diff --git a/install.sh b/install.sh
index a6e14df..b836856 100755
--- a/install.sh
+++ b/install.sh
@@ -64,15 +64,15 @@ EXISTING_ID=$(midclt call initshutdownscript.query '[]' | \
     python3 -c "
 import sys, json
 for s in json.load(sys.stdin):
-    if s.get('script') == '$PATCH_DIR/patch/apply.sh':
+    if s.get('comment') == 'TrueCloud provider patch (S3/B2)':
         print(s['id'])
         break
 " 2>/dev/null || true)
 
 if [ -n "$EXISTING_ID" ]; then
-    echo "Already registered (id=$EXISTING_ID). Ensuring it is enabled ..."
+    echo "Already registered (id=$EXISTING_ID). Updating path and enabling ..."
     midclt call initshutdownscript.update "$EXISTING_ID" \
-        '{"enabled": true}' > /dev/null
+        "{\"enabled\": true, \"script\": \"$PATCH_DIR/patch/apply.sh\"}" > /dev/null
 else
     midclt call initshutdownscript.create \
         "{\"type\":\"SCRIPT\",\"script\":\"$PATCH_DIR/patch/apply.sh\",\"when\":\"PREINIT\",\"enabled\":true,\"comment\":\"TrueCloud provider patch (S3/B2)\"}" \
diff --git a/patch/apply.sh b/patch/apply.sh
index 16fb216..ab885de 100755
--- a/patch/apply.sh
+++ b/patch/apply.sh
@@ -100,11 +100,21 @@ else
     if [ "$_can_install" = true ]; then
         # Substitute PATCH_DIR into the source so sitecustomize.py knows where
         # to write hook_status.json and check the kill switch at runtime.
-        if sed "s|/data/truecloud-patch|$PATCH_DIR|g" \
-               "$PATCH_DIR/patch/sitecustomize.py" \
-               > "$SITE_PKG/sitecustomize.py"; then
+        # Pass PATCH_DIR via env var so arbitrary path characters don't break
+        # the substitution (sed metacharacters & and | are unsafe in shell-
+        # interpolated replacement strings).  Write to a temp file first so a
+        # failed substitution never truncates the existing sitecustomize.py.
+        _sc_tmp="$SITE_PKG/sitecustomize.py.truecloud-tmp"
+        if TRUECLOUD_PATCH_DIR="$PATCH_DIR" \
+               "$PYTHON" -c "
+import os, sys
+d = os.environ['TRUECLOUD_PATCH_DIR']
+with open(d + '/patch/sitecustomize.py', encoding='utf-8') as fh:
+    sys.stdout.write(fh.read().replace('/data/truecloud-patch', d))
+" > "$_sc_tmp" && mv "$_sc_tmp" "$SITE_PKG/sitecustomize.py"; then
             echo "OK: Installed sitecustomize.py → $SITE_PKG/sitecustomize.py"
         else
+            rm -f "$_sc_tmp"
             echo "WARNING: Failed to write $SITE_PKG/sitecustomize.py (permission error?)"
         fi
     fi
diff --git a/recover.sh b/recover.sh
index a83caad..ea65340 100755
--- a/recover.sh
+++ b/recover.sh
@@ -45,4 +45,4 @@ fi
 echo ""
 echo "To re-enable the patch once you have investigated:"
 echo "  rm $PATCH_DIR/disabled"
-echo "  bash $PATCH_DIR/apply.sh"
+echo "  bash $PATCH_DIR/patch/apply.sh"
diff --git a/uninstall.sh b/uninstall.sh
index a181e04..b3d20f5 100755
--- a/uninstall.sh
+++ b/uninstall.sh
@@ -26,7 +26,7 @@ IDS=$(midclt call initshutdownscript.query '[]' | \
     python3 -c "
 import sys, json
 for s in json.load(sys.stdin):
-    if s.get('script') == '$PATCH_DIR/patch/apply.sh':
+    if s.get('comment') == 'TrueCloud provider patch (S3/B2)':
         print(s['id'])
 " 2>/dev/null || true)