diff --git a/cache_images/fedora-netavark_packaging.sh b/cache_images/fedora-netavark_packaging.sh
index 2d310189..6b507339 100644
--- a/cache_images/fedora-netavark_packaging.sh
+++ b/cache_images/fedora-netavark_packaging.sh
@@ -61,13 +61,17 @@ INSTALL_PACKAGES=(\
     zip
 )
 
+# Downstream users of this image are specifically testing netavark & aardvark-dns.
+# They will take care of either building or obtaining the relelvent binaries
+# at runtime.  Similar for cargo and rust.  Ensure these are absent, to allow
+# runtime install of newer bits.
 EXARG="--exclude=netavark --exclude=aardvark-dns --exclude=cargo --exclude=rust"
 
 msg "Installing general build/test dependencies"
 bigto $SUDO dnf install -y $EXARG "${INSTALL_PACKAGES[@]}"
 
-# It was observed in F33, dnf install doesn't always get you the latest/greatest
-lilto $SUDO dnf update -y
+# It was observed in F33, dnf install doesn't always get you the latest/greatest.
+lilto $SUDO dnf update -y $EXARG
 
 msg "Initializing upstream rust environment."
 export CARGO_HOME="/var/cache/cargo"  # must match .cirrus.yml in netavark repo