diff --git a/tests/e2e-cucumber/Cargo.toml b/tests/e2e-cucumber/Cargo.toml
index 268fb36bd..fe2265a92 100644
--- a/tests/e2e-cucumber/Cargo.toml
+++ b/tests/e2e-cucumber/Cargo.toml
@@ -22,6 +22,17 @@ path = "src/bin/rocm-demo-env.rs"
 name = "fake-tailscale"
 path = "src/bin/fake-tailscale.rs"
 
+# Stand-ins for `uv` and the runtime's Python interpreter, planted by the
+# `rocm comfyui install` scenarios so they run deterministically and offline
+# on every platform cargo builds for (see `src/fixture_binary.rs`).
+[[bin]]
+name = "fake-uv"
+path = "src/bin/fake-uv.rs"
+
+[[bin]]
+name = "fake-python"
+path = "src/bin/fake-python.rs"
+
 [dependencies]
 axum.workspace = true
 cucumber = { version = "0.23", features = ["output-json", "output-junit"] }
diff --git a/tests/e2e-cucumber/README.md b/tests/e2e-cucumber/README.md
index 6dbc445ab..d4199265d 100644
--- a/tests/e2e-cucumber/README.md
+++ b/tests/e2e-cucumber/README.md
@@ -238,6 +238,15 @@ The `.feature` file is both the spec and the test input — cucumber reads it at
 3. Implement step functions: Given = setup, When = action, Then = assertion.
 4. Register the module in `tests/e2e.rs` with `pub mod <name>_steps;`.
 5. Run to verify.
+6. If a step needs to fake a subprocess the CLI shells out to (`uv`, a runtime's
+   `python`, `tailscale`), add a `[[bin]]` under [`src/bin/`](src/bin/) rather
+   than writing a shell/batch script: it builds on every platform cargo already
+   targets. [`fixture_binary`](src/fixture_binary.rs)'s `fixture_binary()`
+   locates it and `fixture_target_name()` names it; `install_fixture_binary` in
+   [`tests/e2e.rs`](tests/e2e.rs) plants it (it needs the `rocm-core`
+   dev-dependency the library target can't reach). See
+   [`fake-uv`](src/bin/fake-uv.rs), [`fake-python`](src/bin/fake-python.rs),
+   and [`fake-tailscale`](src/bin/fake-tailscale.rs) for the pattern.
 
