diff --git a/__tests__/tools.test.ts b/__tests__/tools.test.ts
index 5990887..17c3df3 100644
--- a/__tests__/tools.test.ts
+++ b/__tests__/tools.test.ts
@@ -56,8 +56,8 @@ test('ensureSnapd installs snapd if needed', async () => {
   ])
 })
 
-test('ensureSnapd is a no-op if snapd is installed', async () => {
-  expect.assertions(3)
+test('ensureSnapd refreshes snapd if already installed', async () => {
+  expect.assertions(4)
 
   const accessMock = jest
     .spyOn(fs.promises, 'access')
@@ -87,11 +87,12 @@ test('ensureSnapd is a no-op if snapd is installed', async () => {
 
   expect(accessMock).toHaveBeenCalled()
   expect(statMock).toHaveBeenCalled()
-  expect(execMock).not.toHaveBeenCalled()
+  expect(execMock).toHaveBeenCalledTimes(1)
+  expect(execMock).toHaveBeenCalledWith('sudo', ['snap', 'refresh', 'snapd'])
 })
 
 test('ensureSnapd fixes permissions on the root directory', async () => {
-  expect.assertions(3)
+  expect.assertions(5)
 
   const accessMock = jest
     .spyOn(fs.promises, 'access')
@@ -121,7 +122,17 @@ test('ensureSnapd fixes permissions on the root directory', async () => {
 
   expect(accessMock).toHaveBeenCalled()
   expect(statMock).toHaveBeenCalled()
-  expect(execMock).toHaveBeenCalledWith('sudo', ['chown', 'root:root', '/'])
+  expect(execMock).toHaveBeenCalledTimes(2)
+  expect(execMock).toHaveBeenNthCalledWith(1, 'sudo', [
+    'snap',
+    'refresh',
+    'snapd'
+  ])
+  expect(execMock).toHaveBeenNthCalledWith(2, 'sudo', [
+    'chown',
+    'root:root',
+    '/'
+  ])
 })
 
 test('ensureSnapcraft installs Snapcraft if needed', async () => {
diff --git a/src/tools.ts b/src/tools.ts
index 053abb4..dc7fd72 100644
--- a/src/tools.ts
+++ b/src/tools.ts
@@ -20,6 +20,10 @@ export async function ensureSnapd(): Promise<void> {
     await exec.exec('sudo', ['apt-get', 'update', '-q'])
     await exec.exec('sudo', ['apt-get', 'install', '-qy', 'snapd'])
   }
+  else {
+    core.info('Refreshing snapd...')
+    await exec.exec('sudo', ['snap', 'refresh', 'snapd'])
+  }
   // The Github worker environment has weird permissions on the root,
   // which trip up snap-confine.
   const root = await fs.promises.stat('/')