diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5f320add..70cf73c6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -113,6 +113,11 @@ jobs:
       - name: Check local gate discovery and required-check warnings
         run: bash tests/release/ci-local.test.sh
 
+      - name: Check bounded actions and removal of shell grants
+        # Root is used only in an isolated fixture subprocess to prove that the
+        # helper irreversibly drops credentials before touching user files.
+        run: sudo -n bash tests/release/action-steps.test.sh
+
       - name: Check the audit export states its confidentiality class
         run: bash tests/release/audit-export-confidentiality.test.sh
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2ec44bfe..5e6fc2b4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,14 @@ Releases before `0.2.5` predate the public launch; their notes live in the
 
 ## [Unreleased]
 
+### Changed
+
+- Remove whole-binary shell and runuser sudo grants. Firewall, group, Snap,
+  SSH-key and user-scoped Flatpak/Podman/Toolbox operations now use a bounded
+  helper with fixed command grammars. User operations refuse UID 0 and drop
+  groups/GID/UID before file access or execution; SSH edits reject symlinks.
+  Install the new helper together with the daemon and sudoers fragment (#417).
+
 ### Fixed
 
 - Align planner action descriptions with the Ubuntu execution fence, including
diff --git a/Makefile b/Makefile
index 3824d78f..a1870ecd 100644
--- a/Makefile
+++ b/Makefile
@@ -118,6 +118,7 @@ daemon-install: daemon-install-preflight build
 	# sysknife-daemon --test helper_install_coverage` derives the required set
 	# from the daemon source and fails if one is missing.
 	install -Dm 755 packaging/sysknife-apt-pin-edit $(HELPERS)/apt-pin-edit
+	install -Dm 755 packaging/sysknife-action-steps $(HELPERS)/action-steps
 	install -Dm 755 packaging/sysknife-audit-edit $(HELPERS)/audit-edit
 	install -Dm 755 packaging/sysknife-fail2ban-jail-edit $(HELPERS)/fail2ban-jail-edit
 	install -Dm 755 packaging/sysknife-grub-kargs-edit $(HELPERS)/grub-kargs-edit
@@ -148,6 +149,7 @@ daemon-uninstall:
 	rm -f $(SYSUSERS)/sysknife.conf
 	rm -f $(TMPFILES)/sysknife.conf
 	rm -f $(HELPERS)/apt-pin-edit
+	rm -f $(HELPERS)/action-steps
 	rm -f $(HELPERS)/audit-edit
 	rm -f $(HELPERS)/fail2ban-jail-edit
 	rm -f $(HELPERS)/grub-kargs-edit
diff --git a/crates/sysknife-daemon/src/actions/containers.rs b/crates/sysknife-daemon/src/actions/containers.rs
index 0f2993d7..877cf4e3 100644
--- a/crates/sysknife-daemon/src/actions/containers.rs
+++ b/crates/sysknife-daemon/src/actions/containers.rs
@@ -1,4 +1,4 @@
-use super::{command_mechanism, ActionMechanism, ActionSpec};
+use super::{ActionMechanism, ActionSpec};
 use sysknife_types::RiskLevel;
 
 pub fn specs() -> Vec<ActionSpec> {
@@ -16,52 +16,32 @@ pub fn specs() -> Vec<ActionSpec> {
     ]
 }
 
-/// Run a Podman command as the target user via `sudo runuser -l`.
+/// Run fixed Podman argv after dropping to the target user.
 ///
 /// Rootless Podman operates against the user's container storage, not a shared
 /// system store. The daemon runs as the `sysknife` system user whose container
 /// namespace is empty; we must switch to `username` to reach their containers.
-/// `runuser -l` establishes a full login context including XDG_RUNTIME_DIR and
-/// the sub-UID/GID ranges required by the kernel namespace code — those env
-/// vars are populated by `pam_systemd` which only fires for a login shell.
-///
-/// **Shell-injection safety:** the `-c "<podman_cmd>"` form passes a string to
-/// `/bin/sh`, so any metacharacter in an interpolated value would be expanded
-/// by the shell. Defence-in-depth:
-///   1. `username` flows through `validated_username` (`[A-Za-z0-9._-]`, no
-///      leading dash, ≤32 bytes).
-///   2. Container `name` and `image` flow through `validated_safe_arg`, which
-///      enforces `[A-Za-z0-9._:/+@-]`, no leading dash, ≤254 bytes — every
-///      shell metacharacter (`;`, `&`, `|`, `$`, backtick, quotes, whitespace,
-///      glob, brace, `\`, etc.) is rejected at the boundary.
-///   3. The format!-interpolated values are wrapped in single quotes so even
-///      a future validator regression cannot escape the surrounding quotes.
-fn podman_as(username: &str, podman_cmd: &str) -> ActionMechanism {
+/// The helper sets HOME and XDG_RUNTIME_DIR for the resolved UID, resets
+/// supplementary groups, and drops GID/UID before invoking the fixed tool.
+/// Rootless Podman still requires the account's configured sub-UID/GID ranges
+/// and runtime directory. No login shell or user startup file runs as root.
+fn podman_as(username: &str, parameters: &[&str]) -> ActionMechanism {
+    let mut args = vec![
+        "/usr/lib/sysknife/action-steps".to_string(),
+        "podman".to_string(),
+        username.to_string(),
+    ];
+    args.extend(parameters.iter().map(|value| value.to_string()));
     ActionMechanism::Command {
         program: "sudo",
-        args: vec![
-            "runuser".to_string(),
-            "-l".to_string(),
-            username.to_string(),
-            "-c".to_string(),
-            podman_cmd.to_string(),
-        ],
+        args,
     }
 }
 
 pub fn list_containers(username: &str) -> ActionSpec {
     ActionSpec {
         action_name: "ListContainers",
-        mechanism: command_mechanism(
-            "sudo",
-            [
-                "runuser",
-                "-l",
-                username,
-                "-c",
-                "podman ps --all --format json",
-            ],
-        ),
+        mechanism: podman_as(username, &["ps", "--all", "--format", "json"]),
         risk_level: RiskLevel::Low,
         reboot_required: false,
         rollback_available: false,
@@ -69,10 +49,9 @@ pub fn list_containers(username: &str) -> ActionSpec {
 }
 
 pub fn create_container(username: &str, name: &str, image: &str) -> ActionSpec {
-    let cmd = format!("podman create --name '{}' '{}'", name, image);
     ActionSpec {
         action_name: "CreateContainer",
-        mechanism: podman_as(username, &cmd),
+        mechanism: podman_as(username, &["create", "--name", name, image]),
         risk_level: RiskLevel::Medium,
         reboot_required: false,
         rollback_available: false,
@@ -80,10 +59,9 @@ pub fn create_container(username: &str, name: &str, image: &str) -> ActionSpec {
 }
 
 pub fn start_container(username: &str, name: &str) -> ActionSpec {
-    let cmd = format!("podman start '{}'", name);
     ActionSpec {
         action_name: "StartContainer",
-        mechanism: podman_as(username, &cmd),
+        mechanism: podman_as(username, &["start", name]),
         risk_level: RiskLevel::Medium,
         reboot_required: false,
         rollback_available: false,
@@ -91,10 +69,9 @@ pub fn start_container(username: &str, name: &str) -> ActionSpec {
 }
 
 pub fn stop_container(username: &str, name: &str) -> ActionSpec {
-    let cmd = format!("podman stop '{}'", name);
     ActionSpec {
         action_name: "StopContainer",
-        mechanism: podman_as(username, &cmd),
+        mechanism: podman_as(username, &["stop", name]),
         risk_level: RiskLevel::Medium,
         reboot_required: false,
         rollback_available: false,
@@ -102,10 +79,9 @@ pub fn stop_container(username: &str, name: &str) -> ActionSpec {
 }
 
 pub fn remove_container(username: &str, name: &str) -> ActionSpec {
-    let cmd = format!("podman rm '{}'", name);
     ActionSpec {
         action_name: "RemoveContainer",
-        mechanism: podman_as(username, &cmd),
+        mechanism: podman_as(username, &["rm", name]),
         risk_level: RiskLevel::Medium,
         reboot_required: false,
         rollback_available: false,
@@ -113,10 +89,9 @@ pub fn remove_container(username: &str, name: &str) -> ActionSpec {
 }
 
 pub fn get_container_info(username: &str, name: &str) -> ActionSpec {
-    let cmd = format!("podman inspect '{}'", name);
     ActionSpec {
         action_name: "GetContainerInfo",
-        mechanism: podman_as(username, &cmd),
+        mechanism: podman_as(username, &["inspect", name]),
         risk_level: RiskLevel::Low,
         reboot_required: false,
         rollback_available: false,
diff --git a/crates/sysknife-daemon/src/actions/flatpak.rs b/crates/sysknife-daemon/src/actions/flatpak.rs
index 81146a29..fb294d78 100644
--- a/crates/sysknife-daemon/src/actions/flatpak.rs
+++ b/crates/sysknife-daemon/src/actions/flatpak.rs
@@ -19,29 +19,22 @@ pub fn specs() -> Vec<ActionSpec> {
     ]
 }
 
-/// Run a Flatpak command as the target user via `sudo runuser -u user -- flatpak <argv>`.
+/// Run a fixed Flatpak operation after the helper drops to the target user.
 ///
 /// Flatpak user installations live under `~/.local/share/flatpak/` and are
 /// accessed through the user's D-Bus session. The daemon runs as `sysknife`
-/// (a system user) with no user installation; `runuser -u` switches to the
+/// (a system user) with no user installation; the helper switches to the
 /// correct user UID without spawning a login shell, so each argv element is
 /// passed to `flatpak` verbatim.
 ///
-/// **Shell-injection safety:** unlike `runuser -l user -c "<shell-string>"`,
-/// the `-u user -- argv` form bypasses the shell entirely. There is no string
-/// interpolation, no metacharacter expansion, and no quoting concern — every
-/// argument reaches `flatpak(1)` exactly as supplied. Callers must still pass
-/// arguments through `validated_safe_arg`/`validated_username` upstream so a
-/// hostile value cannot impersonate a flag (`-X`) or break out of the
-/// command's own option parser, but they no longer have to defend against
-/// shell metacharacters.
+/// The helper independently allowlists the complete Flatpak argv grammar and
+/// rejects option-shaped values before dropping credentials and executing the
+/// fixed binary. Callers also validate values upstream; no shell parses them.
 fn flatpak_as(username: &str, args: &[&str]) -> ActionMechanism {
     let mut argv: Vec<String> = vec![
-        "runuser".to_string(),
-        "-u".to_string(),
-        username.to_string(),
-        "--".to_string(),
+        "/usr/lib/sysknife/action-steps".to_string(),
         "flatpak".to_string(),
+        username.to_string(),
     ];
     argv.extend(args.iter().map(|s| s.to_string()));
     ActionMechanism::Command {
@@ -168,7 +161,7 @@ pub fn get_flatpak_app_info(username: &str, app_id: &str) -> ActionSpec {
 // every Ubuntu wrapper delegates directly to the shared `flatpak_as` helper.
 // ---------------------------------------------------------------------------
 
-/// Install a Flatpak app on Ubuntu (`sudo runuser -u <user> -- flatpak install --user -y <remote> <app>`).
+/// Install a Flatpak app on Ubuntu through the bounded user-operation helper.
 ///
 /// Identical argv to `InstallFlatpak` on Fedora. Distinct action name for
 /// Ubuntu-specific routing in the daemon and LLM prompt.
@@ -184,7 +177,7 @@ pub fn ubuntu_install_flatpak(username: &str, app_id: &str, remote: &str) -> Act
     }
 }
 