 ## Design principles
 
diff --git a/tests/e2e-cucumber/features/comfyui.feature b/tests/e2e-cucumber/features/comfyui.feature
index 51cf58663..a7caa87d8 100644
--- a/tests/e2e-cucumber/features/comfyui.feature
+++ b/tests/e2e-cucumber/features/comfyui.feature
@@ -10,9 +10,8 @@ Feature: ComfyUI install reports progress and makes failures actionable
   #
   # The runtime, its rocm_sdk probe, the Python interpreter and `uv` itself are
   # all planted so the scenario is hermetic: no GPU, no network, no real
-  # package resolution. Linux-only because the planted shims are POSIX shell
-  # scripts.
-  @id:comfyui-uv-install-failure-names-log @requires-os:linux
+  # package resolution.
+  @id:comfyui-uv-install-failure-names-log
   Scenario: comfyui-01 - A failed dependency install names the log it wrote
     Given a ready ROCm runtime with a ComfyUI checkout pending dependencies
     And the ComfyUI dependency install with uv fails
@@ -32,7 +31,7 @@ Feature: ComfyUI install reports progress and makes failures actionable
   # both `install` and `status` output -- a user-observable line that AGENTS.md
   # requires a Gherkin scenario for, not just the unit tests that assert each
   # command's `folder:` line in isolation.
-  @id:comfyui-uv-install-progress-streamed @requires-os:linux
+  @id:comfyui-uv-install-progress-streamed
   Scenario: comfyui-02 - A dependency install streams progress output
     Given a ready ROCm runtime with a ComfyUI checkout pending dependencies
     And the ComfyUI dependency install with uv prints progress and succeeds
@@ -60,9 +59,8 @@ Feature: ComfyUI install reports progress and makes failures actionable
   #
   # No GPU is needed: runtime readiness is filesystem + manifest state, so the
   # scenario plants two ready wheel runtimes and asserts the refusal names every
-  # remediation and lists both keys. Linux-only because the planted rocm_sdk stub
-  # uses `.so` library names; the selection logic it exercises is platform-agnostic.
-  @id:comfyui-ambiguous-runtime-actionable @requires-os:linux
+  # remediation and lists both keys.
+  @id:comfyui-ambiguous-runtime-actionable
   Scenario: comfyui-03 - ComfyUI install refuses an ambiguous runtime choice and names every remediation
     Given two ready ROCm runtimes and no active default
     When the user installs ComfyUI without choosing a runtime
@@ -89,6 +87,11 @@ Feature: ComfyUI install reports progress and makes failures actionable
   # label-truncation fix in `cli_progress::assemble_status_line` — the
   # tarball scenario in `download_progress_pty.feature` is the regression
   # test for that.
+  # Linux-only: this scenario drives `rocm` under a real PTY, the same
+  # suite-wide limitation `dash.feature`'s header comment documents
+  # (portable-pty compiles on Windows via ConPTY, but that path isn't yet
+  # promoted to a blocking contract) — unrelated to this file's other
+  # scenarios, whose own Linux gate is explained below.
   @id:comfyui-source-download-shows-live-progress @requires-os:linux @serial
   Scenario: comfyui-04 - The source-archive download spinner renders progress and clears on completion
     Given a paced ComfyUI source archive fixture
@@ -109,8 +112,17 @@ Feature: ComfyUI install reports progress and makes failures actionable
   # started during the download), an interrupted reinstall, a user's entry set
   # aside, a failure after the new code is in place, and a download that is
   # not a ComfyUI release. Each asserts what the CLI prints together with what
-  # is actually on disk afterwards. Linux-only because the planted runtime
