diff --git a/home/.chezmoi.yaml.tmpl b/home/.chezmoi.yaml.tmpl
index d4ce5c2c..9416a798 100644
--- a/home/.chezmoi.yaml.tmpl
+++ b/home/.chezmoi.yaml.tmpl
@@ -95,6 +95,11 @@ status:
   exclude:
     - always
 
+hooks:
+  read-source-state:
+    pre:
+      command: {{ .chezmoi.workingTree }}/home/.chezmoihooks/ensure-pre-requisites.sh
+
 {{/* Here we "export" the variables, so we can access them outside this file */ -}}
 data:
   is_wsl: {{ $wsl }}
diff --git a/home/.chezmoihooks/ensure-pre-requisites.sh b/home/.chezmoihooks/ensure-pre-requisites.sh
new file mode 100755
index 00000000..9217fada
--- /dev/null
+++ b/home/.chezmoihooks/ensure-pre-requisites.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+
+# This script must exit as fast as possible when pre-requisites are already
+# met, so we only import the scripts-library when we really need it.
+
+set -eu
+
+wanted_packages=(
+  git  # used to find the latest revisions of github repositories
+  curl # used to find the latest version of github repositories
+  zsh
+)
+
+missing_packages=()
+
+for package in "${wanted_packages[@]}"; do
+  if ! command -v "${package}" >/dev/null; then
+    missing_packages+=("${package}")
+  fi
+done
+
+if [[ ${#missing_packages[@]} -eq 0 ]]; then
+  exit 0
+fi
+
+# shellcheck source=../.chezmoitemplates/scripts-library
+source "${CHEZMOI_SOURCE_DIR?}/.chezmoitemplates/scripts-library"
+
+log_task "Installing missing packages with APT: ${missing_packages[*]}"
+
+c sudo apt update
+c sudo apt install --yes --no-install-recommends "${missing_packages[@]}"
diff --git a/home/.chezmoiscripts/run_before_30-install-prerequisites.sh.tmpl b/home/.chezmoiscripts/run_before_30-install-prerequisites.sh.tmpl
deleted file mode 100644
index 29f1f8bf..00000000
--- a/home/.chezmoiscripts/run_before_30-install-prerequisites.sh.tmpl
+++ /dev/null
@@ -1,36 +0,0 @@
-#!/bin/bash
-
-# {{ include (joinPath .chezmoi.sourceDir ".chezmoitemplates/scripts-library") }}
-
-# The following line is for ShellCheck to correctly identify the above included library
-true || source ../.chezmoitemplates/scripts-library
-
-readonly wanted_packages=(
-  git  # used to find the latest revisions of github repositories
-  curl # used to find the latest version of github repositories
-  zsh
-  # {{ if not .is_devcontainer }}
-  gpg # used to decrypt the gpg keys of the apt repositories
-  # {{ end }}
-)
-missing_packages=()
-
-for package in "${wanted_packages[@]}"; do
-  if ! command -v "${package}" >/dev/null; then
-    missing_packages+=("${package}")
-  fi
-done
-
-if [[ ${#missing_packages[@]} -gt 0 ]]; then
-  log_task "Installing missing packages with APT: ${missing_packages[*]}"
-
-  # This script also gets called when running rootmoi
-  # {{ if eq .chezmoi.username "root" }}
-  apt_command=(apt)
-  # {{ else }}
-  apt_command=(sudo apt)
-  # {{ end }}
-
-  c "${apt_command[@]}" update
-  c "${apt_command[@]}" install --yes --no-install-recommends "${missing_packages[@]}"
-fi
diff --git a/home/.chezmoitemplates/scripts-library b/home/.chezmoitemplates/scripts-library
index 7017b299..005ad1cc 100644
--- a/home/.chezmoitemplates/scripts-library
+++ b/home/.chezmoitemplates/scripts-library
@@ -83,7 +83,7 @@ function sudo() {
 
   # shellcheck disable=SC2312
   if [[ "$(id -u)" -eq 0 ]]; then
-    if [[ "${exec}" == "true" ]]; then
+    if [[ "${exec}" == true ]]; then
       exec "$@"
     else
       "$@"
@@ -93,7 +93,7 @@ function sudo() {
       log_manual_action "Root privileges are required, please enter your password below"
       command sudo --validate
     fi
-    if [[ "${exec}" == "true" ]]; then
+    if [[ "${exec}" == true ]]; then
       exec sudo "$@"
     else
       command sudo "$@"
@@ -108,7 +108,7 @@ function is_apt_package_installed() {
 }
 
 function not_during_test() {
-  if [[ "${DOTFILES_TEST:-}" == "true" ]]; then
+  if [[ "${DOTFILES_TEST:-}" == true ]]; then
     log_info "Skipping '${*}' because we are in test mode"
   else
     "${@}"
diff --git a/home/dot_config/rootmoi/private_chezmoi.yaml.tmpl b/home/dot_config/rootmoi/private_chezmoi.yaml.tmpl
index b33e6b14..7bb62289 100644
--- a/home/dot_config/rootmoi/private_chezmoi.yaml.tmpl
+++ b/home/dot_config/rootmoi/private_chezmoi.yaml.tmpl
@@ -1,16 +1,28 @@
 {{- $chezmoiData := deepCopy . -}}
 {{- $chezmoiData = unset $chezmoiData "chezmoi" -}}
 
