diff --git a/install/hardware/dell-xps13-ptl-speaker-firmware.sh b/install/hardware/dell-xps13-ptl-speaker-firmware.sh
index f36bceab..e66d57fc 100644
--- a/install/hardware/dell-xps13-ptl-speaker-firmware.sh
+++ b/install/hardware/dell-xps13-ptl-speaker-firmware.sh
@@ -3,7 +3,7 @@ if omarchy-hw-dell-xps13-dx13260-ptl; then
 
   # Keep newer Arch firmware when stable's snapshot supersedes the shim.
   if [[ -z $cirrus_package ]] || (( $(vercmp "${cirrus_package#* }" "20260810-3") < 0 )); then
-    firmware_pending="${OMARCHY_XPS13_FIRMWARE_PENDING:-/run/omarchy/xps13-ptl-speaker-firmware}"
+    firmware_pending="/run/omarchy/xps13-ptl-speaker-firmware"
     sudo install -Dm644 /dev/null "$firmware_pending"
 
     # [core] precedes [omarchy], so an unqualified target selects the older firmware.
diff --git a/migrations/1790904845.sh b/migrations/1790904845.sh
index 0f376be3..14c251d8 100644
--- a/migrations/1790904845.sh
+++ b/migrations/1790904845.sh
@@ -4,7 +4,7 @@ if omarchy-hw-dell-xps13-dx13260-ptl; then
   source "$OMARCHY_PATH/install/hardware/dell-xps13-ptl-speaker-firmware.sh"
 
   # The marker lasts until reboot so every user migrating beforehand is prompted.
-  firmware_pending="${OMARCHY_XPS13_FIRMWARE_PENDING:-/run/omarchy/xps13-ptl-speaker-firmware}"
+  firmware_pending="/run/omarchy/xps13-ptl-speaker-firmware"
   if [[ -e $firmware_pending ]]; then
     omarchy-state set reboot-required
   fi
diff --git a/test/shell.d/xps13-ptl-firmware-test.sh b/test/shell.d/xps13-ptl-firmware-test.sh
index 3d754160..281415d9 100755
--- a/test/shell.d/xps13-ptl-firmware-test.sh
+++ b/test/shell.d/xps13-ptl-firmware-test.sh
@@ -97,15 +97,23 @@ SH
 chmod +x "$test_tmp/bin/"*
 
 export PATH="$test_tmp/bin:$ROOT/bin:$PATH"
-export OMARCHY_PATH="$ROOT" TEST_LOG="$test_tmp/calls" TEST_VERSION_FILE="$test_tmp/version"
-export OMARCHY_XPS13_FIRMWARE_PENDING="$test_tmp/run/pending"
+export TEST_LOG="$test_tmp/calls" TEST_VERSION_FILE="$test_tmp/version"
 export TEST_PRODUCT_NAME="XPS 13 DX13260" TEST_INTEL_PTL=1
 install_call="pacman -S --noconfirm --needed omarchy/linux-firmware-cirrus"
+firmware_pending="$test_tmp/run/pending"
+
+# Redirect the fixed filesystem path in isolated copies, not through production environment overrides.
+export OMARCHY_PATH="$test_tmp/omarchy"
+mkdir -p "$OMARCHY_PATH/install/hardware" "$OMARCHY_PATH/migrations"
+sed "s|/run/omarchy/xps13-ptl-speaker-firmware|$firmware_pending|g" "$leaf" >"$OMARCHY_PATH/install/hardware/${leaf##*/}"
+sed "s|/run/omarchy/xps13-ptl-speaker-firmware|$firmware_pending|g" "$migration" >"$OMARCHY_PATH/migrations/${migration##*/}"
+leaf="$OMARCHY_PATH/install/hardware/${leaf##*/}"
+migration="$OMARCHY_PATH/migrations/${migration##*/}"
 
 reset_fixture() {
   : >"$TEST_LOG"
   printf '%s' "$1" >"$TEST_VERSION_FILE"
-  rm -f "$OMARCHY_XPS13_FIRMWARE_PENDING"
+  rm -f "$firmware_pending"
 }
 
