diff --git a/nix/vm-tests/full-setup.nix b/nix/vm-tests/full-setup.nix
index 31eb4e1e9..5721387af 100644
--- a/nix/vm-tests/full-setup.nix
+++ b/nix/vm-tests/full-setup.nix
@@ -1,7 +1,6 @@
 # `vmTests.<system>.full-setup`: one VM runs a whole single-host swarm
-# (`deploy.singleHostSwarm`) with no network and no substituter, and a script
-# walks docs/1-getting-started/setup.md until the controller has committed the
-# agents' meta flake to the swarm's forge.
+# (`deploy.singleHostSwarm`) with no network and no substituter, and a script walks
+# docs/1-getting-started/setup.md until the agents are deployed and need a login.
 #
 # Steps of setup.md, as the script runs them:
 #   1 secret store  `bao operator init`, the granter bootstrap with the root
@@ -15,11 +14,12 @@
 #   9 first agent   The same endpoint, for `iris`: `swarmctl agent create` has no
 #                   archetype flag, and a custom agent's config repo would need
 #                   inputs the VM cannot resolve offline.
-# `swarmctl setup status` is read last: step 9 (the product's `ruth`) stays undone.
-# Not scripted yet; a later slice adds them: step 3, the first SSO login to the
-# forge (an OIDC code flow against authelia), `swarmctl forge make-admin`, and
-# the agents' deploy up to the point where each says it needs a login. Green
-# when `internal/meta` on the forge holds the flake the toplevels were built from.
+# `swarmctl setup status` is read before the agents deploy: steps 1-6 done; step 9
+# (the product's hard-coded `ruth`) stays undone, as no root agent exists here. Not
+# scripted yet: step 3, the first SSO login to the forge (an OIDC code flow against
+# authelia), and `swarmctl forge make-admin`.
+# Green when `GET /api/agents/status` on the controller socket lists `iris` and
+# `spawn` with `freshness` fresh and `needs_login` true.
 #
 # Offline: the test seeds the swarm's forge with `hyperhive/hyperhive` (one
 # commit of `self`, ./hyperhive-fixture-repo.nix). The controller renders
@@ -405,7 +405,14 @@ pkgs.testers.runNixOSTest (
               raise Exception("swarmctl setup status did not report the steps done so far:\n" + "\n".join(lines))
           assert machine.execute("swarmctl setup status >/dev/null")[0] == 1
 
-      # The agents' deploy and the check that they need a login are not scripted yet.
+      with subtest("the agents are deployed and need a login"):
+          settle(
+              f"curl --fail --silent --unix-socket {SOCKET} {API}/api/agents/status "
+              "| jq -e '[.[] | select(.hive == \"" + HIVE + "\" and .freshness == \"fresh\" and .needs_login == true)"
+              " | .name] | contains([\"iris\", \"spawn\"])'",
+              2400,
+              ["swarm-controller", "hive-c0re"],
+          )
     '';
   }
 )