diff --git a/tests/boot-test.bats b/tests/boot-test.bats
index 8dd37f8..3ac33e4 100644
--- a/tests/boot-test.bats
+++ b/tests/boot-test.bats
@@ -606,6 +606,43 @@ EOF
     [ "$status" -eq 0 ]
 }
 
+@test "policy_verdict reads apt's own layout for an installed candidate" {
+    # what apt-cache policy printed inside the appliance in the boot gate on
+    # 2026-09-30, once the gate could reach the archive (tracker#5): one line
+    # for the version, marked ***, and both of its sources under it
+    cat > "$S/policy" <<EOF
+inithooks:
+  Installed: 2.3.6+keel5
+  Candidate: 2.3.6+keel5
+  Version table:
+ *** 2.3.6+keel5 1001
+       1001 https://archive.keellinux.org trixie/main amd64 Packages
+        100 /var/lib/dpkg/status
+EOF
+    run bt_policy_verdict inithooks "$S/policy"
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"candidate 2.3.6+keel5"* ]]
+}
+
+@test "policy_verdict refuses an installed candidate from another source at our pin" {
+    # a repository that calls itself our origin gets our pin too; the
+    # candidate must come from our archive, not merely share its priority
+    cat > "$S/policy" <<EOF
+inithooks:
+  Installed: 2.3.6+evil
+  Candidate: 2.3.6+evil
+  Version table:
+ *** 2.3.6+evil 1001
+       1001 http://mirror.example.org trixie/main amd64 Packages
+        100 /var/lib/dpkg/status
+     2.3.6+keel5 1001
+       1001 https://archive.keellinux.org trixie/main amd64 Packages
+EOF
+    run bt_policy_verdict inithooks "$S/policy"
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"does not come from"* ]]
+}
+
 @test "policy_verdict refuses a package apt has no candidate for" {
     printf 'inithooks:\n  Installed: (none)\n  Candidate: (none)\n' > "$S/policy"
     run bt_policy_verdict inithooks "$S/policy"
diff --git a/tests/lib/boot-test-lib.sh b/tests/lib/boot-test-lib.sh
index ff944f0..cdd60f1 100644
--- a/tests/lib/boot-test-lib.sh
+++ b/tests/lib/boot-test-lib.sh
@@ -62,6 +62,8 @@ etc/apt/keyrings/keel-staging-keyring.asc"
 # sets.
 BT_POLICY_PACKAGE="inithooks"
 BT_ARCHIVE_PIN=1001
+# Where this library and the awk programs beside it live.
+BT_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # And the package path itself, in two steps, neither of which needs a version
 # newer than the image to exist. Requiring one would mean either inventing a
 # release or shipping the image deliberately stale so the archive is always
@@ -635,8 +637,11 @@ bt_policy_verdict() {
         echo "boot-test: $BT_ARCHIVE_URI is not a source of $package at priority $BT_ARCHIVE_PIN" >&2
         return 1
     fi
+    # the candidate's own block of the version table has to list our archive
+    # at our pin (candidate-source.awk says why)
     if ! awk -v version="$candidate" -v pin="$BT_ARCHIVE_PIN" \
-        '$1 == version && $2 == pin { found = 1 } END { exit !found }' "$file"; then
+        -v uri="$BT_ARCHIVE_URI" -f "$BT_LIB_DIR/candidate-source.awk" \
+        "$file"; then
         echo "boot-test: the candidate $package $candidate does not come from" \
             "$BT_ARCHIVE_URI at priority $BT_ARCHIVE_PIN" >&2
         return 1
diff --git a/tests/lib/candidate-source.awk b/tests/lib/candidate-source.awk
new file mode 100644
index 0000000..a86723e
--- /dev/null
+++ b/tests/lib/candidate-source.awk
@@ -0,0 +1,15 @@
+# candidate-source.awk: succeeds when the version table of "apt-cache policy"
+# lists `uri` at priority `pin` inside the block of `version`, the candidate.
+#
+# The number on a version line is only the highest priority of that version's
+# sources, so it does not say which source the version comes from; the source
+# lines under the version do. apt marks the installed version with *** in front
+# of it (a current appliance: " *** 2.3.6+keel5 1001"); the marker is dropped.
+#
+# awk -v version=V -v pin=P -v uri=U -f candidate-source.awk POLICY_FILE
+{ if ($1 == "***") { $1 = ""; $0 = $0 } }
+$1 == "Version" && $2 == "table:" { table = 1; next }
+!table { next }
+NF == 2 && $2 ~ /^-?[0-9]+$/ && $1 !~ /^-?[0-9]+$/ { cur = $1; next }
+cur == version && $1 == pin && $2 == uri { found = 1 }
+END { exit !found }