diff --git a/scripts/install-apt.sh b/scripts/install-apt.sh
index ab9038f..b9f862c 100755
--- a/scripts/install-apt.sh
+++ b/scripts/install-apt.sh
@@ -102,7 +102,7 @@ ensure_nodejs_source() {
 
 echo "Adding APT source for $FORGE_URL/$OWNER ..."
 $SUDO install -d -m 0755 "$APT_ETC/keyrings"
-curl "${CURL_AUTH[@]}" -fsSL "$FORGE_URL/api/packages/$OWNER/debian/repository.key" | $SUDO tee "$KEYRING" >/dev/null
+$SUDO curl "${CURL_AUTH[@]}" -fsSL "$FORGE_URL/api/packages/$OWNER/debian/repository.key" | $SUDO tee "$KEYRING" >/dev/null
 echo "deb [signed-by=$KEYRING] $FORGE_URL/api/packages/$OWNER/debian $DISTRIBUTION $COMPONENT" \
   | $SUDO tee "$LIST" >/dev/null
 # tee inherits our umask; apt's unprivileged _apt user must be able to
@@ -115,7 +115,7 @@ $SUDO chmod 0644 "$KEYRING" "$LIST"
 # is fatal; any other curl outcome (e.g. a network hiccup) is left for
 # apt-get update to report.
 RELEASE_URL="$FORGE_URL/api/packages/$OWNER/debian/dists/$DISTRIBUTION/Release"
-if [ "$(curl "${CURL_AUTH[@]}" -sSL -o /dev/null -w '%{http_code}' "$RELEASE_URL" || true)" = "404" ]; then
+if [ "$($SUDO curl "${CURL_AUTH[@]}" -sSL -o /dev/null -w '%{http_code}' "$RELEASE_URL" || true)" = "404" ]; then
   echo "error: no stoke package has been published to the $OWNER Debian registry yet" >&2
   echo "($RELEASE_URL returned 404)." >&2
   echo "Install stoke via npm or manually instead — see the README." >&2
diff --git a/test/install-apt.test.js b/test/install-apt.test.js
index 3c6529e..93a5b4e 100644
--- a/test/install-apt.test.js
+++ b/test/install-apt.test.js
@@ -41,10 +41,16 @@ function runScenario({ candInitial, candAfterUpdate, candAfterNodesource, preexi
 
   // Force the non-root path so every mutation goes through the sudo stub.
   stub('id', 'echo 1000');
-  stub('sudo', 'exec "$@"');
+  stub('sudo', 'SUDO_ACTIVE=1 exec "$@"');
   // Registry Release-file probes (URLs under /dists/) answer with the
   // scenario's HTTP status; everything else is a key fetch.
   stub('curl', [
+    'uses_netrc=false',
+    'for a in "$@"; do [ "$a" = "--netrc-file" ] && uses_netrc=true; done',
+    'if [ "$uses_netrc" = true ] && [ "${SUDO_ACTIVE:-}" != 1 ]; then',
+    '  echo "curl: root-owned netrc is unreadable without sudo" >&2',
+    '  exit 77',
+    'fi',
     'for a in "$@"; do',
     '  case "$a" in */dists/*) echo "${RELEASE_STATUS:-200}"; exit 0;; esac',
     'done',