-/// Remove a Flatpak app on Ubuntu (`sudo runuser -u <user> -- flatpak uninstall --user -y <app>`).
+/// Remove a Flatpak app on Ubuntu through the bounded user-operation helper.
 ///
 /// Risk: Medium. Uninstalls a sandboxed Flatpak application.
 pub fn ubuntu_remove_flatpak(username: &str, app_id: &str) -> ActionSpec {
diff --git a/crates/sysknife-daemon/src/actions/mod.rs b/crates/sysknife-daemon/src/actions/mod.rs
index 1fbb282b..8872ed8c 100644
--- a/crates/sysknife-daemon/src/actions/mod.rs
+++ b/crates/sysknife-daemon/src/actions/mod.rs
@@ -152,7 +152,7 @@ pub fn exclusive_resource(spec: &ActionSpec) -> Option<ExclusiveResource> {
                 "apt-get" | "apt" | "apt-mark" | "aptitude" | "dpkg" | "dpkg-reconfigure"
                 | "add-apt-repository" | "do-release-upgrade" | "unattended-upgrade"
                 | "apt-pin-edit" => Some(ExclusiveResource::Dpkg),
-                "snap" => Some(ExclusiveResource::Snap),
+                "snap" | "snap-install-hold" => Some(ExclusiveResource::Snap),
                 "rpm-ostree" | "ostree" => Some(ExclusiveResource::RpmOstree),
                 "flatpak" => Some(ExclusiveResource::Flatpak),
                 _ => None,
diff --git a/crates/sysknife-daemon/src/actions/network.rs b/crates/sysknife-daemon/src/actions/network.rs
index b4b63d67..ae36b169 100644
--- a/crates/sysknife-daemon/src/actions/network.rs
+++ b/crates/sysknife-daemon/src/actions/network.rs
@@ -55,37 +55,27 @@ pub fn set_dns_servers(interface: &str, servers: &[&str]) -> ActionSpec {
 
 /// Configure a firewalld rule and reload so it takes effect.
 ///
-/// Uses `sh -c` to chain `firewall-cmd --permanent ... && firewall-cmd --reload`
-/// atomically; firewalld has no single-call equivalent that updates the
-/// permanent rule and reloads runtime in one shot.
-///
-/// **Shell-injection safety:** `zone` and `service` are interpolated into the
-/// script via `format!`, so any shell metacharacter in either would be
-/// expanded by `/bin/sh`. Defence-in-depth:
-///   1. Both flow through `validated_safe_arg` upstream, which enforces a
-///      strict ASCII allowlist (`[A-Za-z0-9._:/+@-]`, no leading dash, ≤254
-///      bytes) and rejects every shell metacharacter at the boundary.
-///   2. The interpolated values are wrapped in single quotes so a future
-///      validator regression cannot escape the surrounding quotes.
-///   3. `verb` is selected from a fixed pair of literals (`add-service` /
-///      `remove-service`); it is never attacker-influenced.
+/// The bounded helper runs the permanent mutation then reloads only on success.
+/// These are sequential commands, not an atomic firewalld transaction. Arguments
+/// are validated independently by the helper and never interpreted as a shell.
 pub fn configure_firewall(zone: &str, service: &str, enabled: bool) -> ActionSpec {
     let verb = if enabled {
         "add-service"
     } else {
         "remove-service"
     };
-    let script = format!(
-        "firewall-cmd --permanent --zone='{}' --{}='{}' && firewall-cmd --reload",
-        zone, verb, service
-    );
-
     ActionSpec {
         action_name: "ConfigureFirewall",
-        mechanism: super::ActionMechanism::Command {
-            program: "sudo",
-            args: vec!["sh".to_string(), "-c".to_string(), script],
-        },
+        mechanism: command_mechanism(
+            "sudo",
+            [
+                "/usr/lib/sysknife/action-steps",
+                "firewall",
+                zone,
+                service,
+                verb,
+            ],
+        ),
         risk_level: RiskLevel::High,
         reboot_required: false,
         rollback_available: false,
diff --git a/crates/sysknife-daemon/src/actions/snap.rs b/crates/sysknife-daemon/src/actions/snap.rs
index d82af700..900388fd 100644
--- a/crates/sysknife-daemon/src/actions/snap.rs
+++ b/crates/sysknife-daemon/src/actions/snap.rs
@@ -10,9 +10,8 @@
 //! `snap refresh --hold <name>` to pin the snap at the installed version.
 //! Set `auto_update: true` in the plan params to skip the hold.
 //!
-//! The hold is applied by building a two-command spec using a shell fragment
-//! via `sh -c "snap install … && snap refresh --hold …"`. `name` and
-//! `channel` are validated by [`snap_install`] itself before interpolation
+//! The bounded helper installs and then holds, stopping on either failure.
+//! `name` and `channel` are validated by [`snap_install`] and the helper
 //! (in addition to, not instead of, the executor's own `validated_safe_arg`
 //! check) — see the `SnapInstallError` doc below.
 
@@ -31,10 +30,8 @@ pub enum SnapInstallError {
     ///
     /// Defense in depth: the executor already validates both via
     /// `validated_safe_arg` before calling this constructor, but the
-    /// `auto_update: false` path interpolates `name`/`channel` into a
-    /// `sh -c "snap install … && snap refresh --hold …"` fragment — a future
-    /// internal Rust caller (fleet plan/execute path) that skipped the
-    /// executor could not otherwise be blocked from injecting through it.
+    /// helper also revalidates them. Keep constructor validation so internal
+    /// callers cannot produce an invalid spec by skipping the executor.
     InvalidArg { param: &'static str, value: String },
 }
 
@@ -132,16 +129,19 @@ pub fn snap_install(
             rollback_available: false,
         })
     } else {
-        // Install + hold in one shell fragment to avoid a window where the snap
-        // can be auto-refreshed between install and hold.
+        // Sequential install and hold: the helper does not hold a failed install.
         let channel_arg = channel.unwrap_or("stable");
-        let cmd = format!(
-            "snap install --channel={} {} && snap refresh --hold {}",
-            channel_arg, name, name
-        );
         Ok(ActionSpec {
             action_name: "SnapInstall",
-            mechanism: super::command_mechanism("sudo", ["sh", "-c", &cmd]),
+            mechanism: super::command_mechanism(
+                "sudo",
+                [
+                    "/usr/lib/sysknife/action-steps",
+                    "snap-install-hold",
+                    name,
+                    channel_arg,
+                ],
+            ),
             risk_level: RiskLevel::Medium,
             reboot_required: false,
             rollback_available: false,
@@ -299,15 +299,18 @@ mod tests {
         let spec = snap_install("firefox", None, false).unwrap();
         let (prog, args) = extract_args(&spec);
         assert_eq!(prog, "sudo");
-        // When auto_update=false the hold is embedded in a sh -c fragment.
-        let full = args.join(" ");
-        assert!(
-            full.contains("snap install"),
-            "missing 'snap install': {full}"
+        assert_eq!(
+            args,
+            [
+                "/usr/lib/sysknife/action-steps",
+                "snap-install-hold",
+                "firefox",
+                "stable"
+            ]
         );
-        assert!(
-            full.contains("snap refresh --hold firefox"),
-            "missing hold: {full}"
+        assert_eq!(
+            crate::actions::exclusive_resource(&spec),
+            Some(crate::actions::ExclusiveResource::Snap)
         );
     }
 
diff --git a/crates/sysknife-daemon/src/actions/ssh.rs b/crates/sysknife-daemon/src/actions/ssh.rs
index 9c41325f..e67330a8 100644
--- a/crates/sysknife-daemon/src/actions/ssh.rs
+++ b/crates/sysknife-daemon/src/actions/ssh.rs
@@ -1,4 +1,4 @@
-use super::{command_mechanism, ActionMechanism, ActionSpec};
+use super::{command_mechanism, ActionSpec};
 use sysknife_types::RiskLevel;
 
 pub fn specs() -> Vec<ActionSpec> {
@@ -10,19 +10,10 @@ pub fn specs() -> Vec<ActionSpec> {
     ]
 }
 
-/// Installed path of the privileged sshd-option helper script.
-/// See `packaging/sysknife-sshd-option-edit` and the matching NOPASSWD grant in
-/// `packaging/sysknife-sudoers`.
+/// Installed root-owned helper, with an independent option/value allowlist.
 const SSHD_OPTION_HELPER: &str = "/usr/lib/sysknife/sshd-option-edit";
 
-/// Set an allowlisted sshd option via a drop-in under
-/// `/etc/ssh/sshd_config.d/`, validated with `sshd -t` and applied by reloading
-/// the ssh service.
-///
-/// Risk: High. A misconfigured sshd can lock out remote access; the helper
-/// gates every change on `sshd -t` and rolls back on failure. `option` and
-/// `value` are checked against a fixed allowlist by both the daemon and the
-/// helper — this is deliberately NOT an arbitrary `sshd_config` editor.
+/// Validate a drop-in with sshd -t before reloading; roll back on rejection.
 pub fn set_sshd_option(option: &str, value: &str) -> ActionSpec {
     ActionSpec {
         action_name: "SetSshdOption",
@@ -46,54 +37,27 @@ pub fn get_authorized_keys(username: &str) -> ActionSpec {
     }
 }
 
-/// Shell body for `AddAuthorizedKey`.
-///
-/// The key and path arrive as positional arguments (`$1`, `$2`) rather than
-/// being interpolated into the script text, so no value the caller supplies is
-/// ever parsed as shell syntax. `printf '%s\n'` is used instead of `echo`
-/// because `echo` mangles values beginning with `-` and interprets backslash
-/// escapes on some shells.
-const ADD_KEY_SCRIPT: &str =
-    "key=$1; path=$2; grep -Fxq -- \"$key\" \"$path\" 2>/dev/null || printf '%s\\n' \"$key\" >> \"$path\"";
-
-/// `sudo runuser -u <username> -- sh -c <script> sh <key> <path>`.
-///
-/// The write runs **as the target user**, not as root. This is the fix for the
-/// symlink-follow escalation: the daemon runs as root only long enough to drop
-/// to `<username>`, so `>> "$path"` following a symlink the attacker planted at
-/// `~/.ssh/authorized_keys` can only reach files that user can already write.
-/// A link to `/etc/passwd` or another account's file fails with `EACCES` instead
-/// of letting root append there. It also keeps the file owned by the user, which
-/// is what `authorized_keys` must be, without a `chown` dance.
-///
-/// The `runuser -u <user> -- <argv>` form bypasses the shell for the outer
-/// command, exactly as `flatpak_as` documents, so `<username>` cannot act as a
-/// flag or a shell metacharacter. The inner `sh -c <script>` still takes the key
-/// and path as positional `$1`/`$2`, never interpolated.
+/// The fixed helper operation resolves the account and drops supplementary
+/// groups, GID and UID before any access to its authorized_keys. It never accepts
+/// a caller-selected path. Keys are compared as literal whole lines, never regex
+/// patterns, and edits retain the existing inode, owner and mode (#145).
 fn keys_edit_as_user(
     action_name: &'static str,
     username: &str,
-    script: &str,
+    operation: &str,
     public_key: &str,
 ) -> ActionSpec {
-    let keys_path = format!("/home/{username}/.ssh/authorized_keys");
     ActionSpec {
         action_name,
-        mechanism: ActionMechanism::Command {
-            program: "sudo",
-            args: vec![
-                "runuser".to_string(),
-                "-u".to_string(),
-                username.to_string(),
-                "--".to_string(),
-                "sh".to_string(),
-                "-c".to_string(),
-                script.to_string(),
-                "sh".to_string(),
-                public_key.to_string(),
-                keys_path,
+        mechanism: command_mechanism(
+            "sudo",
+            [
+                "/usr/lib/sysknife/action-steps",
+                operation,
+                username,
+                public_key,
             ],
-        },
+        ),
         risk_level: RiskLevel::High,
         reboot_required: false,
         rollback_available: false,
@@ -101,46 +65,9 @@ fn keys_edit_as_user(
 }
 
 pub fn add_authorized_key(username: &str, public_key: &str) -> ActionSpec {
-    keys_edit_as_user("AddAuthorizedKey", username, ADD_KEY_SCRIPT, public_key)
+    keys_edit_as_user("AddAuthorizedKey", username, "ssh-add", public_key)
 }
 
