diff --git a/nix/vm-tests/agent-ephemeral-rootfs.nix b/nix/vm-tests/agent-ephemeral-rootfs.nix
index b7ec00c7..3088a706 100644
--- a/nix/vm-tests/agent-ephemeral-rootfs.nix
+++ b/nix/vm-tests/agent-ephemeral-rootfs.nix
@@ -132,6 +132,9 @@ pkgs.testers.runNixOSTest {
     def stop():
         host.succeed(f"nixos-container stop {MACHINE}")
 
+    def priv_journal():
+        return host.execute("journalctl -u hive-priv --no-pager | tail -n 30")[1]
+
     def write_flags():
         """What hive-c0re does before every start: one request to hive-priv."""
         req = json.dumps({
@@ -143,11 +146,10 @@ pkgs.testers.runNixOSTest {
         # socat gives up 0.5s after its stdin ends unless told to wait; the
         # salvage copies a whole root, which takes longer.
         out = host.succeed(f"echo '{req}' | socat -t 120 - UNIX-CONNECT:/run/hive/priv.sock")
-        print("hive-priv answered: " + repr(out))
-        print(host.execute("journalctl -u hive-priv --no-pager | tail -n 30")[1])
         lines = out.strip().splitlines()
-        assert lines, "hive-priv sent no response"
-        assert json.loads(lines[-1])["ok"] is True, out
+        # The journal is read only when the assert fires.
+        assert lines, f"hive-priv sent no response; journal:\n{priv_journal()}"
+        assert json.loads(lines[-1])["ok"] is True, f"response={out!r}; journal:\n{priv_journal()}"
 
     def conf():
         return host.succeed(f"cat /etc/nixos-containers/{MACHINE}.conf")