diff --git a/slab/bin/frame-mcp.mjs b/slab/bin/frame-mcp.mjs
index 57645f5699..3f5619a3d4 100644
--- a/slab/bin/frame-mcp.mjs
+++ b/slab/bin/frame-mcp.mjs
@@ -47,7 +47,7 @@ const settle = (ms = 180) => new Promise((resolve) => setTimeout(resolve, ms));
 function runFrame(args, { timeoutMs = 30000 } = {}) {
   return new Promise((resolve, reject) => {
     execFile(
-      "node",
+      process.execPath,
       [FRAME, ...args],
       { timeout: timeoutMs, maxBuffer: 64 * 1024 * 1024, encoding: "utf8" },
       (err, stdout, stderr) => {
diff --git a/slab/bin/macos.mjs b/slab/bin/macos.mjs
index 5bed09361d..44d38de6c0 100644
--- a/slab/bin/macos.mjs
+++ b/slab/bin/macos.mjs
@@ -39,11 +39,13 @@ export function sh(spec, command, { stdin } = {}) {
   const opts = { input: stdin, encoding: "utf8", maxBuffer: MAX_BUFFER };
   if (spec.local) return execFileSync("bash", ["-lc", command], opts).trim();
   if (spec.ssh) {
-    const argv = [...spec.ssh.split(/\s+/), "bash", "-lc", command];
+    const q = `'${command.replace(/'/g, `'\\''`)}'`;
+    const argv = [...spec.ssh.split(/\s+/), `bash -lc ${q}`];
     return execFileSync("ssh", argv, opts).trim();
   }
   if (spec.sshHost) {
-    return execFileSync("ssh", [spec.sshHost, "bash", "-lc", command], opts).trim();
+    const q = `'${command.replace(/'/g, `'\\''`)}'`;
+    return execFileSync("ssh", [spec.sshHost, `bash -lc ${q}`], opts).trim();
   }
   throw new Error("machine spec needs `local: true` or `ssh: \"...\"`");
 }