diff --git a/letsencrypt/cli.py b/letsencrypt/cli.py
index cdad7d99c..4cbfb8a2a 100644
--- a/letsencrypt/cli.py
+++ b/letsencrypt/cli.py
@@ -367,12 +367,13 @@ def choose_configurator_plugins(args, config, plugins, verb):
     logger.debug("Requested authenticator %s and installer %s", req_auth, req_inst)
 
     # Try to meet the user's request and/or ask them to pick plugins
+    authenticator = installer = None
     if verb == "run" and req_auth == req_inst:
         # Unless the user has explicitly asked for different auth/install,
         # only consider offering a single choice
         authenticator = installer = display_ops.pick_configurator(config, req_inst, plugins)
     else:
-        if need_inst:
+        if need_inst or req_inst:
             installer = display_ops.pick_installer(config, req_inst, plugins)
         if need_auth:
             authenticator = display_ops.pick_authenticator(config, req_auth, plugins)
diff --git a/letsencrypt/tests/cli_test.py b/letsencrypt/tests/cli_test.py
index d31bfaff4..ccc57cb8c 100644
--- a/letsencrypt/tests/cli_test.py
+++ b/letsencrypt/tests/cli_test.py
@@ -96,11 +96,12 @@ class CLITest(unittest.TestCase):
 
     def test_configurator_selection(self):
         plugins = disco.PluginsRegistry.find_all()
+        args = ['--agree-eula', '--apache', '--authenticator', 'standalone']
+        ret, _, _, _ = self._call(args)
         if "apache" in plugins:
-            args = ['--agree-eula', '--apache', '--authenticator', 'standalone']
-            ret, _, _, _ = self._call(args)
             self.assertTrue("Too many flags setting" in ret)
-            # TODO add tests with a broken plugin, a missing plugin, etc
+        else:
+            self.assertTrue("The requested apache plugin does not" in ret)
 
     def test_rollback(self):
         _, _, _, client = self._call(['rollback'])
@@ -126,7 +127,7 @@ class CLITest(unittest.TestCase):
         self.assertEqual(ret, '--domains and --csr are mutually exclusive')
 
         ret, _, _, _ = self._call(['-a', 'bad_auth', 'auth'])
-        self.assertEqual(ret, 'Authenticator could not be determined')
+        self.assertEqual(ret, 'The requested bad_auth plugin does not appear to be installed')
 
     @mock.patch('letsencrypt.cli.zope.component.getUtility')
     def test_auth_new_request_success(self, mock_get_utility):