-  # uses `.so` names and a POSIX-shell Python stand-in.
+  # is actually on disk afterwards. Only three of these still need the POSIX
+  # shell: comfyui-11's GPU-check failing transition plants a `#!/bin/sh`
+  # script (its passing-again half uses the Windows-portable `fake-python`
+  # stand-in, like every other scenario here), and comfyui-08/comfyui-12 each
+  # start their stand-in running ComfyUI process through `sh -c` (see
+  # `spawn_stand_in`). comfyui-05/-06/-07/-09/-10/-13 plant the same
+  # Windows-portable `fake-python` stand-in `comfyui-01`/`-02`/`-03` use and
+  # have no shell dependency of their own, but stay `@requires-os:linux` too:
+  # their reinstall behavior has not been run on Windows yet. Ungating them
+  # is tracked separately (#697), to keep this fix scoped to #629's
+  # comfyui-01/02/03 ask.
   #
   # rocm-cli's saved record of a ComfyUI it started is unreadable here. `stop`
   # cannot read it either, so it must not block the reinstall; the reinstall
diff --git a/tests/e2e-cucumber/src/bin/fake-python.rs b/tests/e2e-cucumber/src/bin/fake-python.rs
new file mode 100644
index 000000000..7df1f3e83
--- /dev/null
+++ b/tests/e2e-cucumber/src/bin/fake-python.rs
@@ -0,0 +1,48 @@
+// Copyright © Advanced Micro Devices, Inc., or its affiliates.
+//
+// SPDX-License-Identifier: MIT
+
+//! A stand-in for the runtime's Python interpreter, for the ComfyUI install
+//! scenarios' two probes.
+//!
+//! `apps/rocm/src/comfyui.rs` shells out to the runtime's Python twice:
+//! `-c <script>` for the pre-install torch-stack version probe (answered here
+//! with empty JSON, so the probe reads "nothing pinned") and
+//! `<script-path> <result-path>` for the post-install GPU check (answered by
+//! writing a fixed, GPU-having result to the given path). One binary answers
+//! both forms unconditionally, so a scenario that only reaches the first
+//! probe and one that reaches both work against the same stand-in.
+//!
+//! A Rust binary rather than a shell script so the scenarios run on Windows
+//! too — a `.bat` stand-in can't take the `-c` form at all: its argument is a
+//! genuine multi-line script, and Rust's CVE-2024-24576 mitigation rejects
+//! any newline-containing argument once the target resolves to a batch file.
+//!
+//! Only the two forms `probe_comfyui` and the torch-stack probe actually use
+//! are accepted; anything else fails loudly rather than guessing, the same
+//! rule `fake-tailscale` follows for an unexpected command.
+
+const GPU_PROBE_JSON: &str = r#"{"torch_version": "2.4.0", "torch_cuda_available": true, "device_count": 1, "devices": ["Fake GPU"]}"#;
+
+// The probe script path is always `probe_comfyui`'s own internally-generated
+// `probe.py` (never user input), so a case-sensitive extension check is fine.
+#[allow(clippy::case_sensitive_file_extension_comparisons)]
+fn main() {
+    let args: Vec<String> = std::env::args().collect();
+    match args.get(1).map(String::as_str) {
+        // `python -c <script>`: the pre-install torch-stack version probe.
+        Some("-c") if args.len() == 3 => {
+            print!("{{}}");
+        }
+        // `python <probe.py> <result.json>`: the post-install GPU check.
+        Some(script) if script.ends_with(".py") && args.len() == 3 => {
+            let result_path = &args[2];
+            std::fs::write(result_path, GPU_PROBE_JSON)
+                .unwrap_or_else(|e| panic!("failed to write GPU probe result: {e}"));
+        }
+        _ => {
