diff --git a/tests/make-test-app.sh b/tests/make-test-app.sh
index 1f5667b8..385bc7da 100755
--- a/tests/make-test-app.sh
+++ b/tests/make-test-app.sh
@@ -117,7 +117,7 @@ ln -s -t ${DIR}/files/share/locale ../../share/runtime/locale/de/share/de
 mkdir -p ${DIR}/files/share/runtime/locale/fr
 ln -s -t ${DIR}/files/share/locale ../../share/runtime/locale/fr/share/fr
 
-flatpak build-finish --command=hello.sh ${DIR}
+flatpak build-finish ${BUILD_FINISH_ARGS-} --command=hello.sh ${DIR}
 mkdir -p repos
 flatpak build-export --disable-sandbox ${collection_args} ${GPGARGS-} ${EXPORT_ARGS-} ${REPO} ${DIR} ${BRANCH}
 rm -rf ${DIR}
diff --git a/tests/test-update-portal.c b/tests/test-update-portal.c
index 03810761..4b2ac492 100644
--- a/tests/test-update-portal.c
+++ b/tests/test-update-portal.c
@@ -116,6 +116,7 @@ typedef struct {
   GMainLoop *loop;
   int expected_end_status;
   int expected_n_ops;
+  const char *expected_error;
 
   int expected_op;
 
@@ -180,6 +181,15 @@ progress_cb (PortalFlatpakUpdateMonitor *object,
               data->exit_status = 1;
             }
         }
+      else if (status == PROGRESS_STATUS_ERROR)
+        {
+          if (data->expected_error != NULL &&
+              strcmp (data->expected_error, error) != 0)
+            {
+              g_printerr ("Unexpected error: %s, should be %s\n", error, data->expected_error);
+              data->exit_status = 1;
+            }
+        }
 
       g_main_loop_quit (data->loop);
     }
@@ -293,6 +303,43 @@ update_fail_test (PortalFlatpak *portal, int status_pipe)
   return data.exit_status;
 }
 
+static int
+update_notsupp_test (PortalFlatpak *portal, int status_pipe)
+{
+  g_autoptr(GError) error = NULL;
+  PortalFlatpakUpdateMonitor *monitor;
+  GVariantBuilder opt_builder;
+  GMainLoop *loop = g_main_loop_new (NULL, FALSE);
+  UpdateData data = { loop };
+
+  monitor = create_monitor (portal, NULL, NULL, &error);
+  if (monitor == NULL)
+    {
+      g_printerr ("Error creating monitor: %s\n", error->message);
+      return 1;
+    }
+
+  g_variant_builder_init (&opt_builder, G_VARIANT_TYPE_VARDICT);
+
+  g_signal_connect (monitor, "progress", G_CALLBACK (progress_cb), &data);
+
+  data.expected_end_status = PROGRESS_STATUS_ERROR;
+  data.expected_n_ops = 2;
+  data.expected_error = "org.freedesktop.DBus.Error.NotSupported";
+
+  if (!portal_flatpak_update_monitor_call_update_sync (monitor, "",
+                                                       g_variant_builder_end (&opt_builder),
+                                                       NULL, &error))
+    {
+      g_printerr ("Error calling update: %s\n", error->message);
+      return 1;
+    }
+
+  g_main_loop_run (loop);
+
+  return data.exit_status;
+}
+
 static int
 run_test (int status_pipe, const char *pidfile, TestCallback test)
 {
@@ -348,6 +395,8 @@ main (int argc, char *argv[])
     test_callback = update_null_test;
   else if (strcmp (argv[1], "update-fail") == 0)
     test_callback = update_fail_test;
+  else if (strcmp (argv[1], "update-notsupp") == 0)
+    test_callback = update_notsupp_test;
   else
     {
       g_printerr ("Unknown command %s specified\n", argv[1]);
diff --git a/tests/test-update-portal.sh b/tests/test-update-portal.sh
index 115c52e0..bea7ee97 100755
--- a/tests/test-update-portal.sh
+++ b/tests/test-update-portal.sh
@@ -23,7 +23,7 @@ set -euo pipefail
 
 skip_without_bwrap
 
-echo "1..5"
+echo "1..6"
 
 setup_repo
 install_repo
@@ -94,7 +94,7 @@ mv repos/test/orig-objects repos/test/objects
 
 echo "ok update fail"
 
-${FLATPAK} ${U} mask org.test.Hello org.test.Hello.*
+${FLATPAK} ${U} mask "org.test.Hello*"
 
 NEW_COMMIT=$(cat repos/test/refs/heads/app/org.test.Hello/$ARCH/master)
 
@@ -110,4 +110,23 @@ kill -9 $MONITOR_PID
 # Should be a "null" update due to mask
 run_with_sandboxed_bus ${test_builddir}/test-update-portal update-null monitor.pid
 
+${FLATPAK} ${U} mask --remove "org.test.Hello*"
+
 echo "ok update vs masked"
+
+BUILD_FINISH_ARGS="--filesystem=host" make_updated_app test "" master UPDATE41
+run_with_sandboxed_bus ${test_builddir}/test-update-portal update-notsupp monitor.pid
+
+BUILD_FINISH_ARGS="--share=network" make_updated_app test "" master UPDATE42
+run_with_sandboxed_bus ${test_builddir}/test-update-portal update-notsupp monitor.pid
+
+BUILD_FINISH_ARGS="--socket=x11" make_updated_app test "" master UPDATE43
+run_with_sandboxed_bus ${test_builddir}/test-update-portal update-notsupp monitor.pid
+
+BUILD_FINISH_ARGS="--own-name=org.some.Name" make_updated_app test "" master UPDATE44
+run_with_sandboxed_bus ${test_builddir}/test-update-portal update-notsupp monitor.pid
+
+make_updated_app test "" master UPDATE45
+run_with_sandboxed_bus ${test_builddir}/test-update-portal update monitor.pid
+
+echo "ok update with changed permissions"