-/// Shell body for `RemoveAuthorizedKey`.
-///
-/// **The key must never reach a regex.** This action previously deleted the
-/// line with `sed -i '\|^KEY$|d'`, which made the caller-supplied key a *basic
-/// regular expression*: a value like `ssh-ed25519 .*` passes every check in
-/// `validated_public_key` (allowed prefix, printable ASCII, no shell
-/// metacharacters) and then matched — and deleted — every ed25519 key in the
-/// file. `sed` exits 0, so the job was recorded `Succeeded` and the signed
-/// audit summary read as a routine single-key removal: the executed effect
-/// silently diverged from the approved preview on a lockout-capable action.
-///
-/// Blocklisting regex metacharacters is NOT a viable fix: `.` is legal inside
-/// a key comment (`alice@example.com`), so rejecting it would refuse valid
-/// keys. The fix is structural — `grep -Fxv` compares fixed whole lines, so no
-/// metacharacter can widen the match, and the key travels as `$1` rather than
-/// being interpolated into the script.
-///
-/// The result is streamed to a temp file and copied back with `cat >` rather
-/// than moved: that preserves the original inode, owner, and mode, which
-/// matters because `authorized_keys` must stay owned by the target user.
-/// `grep` exits 1 when it selects no lines (the file is now empty) — that is a
-/// success here, so only an exit status above 1 is treated as an error.
-const REMOVE_KEY_SCRIPT: &str = "key=$1; path=$2; \
-tmp=$(mktemp) || exit 1; \
-grep -Fxv -- \"$key\" \"$path\" > \"$tmp\"; rc=$?; \
-if [ $rc -gt 1 ]; then rm -f \"$tmp\"; exit $rc; fi; \
-cat \"$tmp\" > \"$path\"; rm -f \"$tmp\"";
-
 pub fn remove_authorized_key(username: &str, public_key: &str) -> ActionSpec {
-    // Runs as the target user, same as the add path: the `cat "$tmp" > "$path"`
-    // must not follow a planted symlink out of the user's own home either.
-    // Revoking a key is lockout-capable and cannot be rolled back, so High,
-    // symmetric with AddAuthorizedKey.
-    keys_edit_as_user(
-        "RemoveAuthorizedKey",
-        username,
-        REMOVE_KEY_SCRIPT,
-        public_key,
-    )
+    keys_edit_as_user("RemoveAuthorizedKey", username, "ssh-remove", public_key)
 }
diff --git a/crates/sysknife-daemon/src/actions/toolbox.rs b/crates/sysknife-daemon/src/actions/toolbox.rs
index a9e4aabd..59bff602 100644
--- a/crates/sysknife-daemon/src/actions/toolbox.rs
+++ b/crates/sysknife-daemon/src/actions/toolbox.rs
@@ -9,38 +9,26 @@ pub fn specs() -> Vec<ActionSpec> {
     ]
 }
 
-/// Run a Toolbox command as the target user via `sudo runuser -l`.
+/// Run fixed Toolbox argv as the target user through the bounded helper.
 ///
 /// Toolbox containers are per-user (rootless Podman under the hood). The
 /// daemon's `sysknife` system user has its own empty container store; we must
 /// switch to the correct user so toolbox reads the right storage path and
 /// sub-UID/GID ranges.
 ///
-/// `XDG_RUNTIME_DIR` must be set explicitly: `runuser -l` starts a login shell
-/// but does not trigger `pam_systemd`, so `XDG_RUNTIME_DIR` is left empty.
-/// Toolbox derives its rootless Podman socket path from it; an empty value
-/// produces `--volume ":"` which Podman rejects.
-///
-/// **Shell-injection safety:** the `-c "<toolbox_cmd>"` form passes a string
-/// to `/bin/sh`, so an attacker-controlled metacharacter would be expanded.
-/// Defence-in-depth:
-///   1. `username` flows through `validated_username` (`[A-Za-z0-9._-]`).
-///   2. Toolbox `name`, `release`, and `image` flow through
-///      `validated_safe_arg`, which now enforces a strict ASCII allowlist
-///      and rejects every shell metacharacter at the boundary.
-///   3. The format!-interpolated values are wrapped in single quotes for
-///      defence-in-depth; the `$(id -u)` expansion is daemon-controlled, not
-///      attacker-reachable.
-fn toolbox_as(username: &str, toolbox_cmd: &str) -> ActionMechanism {
+/// The helper sets XDG_RUNTIME_DIR from the resolved UID, drops credentials,
+/// and independently validates the complete Toolbox argument grammar. No
+/// caller-controlled shell string or environment assignment is accepted.
+fn toolbox_as(username: &str, parameters: &[&str]) -> ActionMechanism {
+    let mut args = vec![
+        "/usr/lib/sysknife/action-steps".to_string(),
+        "toolbox".to_string(),
+        username.to_string(),
+    ];
+    args.extend(parameters.iter().map(|value| value.to_string()));
     ActionMechanism::Command {
         program: "sudo",
-        args: vec![
-            "runuser".to_string(),
-            "-l".to_string(),
-            username.to_string(),
-            "-c".to_string(),
-            format!("XDG_RUNTIME_DIR=/run/user/$(id -u) {}", toolbox_cmd),
-        ],
+        args,
     }
 }
 
@@ -51,7 +39,7 @@ pub fn list_toolboxes(username: &str) -> ActionSpec {
     // directly, which fails when sub-UID/GID ranges are not yet configured.
     ActionSpec {
         action_name: "ListToolboxes",
-        mechanism: toolbox_as(username, "toolbox list"),
+        mechanism: toolbox_as(username, &["list"]),
         risk_level: RiskLevel::Low,
         reboot_required: false,
         rollback_available: false,
@@ -64,16 +52,16 @@ pub fn create_toolbox(
     release: Option<&str>,
     image: Option<&str>,
 ) -> ActionSpec {
-    let mut cmd = format!("toolbox create --container '{}'", name);
+    let mut args = vec!["create", "--container", name];
     if let Some(release) = release {
-        cmd.push_str(&format!(" --release '{}'", release));
+        args.extend(["--release", release]);
     }
     if let Some(image) = image {
-        cmd.push_str(&format!(" --image '{}'", image));
+        args.extend(["--image", image]);
     }
     ActionSpec {
         action_name: "CreateToolbox",
-        mechanism: toolbox_as(username, &cmd),
+        mechanism: toolbox_as(username, &args),
         risk_level: RiskLevel::Medium,
         reboot_required: false,
         rollback_available: false,
@@ -81,10 +69,9 @@ pub fn create_toolbox(
 }
 
 pub fn remove_toolbox(username: &str, name: &str) -> ActionSpec {
-    let cmd = format!("toolbox rm '{}'", name);
     ActionSpec {
         action_name: "RemoveToolbox",
-        mechanism: toolbox_as(username, &cmd),
+        mechanism: toolbox_as(username, &["rm", name]),
         risk_level: RiskLevel::Medium,
         reboot_required: false,
         rollback_available: false,
diff --git a/crates/sysknife-daemon/src/actions/users.rs b/crates/sysknife-daemon/src/actions/users.rs
index a34fdbb1..67f218b2 100644
--- a/crates/sysknife-daemon/src/actions/users.rs
+++ b/crates/sysknife-daemon/src/actions/users.rs
@@ -78,13 +78,17 @@ pub fn add_user_to_group(username: &str, group: &str) -> ActionSpec {
     // /etc/group. If the group is absent from /etc/group, usermod silently
     // succeeds without actually adding the user. Fix: copy the entry via
     // `getent group` (which merges /usr/lib/group + /etc/group) if missing.
-    let script = format!(
-        "grep -q '^{}:' /etc/group || getent group '{}' >> /etc/group; usermod --append --groups '{}' '{}'",
-        group, group, group, username
-    );
     ActionSpec {
         action_name: "AddUserToGroup",
-        mechanism: command_mechanism("sudo", ["sh", "-c", script.as_str()]),
+        mechanism: command_mechanism(
+            "sudo",
+            [
+                "/usr/lib/sysknife/action-steps",
+                "group-add",
+                username,
+                group,
+            ],
+        ),
         // High risk: adding a user to a privileged group (e.g. `wheel`) grants
         // sudo / sysknife-admin rights, constituting a privilege escalation if
         // performed at lower than Admin level.
@@ -98,13 +102,17 @@ pub fn remove_user_from_group(username: &str, group: &str) -> ActionSpec {
     // Same Fedora Atomic group-layer issue as AddUserToGroup: `gpasswd` fails
     // with "group does not exist in /etc/group" for system groups. Ensure the
     // entry is present in /etc/group before deletion.
-    let script = format!(
-        "grep -q '^{}:' /etc/group || getent group '{}' >> /etc/group; gpasswd --delete '{}' '{}'",
-        group, group, username, group
-    );
     ActionSpec {
         action_name: "RemoveUserFromGroup",
-        mechanism: command_mechanism("sudo", ["sh", "-c", script.as_str()]),
+        mechanism: command_mechanism(
+            "sudo",
+            [
+                "/usr/lib/sysknife/action-steps",
+                "group-remove",
+                username,
+                group,
+            ],
+        ),
         // High risk: mirrors AddUserToGroup — removing from a privileged group
         // is equally impactful and should require the same Admin authorization.
         risk_level: RiskLevel::High,
diff --git a/crates/sysknife-daemon/src/executor.rs b/crates/sysknife-daemon/src/executor.rs
index aed13b06..18b585b6 100644
--- a/crates/sysknife-daemon/src/executor.rs
+++ b/crates/sysknife-daemon/src/executor.rs
@@ -2455,11 +2455,9 @@ mod tests {
             ActionMechanism::Command {
                 program: "sudo",
                 args: vec![
-                    "runuser".to_string(),
-                    "-u".to_string(),
-                    "alice".to_string(),
-                    "--".to_string(),
+                    "/usr/lib/sysknife/action-steps".to_string(),
                     "flatpak".to_string(),
+                    "alice".to_string(),
                     "install".to_string(),
                     "--user".to_string(),
                     "-y".to_string(),
@@ -2487,11 +2485,9 @@ mod tests {
             ActionMechanism::Command {
                 program: "sudo",
                 args: vec![
-                    "runuser".to_string(),
-                    "-u".to_string(),
-                    "alice".to_string(),
-                    "--".to_string(),
+                    "/usr/lib/sysknife/action-steps".to_string(),
                     "flatpak".to_string(),
+                    "alice".to_string(),
                     "install".to_string(),
                     "--user".to_string(),
                     "-y".to_string(),
diff --git a/crates/sysknife-daemon/tests/actions_batch1.rs b/crates/sysknife-daemon/tests/actions_batch1.rs
index b6aab933..6f16a3b1 100644
--- a/crates/sysknife-daemon/tests/actions_batch1.rs
+++ b/crates/sysknife-daemon/tests/actions_batch1.rs
@@ -80,11 +80,10 @@ fn flatpak_family_covers_install_remove_and_query_actions() {
 }
 
 #[test]
-fn flatpak_install_routes_through_runuser() {
+fn flatpak_install_routes_through_bounded_helper() {
     // InstallFlatpak must run as the target user (user-scoped Flatpak store).
-    // The daemon runs as `sysknife`; `sudo runuser -u <username> -- flatpak ...`
-    // switches to the correct UID and bypasses the shell entirely so each argv
-    // element is passed to flatpak verbatim (no metacharacter expansion).
+    // The daemon runs as `sysknife`; the fixed helper validates argv and drops
+    // credentials before executing Flatpak without a shell.
     let spec = flatpak::install_flatpak("testuser", "org.mozilla.firefox", "flathub");
 
     assert_eq!(spec.action_name, "InstallFlatpak");
@@ -94,11 +93,9 @@ fn flatpak_install_routes_through_runuser() {
         ActionMechanism::Command {
             program: "sudo",
             args: vec![
-                "runuser".to_string(),
-                "-u".to_string(),
-                "testuser".to_string(),
-                "--".to_string(),
+                "/usr/lib/sysknife/action-steps".to_string(),
                 "flatpak".to_string(),
+                "testuser".to_string(),
                 "install".to_string(),
                 "--user".to_string(),
                 "-y".to_string(),
@@ -123,10 +120,10 @@ fn toolbox_family_covers_create_enter_list_and_remove() {
 }
 