+            eprintln!("fake-python: unexpected invocation: {args:?}");
+            std::process::exit(1);
+        }
+    }
+}
diff --git a/tests/e2e-cucumber/src/bin/fake-uv.rs b/tests/e2e-cucumber/src/bin/fake-uv.rs
new file mode 100644
index 000000000..110890919
--- /dev/null
+++ b/tests/e2e-cucumber/src/bin/fake-uv.rs
@@ -0,0 +1,28 @@
+// Copyright © Advanced Micro Devices, Inc., or its affiliates.
+//
+// SPDX-License-Identifier: MIT
+
+//! A stand-in for `uv`, for the ComfyUI dependency-install scenarios.
+//!
+//! `rocm comfyui install` shells out to `uv` to resolve ComfyUI's Python
+//! dependencies. A scenario that has to be deterministic and offline plants
+//! this instead and controls its outcome through two env vars:
+//!
+//! `FAKE_UV_STDOUT` — a line to print to stdout before exiting (unset: none).
+//! `FAKE_UV_EXIT_CODE` — the exit code to return (unset: `0`).
+//!
+//! A Rust binary rather than a shell script so the scenarios run on Windows
+//! too.
+
+fn main() {
+    if let Ok(line) = std::env::var("FAKE_UV_STDOUT") {
+        println!("{line}");
+    }
+    let code: i32 = match std::env::var("FAKE_UV_EXIT_CODE") {
+        Ok(value) => value.parse().unwrap_or_else(|e| {
+            panic!("FAKE_UV_EXIT_CODE={value:?} is not a valid exit code: {e}")
+        }),
+        Err(_) => 0,
+    };
+    std::process::exit(code);
+}
diff --git a/tests/e2e-cucumber/src/fixture_binary.rs b/tests/e2e-cucumber/src/fixture_binary.rs
new file mode 100644
index 000000000..fa055fa28
--- /dev/null
+++ b/tests/e2e-cucumber/src/fixture_binary.rs
@@ -0,0 +1,47 @@
+// Copyright © Advanced Micro Devices, Inc., or its affiliates.
+//
+// SPDX-License-Identifier: MIT
+
+//! Locate a fixture stand-in built as a `[[bin]]` of this crate.
+//!
+//! A scenario that needs a fake subprocess — `fake-tailscale`, `fake-uv`,
+//! `fake-python` — declares it a normal cargo `[[bin]]` instead of
+//! hand-writing a shell or batch script, so it runs on every platform cargo
+//! already builds for and gets normal incremental, cached builds. Cargo puts
+//! it next to this test binary itself, so finding it is a matter of walking
+//! up from `std::env::current_exe()`.
+//!
+//! Only the lookup lives here: planting the located binary at a scenario's
+//! chosen path needs `rocm_core::fake_executable::write_fake_executable` to
+//! avoid reopening the `ETXTBSY` race, and that helper is a dev-dependency —
+//! unavailable to this crate's own library target. See `install_fixture_binary`
+//! in `tests/e2e.rs`, the test binary that can reach it.
+
+use std::path::PathBuf;
+
+/// The path cargo built the `[[bin]]` named `name` at, alongside this test
+/// binary.
+pub fn fixture_binary(name: &str) -> PathBuf {
+    let mut dir = std::env::current_exe().expect("test binary path");
+    dir.pop();
+    if dir.ends_with("deps") {
+        dir.pop();
+    }
+    let candidate = dir.join(fixture_target_name(name));
+    assert!(
+        candidate.exists(),
+        "the {name} stand-in was not built at {}; it is a [[bin]] of this crate",
+        candidate.display()
+    );
+    candidate
+}
+
+/// The filename a planted fixture executable needs on this platform: `stem`
+/// unchanged on unix, `stem.exe` on Windows.
+pub fn fixture_target_name(stem: &str) -> String {
+    if cfg!(windows) {
+        format!("{stem}.exe")
+    } else {
+        stem.to_owned()
+    }
+}
diff --git a/tests/e2e-cucumber/src/lib.rs b/tests/e2e-cucumber/src/lib.rs
index 97ae7e2e1..48c0466ab 100644
--- a/tests/e2e-cucumber/src/lib.rs
+++ b/tests/e2e-cucumber/src/lib.rs
@@ -4,6 +4,7 @@
 
