diff --git a/standard/atomic-update-ca-trust.service b/minimal/atomic-update-ca-trust.service
similarity index 100%
rename from standard/atomic-update-ca-trust.service
rename to minimal/atomic-update-ca-trust.service
diff --git a/standard/ca-trust.yaml b/minimal/ca-trust.yaml
similarity index 100%
rename from standard/ca-trust.yaml
rename to minimal/ca-trust.yaml
diff --git a/minimal/manifest.yaml b/minimal/manifest.yaml
index 411a026b..be2c3195 100644
--- a/minimal/manifest.yaml
+++ b/minimal/manifest.yaml
@@ -28,6 +28,7 @@ include:
   - basic-fixes.yaml
   - kernel-install.yaml
   - systemd-presets.yaml
+  - ca-trust.yaml
 
 packages:
   # this is implied by dependencies but let's make it explicit
diff --git a/standard/manifest.yaml b/standard/manifest.yaml
index f27a93dd..51820946 100644
--- a/standard/manifest.yaml
+++ b/standard/manifest.yaml
@@ -15,7 +15,6 @@ include:
   - persistent-journal.yaml
   - initramfs-full.yaml
   - generic-growfs.yaml
-  - ca-trust.yaml
   - systemd-presets.yaml
 
 packages:
diff --git a/tests/README.md b/tests/README.md
index 4bd6d16a..2b2fcee1 100644
--- a/tests/README.md
+++ b/tests/README.md
@@ -4,8 +4,8 @@
 For standard images, it also runs the CA trust, image derivation, and sysusers
 tests in disposable container builds.
 
-The CA trust rootfs check verifies that the refresh service is enabled in the
-standard image. `Containerfile.test-ca-trust` generates temporary test CAs and
+The CA trust rootfs check verifies that the refresh service is enabled in every
+tier. `Containerfile.test-ca-trust` generates temporary test CAs and
 exercises the installed service's command against stale trust bundles. It checks
 vendor CA additions and removals, preservation of local anchors and distrust,
 repeated refreshes, and removal of local policy in both the PEM and OpenSSL
diff --git a/tests/rootfs/cases/atomic-update-ca-trust b/tests/rootfs/cases/atomic-update-ca-trust
index d82c2785..a682b367 100755
--- a/tests/rootfs/cases/atomic-update-ca-trust
+++ b/tests/rootfs/cases/atomic-update-ca-trust
@@ -1,13 +1,12 @@
 #!/bin/bash
 set -xeuo pipefail
 
-# Like the automatic update timer, this service is only shipped in standard.
-if [ -f /usr/lib/systemd/system-preset/86-bootc-standard.preset ]; then
-    test -x /usr/bin/update-ca-trust
-    # This static unit is pulled in by a vendor .wants link. is-enabled reports
-    # "static" even with that link, so check that the target resolves to the unit.
-    unit=/usr/lib/systemd/system/atomic-update-ca-trust.service
-    wanted=/usr/lib/systemd/system/sysinit.target.wants/atomic-update-ca-trust.service
-    test -L "$wanted"
-    test "$unit" -ef "$wanted"
-fi
+# Shipped in minimal, so every tier inherits it. ca-certificates is a hard
+# dependency of openssl-libs, so the tool is present in every tier too.
+test -x /usr/bin/update-ca-trust
+# This static unit is pulled in by a vendor .wants link. is-enabled reports
+# "static" even with that link, so check that the target resolves to the unit.
+unit=/usr/lib/systemd/system/atomic-update-ca-trust.service
+wanted=/usr/lib/systemd/system/sysinit.target.wants/atomic-update-ca-trust.service
+test -L "$wanted"
+test "$unit" -ef "$wanted"