diff --git a/infra/build-server/run-from-mac.sh b/infra/build-server/run-from-mac.sh
index df2e6feab..47fbef574 100755
--- a/infra/build-server/run-from-mac.sh
+++ b/infra/build-server/run-from-mac.sh
@@ -23,17 +23,17 @@ BS_TOOL=run-from-mac
 IP="${1:-}"; shift || true
 [ -n "$IP" ] || bs_die "usage: run-from-mac.sh <ip> [--wire-only]"
 WIRE_ONLY=0; [ "${1:-}" = --wire-only ] && WIRE_ONLY=1
-PASS=()
+PASS=""   # a string, not an array: bash 3.2 (the Mac) treats an empty array as unbound under set -u
 for v in MODE RUST_TOOLCHAIN SCCACHE_GB SCCACHE_VERSION NODE_MAJOR SLOTS P2P_PORTS BOX_HOSTNAME SSH_PUBKEY; do
-  [ -n "${!v:-}" ] && PASS+=("$v=$(printf '%q' "${!v}")")
+  [ -n "${!v:-}" ] && PASS="$PASS $v=$(printf '%q' "${!v}")"
 done
 
 ROOT_SSH=(ssh -i "$BS_KEY" -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ServerAliveInterval=15 "root@$IP")
 
 if [ "$WIRE_ONLY" = 0 ]; then
   WORKTREES=$(git -C "$MAIN_REPO" worktree list --porcelain | awk '/^worktree /{ print $2 }' | xargs -n1 basename | tr '\n' ' ')
-  bs_log "provisioning root@$IP with $(printf '%s\n' "$WORKTREES" | wc -w | tr -d ' ') worktree names${PASS[*]:+ and ${PASS[*]}}"
-  if ! "${ROOT_SSH[@]}" "WORKTREES='$WORKTREES' ${PASS[*]} bash -s" < "$HERE/provision.sh"; then
+  bs_log "provisioning root@$IP with $(printf '%s\n' "$WORKTREES" | wc -w | tr -d ' ') worktree names${PASS:+ and$PASS}"
+  if ! "${ROOT_SSH[@]}" "WORKTREES='$WORKTREES'$PASS bash -s" < "$HERE/provision.sh"; then
     bs_log "provision.sh did not finish (an install-mode run ends with a reboot and a lost connection: wait for ssh, then run this again)"
     ssh-keygen -R "$IP" >/dev/null 2>&1 || true
     exit 1