diff --git a/install.sh b/install.sh
index 4176b4e..a080c96 100755
--- a/install.sh
+++ b/install.sh
@@ -279,7 +279,7 @@ SystemCallArchitectures=native
 # ProtectSystem and PrivateTmp are left out: in a user unit they need unprivileged user namespaces, which some
 # systems turn off. Where that works, add them with the drop-in in contrib/rnfs.service.d/hardening.conf
 # (https://github.com/afit21/rnfs/blob/main/contrib/rnfs.service.d/hardening.conf). UMask is left out too: what
-# `rnfs get` writes gets its permissions from your umask.
+# rnfs get writes gets its permissions from your umask.
 
 [Install]
 WantedBy=default.target
diff --git a/tests/test_packaging.py b/tests/test_packaging.py
index 23694eb..7f4d8aa 100644
--- a/tests/test_packaging.py
+++ b/tests/test_packaging.py
@@ -136,6 +136,15 @@ def test_provenance_names_the_tag(self):
         self.assertIn('*--source-ref*) options="$options --source-ref=refs/tags/$RELEASE_TAG"', verify)
         self.assertIn('*--deny-self-hosted-runners*) options="$options --deny-self-hosted-runners"', verify)
 
+    def test_unit_heredoc_runs_nothing(self):
+        """write_unit's heredoc is unquoted (it fills in the launcher's path), so the shell would run anything in
+        backticks or $(...) there: only the systemd_quote of the launcher may be."""
+        body = shell_function("write_unit")
+        heredoc = body[body.index("<<EOF\n") + len("<<EOF\n"):body.index("\nEOF\n")]
+        self.assertNotIn("`", heredoc)
+        self.assertEqual(re.findall(r"\$\(", heredoc), ["$("])
+        self.assertIn('$(systemd_quote "$LAUNCHER")', heredoc)
+
     def test_unit_matches_contrib(self):
         """install.sh's unit has every [Unit] and [Service] line of contrib/rnfs.service, in order, except
         ExecStart (the launcher's path) and comments (SUP-6)."""