diff --git a/runner/harness/abra.py b/runner/harness/abra.py
index 697b91d..4c1a4f5 100644
--- a/runner/harness/abra.py
+++ b/runner/harness/abra.py
@@ -101,9 +101,10 @@ def upgrade(domain: str, version: Optional[str] = None, timeout: int = 900) -> N
     args = ["app", "upgrade", domain]
     if version:
         args.append(version)
-    # -f no prompt, -D skip public-DNS checks (our per-run domains route via the gateway).
-    # (upgrade has no --chaos flag.)
-    args += ["-f", "-D", "-n"]
+    # -f no prompt, -D skip public-DNS checks (our per-run domains route via the gateway), -o offline
+    # (use local tags — incl. the upstream tags fetched at clone — and DON'T fetch from the private
+    # mirror origin, which 401s). upgrade has no --chaos flag.
+    args += ["-f", "-D", "-n", "-o"]
     _run(args, timeout=timeout)