diff --git a/internal/guest/bundled/arch.toml b/internal/guest/bundled/arch.toml
index b0fd447c..ff9d6910 100644
--- a/internal/guest/bundled/arch.toml
+++ b/internal/guest/bundled/arch.toml
@@ -13,9 +13,9 @@ seed_packages = []
 
 [pkg]
 setup = "pacman -Sy --noconfirm"
-install = ["pacman", "-S", "--noconfirm"]
+install = ["pacman", "-S", "--noconfirm", "--needed"]
 scaffold_setup = "pacman -Sy --noconfirm\n"
-scaffold_install = "pacman -S --noconfirm "
+scaffold_install = "pacman -S --noconfirm --needed "
 # Arch names its Python 3 package "python".
 runtime_packages = { python3 = "python" }
 
diff --git a/internal/guest/prelude_test.go b/internal/guest/prelude_test.go
index 1208ab10..ba8722be 100644
--- a/internal/guest/prelude_test.go
+++ b/internal/guest/prelude_test.go
@@ -4,6 +4,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"slices"
 	"strings"
 	"testing"
 )
@@ -171,3 +172,19 @@ func TestWithPreludeKeepsShebangFirst(t *testing.T) {
 		t.Errorf("no-shebang case: %q", got)
 	}
 }
+
+// pacman reinstalls a package it already has unless --needed is passed.
+// devtools and build-deps both install base-devel on Arch, so a VM that
+// selects both would download the whole group twice.
+func TestArchInstallSkipsSatisfiedPackages(t *testing.T) {
+	o, ok := Lookup("arch")
+	if !ok {
+		t.Fatal("bundled arch missing")
+	}
+	if !slices.Contains(o.Pkg.Install, "--needed") {
+		t.Errorf("arch install = %v, want --needed", o.Pkg.Install)
+	}
+	if !strings.Contains(o.Pkg.ScaffoldInstall, "--needed") {
+		t.Errorf("arch scaffold_install = %q, want --needed", o.Pkg.ScaffoldInstall)
+	}
+}
diff --git a/internal/guest/testdata/prelude/arch.sh b/internal/guest/testdata/prelude/arch.sh
index 0253b67e..3a2aff94 100644
--- a/internal/guest/testdata/prelude/arch.sh
+++ b/internal/guest/testdata/prelude/arch.sh
@@ -1,5 +1,5 @@
 stoat_pkg_setup() { pacman -Sy --noconfirm; }
-stoat_pkg_install() { 'pacman' '-S' '--noconfirm' "$@"; }
+stoat_pkg_install() { 'pacman' '-S' '--noconfirm' '--needed' "$@"; }
 stoat_svc_enable() { systemctl enable "$1"; }
 stoat_svc_start() { systemctl start "$1"; }
 stoat_svc_stop() { systemctl stop "$1"; }