diff --git a/openpilot/system/updated/tests/test_fast_request.py b/openpilot/system/updated/tests/test_fast_request.py
index 67d22f744a..82b78a28a3 100644
--- a/openpilot/system/updated/tests/test_fast_request.py
+++ b/openpilot/system/updated/tests/test_fast_request.py
@@ -1,6 +1,7 @@
 from pathlib import Path
 import tempfile
 import threading
+import time
 import sys
 from types import ModuleType
 import unittest
@@ -41,6 +42,7 @@ class TestFastRequest(unittest.TestCase):
     self.helper.request_lock = threading.RLock()
     self.helper.request_generation = 0
     self.helper.fast_target = None
+    self.helper.metadata = None
     self.helper.user_request = self.updated.UserRequest.NONE
     self.helper._control_request('fast', branch='SecretGoodStarPilot', commit='a' * 40)
     self.helper.sleep = Mock(side_effect=StopLoop)
@@ -67,15 +69,22 @@ class TestFastRequest(unittest.TestCase):
     actual = module.Updater()
     actual.params = self.params
     actual._branches_checked = True
+    actual._checked_branch = "SecretGoodStarPilot"
     actual.branches = {"SecretGoodStarPilot": "a" * 40}
     self.values["UpdaterTargetBranch"] = "SecretGoodStarPilot"
     module.run = Mock(return_value="a" * 40)
     module.setup_git_options = Mock()
     module.set_consistent_flag = Mock()
+    module.init_overlay = Mock()
     module.validate_revision = Mock()
     module.AGNOS = False
+    self.updater.target_branch = "SecretGoodStarPilot"
+    self.updater._checked_branch = "SecretGoodStarPilot"
+    self.updater._checked_at = time.monotonic()
     for failure in (False, True):
       with self.subTest(failure=failure):
+        module.init_overlay.reset_mock()
+        module.validate_revision.reset_mock()
         self.writes.clear()
         self.values.pop("LastUpdateTime", None)
         self.helper._control_request("download")
@@ -95,6 +104,11 @@ class TestFastRequest(unittest.TestCase):
         self.assertEqual(states[-1], "idle")
         self.assertEqual("LastUpdateTime" in self.values, not failure)
         module.finalize_update.assert_called_once()
+        module.init_overlay.assert_called_once_with()
+        self.assertEqual(module.validate_revision.call_args_list, [
+          mock.call(module.OVERLAY_MERGED, 'a' * 40),
+          mock.call(module.OVERLAY_MERGED, 'HEAD'),
+        ])
 
   def test_fast_request_skips_staging_and_startup_delay(self):
     self.run_cycle()
diff --git a/openpilot/system/updated/tests/test_unpublished_branch.py b/openpilot/system/updated/tests/test_unpublished_branch.py
index 75b32d6414..4a3696d4d1 100644
--- a/openpilot/system/updated/tests/test_unpublished_branch.py
+++ b/openpilot/system/updated/tests/test_unpublished_branch.py
@@ -24,6 +24,8 @@ class TestUnpublishedBranch(unittest.TestCase):
     self.finalized = self.root / "finalized"
     self.updated = load_updater()
     self.updated.OVERLAY_MERGED = str(self.merged)
+    self.metadata = self.root / "metadata.git"
+    self.updated.METADATA_ROOT = self.metadata
     self.updated.FINALIZED = str(self.finalized)
     self.updated.BASEDIR = str(self.merged)
     self.updated.setup_git_options = Mock()
@@ -35,13 +37,28 @@ class TestUnpublishedBranch(unittest.TestCase):
     self.commands = []
     self.remote_heads = f"{REMOTE}\trefs/heads/another-branch\n"
 
-    def run(command, cwd):
-      self.assertEqual(cwd, str(self.merged))
+    def run(command, cwd, **kwargs):
       self.commands.append(command)
+      if command == ["git", "init", "--bare", str(self.metadata)]:
+        self.assertEqual(cwd, str(self.root))
+        self.metadata.mkdir()
+        (self.metadata / "HEAD").write_text("ref: refs/heads/main\n")
+        return ""
+      if command == ["git", "remote", "get-url", "origin"]:
+        self.assertEqual(cwd, str(self.merged))
+        return "https://example.invalid/updater-test.git"
+      self.assertEqual(cwd, str(self.metadata))
+      if command == ["git", "config", "remote.origin.url", "https://example.invalid/updater-test.git"]:
+        return ""
       if command == ["git", "ls-remote", "--heads", "origin"]:
         return self.remote_heads
-      if command == ["git", "ls-remote", "origin", "HEAD"]:
-        return f"{REMOTE}\tHEAD\n"
+      if command in (
+        ["git", "fetch", "--progress", f"--depth={self.updated.MAX_COMMITS}", "--filter=blob:none", "--no-tags", "--no-recurse-submodules",
+         "origin", f"+{commit}:refs/remotes/origin/{TARGET}"] for commit in (CURRENT, REMOTE)
+      ):
+        return ""
+      if command in (["git", "update-ref", f"refs/starpilot/recent/{TARGET}", commit] for commit in (CURRENT, REMOTE)):
+        return ""
       raise AssertionError(f"Unexpected command: {command}")
 
     self.updated.run = run
@@ -73,7 +90,12 @@ class TestUnpublishedBranch(unittest.TestCase):
     self.assertFalse(self.updater.fetch_update())
     self.assertEqual(self.updater.branches, {"another-branch": REMOTE})
     self.updated.set_consistent_flag.assert_not_called()
-    self.assertNotIn("UpdateAvailable", self.updater.params.values)
+    self.assertIs(self.updater.params.values["UpdateAvailable"], False)
+    self.assertIs(self.updater.params.values["UpdaterFetchAvailable"], False)
+    self.assertIn("UpdaterLastCheckTime", self.updater.params.values)
+    self.assertEqual(self.commands.count(["git", "ls-remote", "--heads", "origin"]), 1)
+    self.assertFalse(any(command[:2] == ["git", "fetch"] for command in self.commands))
+    self.assertNotIn("UpdaterState", self.updater.params.values)
 
   def test_published_same_and_different_commit(self):
     self.remote_heads += f"{CURRENT}\trefs/heads/{TARGET}\n"
@@ -103,7 +125,7 @@ class TestUnpublishedBranch(unittest.TestCase):
     self.updater.check_for_update()
     self.assertTrue(self.updater.update_available)
 
-    def failed_run(command, cwd):
+    def failed_run(command, cwd, **kwargs):
       if command == ["git", "ls-remote", "--heads", "origin"]:
         raise subprocess.CalledProcessError(128, command, output="network failed")
       return f"{REMOTE}\tHEAD\n"
diff --git a/prebuilt.json b/prebuilt.json
index 724473cd37..85519ba1a5 100644
--- a/prebuilt.json
+++ b/prebuilt.json
@@ -1 +1 @@
-{"protected_inventory_sha256": "ae583fdcc5160210f561425b9f97e338b9eb61e23728ae16333c5ea6e70e3ab8", "schema_version": 1}
+{"protected_inventory_sha256": "88dac1f222a4933bcf39c304233603737879ebd15d4b078913aae986b465d1e8", "schema_version": 1}