diff --git a/internal/repoctl/setup_bootstrap_docs_test.go b/internal/repoctl/setup_bootstrap_docs_test.go
index 0fd5e04b63..2bba957374 100644
--- a/internal/repoctl/setup_bootstrap_docs_test.go
+++ b/internal/repoctl/setup_bootstrap_docs_test.go
@@ -17,10 +17,22 @@ func TestSetupBootstrapDocsStayOnCanonicalArtifactContract(t *testing.T) {
 	pbsRel := "docs/PBS.md"
 	pbsDoc := readRepoFile(t, pbsRel)
 	assertContainsAll(t, pbsRel, pbsDoc, []string{
-		`curl -fsSL "http://<pulse-ip>:7655/api/setup-script?type=pbs&host=https://<pbs-ip>:8007&pulse_url=http://<pulse-ip>:7655" | { if [ "$(id -u)" -eq 0 ]; then PULSE_SETUP_TOKEN="<setup-token>" bash; elif command -v sudo >/dev/null 2>&1; then sudo env PULSE_SETUP_TOKEN="<setup-token>" bash; else echo "Root privileges required. Run as root (su -) and retry." >&2; exit 1; fi; }`,
-		"Pulse generates that full command for you from **Settings → Infrastructure**",
+		"### Method 1: API-Only Connection (Recommended)",
+		"proxmox-backup-manager acl update / Audit --auth-id pulse-monitor@pbs",
+		"proxmox-backup-manager acl update / Audit --auth-id 'pulse-monitor@pbs!pulse-token'",
+		`chmod 600 "$HOME/.config/pulse/pbs-agent-token"`,
+		`--output "$HOME/.config/pulse/pbs-agent-install.sh"`,
+		"https://pulse.example.com/install.sh",
+		`--token-file "$HOME/.config/pulse/pbs-agent-token"`,
+		"Stop if the download fails",
+		"Do not bypass certificate checks",
 	})
 	assertContainsNone(t, pbsRel, pbsDoc, []string{
-		`curl -sSL "http://<pulse-ip>:7655/api/setup-script?type=pbs&host=https://<pbs-ip>:8007&pulse_url=http://<pulse-ip>:7655" | bash`,
+		"PULSE_SETUP_TOKEN=",
+		"sudo env PULSE_SETUP_TOKEN=",
+		"curl -k",
+		"--insecure",
+		`--token "`,
+		"| bash",
 	})
 }
diff --git a/scripts/tests/test_pbs_docs.py b/scripts/tests/test_pbs_docs.py
index fc19a7c2fd..d84be0c363 100644
--- a/scripts/tests/test_pbs_docs.py
+++ b/scripts/tests/test_pbs_docs.py
@@ -79,6 +79,7 @@ def server(cert, key, status=200, installer=None, installer_path="/install.sh"):
 
     http = HTTPServer(("127.0.0.1", 0), Handler)
     context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    context.minimum_version = ssl.TLSVersion.TLSv1_2
     context.load_cert_chain(str(cert), str(key))
     http.socket = context.wrap_socket(http.socket, server_side=True)
     thread = threading.Thread(target=http.serve_forever, daemon=True)