diff --git a/src/daemon/rpmostree-sysroot-upgrader.c b/src/daemon/rpmostree-sysroot-upgrader.c
index 9e15e5e3a8..58a4168657 100644
--- a/src/daemon/rpmostree-sysroot-upgrader.c
+++ b/src/daemon/rpmostree-sysroot-upgrader.c
@@ -774,27 +774,9 @@ prepare_context_for_assembly (RpmOstreeSysrootUpgrader *self,
                               GCancellable             *cancellable,
                               GError                  **error)
 {
-  DnfContext *hifctx = rpmostree_context_get_hif (self->ctx);
-
-  const char *sysroot_path =
-    gs_file_get_path_cached (ostree_sysroot_get_path (self->sysroot));
-  g_autofree char *merge_deployment_dirpath =
-    ostree_sysroot_get_deployment_dirpath (self->sysroot,
-                                           self->cfg_merge_deployment);
-  g_autofree char *merge_deployment_root =
-    g_build_filename (sysroot_path, merge_deployment_dirpath, NULL);
-
-  g_autofree char *reposdir = g_build_filename (merge_deployment_root,
-                                                "etc/yum.repos.d", NULL);
-  g_autofree char *passwddir = g_build_filename (merge_deployment_root,
-                                                 "etc", NULL);
-
-  /* point libhif to the yum.repos.d and os-release of the merge deployment */
-  dnf_context_set_repo_dir (hifctx, reposdir);
-  dnf_context_set_source_root (hifctx, tmprootfs);
-
-  /* point the core to the passwd & group of the merge deployment */
-  rpmostree_context_set_passwd_dir (self->ctx, passwddir);
+  /* make sure yum repos and passwd used are from our cfg merge */
+  rpmostree_context_configure_from_deployment (self->ctx, self->sysroot,
+                                               self->cfg_merge_deployment);
 
   /* load the sepolicy to use during import */
   glnx_unref_object OstreeSePolicy *sepolicy = NULL;
diff --git a/src/libpriv/rpmostree-core.c b/src/libpriv/rpmostree-core.c
index 01c10a0a42..f958a18c4a 100644
--- a/src/libpriv/rpmostree-core.c
+++ b/src/libpriv/rpmostree-core.c
@@ -403,6 +403,28 @@ rpmostree_context_ensure_tmpdir (RpmOstreeContext *self,
   return TRUE;
 }
 
+/* Pick up repos dir and passwd from @cfg_deployment. */
+void
+rpmostree_context_configure_from_deployment (RpmOstreeContext *self,
+                                             OstreeSysroot    *sysroot,
+                                             OstreeDeployment *cfg_deployment)
+{
+  const char *sysroot_path = gs_file_get_path_cached (ostree_sysroot_get_path (sysroot));
+  g_autofree char *cfg_deployment_dirpath =
+    ostree_sysroot_get_deployment_dirpath (sysroot, cfg_deployment);
+  g_autofree char *cfg_deployment_root =
+    g_build_filename (sysroot_path, cfg_deployment_dirpath, NULL);
+
+  g_autofree char *reposdir = g_build_filename (cfg_deployment_root, "etc/yum.repos.d", NULL);
+
+  /* point libhif to the yum.repos.d and os-release of the merge deployment */
+  dnf_context_set_repo_dir (self->hifctx, reposdir);
+
+  /* point the core to the passwd & group of the merge deployment */
+  g_assert (!self->passwd_dir);
+  self->passwd_dir = g_build_filename (cfg_deployment_root, "etc", NULL);
+}
+
 /* Use this if no packages will be installed, and we just want a "dummy" run.
  */
 void
@@ -438,14 +460,6 @@ rpmostree_context_set_sepolicy (RpmOstreeContext *self,
   g_set_object (&self->sepolicy, sepolicy);
 }
 
-void
-rpmostree_context_set_passwd_dir (RpmOstreeContext *self,
-                                  const char *passwd_dir)
-{
-  g_clear_pointer (&self->passwd_dir, g_free);
-  self->passwd_dir = g_strdup (passwd_dir);
-}
-
 DnfContext *
 rpmostree_context_get_hif (RpmOstreeContext *self)
 {
@@ -531,7 +545,14 @@ rpmostree_context_setup (RpmOstreeContext    *self,
   /* This exists (as a canonically empty dir) at least on RHEL7+ */
   static const char emptydir_path[] = "/usr/share/empty";
 
-  self->spec = g_object_ref (spec);
+  /* allow NULL for treespec, but canonicalize to an empty keyfile for cleaner queries */
+  if (!spec)
+    {
+      g_autoptr(GKeyFile) kf = g_key_file_new ();
+      self->spec = rpmostree_treespec_new_from_keyfile (kf, NULL);
+    }
+  else
+    self->spec = g_object_ref (spec);
 
   g_variant_dict_lookup (self->spec->dict, "releasever", "&s", &releasever);
 
diff --git a/src/libpriv/rpmostree-core.h b/src/libpriv/rpmostree-core.h
index ea3b0c9812..2ef0241fcb 100644
--- a/src/libpriv/rpmostree-core.h
+++ b/src/libpriv/rpmostree-core.h
@@ -60,6 +60,11 @@ gboolean rpmostree_context_setup (RpmOstreeContext     *self,
                                   GCancellable  *cancellable,
                                   GError       **error);
 
+void
+rpmostree_context_configure_from_deployment (RpmOstreeContext *self,
+                                             OstreeSysroot    *sysroot,
+                                             OstreeDeployment *cfg_deployment);
+
 void rpmostree_context_set_is_empty (RpmOstreeContext *self);
 
 void rpmostree_context_set_repos (RpmOstreeContext *self,
@@ -67,8 +72,6 @@ void rpmostree_context_set_repos (RpmOstreeContext *self,
                                   OstreeRepo       *pkgcache_repo);
 void rpmostree_context_set_sepolicy (RpmOstreeContext *self,
                                      OstreeSePolicy   *sepolicy);
-void rpmostree_context_set_passwd_dir (RpmOstreeContext *self,
-                                       const char *passwd_dir);
 
 void rpmostree_dnf_add_checksum_goal (GChecksum *checksum, HyGoal goal);
 char *rpmostree_context_get_state_sha512 (RpmOstreeContext *self);