diff --git a/Plugin/unraid/include/config.php b/Plugin/unraid/include/config.php
index 93a35f9..8ebf9b3 100644
--- a/Plugin/unraid/include/config.php
+++ b/Plugin/unraid/include/config.php
@@ -110,15 +110,18 @@ function vv_push_master_conf(): array {
         // Single SSH call: get remote SCRIPTS_DIR and verify plugin is installed,
         // Configurations/ exists, and master.conf is already present.
         // Any missing piece means the remote isn't ready — skip rather than push blind.
+        // Remote command built as one PHP string and escapeshellarg()'d whole — shell_exec()
+        // adds its own `sh -c` layer locally, so a bare double-quoted string here would let
+        // the $(...)/${...} substitutions expand on HOST1 before ssh ever sees them, instead
+        // of on the remote host. escapeshellarg() keeps it opaque until the remote shell runs it.
         $sshBase  = 'ssh -i ' . escapeshellarg($sshKey)
                   . ' -o ConnectTimeout=10 -o StrictHostKeyChecking=no root@' . $ip;
-        $probe    = trim(shell_exec(
-            $sshBase . ' "cfg=$(grep SCRIPTS_DIR /boot/config/plugins/varaverk/varaverk.cfg 2>/dev/null)'
-            . ' && sd=$(echo \"$cfg\" | grep -oP \'(?<=SCRIPTS_DIR=\")[^\"]+\')'
-            . ' && test -d \"${sd}/Configurations\"'
-            . ' && test -f \"${sd}/Configurations/master.conf\"'
-            . ' && echo \"$sd\""'
-        ) ?: '');
+        $remoteCmd = 'cfg=$(grep SCRIPTS_DIR /boot/config/plugins/varaverk/varaverk.cfg 2>/dev/null)'
+                   . ' && sd=$(echo "$cfg" | grep -oP \'(?<=SCRIPTS_DIR=")[^"]+\')'
+                   . ' && test -d "${sd}/Configurations"'
+                   . ' && test -f "${sd}/Configurations/master.conf"'
+                   . ' && echo "$sd"';
+        $probe    = trim(shell_exec($sshBase . ' ' . escapeshellarg($remoteCmd)) ?: '');
 
         if ($probe === '') {
             $results[] = ['host' => $hostKey, 'ok' => false, 'ready' => false,