diff --git a/scripts/ci/verify-host-leakage.js b/scripts/ci/verify-host-leakage.js
index a06d9647..520f06c6 100644
--- a/scripts/ci/verify-host-leakage.js
+++ b/scripts/ci/verify-host-leakage.js
@@ -67,6 +67,7 @@ function shouldScan(file) {
 const DEFAULT_ALLOW = [
   /\.dist-info[\\/]direct_url\.json$/,   // PEP 610 install provenance, not read at runtime
   /\.dist-info[\\/]RECORD$/,             // wheel file list, lists relative paths only
+  /\.dist-info[\\/]sboms[\\/]/,          // CycloneDX SBOMs bake the wheel PUBLISHER's CI path (e.g. /Users/runner/work), never ours
 ];
 
 function walk(dir, out = []) {
diff --git a/scripts/ci/verify-mcp-bundles.js b/scripts/ci/verify-mcp-bundles.js
index e3d8e6f0..09f22213 100644
--- a/scripts/ci/verify-mcp-bundles.js
+++ b/scripts/ci/verify-mcp-bundles.js
@@ -22,14 +22,17 @@ function bundlesRoot(appExe) {
   return path.join(path.dirname(appExe), 'resources', 'backend', 'mcp-bundles');
 }
 
+// POSIX ships node under bin/ (node/<arch>/bin/node); Windows drops it (node.exe
+// straight under arch). Must mirror electron/main.js getBundledNodePath() or this
+// gate cant find the binary it bundled and false-fails a perfectly good build.
 function bundledNode(appExe) {
   if (process.platform === 'win32') return path.join(path.dirname(appExe), 'resources', 'node', 'x64', 'node.exe');
   if (process.platform === 'darwin') {
     const i = appExe.indexOf('.app');
     const appRoot = i === -1 ? appExe : appExe.slice(0, i + 4);
-    return path.join(appRoot, 'Contents', 'Resources', 'node', process.arch, 'node');
+    return path.join(appRoot, 'Contents', 'Resources', 'node', process.arch, 'bin', 'node');
   }
-  return path.join(path.dirname(appExe), 'resources', 'node', process.arch, 'node');
+  return path.join(path.dirname(appExe), 'resources', 'node', process.arch, 'bin', 'node');
 }
 
 // Locate the JS entry for each bundle. Single-file bundles ship as <name>.js;