diff --git a/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts b/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts
index cb442069..04718d8c 100644
--- a/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts
+++ b/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts
@@ -761,7 +761,7 @@ export function sentinelPublishImageBuildShell(state: SentinelCicdState, jobName
     "buildkit_log=/workspace/buildkitd.log",
     "mkdir -p \"$(dirname \"$buildkit_socket\")\"",
     "rm -f \"$buildkit_socket\"",
-    "buildkitd --addr \"$buildkit_address\" ${BUILDKITD_FLAGS:-} > \"$buildkit_log\" 2>&1 &",
+    "rootlesskit buildkitd --addr \"$buildkit_address\" ${BUILDKITD_FLAGS:-} > \"$buildkit_log\" 2>&1 &",
     "buildkitd_pid=$!",
     "buildkit_ready=false",
     "buildkit_probe_attempt=0",
diff --git a/scripts/src/platform-infra-pac-failure-evidence.test.ts b/scripts/src/platform-infra-pac-failure-evidence.test.ts
index 5c2a0c01..5b9c182b 100644
--- a/scripts/src/platform-infra-pac-failure-evidence.test.ts
+++ b/scripts/src/platform-infra-pac-failure-evidence.test.ts
@@ -1,7 +1,10 @@
 import { describe, expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { createRequire } from "node:module";
+import { sentinelPublishImageBuildShell } from "./hwlab-node-web-sentinel-cicd-jobs";
+import type { SentinelCicdState } from "./hwlab-node-web-sentinel-cicd-shared";
 import { compactHistoryJson, compactStatusSummary, renderDebugStep, renderHistory, renderStatus } from "./platform-infra-pipelines-as-code";
 
 const require = createRequire(import.meta.url);
@@ -58,13 +61,30 @@ describe("PaC 失败证据合同", () => {
   });
 
   test("sentinel image build 显式等待 socket 与 worker readiness 并清理 daemon", () => {
-    const source = readFileSync(resolve(import.meta.dir, "hwlab-node-web-sentinel-cicd-jobs.ts"), "utf8");
-    expect(source).toContain("mkdir -p \\\"$(dirname \\\"$buildkit_socket\\\")\\\"");
-    expect(source).toContain("buildkitd --addr");
-    expect(source).toContain("debug workers");
-    expect(source).toContain("failure_error_type=BuildKitReadinessError");
-    expect(source).toContain("failure_error_code=BUILDKIT_NOT_READY");
-    expect(source).toContain("cleanup_buildkitd");
-    expect(source).not.toContain("buildctl-daemonless.sh build");
+    const shell = sentinelPublishImageBuildShell({
+      spec: {
+        nodeId: "NC01",
+        lane: "v03",
+        buildkit: { sidecarImage: "moby/buildkit:rootless" },
+        networkProfile: { imageBuildProxy: { http: "", https: "", all: "", noProxy: [] } },
+      },
+      image: {
+        ref: "registry.example.test/web-probe-sentinel:test",
+        monitorWeb: {
+          imageBuildPackageMode: "frozen-lockfile",
+          imageBuildNetworkMode: "host",
+          imageBuildProxySource: "test",
+        },
+      },
+    } as unknown as SentinelCicdState, "sentinel-test");
+    expect(shell).toContain("mkdir -p \"$(dirname \"$buildkit_socket\")\"");
+    expect(shell).toContain("rootlesskit buildkitd --addr");
+    expect(shell).not.toMatch(/(^|\n)buildkitd --addr/);
+    expect(shell).toContain("debug workers");
+    expect(shell).toContain("failure_error_type=BuildKitReadinessError");
+    expect(shell).toContain("failure_error_code=BUILDKIT_NOT_READY");
+    expect(shell).toContain("cleanup_buildkitd");
+    expect(shell).not.toContain("buildctl-daemonless.sh build");
+    expect(spawnSync("sh", ["-n"], { input: shell, encoding: "utf8" })).toMatchObject({ status: 0, stderr: "" });
   });
 });