diff --git a/scripts/setup/machine-setup/machine-setup.sh b/scripts/setup/machine-setup/machine-setup.sh
index 69709e86..407b9169 100755
--- a/scripts/setup/machine-setup/machine-setup.sh
+++ b/scripts/setup/machine-setup/machine-setup.sh
@@ -76,6 +76,14 @@ fi
 
 USER_HOME="/home/$USERNAME"
 
+# Always, and outside any step: everything below reads this index — core utils,
+# the fastfetch PPA, the Docker repo — and `step` skips a step whose name is
+# already in the progress file. With the refresh inside one of those, a resumed
+# run installed against whatever the index happened to say hours or days ago.
+echo ""
+info "Refreshing the package index..."
+pkg_refresh >/dev/null
+
 # =============================================================================
 # 2. System update
 # =============================================================================
@@ -83,12 +91,12 @@ USER_HOME="/home/$USERNAME"
 # Its own section because it is the only thing in the script that moves versions
 # of software already on the machine. Everything else only ever adds what is
 # absent, so this is the one that deserves to be refused on its own.
+#
+# The index refresh is NOT here — it runs in pre-flight, unconditionally, because
+# every later step reads it and this one can be skipped.
 
 step "System update"
 if ! skip; then
-  info "Refreshing the package index..."
-  pkg_refresh >/dev/null
-
   mapfile -t UPGRADABLE < <(pkg_upgradable)
 
   echo ""