From 5b6d278c46c61778dc48bcc87a0f8cf14124414d Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Mon, 31 Aug 2026 10:24:06 -0400
Subject: [PATCH] fix(host): preserve shell variables in privileged fixups

---
 core/archipelago/src/update.rs | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/core/archipelago/src/update.rs b/core/archipelago/src/update.rs
index f25b884f..efe42830 100644
--- a/core/archipelago/src/update.rs
+++ b/core/archipelago/src/update.rs
@@ -1487,6 +1487,11 @@ pub(crate) async fn host_sudo(args: &[&str]) -> Result<std::process::ExitStatus>
         "--quiet",
         "--collect",
         "--pipe",
+        // Shell snippets passed as one argument must reach the child intact.
+        // systemd-run otherwise expands $VAR/${VAR} against the manager's
+        // environment before `sh -lc` can see them (and usually replaces them
+        // with empty strings).
+        "--expand-environment=no",
         "--",
     ];
     full.extend_from_slice(args);
@@ -1506,6 +1511,7 @@ pub(crate) async fn host_sudo_output(args: &[&str]) -> Result<std::process::Outp
         "--quiet",
         "--collect",
         "--pipe",
+        "--expand-environment=no",
         "--",
     ];
     full.extend_from_slice(args);