diff --git a/scripts/deploy-remote.sh b/scripts/deploy-remote.sh
index 7e90e4b..c73cdb7 100755
--- a/scripts/deploy-remote.sh
+++ b/scripts/deploy-remote.sh
@@ -323,11 +323,13 @@ copy_alloy_config() {
     # The repo config carries the token GRAFANA_HOST_LABEL; the installed copy
     # carries the host's name, so Loki streams say WHICH machine's journal a
     # line came from without a second config file per host.
-    # *_CONF_ROOT are test seams: the bats cases execute these copiers for
-    # real against a sandbox with a stubbed run_privileged.
+    # *_CONF_ROOT and ALLOY_CONFIG_SRC are test seams: the bats cases execute
+    # these copiers for real against a sandbox with a stubbed run_privileged;
+    # ALLOY_CONFIG_SRC lets the refusal case feed a deliberately broken config.
     local root="${ALLOY_CONF_ROOT:-/opt/alloy}" tmp
+    local src="${ALLOY_CONFIG_SRC:-shared/alloy/config.alloy}"
     tmp="$(mktemp)"
-    sed "s/GRAFANA_HOST_LABEL/$TARGET/g" shared/alloy/config.alloy > "$tmp"
+    sed "s/GRAFANA_HOST_LABEL/$TARGET/g" "$src" > "$tmp"
     if ! grep -q "host = \"$TARGET\"," "$tmp" || grep -q "GRAFANA_HOST_LABEL" "$tmp"; then
         echo "alloy config: host-label substitution failed" >&2
         rm -f "$tmp"
diff --git a/tests/observability_quadlet.bats b/tests/observability_quadlet.bats
index f9a07b4..74406af 100755
--- a/tests/observability_quadlet.bats
+++ b/tests/observability_quadlet.bats
@@ -799,14 +799,13 @@ assert not any('container_network' in e or 'container_fs_' in e for e in names),
         skip "franksdank/alloy image not present on this box"
     fi
     local sandbox="$BATS_TEST_TMPDIR/opt" cfg="$BATS_TEST_TMPDIR/broken.alloy"
-    sed 's/GRAFANA_HOST_LABEL/dankclaw/g' shared/alloy/config.alloy > "$cfg"
+    sed 's/GRAFANA_HOST_LABEL/dankclaw/g' "$REPO_ROOT/shared/alloy/config.alloy" > "$cfg"
     printf 'bogus_attr = "x"\n' >> "$cfg"
     ! (
         cd "$REPO_ROOT"
         eval "$(sed -n '/^copy_alloy_config()/,/^}/p' scripts/deploy-remote.sh)"
         run_privileged() { "$@"; }
-        cp() { if [ "$1" = "$cfg" ]; then return 1; fi; command cp "$@"; }
-        export TARGET=dankclaw ALLOY_CONF_ROOT="$sandbox"
+        export TARGET=dankclaw ALLOY_CONF_ROOT="$sandbox" ALLOY_CONFIG_SRC="$cfg"
         copy_alloy_config
     )
     [ ! -f "$sandbox/config/config.alloy" ]
@@ -820,7 +819,7 @@ assert not any('container_network' in e or 'container_fs_' in e for e in names),
         skip "franksdank/alloy image not present on this box"
     fi
     local cfg="$BATS_TEST_TMPDIR/rendered.alloy"
-    sed 's/GRAFANA_HOST_LABEL/dankclaw/g' shared/alloy/config.alloy > "$cfg"
+    sed 's/GRAFANA_HOST_LABEL/dankclaw/g' "$REPO_ROOT/shared/alloy/config.alloy" > "$cfg"
     podman run --rm -v "$cfg:/c.alloy:ro" --entrypoint /usr/bin/alloy \
         localhost/franksdank/alloy:latest validate /c.alloy
 }