diff --git a/tests/unit/test_builtin_agent_images.py b/tests/unit/test_builtin_agent_images.py
index 61fa961..b08b301 100644
--- a/tests/unit/test_builtin_agent_images.py
+++ b/tests/unit/test_builtin_agent_images.py
@@ -21,10 +21,12 @@ class TestBuiltinAgentImages(unittest.TestCase):
                     r"(?m)^FROM node:22-trixie-slim\s*$",
                 )
 
-    def test_all_install_podman(self):
+    def test_none_install_podman(self):
+        # podman lives in the nested-containers derived layer (nested_containers.py),
+        # not in the base agent images, so bottles without the flag pay no cost.
         for dockerfile in _AGENT_DOCKERFILES:
             with self.subTest(provider=dockerfile.parent.name):
-                self.assertRegex(
+                self.assertNotRegex(
                     dockerfile.read_text(),
                     re.compile(r"(?m)^\s*podman(?:\s|\\|$)"),
                 )
diff --git a/tests/unit/test_macos_nested_containers.py b/tests/unit/test_macos_nested_containers.py
index c771500..c6e5fdb 100644
--- a/tests/unit/test_macos_nested_containers.py
+++ b/tests/unit/test_macos_nested_containers.py
@@ -108,7 +108,7 @@ class TestNestedContainersImage(unittest.TestCase):
             calls.append((image, context, dockerfile))
             text = Path(dockerfile).read_text(encoding="utf-8")
             self.assertIn("FROM agent:base", text)
-            self.assertIn("aardvark-dns fuse-overlayfs netavark nftables passt", text)
+            self.assertIn("aardvark-dns fuse-overlayfs netavark nftables passt podman", text)
             self.assertIn("USER node", text)
             self.assertTrue((Path(context) / "nested-containers-init.sh").is_file())
 
@@ -128,7 +128,7 @@ class TestNestedContainersImage(unittest.TestCase):
             seen.append(Path(dockerfile).read_text(encoding="utf-8"))
 
         nested_containers.build_image("agent:base", build)
-        for package in ("passt", "nftables", "aardvark-dns"):
+        for package in ("podman", "passt", "nftables", "aardvark-dns"):
             self.assertIn(package, seen[0])
 
     def test_strips_subordinate_ranges_so_podman_avoids_newuidmap(self) -> None: