diff --git a/hack/e2e-install-cozystack.bats b/hack/e2e-install-cozystack.bats
index ad915c944..2a58e6715 100644
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -109,7 +109,9 @@ EOF
   # signal for "all platform HRs have been emitted" without hard-coding the
   # expected list, so the 5s pad lets a few late-arrivals join the snapshot.
   sleep 5
-  kubectl get hr -A | awk 'NR>1 {print "kubectl wait --timeout=15m --for=condition=ready -n "$1" hr/"$2" &"} END {print "wait"}' | sh -ex
+  # Pacing only: names every HR that timed out in the trace; the authoritative
+  # gate re-lists below, covering HRs created after this snapshot (#2822).
+  kubectl wait hr --all -A --timeout=15m --for=condition=ready || true
 
   echo "Waiting for post-install-prep to complete"
   if ! wait $POST_PREP_PID; then
@@ -119,10 +121,20 @@ EOF
   fi
   cat /tmp/post-install-prep.log
 
-  # Fail the test if any HelmRelease is not Ready
-  if kubectl get hr -A | grep -v " True " | grep -v NAME; then
-    kubectl get hr -A
+  # Fail the test if any HelmRelease is not Ready. Wait again on a fresh
+  # listing so HelmReleases created after the snapshot above are gated too;
+  # the window absorbs momentary Unknown flaps from drift reconciles.
+  if ! kubectl wait hr --all -A --timeout=15m --for=condition=ready; then
+    kubectl get hr -A || true
+    # kubectl's STATUS column truncates long messages; dump the full Ready
+    # condition per non-ready HR so the real error (e.g. a rejected CRD) is
+    # visible in the test output instead of only inside the cozyreport.
+    kubectl get hr -A --no-headers | awk '$4 != "True"' | while read -r ns name _; do
+      echo "--- Non-ready HelmRelease: $ns/$name" >&2
+      kubectl get hr -n "$ns" "$name" -o jsonpath='{range .status.conditions[*]}{.type}={.status} reason={.reason}: {.message}{"\n"}{end}' >&2 || true
+    done
     echo "Some HelmReleases failed to reconcile" >&2
+    exit 1
   fi
 }