 #[test]
-fn toolbox_create_routes_through_runuser_with_xdg_runtime_dir() {
+fn toolbox_create_routes_through_bounded_helper_with_xdg_runtime_dir() {
     // CreateToolbox must run as the target user (rootless Podman per-user).
-    // XDG_RUNTIME_DIR must be set explicitly because `runuser -l` does not
-    // trigger pam_systemd — without it toolbox fails to locate its Podman socket.
+    // The helper sets XDG_RUNTIME_DIR explicitly after dropping credentials;
+    // without it toolbox fails to locate its Podman socket.
     let spec = toolbox::create_toolbox("testuser", "sysknife-dev", Some("41"), None);
 
     assert_eq!(spec.action_name, "CreateToolbox");
@@ -136,11 +133,14 @@ fn toolbox_create_routes_through_runuser_with_xdg_runtime_dir() {
         ActionMechanism::Command {
             program: "sudo",
             args: vec![
-                "runuser".to_string(),
-                "-l".to_string(),
+                "/usr/lib/sysknife/action-steps".to_string(),
+                "toolbox".to_string(),
                 "testuser".to_string(),
-                "-c".to_string(),
-                "XDG_RUNTIME_DIR=/run/user/$(id -u) toolbox create --container 'sysknife-dev' --release '41'".to_string(),
+                "create".to_string(),
+                "--container".to_string(),
+                "sysknife-dev".to_string(),
+                "--release".to_string(),
+                "41".to_string(),
             ],
         }
     );
@@ -318,11 +318,9 @@ fn update_flatpak_with_app_id_appends_it() {
         ActionMechanism::Command {
             program: "sudo",
             args: vec![
-                "runuser".to_string(),
-                "-u".to_string(),
-                "testuser".to_string(),
-                "--".to_string(),
+                "/usr/lib/sysknife/action-steps".to_string(),
                 "flatpak".to_string(),
+                "testuser".to_string(),
                 "update".to_string(),
                 "--user".to_string(),
                 "-y".to_string(),
@@ -343,11 +341,9 @@ fn update_flatpak_without_app_id_omits_it() {
         ActionMechanism::Command {
             program: "sudo",
             args: vec![
-                "runuser".to_string(),
-                "-u".to_string(),
-                "testuser".to_string(),
-                "--".to_string(),
+                "/usr/lib/sysknife/action-steps".to_string(),
                 "flatpak".to_string(),
+                "testuser".to_string(),
                 "update".to_string(),
                 "--user".to_string(),
                 "-y".to_string(),
@@ -448,7 +444,7 @@ fn container_family_covers_runtime_lifecycle() {
 }
 
 #[test]
-fn container_create_routes_through_runuser() {
+fn container_create_routes_through_bounded_helper() {
     // CreateContainer must run in the user's rootless Podman context.
     // Direct podman invocation as `sysknife` would use an empty, unrelated store.
     let spec = containers::create_container(
@@ -463,11 +459,13 @@ fn container_create_routes_through_runuser() {
         ActionMechanism::Command {
             program: "sudo",
             args: vec![
-                "runuser".to_string(),
-                "-l".to_string(),
+                "/usr/lib/sysknife/action-steps".to_string(),
+                "podman".to_string(),
                 "testuser".to_string(),
-                "-c".to_string(),
-                "podman create --name 'sysknife-dev' 'registry.fedoraproject.org/fedora-toolbox:41'".to_string(),
+                "create".to_string(),
+                "--name".to_string(),
+                "sysknife-dev".to_string(),
+                "registry.fedoraproject.org/fedora-toolbox:41".to_string(),
             ],
         }
     );
diff --git a/crates/sysknife-daemon/tests/actions_batch2.rs b/crates/sysknife-daemon/tests/actions_batch2.rs
index 7cc85758..eabda4c1 100644
--- a/crates/sysknife-daemon/tests/actions_batch2.rs
+++ b/crates/sysknife-daemon/tests/actions_batch2.rs
@@ -337,9 +337,11 @@ fn configure_firewall_enable_uses_permanent_and_reload() {
         ActionMechanism::Command {
             program: "sudo",
             args: vec![
-                "sh".to_string(),
-                "-c".to_string(),
-                "firewall-cmd --permanent --zone='public' --add-service='ssh' && firewall-cmd --reload".to_string(),
+                "/usr/lib/sysknife/action-steps".to_string(),
+                "firewall".to_string(),
+                "public".to_string(),
+                "ssh".to_string(),
+                "add-service".to_string(),
             ],
         }
     );
@@ -354,9 +356,11 @@ fn configure_firewall_disable_uses_remove_service_with_reload() {
         ActionMechanism::Command {
             program: "sudo",
             args: vec![
-                "sh".to_string(),
-                "-c".to_string(),
-                "firewall-cmd --permanent --zone='public' --remove-service='ssh' && firewall-cmd --reload".to_string(),
+                "/usr/lib/sysknife/action-steps".to_string(),
+                "firewall".to_string(),
+                "public".to_string(),
+                "ssh".to_string(),
+                "remove-service".to_string(),
             ],
         }
     );
@@ -588,22 +592,14 @@ fn user_creation_and_group_changes_use_sudo_prefixed_shadow_tools() {
     // without actually modifying group membership.
     if let ActionMechanism::Command { program, args } = &add_group.mechanism {
         assert_eq!(*program, "sudo", "AddUserToGroup must use sudo");
-        assert!(
-            args.contains(&"sh".to_string()),
-            "must use sh -c for the guard script"
-        );
-        assert!(
-            args.contains(&"-c".to_string()),
-            "must use sh -c for the guard script"
-        );
-        let cmd = args.last().unwrap();
-        assert!(
-            cmd.contains("getent group"),
-            "must use getent group to resolve OSTree group layer: {cmd}"
-        );
-        assert!(
-            cmd.contains("usermod"),
-            "must call usermod to add group membership: {cmd}"
+        assert_eq!(
+            args,
+            &[
+                "/usr/lib/sysknife/action-steps",
+                "group-add",
+                "alice",
+                "wheel"
+            ]
         );
     } else {
         panic!("AddUserToGroup must use Command mechanism");
@@ -611,18 +607,14 @@ fn user_creation_and_group_changes_use_sudo_prefixed_shadow_tools() {
 
     if let ActionMechanism::Command { program, args } = &remove_group.mechanism {
         assert_eq!(*program, "sudo", "RemoveUserFromGroup must use sudo");
-        assert!(
-            args.contains(&"sh".to_string()),
-            "must use sh -c for the guard script"
-        );
-        let cmd = args.last().unwrap();
-        assert!(
-            cmd.contains("getent group"),
-            "must use getent group to resolve OSTree group layer: {cmd}"
-        );
-        assert!(
-            cmd.contains("gpasswd"),
-            "must call gpasswd to remove group membership: {cmd}"
+        assert_eq!(
+            args,
+            &[
+                "/usr/lib/sysknife/action-steps",
+                "group-remove",
+                "alice",
+                "wheel"
+            ]
         );
     } else {
         panic!("RemoveUserFromGroup must use Command mechanism");
diff --git a/crates/sysknife-daemon/tests/ssh_key_ops.rs b/crates/sysknife-daemon/tests/ssh_key_ops.rs
index 1f8fa52e..9b08d977 100644
--- a/crates/sysknife-daemon/tests/ssh_key_ops.rs
+++ b/crates/sysknife-daemon/tests/ssh_key_ops.rs
@@ -1,24 +1,11 @@
 //! Execution correctness tests for AddAuthorizedKey and RemoveAuthorizedKey.
 //!
-//! Both actions use `sh -c` scripts composed at runtime. The unit tests in
-//! `actions_batch*.rs` prove the scripts are *constructed* correctly (right
-//! program, right template). These tests prove the scripts *execute* correctly:
-//!
-//!   AddAuthorizedKey  — idempotent append via `grep -Fxq … || printf … >>`
-//!   RemoveAuthorizedKey — exact-line deletion via `grep -Fxv` into a temp
-//!                         file copied back over the original
-//!
-//! Both scripts take the key and path as positional arguments, so no caller
-//! value is ever parsed as shell syntax or as a regular expression. The
-//! literal-not-pattern test below is the regression guard for the earlier
-//! `sed`-based removal, which let `ssh-ed25519 .*` wipe the whole file.
-//!
-//! Technique: call the real `ssh::add_authorized_key` / `ssh::remove_authorized_key`
-//! functions to build the ActionSpec, then redirect the path inside the generated
-//! shell script from `/home/testuser/.ssh/authorized_keys` to a tempfile. This
-//! tests the actual production script without touching the real filesystem.
-//!
-//! Requirements: sh, grep, sed (standard on any Linux — available in CI).
+//! The production helper edits literal whole lines, retaining inode and mode.
+//! These tests call its real edit function on temporary files through the real
+//! executor, with operation/key arguments taken from the generated ActionSpec.
+//! Credential dropping is tested separately in action-steps.test.sh, including
+//! a root subprocess that cannot regain root or write through a planted symlink.
+//! Requirements: Python 3 and Linux filesystem semantics.
 
 use sysknife_daemon::actions::{ssh, ActionMechanism};
 use sysknife_daemon::executor::execute_spec;
@@ -47,41 +34,34 @@ const WILDCARD_KEY: &str = "ssh-ed25519 .*";
 /// Build an ActionSpec for `add_authorized_key` or `remove_authorized_key` that
 /// operates on `temp_path` instead of the real `/home/{USERNAME}/.ssh/authorized_keys`.
 ///
-/// The production functions use `sudo sh -c` so the daemon (running as the sysknife
-/// system user) can write to files owned by the target user. In tests, we strip the
-/// `sudo` prefix and run as the current user against a tempfile — no elevated privileges
-/// needed, and the script logic is still fully exercised.
+/// The fixture invokes the packaged helper's edit function without privilege,
+/// retaining the generated operation and key. No production test-path override
+/// or generic command mode is exposed by the installed helper.
 fn redirect_spec_path(
     mut spec: sysknife_daemon::actions::ActionSpec,
     temp_path: &str,
 ) -> sysknife_daemon::actions::ActionSpec {
-    let real_path = format!("/home/{USERNAME}/.ssh/authorized_keys");
     if let ActionMechanism::Command {
         ref mut program,
         ref mut args,
         ..
     } = spec.mechanism
     {
-        // The production form is `sudo runuser -u <user> -- sh -c <script> ...`,
-        // which runs the write as the target user (the symlink-escalation fix).
-        // Strip the `sudo runuser -u <user> --` prefix down to the inner `sh`
-        // so the test can run it unprivileged as the current user.
-        if *program == "sudo"
-            && args.first().map(String::as_str) == Some("runuser")
-            && args.get(3).map(String::as_str) == Some("--")
-        {
-            *program = "sh";
-            args.drain(0..5); // runuser -u <user> -- sh  → leaves -c <script> ...
-        } else if *program == "sudo" && args.first().map(String::as_str) == Some("sh") {
-            // Older direct form, kept so this helper survives either shape.
-            *program = "sh";
-            args.remove(0);
-        }
-        for arg in args.iter_mut() {
-            if arg.contains(&real_path) {
-                *arg = arg.replace(&real_path, temp_path);
-            }
-        }
+        assert_eq!(*program, "sudo");
+        assert_eq!(args[0], "/usr/lib/sysknife/action-steps");
+        assert!(matches!(args[1].as_str(), "ssh-add" | "ssh-remove"));
+        assert_eq!(args[2], USERNAME);
+        assert_eq!(args.len(), 4);
+        let helper = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("../../packaging/sysknife-action-steps");
+        // Exercise the real edit function as the current unprivileged test user.
+        // Separate helper tests execute and verify the production privilege drop.
+        let operation = args[1].clone();
+        let key = args[3].clone();
+        *program = "python3";
+        *args = vec!["-c".into(),
+            "import runpy,sys; m=runpy.run_path(sys.argv[1]); m['edit_key'](sys.argv[2],sys.argv[3],sys.argv[4]=='ssh-add')".into(),
+            helper.to_string_lossy().into_owned(), temp_path.into(), key, operation];
     }
     spec
 }
@@ -264,37 +244,28 @@ async fn remove_authorized_key_treats_the_key_as_a_literal_not_a_pattern() {
 }
 