-sourceDir: "{{ joinPath .chezmoi.workingTree "root" }}"
+{{- $sourceDir := joinPath .chezmoi.workingTree "root" -}}
+sourceDir: "{{ $sourceDir }}"
 
 destDir: "/"
 
 verbose: true
 
+# https://github.com/twpayne/chezmoi/issues/3257
+pager: ""
+
 diff:
   exclude:
     - scripts
+status:
+  exclude:
+    - always
+
+hooks:
+  read-source-state:
+    pre:
+      command: {{ $sourceDir }}/.chezmoihooks/ensure-pre-requisites.sh
 
 data:
   non_root_user: "{{ .chezmoi.username }}"
-{{ $chezmoiData | toYaml | indent 2 }}
+  {{- $chezmoiData | toYaml | nindent 2 }}
diff --git a/home/dot_local/bin/executable_rootmoi.tmpl b/home/dot_local/bin/executable_rootmoi.tmpl
index 72f6c03d..1733ec39 100644
--- a/home/dot_local/bin/executable_rootmoi.tmpl
+++ b/home/dot_local/bin/executable_rootmoi.tmpl
@@ -25,7 +25,14 @@ fi
 # shellcheck disable=SC2016
 mkdir -p '{{ $configDir }}' '{{ $cacheDir }}'
 
-sudo exec --preserve-env=PATH -- \
+# We should not use sudo's --preserve-env option because the sudo function will
+# automatically bypass sudo if the user is root already.
+env_args=(env "PATH=${PATH}")
+if [[ "${DOTFILES_TEST:-}" == true ]]; then
+  env_args+=("DOTFILES_TEST=true")
+fi
+
+sudo exec "${env_args[@]}" \
   "${executable}" "$@" \
   --config='{{ $configFile }}' \
   --persistent-state='{{ $persistentStateFile }}' \
diff --git a/root/.chezmoihooks/ensure-pre-requisites.sh b/root/.chezmoihooks/ensure-pre-requisites.sh
new file mode 100755
index 00000000..e5caff6c
--- /dev/null
+++ b/root/.chezmoihooks/ensure-pre-requisites.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+# This script must exit as fast as possible when pre-requisites are already
+# met, so we only import the scripts-library when we really need it.
+
+set -eu
+
+wanted_packages=(
+  gpg # used to decrypt the gpg keys of the apt repositories
+)
+
+missing_packages=()
+
+for package in "${wanted_packages[@]}"; do
+  if ! command -v "${package}" >/dev/null; then
+    missing_packages+=("${package}")
+  fi
+done
+
+if [[ ${#missing_packages[@]} -eq 0 ]]; then
+  exit 0
+fi
+
+# shellcheck source=../.chezmoitemplates/scripts-library
+source "${CHEZMOI_SOURCE_DIR?}/.chezmoitemplates/scripts-library"
+
+log_task "Installing missing packages with APT: ${missing_packages[*]}"
+
+c apt update
+c apt install --yes --no-install-recommends "${missing_packages[@]}"
diff --git a/root/.chezmoiscripts/run_after_10-install-apt-packages.sh.tmpl b/root/.chezmoiscripts/run_after_10-install-apt-packages.sh.tmpl
index 2236cdde..ecd0b466 100644
--- a/root/.chezmoiscripts/run_after_10-install-apt-packages.sh.tmpl
+++ b/root/.chezmoiscripts/run_after_10-install-apt-packages.sh.tmpl
@@ -66,5 +66,13 @@ if [[ ${#missing_packages[@]} -gt 0 ]]; then
   log_task "Installing missing packages with APT: ${missing_packages[*]}"
 
   c apt update --yes
-  c apt install --yes --install-recommends "${missing_packages[@]}"
+
+  if [[ "${DOTFILES_TEST:-}" == true ]]; then
+    log_manual_action "Not installing recommended packages to speed up test mode"
+    recommends_arg="--no-install-recommends"
+  else
+    recommends_arg="--install-recommends"
+  fi
+
+  c apt install --yes "${recommends_arg}" "${missing_packages[@]}"
 fi
diff --git a/root/.chezmoiscripts/run_before_10-install-prerequisites.sh.tmpl b/root/.chezmoiscripts/run_before_10-install-prerequisites.sh.tmpl
deleted file mode 120000
index 8bd25833..00000000
--- a/root/.chezmoiscripts/run_before_10-install-prerequisites.sh.tmpl
+++ /dev/null
@@ -1 +0,0 @@
-../../home/.chezmoiscripts/run_before_30-install-prerequisites.sh.tmpl
\ No newline at end of file
diff --git a/scripts/test.sh b/scripts/test.sh
index b36998c8..be79d014 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -137,7 +137,6 @@ if [[ "${debug}" == "on" ]]; then
 fi
 
 export DOTFILES_TEST=true
-echo 'Defaults env_keep += "DOTFILES_TEST"' | sudo tee /etc/sudoers.d/env_keep
 
 ~/.dotfiles/install.sh
 
@@ -179,6 +178,9 @@ for variant in "${variants[@]}"; do
         cat <<'EOF'
 export IS_WSL=true
 
+# Exercises install-pre-requisites.sh
+sudo apt remove --yes zsh curl git gpg
+
 cat <<'EOM' | sudo tee /usr/local/bin/wslpath
 #!/bin/bash
 
@@ -204,7 +206,7 @@ EOF
         # shellcheck disable=SC2312
         cat <<'EOF'
 sudo apt update --yes
-sudo apt install -y --no-install-recommends gnome-shell
+sudo apt install --yes --no-install-recommends gnome-shell
 EOF
       )"
       ;;