diff --git a/tests/common/libvm.sh b/tests/common/libvm.sh
index 5abb43e1..c299f3dc 100644
--- a/tests/common/libvm.sh
+++ b/tests/common/libvm.sh
@@ -74,15 +74,34 @@ vm_has_packages() {
   done
 }
 
+# retrieve info from the booted deployment
+# - $1   key to retrieve
+vm_get_booted_deployment_info() {
+  key=$1
+  vm_cmd rpm-ostree status --json | \
+    python -c "
+import sys, json
+deployments = json.load(sys.stdin)[\"deployments\"]
+booted = None
+for deployment in deployments:
+  if deployment[\"booted\"]:
+    booted = deployment
+    break
+if not booted:
+  print \"Failed to determine currently booted deployment\"
+  exit(1)
+if \"$key\" in booted:
+  data = booted[\"$key\"]
+  if type(data) is list:
+    print \" \".join(data)
+  else:
+    print data
+"
+}
+
 # print the layered packages
 vm_get_layered_packages() {
-  vm_cmd rpm-ostree status --json | \
-    python -c '
-import sys, json
-depl = json.load(sys.stdin)["deployments"][0]
-if "packages" in depl:
-  print " ".join(depl["packages"])
-'
+  vm_get_booted_deployment_info packages
 }
 
 # check that the packages are currently layered
@@ -95,3 +114,8 @@ vm_has_layered_packages() {
     fi
   done
 }
+
+# retrieve the checksum of the currently booted deployment
+vm_get_booted_csum() {
+  vm_get_booted_deployment_info checksum
+}
diff --git a/tests/vmcheck/test-layering.sh b/tests/vmcheck/test-layering.sh
index c7986539..33e4ffc3 100755
--- a/tests/vmcheck/test-layering.sh
+++ b/tests/vmcheck/test-layering.sh
@@ -24,15 +24,6 @@ set -e
 
 set -x
 
-# XXX: this should be done by the test harness
-test_cleanup() {
-  if vm_has_packages foo; then
-    vm_cmd rpm-ostree rollback
-    vm_reboot
-  fi
-}
-trap 'test_cleanup; _cleanup_tmpdir' EXIT
-
 # make sure package foo is not already layered
 if vm_has_files /usr/bin/foo; then
   assert_not_reached "/usr/bin/foo already present"
diff --git a/tests/vmcheck/test.sh b/tests/vmcheck/test.sh
index 21f3754a..2a7d3e3e 100644
--- a/tests/vmcheck/test.sh
+++ b/tests/vmcheck/test.sh
@@ -12,11 +12,23 @@ export SCP="scp -F $PWD/ssh-config"
 . ${commondir}/libvm.sh
 
 # stand up ssh connection and sanity check that it all works
-if ! vm_ssh_wait 10; then
+if ! vm_ssh_wait 20; then
   echo "ERROR: A running VM is required for 'make vmcheck'."
   exit 1
 fi
 
+unlocked_cur=$(vm_get_booted_deployment_info unlocked)
+if [[ $unlocked_cur != none ]]; then
+  echo "ERROR: VM is unlocked."
+  exit 1
+fi
+
+# remember the csum we're currently on and tag it so that ostree doesn't wipe it
+csum_orig=$(vm_get_booted_csum)
+vm_cmd ostree rev-parse $csum_orig &> /dev/null # validate
+vm_cmd ostree refs vmcheck_orig --delete
+vm_cmd ostree refs $csum_orig --create vmcheck_orig
+
 LOG=${LOG:-"$PWD/vmcheck.log"}
 echo -n '' > ${LOG}
 
@@ -51,6 +63,18 @@ for tf in $(find . -name 'test-*.sh' | sort); do
             let "failures += 1"
         fi
     fi
+
+    # go back to the original vmcheck deployment if needed
+    csum_cur=$(vm_get_booted_csum)
+    unlocked_cur=$(vm_get_booted_deployment_info unlocked)
+    if [[ $csum_orig != $csum_cur ]] || \
+       [[ $unlocked_cur != none ]]; then
+      # redeploy under the name 'vmcheck' so that tests can never modify the
+      # vmcheck_orig ref itself (e.g. package layering)
+      vm_cmd ostree commit -b vmcheck --tree=ref=vmcheck_orig
+      vm_cmd ostree admin deploy vmcheck
+      vm_reboot
+    fi
 done
 
 # tear down ssh connection