diff --git a/clusters/base/apps-vms.yaml b/clusters/base/apps-vms.yaml
index 9a8fd6c..41ea2b5 100644
--- a/clusters/base/apps-vms.yaml
+++ b/clusters/base/apps-vms.yaml
@@ -23,7 +23,7 @@ spec:
     kind: GitRepository
     name: flux-system
   path: ./apps/vms
-  postBuild:
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-vars
+  # NO postBuild.substituteFrom: Flux's envsubst would run over the ENTIRE manifest, including the
+  # VM cloud-init shell scripts, and mangle every `${...}` (e.g. ${UOS_URL}, ${PIPESTATUS[0]}) —
+  # corrupting the in-guest install. VM manifests reference no cluster-vars, so substitution is
+  # unneeded here. A future VM that needs a cluster-var must escape its shell `${...}` as `$${...}`.