 pub mod capability;
 pub mod expectation;
+pub mod fixture_binary;
 pub mod harness_diagnostics;
 pub mod http_server;
 pub mod installer_fixture;
diff --git a/tests/e2e-cucumber/tests/e2e.rs b/tests/e2e-cucumber/tests/e2e.rs
index 5db71ed4e..7ff04fa5f 100644
--- a/tests/e2e-cucumber/tests/e2e.rs
+++ b/tests/e2e-cucumber/tests/e2e.rs
@@ -754,6 +754,34 @@ pub fn rocmd_binary() -> PathBuf {
     })
 }
 
+/// Plants the `[[bin]]` fixture `name` (see `e2e_cucumber::fixture_binary`)
+/// at the exact path `dest`.
+///
+/// Parent dirs are created as needed. Shared so the three stand-ins
+/// (`fake-tailscale`, `fake-uv`, `fake-python`) don't each repeat the same
+/// create-then-write body.
+///
+/// Lives here rather than in `e2e_cucumber::fixture_binary` because it needs
+/// `rocm_core::fake_executable::write_fake_executable` to avoid reopening the
+/// `ETXTBSY` race a plain `std::fs::copy` would — holding a write fd on `dest`
+/// for the duration of the copy is exactly the window that race exploits —
+/// and `rocm-core` is a dev-dependency this crate's library target cannot
+/// reach, only this test binary.
+pub fn install_fixture_binary(name: &str, dest: &Path) {
+    if let Some(parent) = dest.parent() {
+        std::fs::create_dir_all(parent)
+            .unwrap_or_else(|e| panic!("failed to create {}: {e}", parent.display()));
+    }
+    let contents = std::fs::read(e2e_cucumber::fixture_binary::fixture_binary(name))
+        .unwrap_or_else(|e| panic!("failed to read the {name} stand-in: {e}"));
+    rocm_core::fake_executable::write_fake_executable(dest, contents).unwrap_or_else(|e| {
+        panic!(
+            "failed to install the {name} stand-in at {}: {e}",
+            dest.display()
+        )
+    });
+}
+
 /// Spawn the real `rocm` binary with the scenario's isolated env.
 ///
 /// Returns `(stdout, stderr, rc)`. Every scenario goes through here, so this is
diff --git a/tests/e2e-cucumber/tests/e2e/comfyui_steps.rs b/tests/e2e-cucumber/tests/e2e/comfyui_steps.rs
index 4cfb89f99..fe7f2fdc2 100644
--- a/tests/e2e-cucumber/tests/e2e/comfyui_steps.rs
+++ b/tests/e2e-cucumber/tests/e2e/comfyui_steps.rs
@@ -7,12 +7,12 @@
 //! `comfyui-01` and `comfyui-02` drive a dependency install against an entirely
 //! planted runtime: a `wheel` manifest with a satisfying `rocm_sdk` probe, a
 //! pre-existing source checkout (so the CLI never attempts the real network
-//! download of ComfyUI's source archive) and a fake Python interpreter that
-//! answers the torch-stack version probe with valid, empty JSON. `comfyui-01`
-//! covers what happens when the `uv` dependency install that follows all of
-//! that fails; `comfyui-02` covers a `uv` install that succeeds, which runs on
-//! into the post-install GPU check and needs the fake Python to also answer
-//! that second probe.
+//! download of ComfyUI's source archive) and a `fake-python` stand-in
+//! (`src/bin/fake-python.rs`) that answers both the pre-install torch-stack
+//! version probe and the post-install GPU check. `comfyui-01` covers what
+//! happens when the `uv` dependency install that follows all of that fails;
+//! `comfyui-02` covers a `uv` install that succeeds, which runs on into the
+//! post-install GPU check that `fake-python` also answers.
 //!
 //! `comfyui-03` covers runtime *selection* rather than the install that follows
 //! it: `rocm comfyui install` refuses when more than one managed ROCm runtime is
@@ -74,6 +74,7 @@ use std::path::{Path, PathBuf};
 use std::time::Duration;
 
 use cucumber::{given, then, when};
+use e2e_cucumber::fixture_binary::fixture_target_name;
 use e2e_cucumber::paced_download::{
     PacedDownloadServer, build_gzip_tarball, deterministic_payload,
 };
@@ -116,12 +117,17 @@ fn write_fixture(path: &Path, contents: &str) {
 }
 
 /// Writes an executable POSIX shell script, standing in for a real binary the
-/// CLI shells out to (`uv`, the runtime's Python).
+/// CLI shells out to.
 ///
 /// Written via [`rocm_core::fake_executable::write_fake_executable`], not
 /// `std::fs::write`: scenarios run concurrently, and a write fd another
 /// scenario's spawn inherits makes the CLI's first run of the shim fail with
 /// `Text file busy`.
+///
+/// comfyui-11 is the only remaining caller (its GPU-check failing transition,
+/// via `gpu_check_fails`): every other scenario's runtime Python is the
+/// Windows-portable `fake-python` `[[bin]]` planted by `install_fake_python`,
+/// including comfyui-11's own passing-again half (`gpu_check_passes_again`).
 fn write_shim(path: &Path, body: &str) {
     if let Some(parent) = path.parent() {
         std::fs::create_dir_all(parent).expect("failed to create fixture directory");
@@ -130,22 +136,43 @@ fn write_shim(path: &Path, body: &str) {
         .unwrap_or_else(|e| panic!("failed to write fake {}: {e}", path.display()));
 }
 
