diff --git a/frontend-modern/src/components/Settings/__tests__/InfrastructureOperationsModel.test.tsx b/frontend-modern/src/components/Settings/__tests__/InfrastructureOperationsModel.test.tsx
index b6c1818533..c9fd83a24f 100644
--- a/frontend-modern/src/components/Settings/__tests__/InfrastructureOperationsModel.test.tsx
+++ b/frontend-modern/src/components/Settings/__tests__/InfrastructureOperationsModel.test.tsx
@@ -277,9 +277,7 @@ describe('infrastructure operations model', () => {
       'Use Availability checks for ping-only or agentless device monitoring.',
     );
     expect(infrastructureInstallerSectionSource).toContain('checks this Pulse URL and');
-    expect(infrastructureInstallerSectionSource).toContain(
-      'before asking for administrator privileges',
-    );
+    expect(infrastructureInstallerSectionSource).toContain('before reading a Unix token');
     expect(infrastructureInstallerSectionSource).toContain(
       'For Proxmox, start with a dedicated read-only or narrowly scoped API token',
     );
diff --git a/frontend-modern/src/components/Settings/__tests__/infrastructureAgentDoctorModel.test.ts b/frontend-modern/src/components/Settings/__tests__/infrastructureAgentDoctorModel.test.ts
index 702c93845b..72260c3b27 100644
--- a/frontend-modern/src/components/Settings/__tests__/infrastructureAgentDoctorModel.test.ts
+++ b/frontend-modern/src/components/Settings/__tests__/infrastructureAgentDoctorModel.test.ts
@@ -1,3 +1,4 @@
+import { unixBootstrapTestSource } from '@/utils/__tests__/unixBootstrapTestSource';
 import { execFileSync } from 'node:child_process';
 import { useInfrastructureOperationsState } from '../useInfrastructureOperationsState';
 import { describe, expect, it, vi } from 'vitest';
@@ -392,8 +393,8 @@ describe('Agent Doctor model', () => {
     expect(install).toContain('--enable-privileged-helper');
     expect(install).toContain('--enable-action-runner');
     expect(install).toContain('--action-token-file');
-    expect(install).toContain("--agent-id 'host-1'");
-    expect(install).toContain("--hostname 'host-1.local'");
+    expect(unixBootstrapTestSource(install)).toContain("--agent-id 'host-1'");
+    expect(unixBootstrapTestSource(install)).toContain("--hostname 'host-1.local'");
     expect(install).toContain("--cacert '/etc/pulse/ca.pem'");
     expect(install).not.toContain(secret);
     expect(install).not.toContain('--action-token ');
diff --git a/frontend-modern/src/components/Settings/__tests__/useInfrastructureOperationsState.branchcov0722pm.test.tsx b/frontend-modern/src/components/Settings/__tests__/useInfrastructureOperationsState.branchcov0722pm.test.tsx
index 27250bcb9a..bde07dcf74 100644
--- a/frontend-modern/src/components/Settings/__tests__/useInfrastructureOperationsState.branchcov0722pm.test.tsx
+++ b/frontend-modern/src/components/Settings/__tests__/useInfrastructureOperationsState.branchcov0722pm.test.tsx
@@ -1,3 +1,4 @@
+import { unixBootstrapTestSource } from '@/utils/__tests__/unixBootstrapTestSource';
 import { createRoot } from 'solid-js';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import type { Connection } from '@/api/connections';
@@ -308,8 +309,8 @@ describe('useInfrastructureOperationsState command-building closures', () => {
       };
 
       const cmd = state.getUninstallCommand(row);
-      expect(cmd).toContain("--agent-id 'act-9'");
-      expect(cmd).toContain("--hostname 'host-9'");
+      expect(unixBootstrapTestSource(cmd)).toContain("--agent-id 'act-9'");
+      expect(unixBootstrapTestSource(cmd)).toContain("--hostname 'host-9'");
       expect(cmd).not.toContain('agent-9');
       dispose();
     });
@@ -321,8 +322,8 @@ describe('useInfrastructureOperationsState command-building closures', () => {
       const row: AgentUninstallIdentity = { agentId: 'agent-7', hostname: 'host-7' };
 
       const cmd = state.getUninstallCommand(row);
-      expect(cmd).toContain("--agent-id 'agent-7'");
-      expect(cmd).toContain("--hostname 'host-7'");
+      expect(unixBootstrapTestSource(cmd)).toContain("--agent-id 'agent-7'");
+      expect(unixBootstrapTestSource(cmd)).toContain("--hostname 'host-7'");
       dispose();
     });
 
diff --git a/frontend-modern/src/utils/__tests__/unixBootstrapTestSource.ts b/frontend-modern/src/utils/__tests__/unixBootstrapTestSource.ts
new file mode 100644
index 0000000000..58be170a82
--- /dev/null
+++ b/frontend-modern/src/utils/__tests__/unixBootstrapTestSource.ts
@@ -0,0 +1,8 @@
+// Decode exactly the single-quoted Bash -c argument, including POSIX apostrophe
+// escapes. Consumers can assert its actual source without depending on the
+// extra outer quoting layer. Executable PTY tests separately pin real argv.
+export const unixBootstrapTestSource = (command: string): string => {
+  const child = /bash -c ('(?:[^']|'"'"')*') pulse-bootstrap "\$install_script";/.exec(command);
+  if (!child) throw new Error('Expected a single-quoted private Unix bootstrap child');
+  return child[1].slice(1, -1).replaceAll(`'"'"'`, "'");
+};