 #[tokio::test]
-async fn remove_authorized_key_script_never_embeds_the_key_in_its_text() {
-    // Structural guard: the key must travel as a positional argument, never
-    // interpolated into the script body. If a future edit inlines it again,
-    // the quoting/metacharacter problem returns even if the behavioural test
-    // above happens to still pass for the specific payload it uses.
+async fn remove_authorized_key_passes_key_only_as_fixed_helper_data() {
+    // Guard the complete executable/argv contract: no shell or command text
+    // may be reintroduced, and the key is only the final data argument.
     let spec = ssh::remove_authorized_key(USERNAME, TEST_KEY);
-    let ActionMechanism::Command { args, .. } = &spec.mechanism else {
+    let ActionMechanism::Command { program, args, .. } = &spec.mechanism else {
         panic!("remove_authorized_key must use a Command mechanism");
     };
-    let script = args
-        .iter()
-        .find(|a| a.contains("grep") || a.contains("sed"))
-        .expect("script body must be present in argv");
-    assert!(
-        !script.contains(TEST_KEY),
-        "key must not be interpolated into the script body: {script:?}"
-    );
-    assert!(
-        !script.contains("sed"),
-        "removal must not build a sed address from caller data: {script:?}"
-    );
-    assert!(
-        args.iter().any(|a| a == TEST_KEY),
-        "key must be passed as its own argv element: {args:?}"
+    assert_eq!(*program, "sudo");
+    assert_eq!(
+        args,
+        &[
+            "/usr/lib/sysknife/action-steps",
+            "ssh-remove",
+            USERNAME,
+            TEST_KEY
+        ]
     );
 }
 
 #[tokio::test]
 async fn remove_authorized_key_is_noop_when_key_absent() {
-    // `grep -Fxv` simply copies every line through when the key is absent —
-    // exit code 0, file unchanged.
+    // An absent literal line is a successful no-op.
     let dir = tempdir().unwrap();
     let keys_path = dir
         .path()
@@ -336,8 +307,16 @@ fn key_edits_drop_to_the_target_user() {
         };
         assert_eq!(*program, "sudo", "{}", spec.action_name);
         assert_eq!(
-            &args[0..4],
-            &["runuser", "-u", USERNAME, "--"],
+            &args[0..3],
+            &[
+                "/usr/lib/sysknife/action-steps",
+                if spec.action_name == "AddAuthorizedKey" {
+                    "ssh-add"
+                } else {
+                    "ssh-remove"
+                },
+                USERNAME
+            ],
             "{} must run as {USERNAME}, not root; got {args:?}",
             spec.action_name
         );
diff --git a/crates/sysknife-daemon/tests/sudoers_grants_match_argv.rs b/crates/sysknife-daemon/tests/sudoers_grants_match_argv.rs
index 798b3c07..6a7c8530 100644
--- a/crates/sysknife-daemon/tests/sudoers_grants_match_argv.rs
+++ b/crates/sysknife-daemon/tests/sudoers_grants_match_argv.rs
@@ -107,6 +107,14 @@ fn every_sudo_action_is_authorised_by_a_packaged_grant() {
                 continue;
             }
             checked += 1;
+            assert!(
+                !args.iter().take(1).any(|arg| matches!(
+                    arg.rsplit('/').next(),
+                    Some("sh" | "bash" | "dash" | "runuser")
+                )),
+                "{} must use bounded argv instead of a privileged shell/user launcher",
+                spec.action_name
+            );
             if !grants.iter().any(|g| grant_allows(g, args)) {
                 unauthorised.push(format!("{}: sudo {}", spec.action_name, args.join(" ")));
             }
diff --git a/docs/action-reference.md b/docs/action-reference.md
index 90186aa6..0fff6628 100644
--- a/docs/action-reference.md
+++ b/docs/action-reference.md
@@ -47,27 +47,27 @@ Every row is derived from the live code: the command from each action's `ActionS
 
 | Action | Command | Risk | Distro | Rb | Ro | Description |
 |---|---|---|---|---|---|---|
-| `InstallFlatpak` | `sudo runuser -u testuser -- flatpak install --user -y flathub app-id` | Medium | All | – | – | install a Flatpak app — params: username\* (Linux user), app_id\* (e.g. org.mozilla.firefox), remote\* (e.g. flathub) |
-| `RemoveFlatpak` | `sudo runuser -u testuser -- flatpak uninstall --user -y app-id` | Medium | All | – | – | uninstall a Flatpak app — params: username\*, app_id\* |
+| `InstallFlatpak` | `sudo /usr/lib/sysknife/action-steps flatpak testuser install --user -y flathub app-id` | Medium | All | – | – | install a Flatpak app — params: username\* (Linux user), app_id\* (e.g. org.mozilla.firefox), remote\* (e.g. flathub) |
+| `RemoveFlatpak` | `sudo /usr/lib/sysknife/action-steps flatpak testuser uninstall --user -y app-id` | Medium | All | – | – | uninstall a Flatpak app — params: username\*, app_id\* |
 | `SearchFlatpakApps` | `flatpak search search-term` | Low | All | – | – | search Flatpak remotes for apps — param: term\* (query string) — no username needed |
-| `ListFlatpakRemotes` | `sudo runuser -u testuser -- flatpak remotes --user --columns=name,url` | Low | All | – | – | list configured Flatpak remotes — param: username\* |
-| `ListInstalledFlatpaks` | `sudo runuser -u testuser -- flatpak list --user --app --columns=application,name,version,origin` | Low | All | – | – | list installed Flatpak apps for a user — param: username\* |
-| `AddFlatpakRemote` | `sudo runuser -u testuser -- flatpak remote-add --user --if-not-exists remote https://example.invalid` | Medium | All | – | – | add a Flatpak remote — params: username\*, remote\* (name), url\* |
-| `RemoveFlatpakRemote` | `sudo runuser -u testuser -- flatpak remote-delete --user remote` | Medium | All | – | – | remove a Flatpak remote — params: username\*, remote\* (name) |
-| `GetFlatpakAppInfo` | `sudo runuser -u testuser -- flatpak info --user app-id` | Low | All | – | – | show metadata for an installed Flatpak — params: username\*, app_id\* |
-| `UpdateFlatpak` | `sudo runuser -u testuser -- flatpak update --user -y com.example.App` | Medium | All | – | – | update Flatpak apps — params: username\* (required); app_id (optional — omit to update all) |
-| `UbuntuInstallFlatpak` | `sudo runuser -u testuser -- flatpak install --user -y flathub app-id` | Medium | Ubuntu | – | – | install a Flatpak app — params: username\*, app_id\*, remote\* (e.g. flathub); Medium risk |
-| `UbuntuRemoveFlatpak` | `sudo runuser -u testuser -- flatpak uninstall --user -y app-id` | Medium | Ubuntu | – | – | remove a Flatpak app — params: username\*, app_id\*; Medium risk |
-| `UbuntuUpdateFlatpak` | `sudo runuser -u testuser -- flatpak update --user -y com.example.App` | Medium | Ubuntu | – | – | update Flatpak app(s) — param: username\*; optional: app_id (omit for all); Medium risk |
-| `UbuntuListFlatpaks` | `sudo runuser -u testuser -- flatpak list --user --app --columns=application,name,version,origin` | Low | Ubuntu | – | – | list installed Flatpak apps — param: username\*; read-only |
+| `ListFlatpakRemotes` | `sudo /usr/lib/sysknife/action-steps flatpak testuser remotes --user --columns=name,url` | Low | All | – | – | list configured Flatpak remotes — param: username\* |
+| `ListInstalledFlatpaks` | `sudo /usr/lib/sysknife/action-steps flatpak testuser list --user --app --columns=application,name,version,origin` | Low | All | – | – | list installed Flatpak apps for a user — param: username\* |
+| `AddFlatpakRemote` | `sudo /usr/lib/sysknife/action-steps flatpak testuser remote-add --user --if-not-exists remote https://example.invalid` | Medium | All | – | – | add a Flatpak remote — params: username\*, remote\* (name), url\* |
+| `RemoveFlatpakRemote` | `sudo /usr/lib/sysknife/action-steps flatpak testuser remote-delete --user remote` | Medium | All | – | – | remove a Flatpak remote — params: username\*, remote\* (name) |
+| `GetFlatpakAppInfo` | `sudo /usr/lib/sysknife/action-steps flatpak testuser info --user app-id` | Low | All | – | – | show metadata for an installed Flatpak — params: username\*, app_id\* |
+| `UpdateFlatpak` | `sudo /usr/lib/sysknife/action-steps flatpak testuser update --user -y com.example.App` | Medium | All | – | – | update Flatpak apps — params: username\* (required); app_id (optional — omit to update all) |
+| `UbuntuInstallFlatpak` | `sudo /usr/lib/sysknife/action-steps flatpak testuser install --user -y flathub app-id` | Medium | Ubuntu | – | – | install a Flatpak app — params: username\*, app_id\*, remote\* (e.g. flathub); Medium risk |
+| `UbuntuRemoveFlatpak` | `sudo /usr/lib/sysknife/action-steps flatpak testuser uninstall --user -y app-id` | Medium | Ubuntu | – | – | remove a Flatpak app — params: username\*, app_id\*; Medium risk |
+| `UbuntuUpdateFlatpak` | `sudo /usr/lib/sysknife/action-steps flatpak testuser update --user -y com.example.App` | Medium | Ubuntu | – | – | update Flatpak app(s) — param: username\*; optional: app_id (omit for all); Medium risk |
+| `UbuntuListFlatpaks` | `sudo /usr/lib/sysknife/action-steps flatpak testuser list --user --app --columns=application,name,version,origin` | Low | Ubuntu | – | – | list installed Flatpak apps — param: username\*; read-only |
 
 ## Toolbox
 
 | Action | Command | Risk | Distro | Rb | Ro | Description |
 |---|---|---|---|---|---|---|
-| `ListToolboxes` | `sudo runuser -l testuser -c "XDG_RUNTIME_DIR=/run/user/$(id -u) toolbox list"` | Low | All | – | – | list toolbox containers for a user — param: username\* |
-| `CreateToolbox` | `sudo runuser -l testuser -c "XDG_RUNTIME_DIR=/run/user/$(id -u) toolbox create --container 'sysknife-dev' --release '41'"` | Medium | All | – | – | create a toolbox container — params: username\*, name\*; optional: image, release |
-| `RemoveToolbox` | `sudo runuser -l testuser -c "XDG_RUNTIME_DIR=/run/user/$(id -u) toolbox rm 'sysknife-dev'"` | Medium | All | – | – | remove a toolbox container — params: username\*, name\* |
+| `ListToolboxes` | `sudo /usr/lib/sysknife/action-steps toolbox testuser list` | Low | All | – | – | list toolbox containers for a user — param: username\* |
+| `CreateToolbox` | `sudo /usr/lib/sysknife/action-steps toolbox testuser create --container sysknife-dev --release 41` | Medium | All | – | – | create a toolbox container — params: username\*, name\*; optional: image, release |
+| `RemoveToolbox` | `sudo /usr/lib/sysknife/action-steps toolbox testuser rm sysknife-dev` | Medium | All | – | – | remove a toolbox container — params: username\*, name\* |
 
