diff --git a/backend/app/services/boot_images/manifest.json b/backend/app/services/boot_images/manifest.json
index 4df1fff3..7f1240d8 100644
--- a/backend/app/services/boot_images/manifest.json
+++ b/backend/app/services/boot_images/manifest.json
@@ -22,13 +22,13 @@
         {
           "name": "velxio-pi-rootfs-arm64.ext4",
           "asset_id": "velxio-pi-rootfs-arm64-zst",
-          "sha256": "6b471bdf2d078eae75e00249fa3d1d1c377a3801b205afebe1dd50dc9db5de07",
+          "sha256": "d6d4a2747d18055493a621f28bf2552e94dc2a11b1586d64b0eeb3847c7e06be",
           "size_bytes": 629145600,
-          "version": "2026.05+phase2-shims-autodiscovery",
+          "version": "2026.05+phase2-shims-final",
           "compressed": {
             "encoding": "zstd",
-            "sha256": "6c189066aa1796eb2344c4b140be2190e2e767467f1fd6a2db9d63f225fd4414",
-            "size_bytes": 24734406
+            "sha256": "debd1c339dc8a6e0c72494a14f032d69f3579f4f55929ca45446f030415602ca",
+            "size_bytes": 24733697
           }
         }
       ]
diff --git a/test/pi3_protocols/test_pi3_protocols.py b/test/pi3_protocols/test_pi3_protocols.py
index 2674a115..7db63e52 100644
--- a/test/pi3_protocols/test_pi3_protocols.py
+++ b/test/pi3_protocols/test_pi3_protocols.py
@@ -147,14 +147,40 @@ def run() -> int:
             if not chunk:
                 break
             buf.extend(chunk)
-            if not saw_prompt and b"login on" in buf:
+            # Wait for the actual bash prompt (`:~#`) — `login on` alone
+            # fires from the login message line BEFORE bash is fully
+            # ready to read input. The :~# marker only appears once
+            # bash has printed PS1.
+            if not saw_prompt and b":~#" in buf:
                 saw_prompt = True
-                print("[test] login reached, sending Python GPIO call")
-                time.sleep(2)
-                cmd = (b"python3 -c \"import RPi.GPIO as G; "
-                       b"G.setmode(G.BCM); G.setup(17, G.OUT); "
-                       b"G.output(17, 1); import time; time.sleep(0.3); "
-                       b"print('SHIM_OK')\"\n")
+                print("[test] bash prompt reached, sending Python GPIO call")
+                time.sleep(3)
+                try:
+                    while True:
+                        more = sock.recv(4096)
+                        if not more:
+                            break
+                        buf.extend(more)
+                except socket.timeout:
+                    pass
+                # Send the Python test as a base64-encoded file —
+                # avoids all the bash/python -c quote-nesting hell
+                # (which silently corrupts the script and makes
+                # nothing happen, see the Phase 2 debug logs).
+                import base64
+                py = (
+                    "import RPi.GPIO as G\n"
+                    "G.setmode(G.BCM)\n"
+                    "G.setup(17, G.OUT)\n"
+                    "G.output(17, 1)\n"
+                    "import time; time.sleep(0.5)\n"
+                    "print('SHIM_OK')\n"
+                )
+                b64 = base64.b64encode(py.encode()).decode()
+                cmd = (
+                    f"echo {b64} | base64 -d > /tmp/shim_test.py && "
+                    f"python3 /tmp/shim_test.py\n"
+                ).encode()
                 sock.sendall(cmd)
                 sent_test = True
             if sent_test and b"SHIM_OK" in buf: