@@ -119,18 +119,30 @@ func unitIs(verb, unit string) bool {
 // rather than a supported setup, so the tie-break exists to be predictable
 // and explainable, not to be clever about it.
 func Select(cfg config.Config) (firewall.Backend, error) {
+	name, err := Resolve(cfg)
+	if err != nil {
+		return nil, err
+	}
+	return build(name, cfg)
+}
+
+// Resolve names the backend Select will build, without building it. It is
+// separate because deciding *which* firewall this machine runs and reaching
+// for its binary are two different questions, and only the first one can be
+// answered — or tested — on a machine that has neither.
+func Resolve(cfg config.Config) (string, error) {
 	switch name := cfg.String(KeyBackend, BackendAuto); name {
 	case BackendUFW, BackendFirewalld:
-		return build(name, cfg)
+		return name, nil
 	case BackendAuto:
-		return selectAuto(cfg)
+		return resolveAuto()
 	default:
-		return nil, fmt.Errorf("unknown backend %q", name)
+		return "", fmt.Errorf("unknown backend %q", name)
 	}
 }
 
-// selectAuto implements the detection described on Select.
-func selectAuto(cfg config.Config) (firewall.Backend, error) {
+// resolveAuto implements the detection described on Select.
+func resolveAuto() (string, error) {
 	var installed, enabled []string
 	for _, name := range preference {
 		probe := probes[name]
@@ -139,7 +151,7 @@ func selectAuto(cfg config.Config) (firewall.Backend, error) {
 		}
 		installed = append(installed, name)
 		if probe.Active() {
-			return build(name, cfg)
+			return name, nil
 		}
 		if probe.Enabled() {
 			enabled = append(enabled, name)
@@ -148,14 +160,14 @@ func selectAuto(cfg config.Config) (firewall.Backend, error) {
 	if len(enabled) > 0 {
 		// Nothing is running, but systemd would start this one at boot: it is
 		// the firewall this machine is configured to use.
-		return build(enabled[0], cfg)
+		return enabled[0], nil
 	}
 	if len(installed) > 0 {
 		// Nothing is running or enabled: fall back to the first installed
 		// backend so the user can at least inspect it.
-		return build(installed[0], cfg)
+		return installed[0], nil
 	}
-	return nil, fmt.Errorf(
+	return "", fmt.Errorf(
 		"no supported firewall found; install ufw " +
 			"(apt install ufw / pacman -S ufw) or firewalld " +
 			"(dnf install firewalld), pick one with `backend = \"...\"` " +
 
@@ -37,57 +37,57 @@ func autoConfig() config.Config {
 	return config.Config{Values: map[string]string{KeyBackend: BackendAuto}}
 }
 
-func TestSelectAutoPrefersTheActiveBackend(t *testing.T) {
+func TestResolveAutoPrefersTheActiveBackend(t *testing.T) {
 	// firewalld installed and running, ufw installed but stopped: the running
 	// one wins even though ufw comes first in the preference order.
 	stubProbes(t,
 		probeState{installed: true},
 		probeState{installed: true, active: true, enabled: true})
 
-	backend, err := Select(autoConfig())
+	name, err := Resolve(autoConfig())
 	if err != nil {
-		t.Fatalf("Select: %v", err)
+		t.Fatalf("Resolve: %v", err)
 	}
-	if backend.Name() != BackendFirewalld {
-		t.Errorf("Name = %q, want firewalld", backend.Name())
+	if name != BackendFirewalld {
+		t.Errorf("Resolve = %q, want firewalld", name)
 	}
 }
 
-func TestSelectAutoPrefersTheEnabledUnit(t *testing.T) {
+func TestResolveAutoPrefersTheEnabledUnit(t *testing.T) {
 	// Both installed, neither running: the one systemd would start at boot is
 	// the one this machine is configured to use, even though ufw is first in
 	// the preference order.
 	stubProbes(t,
 		probeState{installed: true},
 		probeState{installed: true, enabled: true})
 
-	backend, err := Select(autoConfig())
+	name, err := Resolve(autoConfig())
 	if err != nil {
-		t.Fatalf("Select: %v", err)
+		t.Fatalf("Resolve: %v", err)
 	}
-	if backend.Name() != BackendFirewalld {
-		t.Errorf("Name = %q, want firewalld", backend.Name())
+	if name != BackendFirewalld {
+		t.Errorf("Resolve = %q, want firewalld", name)
 	}
 }
 
-func TestSelectAutoFallsBackToInstalled(t *testing.T) {
+func TestResolveAutoFallsBackToInstalled(t *testing.T) {
 	// Nothing is running and nothing is enabled: the first installed backend
 	// is used so the user can look at it.
 	stubProbes(t, probeState{}, probeState{installed: true})
 
-	backend, err := Select(autoConfig())
+	name, err := Resolve(autoConfig())
 	if err != nil {
-		t.Fatalf("Select: %v", err)
+		t.Fatalf("Resolve: %v", err)
 	}
-	if backend.Name() != BackendFirewalld {
-		t.Errorf("Name = %q, want firewalld", backend.Name())
+	if name != BackendFirewalld {
+		t.Errorf("Resolve = %q, want firewalld", name)
 	}
 }
 
-func TestSelectAutoWithoutAnyFirewall(t *testing.T) {
+func TestResolveAutoWithoutAnyFirewall(t *testing.T) {
 	stubProbes(t, probeState{}, probeState{})
 
-	_, err := Select(autoConfig())
+	_, err := Resolve(autoConfig())
 	if err == nil {
 		t.Fatal("expected an error when no firewall is installed")
 	}
@@ -98,14 +98,45 @@ func TestSelectAutoWithoutAnyFirewall(t *testing.T) {
 	}
 }
 
-func TestSelectUnknownBackend(t *testing.T) {
-	if _, err := Select(config.Config{
+func TestResolveUnknownBackend(t *testing.T) {
+	if _, err := Resolve(config.Config{
 		Values: map[string]string{KeyBackend: "iptables"},
 	}); err == nil {
 		t.Error("expected an error for an unknown backend")
 	}
 }
 
+func TestResolveHonoursAnExplicitChoice(t *testing.T) {
+	// An explicit choice skips detection entirely: the user said which
+	// firewall this machine runs, and the tool does not argue.
+	stubProbes(t, probeState{installed: true, active: true}, probeState{})
+	name, err := Resolve(config.Config{
+		Values: map[string]string{KeyBackend: BackendFirewalld},
+	})
+	if err != nil {
+		t.Fatalf("Resolve: %v", err)
+	}
+	if name != BackendFirewalld {
+		t.Errorf("Resolve = %q, want firewalld", name)
+	}
+}
+
+func TestSelectBuildsTheResolvedBackend(t *testing.T) {
+	// Select reaches for the binary, which a test machine may not have; what
+	// matters either way is that it reports the backend Resolve named, and
+	// says so legibly when that binary is missing.
+	stubProbes(t, probeState{installed: true, active: true}, probeState{})
+	backend, err := Select(autoConfig())
+	switch {
+	case err != nil:
+		if !strings.Contains(err.Error(), "ufw") {
+			t.Errorf("error should name the backend it could not build: %v", err)
+		}
+	case backend.Name() != BackendUFW:
+		t.Errorf("Name = %q, want ufw", backend.Name())
+	}
+}
+
 func TestInspectReportsEveryBackend(t *testing.T) {
 	// The detector must describe the backend it did not pick, so `--check`
 	// can say "firewalld is here but stopped" instead of staying silent.