diff --git a/tests/nixos/git-submodules.nix b/tests/nixos/git-submodules.nix
index b18300a91..a82ddf418 100644
--- a/tests/nixos/git-submodules.nix
+++ b/tests/nixos/git-submodules.nix
@@ -46,6 +46,7 @@
       remote.wait_for_unit("sshd")
       remote.wait_for_unit("multi-user.target")
       remote.wait_for_unit("network-online.target")
+      client.wait_for_unit("network-online.target")
       client.succeed(f"ssh -o StrictHostKeyChecking=no {remote.name} 'echo hello world'")
 
       remote.succeed("""
diff --git a/tests/nixos/github-flakes.nix b/tests/nixos/github-flakes.nix
index 8e646f6dd..69d1df410 100644
--- a/tests/nixos/github-flakes.nix
+++ b/tests/nixos/github-flakes.nix
@@ -161,7 +161,9 @@ in
          github.succeed("cat /var/log/httpd/*.log >&2")
 
     github.wait_for_unit("httpd.service")
+    github.wait_for_unit("network-online.target")
 
+    client.wait_for_unit("network-online.target")
     client.succeed("curl -v https://github.com/ >&2")
     out = client.succeed("nix registry list")
     print(out)
diff --git a/tests/nixos/nix-docker.nix b/tests/nixos/nix-docker.nix
index dfd508988..00b04482c 100644
--- a/tests/nixos/nix-docker.nix
+++ b/tests/nixos/nix-docker.nix
@@ -37,6 +37,7 @@ in {
 
   testScript = { nodes }: ''
     cache.wait_for_unit("harmonia.service")
+    cache.wait_for_unit("network-online.target")
 
     machine.succeed("mkdir -p /etc/containers")
     machine.succeed("""echo '{"default":[{"type":"insecureAcceptAnything"}]}' > /etc/containers/policy.json""")
diff --git a/tests/nixos/nss-preload.nix b/tests/nixos/nss-preload.nix
index 610769c8d..b7e704f39 100644
--- a/tests/nixos/nss-preload.nix
+++ b/tests/nixos/nss-preload.nix
@@ -102,6 +102,7 @@ in
   };
 
   testScript = { nodes, ... }: ''
+    http_dns.wait_for_unit("network-online.target")
     http_dns.wait_for_unit("nginx")
     http_dns.wait_for_open_port(80)
     http_dns.wait_for_unit("unbound")
@@ -109,6 +110,7 @@ in
 
     client.start()
     client.wait_for_unit('multi-user.target')
+    client.wait_for_unit('network-online.target')
 
     with subtest("can fetch data from a remote server outside sandbox"):
         client.succeed("nix --version >&2")
diff --git a/tests/nixos/s3-binary-cache-store.nix b/tests/nixos/s3-binary-cache-store.nix
index 83b85c032..f8659b830 100644
--- a/tests/nixos/s3-binary-cache-store.nix
+++ b/tests/nixos/s3-binary-cache-store.nix
@@ -52,12 +52,15 @@ in {
 
     # Create a binary cache.
     server.wait_for_unit("minio")
+    server.wait_for_unit("network-online.target")
 
     server.succeed("mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4")
     server.succeed("mc mb minio/my-cache")
 
     server.succeed("${env} nix copy --to '${storeUrl}' ${pkgA}")
 
+    client.wait_for_unit("network-online.target")
+
     # Test fetchurl on s3:// URLs while we're at it.
     client.succeed("${env} nix eval --impure --expr 'builtins.fetchurl { name = \"foo\"; url = \"s3://my-cache/nix-cache-info?endpoint=http://server:9000&region=eu-west-1\"; }'")
 
diff --git a/tests/nixos/sourcehut-flakes.nix b/tests/nixos/sourcehut-flakes.nix
index 04f3590e1..2f469457a 100644
--- a/tests/nixos/sourcehut-flakes.nix
+++ b/tests/nixos/sourcehut-flakes.nix
@@ -122,6 +122,8 @@ in
       start_all()
 
       sourcehut.wait_for_unit("httpd.service")
+      sourcehut.wait_for_unit("network-online.target")
+      client.wait_for_unit("network-online.target")
 
       client.succeed("curl -v https://git.sr.ht/ >&2")
       client.succeed("nix registry list | grep nixpkgs")