-/// Writes a fake runtime Python that answers both forms `probe_comfyui`'s
-/// post-install GPU check shells out to: `-c <script>` (the pre-install
-/// torch-stack probe) and `<script-path> <result-path>` (the post-install
-/// check, which writes its JSON result to the given path instead of stdout).
-fn write_gpu_probe_shim(path: &Path) {
-    write_shim(
-        path,
-        "#!/bin/sh\n\
-         if [ \"$1\" = \"-c\" ]; then\n\
-         \tprintf '{}'\n\
-         \texit 0\n\
-         fi\n\
-         cat > \"$2\" <<'JSON'\n\
-         {\"torch_version\": \"2.4.0\", \"torch_cuda_available\": true, \"device_count\": 1, \"devices\": [\"Fake GPU\"]}\n\
-         JSON\n",
-    );
+/// Installs the `fake-uv` stand-in at `path`, configured via env vars it
+/// reads (see `src/bin/fake-uv.rs`). Returns the env additions the invoking
+/// `rocm` process needs so its own child `uv` process — which inherits
+/// `rocm`'s environment — picks them up.
+fn install_fake_uv(
+    path: &Path,
+    exit_code: i32,
+    stdout_line: Option<&str>,
+) -> Vec<(&'static str, std::ffi::OsString)> {
+    crate::install_fixture_binary("fake-uv", path);
+    let mut env = vec![("FAKE_UV_EXIT_CODE", exit_code.to_string().into())];
+    if let Some(line) = stdout_line {
+        env.push(("FAKE_UV_STDOUT", line.into()));
+    }
+    env
+}
+
+/// Installs the `fake-python` stand-in at `path` (see `src/bin/fake-python.rs`).
+/// It always answers both of the runtime Python's invocation forms
+/// (`probe_torch_stack_versions`'s `-c`, `probe_comfyui`'s script form), so
+/// one install serves every scenario regardless of how far `install()` runs.
+fn install_fake_python(path: &Path) {
+    crate::install_fixture_binary("fake-python", path);
+}
+
+// A simplified stand-in for `rocm_core::runtime_rocm_library_filename` rather
+// than imported: only the filename's look matters here, since readiness only
+// checks `path.is_file()` on whatever the manifest lists (see
+// `probe_has_resolved_library` in `apps/rocm/src/therock.rs`) — never the
+// filename itself. Importing the product crate for that would buy nothing,
+// so it stays a local stand-in.
+fn rocm_library_filename(shortname: &str) -> String {
+    if cfg!(windows) {
+        format!("{shortname}.dll")
+    } else {
+        format!("lib{shortname}.so")
+    }
 }
 
 /// Plant one ready wheel runtime: the on-disk stubs the CLI's readiness check
@@ -165,12 +192,14 @@ fn plant_ready_runtime(data: &Path, key: &str) {
     let install_root = data.join("runtimes").join("roots").join(key);
     let sdk_root = install_root.join("sdk");
     let sdk_bin = sdk_root.join("bin");
-    let python = install_root.join("bin").join("python3");
-    let amdhip = sdk_bin.join("libamdhip64.so");
-    let hipblas = sdk_bin.join("libhipblas.so");
+    let python = install_root
+        .join("bin")
+        .join(fixture_target_name("python3"));
+    let amdhip = sdk_bin.join(rocm_library_filename("amdhip64"));
+    let hipblas = sdk_bin.join(rocm_library_filename("hipblas"));
 
     write_fixture(&install_root.join(".rocm-cli-runtime.json"), "{}");
-    write_fixture(&python, "#!/bin/sh\nexit 0\n");
+    install_fake_python(&python);
     write_fixture(&amdhip, "stub");
     write_fixture(&hipblas, "stub");
 
@@ -231,13 +260,15 @@ async fn ready_install_pending_dependencies(world: &mut E2eWorld) {
     let source_dir = install_root.join("apps").join("comfyui").join("source");
     write_fixture(&source_dir.join("requirements.txt"), "numpy==1.26.0\n");
 