 ## Services
 
@@ -178,7 +178,7 @@ Every row is derived from the live code: the command from each action's `ActionS
 |---|---|---|---|---|---|---|
 | `ConfigureWifi` | `sudo nmcli device wifi connect CafeHotspot` | High | All | – | – | connect to a Wi-Fi network — params: ssid\*, password (optional for open networks) |
 | `SetDnsServers` | `sudo resolvectl dns wlp1s0 1.1.1.1 8.8.8.8` | High | All | – | – | set DNS servers for an interface — params: interface\* (e.g. wlp1s0), servers\* (string\[\]) |
-| `ConfigureFirewall` | `sudo sh -c "firewall-cmd --permanent --zone='public' --add-service='ssh' && firewall-cmd --reload"` | High | All | – | – | add/remove a service in a firewalld zone — params: zone\*, service\*, enabled\* (bool) |
+| `ConfigureFirewall` | `sudo /usr/lib/sysknife/action-steps firewall public ssh add-service` | High | All | – | – | add/remove a service in a firewalld zone — params: zone\*, service\*, enabled\* (bool) |
 | `GetFirewallState` | `firewall-cmd --list-all` | Low | All | – | – | show current firewalld zones, open services, and port rules — no params |
 | `GetNetworkStatus` | `ip -brief addr` | Low | All | – | – | show LIVE network state: interfaces, IP addresses, and connection state — no params; this is runtime status, NOT the saved configuration; on Ubuntu the saved config is NetplanGetConfig |
 | `GetListeningPorts` | `ss -tulpnH` | Low | All | – | – | show listening TCP/UDP sockets and the process bound to each (ss -tulpn) — no params; read-only; use for "what is listening on port X?" |
@@ -208,8 +208,8 @@ Every row is derived from the live code: the command from each action's `ActionS
 | `ListGroups` | `getent group` | Low | All | – | – | list all local groups — no params |
 | `CreateUser` | `sudo useradd --create-home --home-dir /home/alice --shell /bin/bash alice` | High | All | – | – | create a local user account — param: username\*; optional: shell, home |
 | `DeleteUser` | `sudo userdel alice` | High | All | – | – | delete a local user account — param: username\* |
-| `AddUserToGroup` | `sudo sh -c "grep -q '^wheel:' /etc/group \|\| getent group 'wheel' >> /etc/group; usermod --append --groups 'wheel' 'alice'"` | High | All | – | – | add a user to a group — params: username\*, group\* |
-| `RemoveUserFromGroup` | `sudo sh -c "grep -q '^wheel:' /etc/group \|\| getent group 'wheel' >> /etc/group; gpasswd --delete 'alice' 'wheel'"` | High | All | – | – | remove a user from a group — params: username\*, group\* |
+| `AddUserToGroup` | `sudo /usr/lib/sysknife/action-steps group-add alice wheel` | High | All | – | – | add a user to a group — params: username\*, group\* |
+| `RemoveUserFromGroup` | `sudo /usr/lib/sysknife/action-steps group-remove alice wheel` | High | All | – | – | remove a user from a group — params: username\*, group\* |
 | `CreateGroup` | `sudo groupadd developers` | Medium | All | – | – | create a local group — param: group\*; optional: system (bool → system GID range) |
 | `DeleteGroup` | `sudo groupdel developers` | High | All | – | – | delete a local group — param: group\*; irreversible |
 | `LockUserAccount` | `sudo usermod --lock alice` | High | All | – | – | disable password login for a user without deleting it — param: username\* |
@@ -220,8 +220,8 @@ Every row is derived from the live code: the command from each action's `ActionS
 | Action | Command | Risk | Distro | Rb | Ro | Description |
 |---|---|---|---|---|---|---|
 | `GetAuthorizedKeys` | `cat /home/alice/.ssh/authorized_keys` | Low | All | – | – | list SSH authorized_keys for a user — param: username\* |
-| `AddAuthorizedKey` | `sudo runuser -u alice -- sh -c "key=$1; path=$2; grep -Fxq -- \\"$key\\" \\"$path\\" 2>/dev/null \|\| printf '%s\\n' \\"$key\\" >> \\"$path\\"" sh "ssh-ed25519 AAAA..." /home/alice/.ssh/authorized_keys` | High | All | – | – | append an SSH public key to a user's authorized_keys — params: username\*, public_key\* (full key string) |
-| `RemoveAuthorizedKey` | `sudo runuser -u alice -- sh -c "key=$1; path=$2; tmp=$(mktemp) \|\| exit 1; grep -Fxv -- \\"$key\\" \\"$path\\" > \\"$tmp\\"; rc=$?; if [ $rc -gt 1 ]; then rm -f \\"$tmp\\"; exit $rc; fi; cat \\"$tmp\\" > \\"$path\\"; rm -f \\"$tmp\\"" sh "ssh-ed25519 AAAA..." /home/alice/.ssh/authorized_keys` | High | All | – | – | remove an SSH public key from a user's authorized_keys — params: username\*, public_key\* (full key string) |
+| `AddAuthorizedKey` | `sudo /usr/lib/sysknife/action-steps ssh-add alice "ssh-ed25519 AAAA..."` | High | All | – | – | append an SSH public key to a user's authorized_keys — params: username\*, public_key\* (full key string) |
+| `RemoveAuthorizedKey` | `sudo /usr/lib/sysknife/action-steps ssh-remove alice "ssh-ed25519 AAAA..."` | High | All | – | – | remove an SSH public key from a user's authorized_keys — params: username\*, public_key\* (full key string) |
 | `SetSshdOption` | `sudo /usr/lib/sysknife/sshd-option-edit --option PermitRootLogin --value prohibit-password` | High | All | – | – | harden sshd by setting an allowlisted option via a validated drop-in — params: option\* (one of PermitRootLogin, PasswordAuthentication, PubkeyAuthentication, X11Forwarding, PermitEmptyPasswords), value\* (per-option: yes/no, or prohibit-password/forced-commands-only for PermitRootLogin) |
 
 ## Package repositories
@@ -245,12 +245,12 @@ Every row is derived from the live code: the command from each action's `ActionS
 
 | Action | Command | Risk | Distro | Rb | Ro | Description |
 |---|---|---|---|---|---|---|
-| `ListContainers` | `sudo runuser -l testuser -c "podman ps --all --format json"` | Low | All | – | – | list Podman containers for a user — param: username\* |
-| `CreateContainer` | `sudo runuser -l testuser -c "podman create --name 'sysknife-dev' 'registry.fedoraproject.org/fedora-toolbox:41'"` | Medium | All | – | – | create a Podman container — params: username\*, name\*, image\* (e.g. ubuntu:22.04) |
-| `StartContainer` | `sudo runuser -l testuser -c "podman start 'sysknife-dev'"` | Medium | All | – | – | start a Podman container — params: username\*, name\* |
-| `StopContainer` | `sudo runuser -l testuser -c "podman stop 'sysknife-dev'"` | Medium | All | – | – | stop a Podman container — params: username\*, name\* |
-| `RemoveContainer` | `sudo runuser -l testuser -c "podman rm 'sysknife-dev'"` | Medium | All | – | – | remove a stopped Podman container — params: username\*, name\* |
-| `GetContainerInfo` | `sudo runuser -l testuser -c "podman inspect 'sysknife-dev'"` | Low | All | – | – | inspect a Podman container — params: username\*, name\* |
+| `ListContainers` | `sudo /usr/lib/sysknife/action-steps podman testuser ps --all --format json` | Low | All | – | – | list Podman containers for a user — param: username\* |
+| `CreateContainer` | `sudo /usr/lib/sysknife/action-steps podman testuser create --name sysknife-dev registry.fedoraproject.org/fedora-toolbox:41` | Medium | All | – | – | create a Podman container — params: username\*, name\*, image\* (e.g. ubuntu:22.04) |
+| `StartContainer` | `sudo /usr/lib/sysknife/action-steps podman testuser start sysknife-dev` | Medium | All | – | – | start a Podman container — params: username\*, name\* |
+| `StopContainer` | `sudo /usr/lib/sysknife/action-steps podman testuser stop sysknife-dev` | Medium | All | – | – | stop a Podman container — params: username\*, name\* |
+| `RemoveContainer` | `sudo /usr/lib/sysknife/action-steps podman testuser rm sysknife-dev` | Medium | All | – | – | remove a stopped Podman container — params: username\*, name\* |
+| `GetContainerInfo` | `sudo /usr/lib/sysknife/action-steps podman testuser inspect sysknife-dev` | Low | All | – | – | inspect a Podman container — params: username\*, name\* |
 
 ## Reboot
 
@@ -319,7 +319,7 @@ Every row is derived from the live code: the command from each action's `ActionS
 
