diff --git a/distros/alma9/distro.env b/distros/alma9/distro.env
index f835c18..877acde 100644
--- a/distros/alma9/distro.env
+++ b/distros/alma9/distro.env
@@ -9,4 +9,7 @@ IMAGE="almalinux9"
 CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el9/Packages/unkin-ca-certificates-2025.7.13-1.el9.x86_64.rpm"
 CA_RPM_SHA256="c12fb81ea639a92d19506e07e88df290635b15e175b1f8c063d4e8a2d86bab6e"
 
+# Estate local repo used to prove HTTPS trust and dnf reachability.
+ESTATE_REPO="rpm-vendor-el9"
+
 PACKAGES="git jq make python3.11 python3.11-pip python3.12 python3.12-pip uv wget"
diff --git a/pre-commit.sh b/pre-commit.sh
index 3b71437..e61f01a 100755
--- a/pre-commit.sh
+++ b/pre-commit.sh
@@ -3,7 +3,7 @@
 # out of a .woodpecker matrix, so it silently never gets built.
 set -uo pipefail
 
-REQUIRED_KEYS="BASE_IMAGE IMAGE CA_RPM_URL CA_RPM_SHA256 PACKAGES"
+REQUIRED_KEYS="BASE_IMAGE IMAGE CA_RPM_URL CA_RPM_SHA256 ESTATE_REPO PACKAGES"
 WORKFLOWS=".woodpecker/build.yaml .woodpecker/test.yaml .woodpecker/docker.yaml"
 
 fail=0
diff --git a/test.sh b/test.sh
index 8a8c118..cc86ba5 100755
--- a/test.sh
+++ b/test.sh
@@ -19,14 +19,14 @@ check() {
 
 # No -k and no --cacert: fails unless the bootstrapped internal CA is in the trust store.
 check "internal CA trusted (artifactapi)" \
-  curl -fsS -o /dev/null "$ARTIFACTAPI/api/v1/local/rpm-vendor-el9/repodata/repomd.xml"
+  curl -fsS -o /dev/null "$ARTIFACTAPI/api/v1/local/$ESTATE_REPO/repodata/repomd.xml"
 check "unkin-ca-certificates installed" rpm -q unkin-ca-certificates
 
 # Every configured repo must refresh, and a package that exists only in the estate's
 # local repos must resolve.
 check "dnf refreshes every estate repo" dnf -q makecache --refresh
 check "dnf resolves an estate-only package" \
-  dnf -q --disablerepo='*' --enablerepo='rpm-vendor*' list --available nfpm
+  dnf -q --disablerepo='*' --enablerepo="$ESTATE_REPO" list --available nfpm
 
 for p in $PACKAGES; do
   check "package $p installed" rpm -q "$p"