diff --git a/internal/api/contract_test.go b/internal/api/contract_test.go
index f0ad503610..5625301458 100644
--- a/internal/api/contract_test.go
+++ b/internal/api/contract_test.go
@@ -23275,8 +23275,8 @@ func TestContract_RequestOriginCannotRetargetTokenBearingCommands(t *testing.T)
 				if err := json.Unmarshal(rec.Body.Bytes(), &response); err != nil {
 					t.Fatalf("decode response: %v", err)
 				}
-				if response.Token == "" || !strings.Contains(response.Command, response.Token) {
-					t.Fatalf("fresh token was not carried by install command: %#v", response)
+				if response.Token == "" || strings.Contains(response.Command, response.Token) || !strings.Contains(response.Command, `--token-file "$token_file"`) {
+					t.Fatal("fresh credential must be returned separately and entered privately")
 				}
 				if !strings.Contains(response.Command, tc.wantBaseURL+"/install.sh") ||
 					!strings.Contains(response.Command, "--url "+posixShellQuote(tc.wantBaseURL)) {
@@ -24090,7 +24090,7 @@ func TestContract_HostedInstallerOriginsFailClosedAtRouter(t *testing.T) {
 					if err := json.Unmarshal(rec.Body.Bytes(), &response); err != nil {
 						t.Fatalf("decode install response: %v", err)
 					}
-					if response.Token == "" || !strings.Contains(response.Command, response.Token) || !strings.Contains(response.Command, wantBaseURL+"/install.sh") {
+					if response.Token == "" || strings.Contains(response.Command, response.Token) || !strings.Contains(response.Command, `--token-file "$token_file"`) || !strings.Contains(response.Command, wantBaseURL+"/install.sh") {
 						t.Fatalf("install response did not bind fresh token to configured URL %q: %#v", wantBaseURL, response)
 					}
 					if strings.Contains(response.Command, "attacker") || len(cfg.APITokens) != 2 {
@@ -25075,8 +25075,8 @@ func TestContract_HostedRuntimeAgentInstallCommandCarriesToken(t *testing.T) {
 		if strings.TrimSpace(token) == "" {
 			t.Fatalf("%s: hosted install payload has no token: %s", body, rec.Body.String())
 		}
-		if command, _ := payload["command"].(string); command != "" && !strings.Contains(command, token) {
-			t.Fatalf("%s: install command does not carry the minted token", body)
+		if command, _ := payload["command"].(string); command != "" && (strings.Contains(command, token) || !strings.Contains(command, `--token-file "$token_file"`)) {
+			t.Fatalf("%s: minted credential must be entered privately, not embedded", body)
 		}
 	}
 }
diff --git a/internal/api/hosted_agent_install_command_test.go b/internal/api/hosted_agent_install_command_test.go
index e212d923cf..ce3c24ce33 100644
--- a/internal/api/hosted_agent_install_command_test.go
+++ b/internal/api/hosted_agent_install_command_test.go
@@ -63,7 +63,7 @@ func TestHostedTenantAgentInstallCommand_GeneratesOrgBoundTokenAndCommand(t *tes
 	require.Contains(t, resp.Command, "https://cloud.example.com/install.sh")
 	require.NotContains(t, resp.Command, resp.Token)
 	require.Contains(t, resp.Command, `--token-file "$token_file"`)
-	require.Contains(t, resp.Command, "--proxmox-type "+posixShellQuote("pbs"))
+	require.Contains(t, resp.Command, "--proxmox-type "+strings.ReplaceAll(posixShellQuote("pbs"), "'", `'"'"'`))
 
 	require.Regexp(t, regexp.MustCompile(`^[a-f0-9]{64}$`), resp.Token)
 
@@ -146,7 +146,7 @@ func TestGenerateHostedTenantAgentInstallCommandEnforcesHostedOrgBoundary(t *tes
 	require.NotEmpty(t, result.Token)
 	require.NotEmpty(t, result.TokenID)
 	require.Contains(t, result.Command, "https://acme.cloud.example.com/install.sh")
-	require.Contains(t, result.Command, "--proxmox-type "+posixShellQuote("pbs"))
+	require.Contains(t, result.Command, "--proxmox-type "+strings.ReplaceAll(posixShellQuote("pbs"), "'", `'"'"'`))
 
 	tokens, err := persistence.LoadAPITokens()
 	require.NoError(t, err)