 | Action | Command | Risk | Distro | Rb | Ro | Description |
 |---|---|---|---|---|---|---|
-| `SnapInstall` | `sudo sh -c "snap install --channel=stable firefox && snap refresh --hold firefox"` | Medium | Ubuntu | – | – | install a snap (auto-holds to prevent auto-refresh) — params: name\*; optional: channel (default stable), auto_update (bool, default false) |
+| `SnapInstall` | `sudo /usr/lib/sysknife/action-steps snap-install-hold firefox stable` | Medium | Ubuntu | – | – | install a snap (auto-holds to prevent auto-refresh) — params: name\*; optional: channel (default stable), auto_update (bool, default false) |
 | `SnapRemove` | `sudo snap remove firefox` | Medium | Ubuntu | – | – | remove a snap — param: name\* |
 | `SnapRefresh` | `sudo snap refresh firefox` | Medium | Ubuntu | – | – | update a snap or all snaps — param: name (optional, omit for all) |
 | `SnapHold` | `sudo snap refresh --hold firefox` | Medium | Ubuntu | – | – | pin a snap at its current version (snap refresh --hold) — param: name\* |
diff --git a/packaging/sysknife-action-steps b/packaging/sysknife-action-steps
new file mode 100755
index 00000000..cc601a7b
--- /dev/null
+++ b/packaging/sysknife-action-steps
@@ -0,0 +1,200 @@
+#!/usr/bin/python3 -I
+"""Bounded multi-step actions. No command, shell, path or environment input.
+
+Install root-owned as /usr/lib/sysknife/action-steps. Each sudoers grant names
+one operation; this helper validates its entire argument grammar independently.
+User operations drop all root credentials before touching a home or invoking a
+user-configurable tool. Never add a generic exec mode or a caller-selected path.
+"""
+import os
+import re
+import stat
+import subprocess
+import sys
+
+SYSTEM_ENV = {"PATH": "/usr/sbin:/usr/bin:/sbin:/bin", "LANG": "C.UTF-8"}
+
+
+def safe(value):
+    if not re.fullmatch(r"[A-Za-z0-9._:/+@][A-Za-z0-9._:/+@-]{0,253}", value):
+        raise ValueError("invalid argument")
+    return value
+
+
+def username(value):
+    if not re.fullmatch(r"[A-Za-z0-9._][A-Za-z0-9._-]{0,31}", value):
+        raise ValueError("invalid account name")
+    return value
+
+
+def public_key(value):
+    types = ("ssh-rsa", "ssh-ed25519", "ssh-ed25519-sk", "ecdsa-sha2-nistp256",
+             "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521",
+             "sk-ssh-ed25519", "sk-ecdsa-sha2-nistp256")
+    if (not value.startswith(types) or len(value) > 8192
+            or any(ord(c) < 32 or ord(c) > 126 or c in "'|;`$\\&" for c in value)):
+        raise ValueError("invalid public key")
+    return value
+
+
+def tool_argv(tool, args):
+    """Accept only argv produced by the corresponding typed constructors."""
+    if tool == "podman":
+        if args == ["ps", "--all", "--format", "json"]:
+            return ["/usr/bin/podman", *args]
+        if len(args) == 4 and args[:2] == ["create", "--name"]:
+            return ["/usr/bin/podman", "create", "--name", safe(args[2]), safe(args[3])]
+        if len(args) == 2 and args[0] in ("start", "stop", "rm", "inspect"):
+            return ["/usr/bin/podman", args[0], safe(args[1])]
+    elif tool == "toolbox":
+        if args == ["list"]:
+            return ["/usr/bin/toolbox", "list"]
+        if len(args) == 2 and args[0] == "rm":
+            return ["/usr/bin/toolbox", "rm", safe(args[1])]
+        if len(args) in (3, 5, 7) and args[:2] == ["create", "--container"]:
+            result = ["/usr/bin/toolbox", "create", "--container", safe(args[2])]
+            seen = set()
+            for flag, value in zip(args[3::2], args[4::2]):
+                if flag not in ("--release", "--image") or flag in seen:
+                    raise ValueError("invalid toolbox option")
+                seen.add(flag)
+                result.extend([flag, safe(value)])
+            return result
+    elif tool == "flatpak":
+        patterns = [
+            (["install", "--user", "-y"], 2),
+            (["uninstall", "--user", "-y"], 1),
+            (["remotes", "--user", "--columns=name,url"], 0),
+            (["remote-add", "--user", "--if-not-exists"], 2),
+            (["remote-delete", "--user"], 1),
+            (["list", "--user", "--app", "--columns=application,name,version,origin"], 0),
+            (["update", "--user", "-y"], 0),
+            (["update", "--user", "-y"], 1),
+            (["info", "--user"], 1),
+        ]
+        for prefix, count in patterns:
+            if args[:len(prefix)] == prefix and len(args) == len(prefix) + count:
+                return ["/usr/bin/flatpak", *prefix, *(safe(v) for v in args[len(prefix):])]
+    raise ValueError("unsupported user operation")
+
+
+def drop_to_user(name):
+    import pwd
+    account = pwd.getpwnam(username(name))
+    if account.pw_uid == 0 or not os.path.isabs(account.pw_dir):
+        raise ValueError("user operations require a non-root account with an absolute home")
+    # NSS lookup is the only home-related operation permitted before this point.
+    os.initgroups(account.pw_name, account.pw_gid)
+    os.setgid(account.pw_gid)
+    os.setuid(account.pw_uid)
+    if os.getuid() != account.pw_uid or os.geteuid() != account.pw_uid:
+        raise PermissionError("failed to drop root credentials")
+    os.environ.clear()
+    os.environ.update(SYSTEM_ENV, HOME=account.pw_dir, USER=account.pw_name,
+                      LOGNAME=account.pw_name, SHELL=account.pw_shell,
+                      XDG_RUNTIME_DIR=f"/run/user/{account.pw_uid}",
+                      DBUS_SESSION_BUS_ADDRESS=f"unix:path=/run/user/{account.pw_uid}/bus")
+    os.umask(0o077)
+    os.chdir(account.pw_dir)
+    return account
+
+
+def edit_key(path, key, add):
+    import fcntl
+    flags = os.O_RDWR | os.O_NOFOLLOW | os.O_NONBLOCK
+    if add:
+        flags |= os.O_CREAT
+    fd = os.open(path, flags, 0o600)
+    with os.fdopen(fd, "r+b") as stream:
+        if not stat.S_ISREG(os.fstat(stream.fileno()).st_mode):
+            raise ValueError("authorized_keys is not a regular file")
+        fcntl.flock(stream, fcntl.LOCK_EX)
+        original = stream.read(16 * 1024 * 1024 + 1)
+        if len(original) > 16 * 1024 * 1024:
+            raise ValueError("authorized_keys exceeds size limit")
+        encoded = public_key(key).encode("ascii")
+        # Whole lines, never regex: a key comment like .* is literal text.
+        lines = original.splitlines(keepends=True)
+        if add:
+            if any(line.rstrip(b"\n") == encoded for line in lines):
+                return
+            updated = original + (b"\n" if original and not original.endswith(b"\n") else b"") + encoded + b"\n"
+        else:
+            updated = b"".join(line for line in lines if line.rstrip(b"\n") != encoded)
+        if updated != original:
+            stream.seek(0)
+            stream.write(updated)
+            stream.truncate()
+            stream.flush()
+            os.fsync(stream.fileno())
+
+
+def ensure_local_group(group):
+    import fcntl
+    import grp
+    entry = grp.getgrnam(username(group))
+    # Preserve the Fedora Atomic /usr/lib/group -> /etc/group materialization.
+    # A fixed root-owned path, a locked descriptor and no symlink following.
+    fd = os.open("/etc/group", os.O_RDWR | os.O_NOFOLLOW)
+    with os.fdopen(fd, "r+", encoding="utf-8") as stream:
+        fcntl.flock(stream, fcntl.LOCK_EX)
+        data = stream.read()
+        if any(line.split(":", 1)[0] == group for line in data.splitlines()):
+            return
+        stream.seek(0, os.SEEK_END)
+        if data and not data.endswith("\n"):
+            stream.write("\n")
+        stream.write(f"{entry.gr_name}:{entry.gr_passwd}:{entry.gr_gid}:{','.join(entry.gr_mem)}\n")
+        stream.flush()
+        os.fsync(stream.fileno())
+
+
+def run(argv):
+    subprocess.run(argv, check=True, env=SYSTEM_ENV)
+
+
+def main(args):
+    if not args:
+        raise ValueError("operation required")
+    op, *values = args
+    if op == "firewall" and len(values) == 3:
+        zone, service, verb = values
+        if verb not in ("add-service", "remove-service"):
+            raise ValueError("invalid firewall operation")
+        first = ["/usr/bin/firewall-cmd", "--permanent", f"--zone={safe(zone)}", f"--{verb}={safe(service)}"]
+        run(first)
+        run(["/usr/bin/firewall-cmd", "--reload"])
+    elif op == "snap-install-hold" and len(values) == 2:
+        name, channel = map(safe, values)
+        run(["/usr/bin/snap", "install", f"--channel={channel}", name])
+        run(["/usr/bin/snap", "refresh", "--hold", name])
+    elif op in ("group-add", "group-remove") and len(values) == 2:
+        name, group = map(username, values)
+        ensure_local_group(group)
+        if op == "group-add":
+            run(["/usr/sbin/usermod", "--append", "--groups", group, name])
+        else:
+            run(["/usr/bin/gpasswd", "--delete", name, group])
+    elif op in ("ssh-add", "ssh-remove") and len(values) == 2:
+        name, key = values
+        public_key(key)
+        account = drop_to_user(name)
+        # No stat/open/mkdir of this user-controlled path occurs as root.
+        edit_key(os.path.join(account.pw_dir, ".ssh", "authorized_keys"), key, op == "ssh-add")
+    elif op in ("flatpak", "podman", "toolbox") and len(values) >= 2:
+        name, *parameters = values
+        argv = tool_argv(op, parameters)
+        drop_to_user(name)
+        os.execve(argv[0], argv, dict(os.environ))
+    else:
+        raise ValueError("unsupported operation or argument count")
+
+
+if __name__ == "__main__":
+    try:
+        main(sys.argv[1:])
+    except subprocess.CalledProcessError as error:
+        sys.exit(error.returncode if error.returncode > 0 else 1)
+    except (ValueError, KeyError, OSError) as error:
+        print(f"action-steps: {error}", file=sys.stderr)
+        sys.exit(1)
diff --git a/packaging/sysknife-sudoers b/packaging/sysknife-sudoers
index 4babd4c6..dc1f27a7 100644
--- a/packaging/sysknife-sudoers
+++ b/packaging/sysknife-sudoers
@@ -6,12 +6,10 @@
 # These commands are not controllable via D-Bus / polkit and therefore
 # require a direct sudo invocation by the daemon process.
 #
-# Most grants are narrow (an exact binary, no wildcard) for defense-in-depth.
-# Two grants are intentionally broad — `/usr/bin/sh` and `/usr/sbin/runuser` —
-# because a handful of operations have no argv-only form (see the SECURITY NOTE
-# on the `sh` grant below). Those make the daemon effectively root-capable, so
-# the security boundary is the daemon's own authorization + validation + audit,
-# not this file. See each grant's comment for its exact call sites and rationale.
+# No shell or general runuser grant is permitted. Multi-step and user-scoped
+# actions use independently validated, operation-restricted helpers. Other
+# grants still cover powerful administrative tools: the daemon's authorization,
+# validation and audit remain essential. See each grant's scope below.
 #
 # IMPORTANT: test with `visudo -cf /etc/sudoers.d/sysknife` before deploying.
 #
@@ -95,36 +93,19 @@ sysknife ALL=(root) NOPASSWD: /usr/bin/ostree
 sysknife ALL=(root) NOPASSWD: /usr/sbin/lvextend
 sysknife ALL=(root) NOPASSWD: /usr/sbin/lvcreate
 
-# Shell for the few multi-step root operations with no argv-only equivalent:
-#   - ConfigureFirewall (network.rs): `firewall-cmd --permanent … && firewall-cmd --reload`
-#
-# SECURITY NOTE — this is the widest grant in this file, and it means sudoers is NOT the
-# security boundary. `sudo sh -c '<script>'` has no argument constraint, so the sysknife
-# daemon is effectively root-capable. The real boundary is the daemon itself: IPC
-# caller-role authorization (SO_PEERCRED), the one-time approval interlock, per-argument
-# input validation (actions/validate.rs), and the signed audit chain. The narrow grants
-# above limit the blast radius of an *argv*-construction bug in a specific action; they
-# cannot contain a `sh -c` script — every script the daemon passes to `sh -c` is built
-# only from values already run through the validators in validate.rs.
-# TODO(post-launch hardening): refactor ConfigureFirewall + the ssh key ops to shell-free
-# argv forms so this grant (and the runuser `-c` grant below) can be dropped.
-sysknife ALL=(root) NOPASSWD: /usr/bin/sh
-
-# runuser — run tooling as the target (non-root) user for user-scoped operations:
-#   - Flatpak user installs (flatpak.rs): `runuser -u <user> -- flatpak …` (shell-free)
-#   - Rootless Podman / Toolbox / Distrobox (containers.rs, toolbox.rs):
-#     `runuser -l <user> -c '<cmd>'` — needs a login context for XDG_RUNTIME_DIR and the
-#     sub-UID/GID ranges rootless containers require.
-#   - AddAuthorizedKey / RemoveAuthorizedKey (ssh.rs): `runuser -u <user> -- sh -c
-#     '<script>' sh <key> <path>` runs the authorized_keys edit AS the target user, so a
-#     symlink planted at ~/.ssh/authorized_keys cannot redirect a root write into another
-#     account's files. The key and path are positional `$1`/`$2`, never interpolated.
-# Without this grant every user-scoped Flatpak/container/toolbox action fails
-# non-interactively (sudo would prompt for a password the daemon cannot supply). The
-# `-c` form is arbitrary-command and, like `sh` above, cannot be narrowed in sudoers; it
-# adds no privilege beyond the existing `sh` grant. Usernames and arguments are validated
-# upstream (validated_username / validated_safe_arg). On Ubuntu runuser is /usr/sbin/runuser.
-sysknife ALL=(root) NOPASSWD: /usr/sbin/runuser
+# Fixed multi-step operations. No generic exec, shell, runuser, path or environment
+# argument is accepted. The helper checks exact argument counts and allowlists.
+# User modes resolve the account and irreversibly drop groups/GID/UID before
+# opening authorized_keys or executing a user-configurable tool; UID 0 is refused.
+sysknife ALL=(root) NOPASSWD: /usr/lib/sysknife/action-steps firewall *
+sysknife ALL=(root) NOPASSWD: /usr/lib/sysknife/action-steps group-add *
+sysknife ALL=(root) NOPASSWD: /usr/lib/sysknife/action-steps group-remove *
+sysknife ALL=(root) NOPASSWD: /usr/lib/sysknife/action-steps snap-install-hold *
+sysknife ALL=(root) NOPASSWD: /usr/lib/sysknife/action-steps ssh-add *
+sysknife ALL=(root) NOPASSWD: /usr/lib/sysknife/action-steps ssh-remove *
+sysknife ALL=(root) NOPASSWD: /usr/lib/sysknife/action-steps flatpak *
+sysknife ALL=(root) NOPASSWD: /usr/lib/sysknife/action-steps podman *
+sysknife ALL=(root) NOPASSWD: /usr/lib/sysknife/action-steps toolbox *
 
