diff --git a/nix/vm-tests/agent-ephemeral-rootfs.nix b/nix/vm-tests/agent-ephemeral-rootfs.nix
index e05a26de..5e5098d6 100644
--- a/nix/vm-tests/agent-ephemeral-rootfs.nix
+++ b/nix/vm-tests/agent-ephemeral-rootfs.nix
@@ -103,6 +103,13 @@ pkgs.testers.runNixOSTest {
         ../host-modules/hive-priv.nix
       ];
       virtualisation.memorySize = 2048;
+      # The store is an erofs image, which the kernel can idmap; the default
+      # 9p-backed store cannot. The userns subtest binds the image over the
+      # overlay that writableStore layers on it.
+      virtualisation.useNixStoreImage = true;
+      # With an image the store is read-only unless this is set; `nix-env -i`
+      # writes to it, and register-nix-paths creates /nix/store/.links.
+      virtualisation.writableStore = true;
       # The script `nix-env -i`s these store paths inside the container, which
       # shares the host's store; the VM has no substituter to fetch them.
       virtualisation.additionalPaths = [
@@ -346,6 +353,10 @@ pkgs.testers.runNixOSTest {
         host.succeed(f"stat -c %u:%g {NS_DIR}/config/cfg | grep -x 0:0")
         host.succeed("stat -c %u:%g ${nsSocketDir} | grep -x ${dataOwner}:${dataOwner}")
 
+        # nspawn idmaps the /nix/store bind under a user namespace, which an
+        # overlayfs store refuses; the image under it accepts it. The remaining
+        # steps write nothing to the store.
+        host.succeed("mount --bind /nix/.ro-store /nix/store")
         boot_ns = lambda: (
             host.succeed(f"nixos-container start {NS}"),
             host.wait_until_succeeds(f"nixos-container run {NS} -- systemctl is-active multi-user.target"),
diff --git a/nix/vm-tests/swarm-builder-offline.nix b/nix/vm-tests/swarm-builder-offline.nix
index 340a233d..f81b9a86 100644
--- a/nix/vm-tests/swarm-builder-offline.nix
+++ b/nix/vm-tests/swarm-builder-offline.nix
@@ -247,7 +247,8 @@ pkgs.testers.runNixOSTest {
         machine.succeed(
             "cp --remove-destination $(readlink -f /etc/nix/nix.conf) /etc/nix/nix.conf "
             "&& sed -i 's/^max-jobs = 0$/max-jobs = 1/' /etc/nix/nix.conf "
-            "&& systemctl restart nix-daemon.socket nix-daemon.service"
+            "&& systemctl stop nix-daemon.socket nix-daemon.service "
+            "&& systemctl start nix-daemon.socket"
         )
         machine.succeed(
             "NIX_CONFIG='experimental-features = nix-command' "