 run_leaf() {
@@ -120,12 +128,12 @@ for model in "XPS 9350" "XPS 13 DX13261"; do
   reset_fixture "20260810-2"
   TEST_PRODUCT_NAME="$model" run_leaf
   TEST_PRODUCT_NAME="$model" run_migration
-  [[ ! -s $TEST_LOG && ! -e $OMARCHY_XPS13_FIRMWARE_PENDING ]] || fail "other models receive no firmware repair"
+  [[ ! -s $TEST_LOG && ! -e $firmware_pending ]] || fail "other models receive no firmware repair"
 done
 reset_fixture "20260810-2"
 TEST_INTEL_PTL=0 run_leaf
 TEST_INTEL_PTL=0 run_migration
-[[ ! -s $TEST_LOG && ! -e $OMARCHY_XPS13_FIRMWARE_PENDING ]] || fail "the Wildcat Lake variant receives no firmware repair"
+[[ ! -s $TEST_LOG && ! -e $firmware_pending ]] || fail "the Wildcat Lake variant receives no firmware repair"
 pass "other models and the Wildcat Lake variant receive no firmware repair"
 
 for version in "" "20260810-2"; do
@@ -133,7 +141,7 @@ for version in "" "20260810-2"; do
   run_leaf || fail "missing or old firmware is installed during hardware setup"
   [[ $(<"$TEST_LOG") == "$install_call" && $(<"$TEST_VERSION_FILE") == "20260810-3" ]] ||
     fail "hardware setup explicitly selects the Omarchy firmware"
-  [[ -e $OMARCHY_XPS13_FIRMWARE_PENDING ]] || fail "the firmware repair records its pending reboot"
+  [[ -e $firmware_pending ]] || fail "the firmware repair records its pending reboot"
 done
 pass "hardware setup explicitly installs the Omarchy firmware when missing or old"
 
@@ -141,7 +149,7 @@ for version in "20260810-3" "20260810-4" "20260910-2" "1:20260810-2"; do
   reset_fixture "$version"
   run_leaf
   run_migration
-  [[ ! -s $TEST_LOG && ! -e $OMARCHY_XPS13_FIRMWARE_PENDING && $(<"$TEST_VERSION_FILE") == "$version" ]] ||
+  [[ ! -s $TEST_LOG && ! -e $firmware_pending && $(<"$TEST_VERSION_FILE") == "$version" ]] ||
     fail "sufficient or newer firmware is preserved without a reboot request"
 done
 pass "sufficient or newer firmware is preserved without a reboot request"
@@ -167,15 +175,26 @@ run_migration
 pass "a second user before reboot is prompted without reinstalling"
 
 : >"$TEST_LOG"
-rm -f "$OMARCHY_XPS13_FIRMWARE_PENDING"
+rm -f "$firmware_pending"
 run_migration
 [[ ! -s $TEST_LOG ]] || fail "the migration is a no-op after reboot with repaired firmware"
 pass "the migration is a no-op after reboot with repaired firmware"
 
 reset_fixture "20260810-2"
-if OMARCHY_XPS13_FIRMWARE_PENDING="$TEST_VERSION_FILE/not-a-directory" run_migration 2>/dev/null; then
+rm -rf "$test_tmp/run"
+touch "$test_tmp/run"
+if run_migration 2>/dev/null; then
   fail "failure to record the pending reboot fails the migration"
 fi
 [[ ! -s $TEST_LOG && $(<"$TEST_VERSION_FILE") == "20260810-2" ]] ||
   fail "failure to record the reboot marker installs nothing"
 pass "failure to record the reboot marker installs nothing"
+
+rm -f "$test_tmp/run"
+reset_fixture "20260810-2"
+protected_file="$test_tmp/protected"
+printf 'preserve me\n' >"$protected_file"
+OMARCHY_XPS13_FIRMWARE_PENDING="$protected_file" run_migration
+[[ $(<"$protected_file") == "preserve me" && -e $firmware_pending && $(<"$TEST_LOG") == "$install_call"$'\nstate set reboot-required' ]] ||
+  fail "the invoking user's environment cannot redirect the privileged marker write"
+pass "the invoking user's environment cannot redirect the privileged marker write"