 # ─────────────────────────────────────────────────────────────────────────────
 # Ubuntu / Debian-family binaries
diff --git a/tests/e2e/ubuntu-provision.sh b/tests/e2e/ubuntu-provision.sh
index 262eb1c6..f5b76d8f 100755
--- a/tests/e2e/ubuntu-provision.sh
+++ b/tests/e2e/ubuntu-provision.sh
@@ -265,6 +265,8 @@ install -Dm 755 packaging/sysknife-grub-kargs-edit /usr/lib/sysknife/grub-kargs-
 install -Dm 755 packaging/sysknife-unattended-upgrades-edit /usr/lib/sysknife/unattended-upgrades-edit \
     || fail "Install sysknife-unattended-upgrades-edit"
 # sshd-option-edit: invoked by SetSshdOption.
+install -Dm 755 packaging/sysknife-action-steps /usr/lib/sysknife/action-steps \
+    || fail "Install sysknife-action-steps"
 install -Dm 755 packaging/sysknife-sshd-option-edit /usr/lib/sysknife/sshd-option-edit \
     || fail "Install sysknife-sshd-option-edit"
 # scheduled-job-edit: invoked by CreateScheduledJob.
diff --git a/tests/release/action-steps.test.sh b/tests/release/action-steps.test.sh
new file mode 100755
index 00000000..752b8286
--- /dev/null
+++ b/tests/release/action-steps.test.sh
@@ -0,0 +1,200 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")/../.."
+python3 - <<'PY'
+from pathlib import Path
+import re
+import os
+import runpy
+import subprocess
+import tempfile
+import types
+import sys
+import unittest
+from unittest import mock
+
+helper = runpy.run_path('packaging/sysknife-action-steps')
+# runpy returns a copy; functions keep the original globals dictionary.
+helper = helper['main'].__globals__
+
+
+class ShellGrants(unittest.TestCase):
+    def test_no_shell_or_runuser_grant(self):
+        grants = [line for line in Path('packaging/sysknife-sudoers').read_text(encoding='utf-8').splitlines()
+                  if line.strip() and not line.lstrip().startswith('#')]
+        for grant in grants:
+            self.assertIsNone(re.search(r'/(?:sh|bash|dash|runuser)(?:\s|$)', grant), grant)
+
+    def test_no_unrestricted_helper_grant(self):
+        grants = [line for line in Path('packaging/sysknife-sudoers').read_text(encoding='utf-8').splitlines()
+                  if line.startswith('sysknife ') and '/action-steps' in line]
+        self.assertEqual(len(grants), 9)
+        for grant in grants:
+            self.assertRegex(grant, r'/action-steps (firewall|group-add|group-remove|snap-install-hold|ssh-add|ssh-remove|flatpak|podman|toolbox) \*$')
+
+    def test_fixed_sequence_stops_at_failure(self):
+        for args, expected in [
+            (['firewall', 'public', 'ssh', 'add-service'],
+             [['/usr/bin/firewall-cmd', '--permanent', '--zone=public', '--add-service=ssh'], ['/usr/bin/firewall-cmd', '--reload']]),
+            (['snap-install-hold', 'firefox', 'stable'],
+             [['/usr/bin/snap', 'install', '--channel=stable', 'firefox'], ['/usr/bin/snap', 'refresh', '--hold', 'firefox']]),
+        ]:
+            with mock.patch.dict(helper, run=mock.Mock()) as patched:
+                helper['main'](args)
+                self.assertEqual(patched['run'].call_args_list, [mock.call(v) for v in expected])
+            runner = mock.Mock(side_effect=subprocess.CalledProcessError(42, expected[0]))
+            with mock.patch.dict(helper, run=runner):
+                with self.assertRaises(subprocess.CalledProcessError):
+                    helper['main'](args)
+                self.assertEqual(runner.call_count, 1)
+
+    def test_rejects_arbitrary_commands_options_and_extra_arguments(self):
+        bad = [[], ['exec', '/bin/sh'], ['firewall', 'public', 'ssh', 'reload'],
+               ['firewall', 'x;id', 'ssh', 'add-service'], ['snap-install-hold', '--dangerous', 'stable'],
+               ['group-add', 'alice', 'wheel\nroot'], ['ssh-add', 'alice', 'ssh-ed25519 a\nroot'],
+               ['podman', 'alice', 'run', '--privileged', 'image'],
+               ['toolbox', 'alice', 'run', 'sh'], ['flatpak', 'alice', 'run', '--command=sh', 'app'],
+               ['ssh-remove', 'alice', 'ssh-ed25519 a', '/etc/passwd']]
+        runner = mock.Mock(side_effect=AssertionError('must not execute'))
+        with mock.patch.dict(helper, run=runner, drop_to_user=runner):
+            for args in bad:
+                with self.subTest(args=args), self.assertRaises(ValueError):
+                    helper['main'](args)
+
+    def test_user_tool_grammar_and_drop_before_exec(self):
+        cases = [('podman', ['ps', '--all', '--format', 'json']),
+                 ('podman', ['create', '--name', 'demo', 'registry.example/demo:latest']),
+                 ('podman', ['inspect', 'demo']), ('toolbox', ['list']),
+                 ('toolbox', ['create', '--container', 'demo', '--release', '41', '--image', 'fedora:41']),
+                 ('flatpak', ['install', '--user', '-y', 'flathub', 'org.example.App']),
+                 ('flatpak', ['update', '--user', '-y']),
+                 ('flatpak', ['remote-add', '--user', '--if-not-exists', 'demo', 'https://example.org/repo'])]
+        for tool, args in cases:
+            events = []
+            with mock.patch.dict(helper, drop_to_user=lambda user: events.append(('drop', user))):
+                with mock.patch.object(os, 'execve', side_effect=lambda *a: events.append(('exec', a))):
+                    helper['main']([tool, 'alice', *args])
+            self.assertEqual(events[0], ('drop', 'alice'))
+            self.assertEqual(events[1][1][:2], ('/usr/bin/' + tool, ['/usr/bin/' + tool, *args]))
+
+    def test_key_access_occurs_after_drop(self):
+        events = []
+        def drop(user):
+            events.append('drop')
+            return types.SimpleNamespace(pw_dir='/home/alice')
+        with mock.patch.dict(helper, drop_to_user=drop, edit_key=lambda *a: events.append(('edit', a))):
+            helper['main'](['ssh-add', 'alice', 'ssh-ed25519 AAAA...'])
+        self.assertEqual(events, ['drop', ('edit', (os.path.join('/home/alice', '.ssh', 'authorized_keys'), 'ssh-ed25519 AAAA...', True))])
+
+    def test_group_materialization_failure_prevents_membership_change(self):
+        for op in ('group-add', 'group-remove'):
+            runner = mock.Mock()
+            with mock.patch.dict(helper, run=runner,
+                                 ensure_local_group=mock.Mock(side_effect=KeyError('missing'))):
+                with self.assertRaises(KeyError):
+                    helper['main']([op, 'alice', 'wheel'])
+                runner.assert_not_called()
+
+    @unittest.skipUnless(os.name == 'posix', 'Linux group-file semantics')
+    def test_group_materialization_is_exact_and_idempotent(self):
+        with tempfile.TemporaryDirectory() as d:
+            path = Path(d) / 'group'
+            path.write_text('wheel-extra:x:9:alice\n')
+            real_open = os.open
+            def opened(name, flags):
+                self.assertEqual(name, '/etc/group')
+                return real_open(path, flags)
+            group = types.SimpleNamespace(gr_name='wheel', gr_passwd='x', gr_gid=10, gr_mem=['bob'])
+            with mock.patch('grp.getgrnam', return_value=group), mock.patch.object(os, 'open', side_effect=opened):
+                helper['ensure_local_group']('wheel')
+                helper['ensure_local_group']('wheel')
+            self.assertEqual(path.read_text(), 'wheel-extra:x:9:alice\nwheel:x:10:bob\n')
+
+    def test_drop_order_and_root_refusal(self):
+        account = types.SimpleNamespace(pw_name='alice', pw_uid=1234, pw_gid=4567,
+                                        pw_dir='/home/alice', pw_shell='/bin/bash')
+        events = []
+        pwd = types.SimpleNamespace(getpwnam=lambda name: account)
+        with mock.patch.dict('sys.modules', pwd=pwd), mock.patch.dict(os.environ, {}, clear=True):
+            with mock.patch.multiple(os, initgroups=lambda *a: events.append('groups'),
+                                     setgid=lambda *a: events.append('gid'),
+                                     setuid=lambda *a: events.append('uid'),
+                                     getuid=lambda: 1234, geteuid=lambda: 1234,
+                                     chdir=lambda *a: events.append('home'),
+                                     umask=lambda *a: None, create=True):
+                helper['drop_to_user']('alice')
+                self.assertEqual(events, ['groups', 'gid', 'uid', 'home'])
+                self.assertEqual(os.environ['HOME'], '/home/alice')
+                self.assertEqual(os.environ['XDG_RUNTIME_DIR'], '/run/user/1234')
+                account.pw_uid = 0
+                with self.assertRaises(ValueError):
+                    helper['drop_to_user']('alice')
+
+    @unittest.skipUnless(os.name == 'posix', 'Linux filesystem semantics')
+    def test_literal_key_edits_preserve_inode_mode_and_refuse_symlinks(self):
+        with tempfile.TemporaryDirectory() as d:
+            path = Path(d) / 'authorized_keys'
+            key = 'ssh-ed25519 .*'
+            original = 'ssh-ed25519 AAAA alice@example.com\n' + key + '\n'
+            path.write_text(original)
+            path.chmod(0o640)
+            before = path.stat()
+            helper['edit_key'](path, key, False)
+            self.assertEqual(path.read_text(), 'ssh-ed25519 AAAA alice@example.com\n')
+            helper['edit_key'](path, key, True)
+            helper['edit_key'](path, key, True)
+            self.assertEqual(path.read_text(), original)
+            self.assertEqual((path.stat().st_ino, path.stat().st_mode), (before.st_ino, before.st_mode))
+            link = Path(d) / 'link'
+            link.symlink_to(path)
+            with self.assertRaises(OSError):
+                helper['edit_key'](link, key, True)
+
+    @unittest.skipUnless(hasattr(os, 'geteuid') and os.geteuid() == 0,
+                         'real credential-drop test requires a root test subprocess')
+    def test_real_drop_cannot_regain_root_or_write_through_a_symlink(self):
+        import pwd
+        account = pwd.getpwnam('nobody')
+        with tempfile.TemporaryDirectory() as d:
+            root = Path(d)
+            root.chmod(0o755)
+            home = root / 'home'
+            ssh = home / '.ssh'
+            ssh.mkdir(parents=True)
+            for path in (home, ssh):
+                os.chown(path, account.pw_uid, account.pw_gid)
+                path.chmod(0o700)
+            protected = root / 'root-only'
+            protected.write_text('must remain unchanged\n')
+            protected.chmod(0o600)
+            source = '''
+import os,pwd,runpy,sys,types
+m=runpy.run_path(sys.argv[1]); account=pwd.getpwnam('nobody')
+# Substitute only the fixture home; use real NSS identity and real set*id calls.
+pwd.getpwnam=lambda name: types.SimpleNamespace(pw_name=account.pw_name,pw_uid=account.pw_uid,pw_gid=account.pw_gid,pw_dir=sys.argv[2],pw_shell=account.pw_shell)
+failed=False
+try: m['main'](['ssh-add','nobody','ssh-ed25519 AAAA fixture'])
+except OSError: failed=True
+assert failed == (sys.argv[3]=='symlink')
+assert os.getuid()==account.pw_uid and os.geteuid()==account.pw_uid
+assert os.getgid()==account.pw_gid and 0 not in os.getgroups()
+try: os.setuid(0)
+except PermissionError: pass
+else: raise AssertionError('root can be regained')
+'''
+            command = [sys.executable, '-I', '-c', source,
+                       str(Path('packaging/sysknife-action-steps').resolve()), str(home)]
+            result = subprocess.run([*command, 'normal'], capture_output=True, text=True)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            keys = ssh / 'authorized_keys'
+            self.assertEqual(keys.stat().st_uid, account.pw_uid)
+            self.assertEqual(keys.read_text(), 'ssh-ed25519 AAAA fixture\n')
+            keys.unlink()
+            keys.symlink_to(protected)
+            result = subprocess.run([*command, 'symlink'], capture_output=True, text=True)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertEqual(protected.read_text(), 'must remain unchanged\n')
+
+
+unittest.main(verbosity=2)
+PY