diff --git a/scripts/run.sh b/scripts/run.sh
index 030c7c2..1c6c5f7 100755
--- a/scripts/run.sh
+++ b/scripts/run.sh
@@ -29,5 +29,5 @@ ssh -o BatchMode=yes mac 'test ! -e /etc/sudoers.d/mac-setup && echo "[ok] temp
 mkdir -p .backup/mac && rsync -a mac:.mac-setup-backup/ .backup/mac/
 [[ ${1:-} == --no-tank ]] && exit 0
 PUB=$(ssh mac cat .ssh/id_ed25519.pub)
-ssh pve173 'bash -s' -- "$PUB" < scripts/tank-side.sh
+ssh pve173 "PUB='$PUB' bash -s" < scripts/tank-side.sh
 echo "tank side done; test: ssh mac ~/mac/scripts/backup.sh"
diff --git a/scripts/tank-side.sh b/scripts/tank-side.sh
index bb6f669..0fd5532 100755
--- a/scripts/tank-side.sh
+++ b/scripts/tank-side.sh
@@ -1,8 +1,10 @@
 #!/bin/bash
-# Run on pve173: ssh pve173 'bash -s' -- "<pubkey>" < scripts/tank-side.sh
+# Run on pve173: ssh pve173 "PUB='<pubkey line>' bash -s" < scripts/tank-side.sh
+# PUB comes via env (not a command arg) so ssh's remote-side re-splitting can't truncate the
+# space-separated key line. $1 kept as a fallback for a local run.
 set -euo pipefail
-PUB=${1:?pubkey line required}
-[[ $PUB == ssh-ed25519* ]] || { echo "not a pubkey: $PUB"; exit 1; }
+PUB=${PUB:-${1:-}}
+[[ $PUB == ssh-ed25519\ AAAA* ]] || { echo "not a full pubkey line: '$PUB'"; exit 1; }
 DS=tank/backups/mac; TS=$(date +%s)
 if zfs list "$DS" >/dev/null 2>&1; then echo "[skip] dataset $DS"; else zfs create "$DS"; echo "[set] created $DS"; fi
 if grep -q "^\[$DS\]" /etc/sanoid/sanoid.conf; then echo "[skip] sanoid stanza"; else