "429" in r.out or "rate limit" in r.out.lower(), "the failure does not say the forge rate-limited\n" + r.report(inst)
 
 
 # Where each tool's pinned artifact is downloaded from, as the PM lock declares it; the edge
diff --git a/tests/e2e/core/upgrade/network/test_proxy_only_egress.py b/tests/e2e/core/upgrade/network/test_proxy_only_egress.py
index dd09c81fed..ad9c009a55 100644
--- a/tests/e2e/core/upgrade/network/test_proxy_only_egress.py
+++ b/tests/e2e/core/upgrade/network/test_proxy_only_egress.py
@@ -115,6 +115,6 @@ def test_tunnel_cut_to_channel_host_fails_fast_and_changes_nothing(inst):
     finally:
         edge.close()
     assert r.secs < 60, f"a cut tunnel took {r.secs:.0f}s to fail\n" + r.report(inst)
+    S.assert_nothing_changed(inst, before, r, "tunnel cut to the channel host")
     assert "channel" in r.out.lower() and "unavailable" in r.out.lower(), (
         "the failure does not say the release channel was unreachable\n" + r.report(inst))
-    S.assert_nothing_changed(inst, before, r, "tunnel cut to the channel host")
diff --git a/tests/e2e/core/upgrade/network/test_release_channel_records.py b/tests/e2e/core/upgrade/network/test_release_channel_records.py
index 166150e2b3..58140d0e72 100644
--- a/tests/e2e/core/upgrade/network/test_release_channel_records.py
+++ b/tests/e2e/core/upgrade/network/test_release_channel_records.py
@@ -74,9 +74,9 @@ def test_valid_stable_record_lands_exactly_on_its_commit(inst):
 
 
 def _refused(inst: S.Installed, r: S.Result, before: dict, what: str) -> None:
+    S.assert_nothing_changed(inst, before, r, what)
     assert "stable" in r.out and "No update was applied" in r.out, (
         f"{what}: the refusal does not name the stable channel and say nothing was applied\n" + r.report(inst))
-    S.assert_nothing_changed(inst, before, r, what)
 
 
 UNAVAILABLE = {