diff --git a/tools/tests/test_ci_checks.py b/tools/tests/test_ci_checks.py
index edeb6dec0..dd26885fb 100644
--- a/tools/tests/test_ci_checks.py
+++ b/tools/tests/test_ci_checks.py
@@ -2,6 +2,7 @@ import itertools
 import os
 from pathlib import Path
 import subprocess
+import tempfile
 import unittest
 
 import yaml
@@ -11,6 +12,28 @@ ROOT = Path(__file__).resolve().parents[2]
 
 
 class CiChecksTest(unittest.TestCase):
+    def test_dependency_update_errors_block_installation(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            sudo = root / 'sudo'
+            sudo.write_text('#!/bin/bash\nprintf "%s\\n" "$*" >> "$APT_LOG"\nexit "${APT_RESULT:-0}"\n')
+            sudo.chmod(0o755)
+            log = root / 'apt.log'
+            env = dict(os.environ, PATH=str(root) + os.pathsep + os.environ['PATH'], APT_LOG=str(log))
+            installer = ROOT / 'tools/ci/install-ubuntu-packages.sh'
+            result = subprocess.run(['bash', str(installer), 'qemu-user'], env=dict(env, APT_RESULT='17'))
+            self.assertEqual(result.returncode, 17)
+            self.assertEqual(len(log.read_text().splitlines()), 1)
+            log.unlink()
+            subprocess.run(['bash', str(installer), 'qemu-user'], env=env, check=True)
+            update, install = log.read_text().splitlines()
+            for command in (update, install):
+                self.assertIn('Dir::Etc::sourceparts=-', command)
+                self.assertIn('Acquire::https::Timeout=30', command)
+                self.assertIn('Acquire::Retries=3', command)
+            self.assertIn('APT::Update::Error-Mode=any', update)
+            self.assertIn('install -y -qq --no-install-recommends qemu-user', install)
+
     def test_required_status_rejects_failed_cancelled_or_skipped_test_jobs(self):
         jobs = yaml.safe_load((ROOT / '.github/workflows/build.yml').read_text())['jobs']
         gate = jobs['checks']