diff --git a/commands/bootstrap.sh b/commands/bootstrap.sh
index bf19ba6..c8cae9e 100755
--- a/commands/bootstrap.sh
+++ b/commands/bootstrap.sh
@@ -144,7 +144,7 @@ case "$ROLE" in
     templates_resolve || exit 2
     trap '[ -n "$TEMPLATES_TMP" ] && rm -rf "$TEMPLATES_TMP"' EXIT
     MACHINE_TEMPLATE_DIR="$REGISTRY_DIR/$ROLE"
-    if { [ "$ROLE" != "workstation" ] && [[ ! "$ROLE" =~ ^[a-z][a-z0-9-]*-server$ ]]; } \
+    if [[ ! "$ROLE" =~ ^[a-z][a-z0-9-]*-server$ ]] \
       || [ "$(template_family "$ROLE" 2>/dev/null || true)" != "machine" ] \
       || [ ! -f "$MACHINE_TEMPLATE_DIR/template.env" ]; then
       MACHINE_ROLES="$(templates_machine_roles "$REGISTRY_DIR" | paste -sd'|' -)"
@@ -807,7 +807,7 @@ fi
 # directory. Definitions own idempotence, like bootstrap itself.
 if [ -n "$MACHINE_TEMPLATE_DIR" ] && [ -e "$MACHINE_TEMPLATE_DIR/install.sh" ]; then
   log "running install hook for ${ROLE} from $(templates_source_desc)"
-  if ! (cd "$MACHINE_TEMPLATE_DIR" && RIG_ROLE="$ROLE" ./install.sh); then
+  if ! (cd "$MACHINE_TEMPLATE_DIR" && RIG_ROLE="$ROLE" bash ./install.sh); then
     die "install hook failed for role $ROLE from $(templates_source_desc)"
   fi
 fi
diff --git a/test/cli.sh b/test/cli.sh
index e4955ae..fff0f8c 100644
--- a/test/cli.sh
+++ b/test/cli.sh
@@ -616,10 +616,7 @@ printf 'USER="x"\nCONTEXT_PATH=".x/A.md"\nCLI_NAME="x"\nPATH_LINE="p"\nAPT_EXTRA
 mkdir -p "$TPL_FIX/scratch-server"
 printf 'ROOT_DOOR="closed"\nHOST="no"\nJOIN="login"\n' > "$TPL_FIX/scratch-server/template.env"
 mkdir -p "$TPL_FIX/workstation"
-printf 'ROOT_DOOR="closed"\nHOST="yes"\nJOIN="login"\n' > "$TPL_FIX/workstation/template.env"
-mkdir -p "$TPL_FIX/hooked-server"
-printf 'ROOT_DOOR="open"\nHOST="no"\nJOIN="authkey"\n' > "$TPL_FIX/hooked-server/template.env"
-printf '#!/usr/bin/env bash\nexit 1\n' > "$TPL_FIX/hooked-server/install.sh"
+printf 'ROOT_DOOR="closed"\nHOST="yes"\nJOIN="authkey"\n' > "$TPL_FIX/workstation/template.env"
 mkdir -p "$TPL_FIX/baddoor-server"
 printf 'ROOT_DOOR="ajar"\nHOST="no"\nJOIN="authkey"\n' > "$TPL_FIX/baddoor-server/template.env"
 mkdir -p "$TPL_FIX/tenantkeys-server"
@@ -908,7 +905,7 @@ check "machine template: install failure names role and source" 0 "" \
   grep -qF 'install hook failed for role $ROLE from $(templates_source_desc)' "$ROOT/commands/bootstrap.sh"
 # shellcheck disable=SC2016
 check "machine template: install runs from its definition with RIG_ROLE" 0 "" \
-  grep -qF 'cd "$MACHINE_TEMPLATE_DIR" && RIG_ROLE="$ROLE" ./install.sh' "$ROOT/commands/bootstrap.sh"
+  grep -qF 'cd "$MACHINE_TEMPLATE_DIR" && RIG_ROLE="$ROLE" bash ./install.sh' "$ROOT/commands/bootstrap.sh"
 rm -rf "$TPL_FIX" "$TPL_WORK"
 
 # Creds-free BY CONSTRUCTION, provable by absence (box#69's grep-refusal