diff --git a/test/acceptance.d/security-test.sh b/test/acceptance.d/security-test.sh
index 0755c722..4dc96ad9 100755
--- a/test/acceptance.d/security-test.sh
+++ b/test/acceptance.d/security-test.sh
@@ -58,7 +58,17 @@ verify_sshd_hardening() {
   rm -f "$key_file" "$key_file.pub"
   ssh-keygen -t ed25519 -N "" -q -C "omarchy-acceptance" -f "$key_file"
 
-  if ! omarchy-setup-security-sshd --key="$(cat "$key_file.pub")" >"$ARTIFACTS/setup-security-sshd.log" 2>&1; then
+  # sudo keys its cached credential on the calling terminal and, absent one, on
+  # the caller's parent process alone, so a timestamp validated in this shell
+  # never reaches the setup command's own sudo calls when the suite runs
+  # without a terminal (omarchy-iso-test drives it over ssh with no pty). Give
+  # the exercise a pseudo-terminal and validate the password on it first, so
+  # every sudo underneath shares that terminal's credential.
+  if ! OMARCHY_ACCEPTANCE_SUDO_PASSWORD="$OMARCHY_ACCEPTANCE_SUDO_PASSWORD" \
+    OMARCHY_ACCEPTANCE_SSHD_KEY="$(cat "$key_file.pub")" SHELL=/bin/bash \
+    script -qec 'printf "%s\n" "$OMARCHY_ACCEPTANCE_SUDO_PASSWORD" | sudo -S -v 2>/dev/null &&
+      omarchy-setup-security-sshd --key="$OMARCHY_ACCEPTANCE_SSHD_KEY"' /dev/null \
+    </dev/null >"$ARTIFACTS/setup-security-sshd.log" 2>&1; then
     fail "omarchy-setup-security-sshd completes unattended" "$(tail -5 "$ARTIFACTS/setup-security-sshd.log")"
   fi
   pass "omarchy-setup-security-sshd completes unattended"
diff --git a/test/shell.d/theme-install-guards-test.sh b/test/shell.d/theme-install-guards-test.sh
index 6c6044d0..2edc85dc 100755
--- a/test/shell.d/theme-install-guards-test.sh
+++ b/test/shell.d/theme-install-guards-test.sh
@@ -71,8 +71,15 @@ done
 pass "a URL naming a transport git does not implement never reaches git"
 
 # The checker is a separate command, so its absence has to refuse the URL rather
-# than wave it through to git.
-if install_theme "https://github.com/example/omarchy-cool-theme.git" "$mock_bin:$PATH"; then
+# than wave it through to git. Installed machines carry the packaged checker in
+# /usr/bin, so absence is simulated by shadowing it with a stub that reports
+# command-not-found instead of thinning the PATH.
+missing_checker_bin="$test_tmp/missing-checker-bin"
+mkdir -p "$missing_checker_bin"
+printf '#!/bin/bash\nexit 127\n' >"$missing_checker_bin/omarchy-git-url-check"
+chmod +x "$missing_checker_bin/omarchy-git-url-check"
+
+if install_theme "https://github.com/example/omarchy-cool-theme.git" "$missing_checker_bin:$mock_bin:$ROOT/bin:$PATH"; then
   fail "omarchy-theme-install refuses a URL it cannot check"
 fi
 
diff --git a/test/shell.d/windows-vm-mount-boundary-test.sh b/test/shell.d/windows-vm-mount-boundary-test.sh
index 34f36cc2..13623d81 100644
--- a/test/shell.d/windows-vm-mount-boundary-test.sh
+++ b/test/shell.d/windows-vm-mount-boundary-test.sh
@@ -15,6 +15,10 @@ fi
 test_tmp=$(mktemp -d)
 trap 'rm -rf "$test_tmp"' EXIT
 
+# The checkout may live under /home, which the tmpfs below hides, so take a
+# mount-safe copy of the helper before the mounts land.
+cp "$ROOT/bin/omarchy-windows-vm" "$test_tmp/omarchy-windows-vm"
+
 # Hide host state before creating the production paths used by the root helper.
 mount -t tmpfs -o mode=0755,size=8m run-test /run
 mkdir -p /run/lock
@@ -27,7 +31,7 @@ mount -t tmpfs -o uid=0,gid=0,mode=0710,size=1g home-alice /home/alice
 export HOME=/home/alice
 unset OMARCHY_WINDOWS_DIR
 set -- help
-source "$ROOT/bin/omarchy-windows-vm" >/dev/null 2>&1
+source "$test_tmp/omarchy-windows-vm" >/dev/null 2>&1
 
 # The namespace maps the host filesystem's uid 0 to nobody. Only / remains on
 # that filesystem; all paths the helper mutates are isolated tmpfs mounts.