-    // Fake Python interpreter: succeeds and prints valid (empty) JSON, so the
-    // torch-stack constraint probe that runs before `uv` passes cleanly.
+    // `install_fake_python` answers both of the runtime Python's invocation
+    // forms, but this scenario only reaches the torch-stack constraint probe
+    // (`-c`) before `uv`; the empty JSON it prints is what makes that probe
+    // pass cleanly.
     let python = root(world)
         .join("comfyui-fixture")
         .join("python")
-        .join("rocm-python");
-    write_shim(&python, "#!/bin/sh\nprintf '{}'\n");
+        .join(fixture_target_name("rocm-python"));
+    install_fake_python(&python);
 
     // A `rocm_sdk` probe that satisfies `validate_rocm_sdk_runtime_probe`:
     // importable, with an existing root/bin dir and resolved amdhip64/hipblas
@@ -246,8 +277,8 @@ async fn ready_install_pending_dependencies(world: &mut E2eWorld) {
     let sdk_bin = install_root.join("rocm_sdk").join("bin");
     std::fs::create_dir_all(&sdk_root).expect("failed to create fake rocm_sdk root dir");
     std::fs::create_dir_all(&sdk_bin).expect("failed to create fake rocm_sdk bin dir");
-    let amdhip64 = sdk_root.join("libamdhip64.so");
-    let hipblas = sdk_root.join("libhipblas.so");
+    let amdhip64 = sdk_root.join(rocm_library_filename("amdhip64"));
+    let hipblas = sdk_root.join(rocm_library_filename("hipblas"));
     write_fixture(&amdhip64, "");
     write_fixture(&hipblas, "");
 
@@ -283,8 +314,8 @@ async fn uv_install_fails(world: &mut E2eWorld) {
     let uv = root(world)
         .join("comfyui-fixture")
         .join("uv-bin")
-        .join("uv");
-    write_shim(&uv, "#!/bin/sh\nexit 7\n");
+        .join(fixture_target_name("uv"));
+    world.command_env.extend(install_fake_uv(&uv, 7, None));
     world
         .command_env
         .push(("ROCM_CLI_UV_BINARY", uv.into_os_string()));
@@ -295,8 +326,10 @@ async fn uv_install_prints_progress_and_succeeds(world: &mut E2eWorld) {
     let uv = root(world)
         .join("comfyui-fixture")
         .join("uv-bin")
-        .join("uv");
-    write_shim(&uv, "#!/bin/sh\necho 'Resolved 3 packages'\nexit 0\n");
+        .join(fixture_target_name("uv"));
+    world
+        .command_env
+        .extend(install_fake_uv(&uv, 0, Some("Resolved 3 packages")));
     world
         .command_env
         .push(("ROCM_CLI_UV_BINARY", uv.into_os_string()));
@@ -305,15 +338,9 @@ async fn uv_install_prints_progress_and_succeeds(world: &mut E2eWorld) {
     // check, which shells out to the runtime's Python a second time with two
     // path arguments (a generated probe script, then where to write its JSON
     // result) rather than `-c <script>` like the pre-install torch-stack probe.
-    // The fixture Python from the `Given` above only answers the `-c` form, so
-    // it must be replaced here with one that answers both: unlike
-    // `comfyui-01`, this scenario runs `install()` far enough to reach that
-    // second call.
-    let python = root(world)
-        .join("comfyui-fixture")
-        .join("python")
-        .join("rocm-python");
-    write_gpu_probe_shim(&python);
+    // The fixture Python the `Given` above installed already answers both
+    // forms, so nothing more is needed here for `install()` to reach that
+    // second call, unlike `comfyui-01`, which fails before reaching it.
 }
 
 #[when("the user installs ComfyUI")]
@@ -520,21 +547,14 @@ const PTY_SCREEN_TIMEOUT: Duration = Duration::from_secs(30);
 #[given("a paced ComfyUI source archive fixture")]
 async fn paced_comfyui_source_archive_fixture(world: &mut E2eWorld) {
     let data = data_dir(world);
-    plant_ready_runtime(&data, RUNTIME_KEY);
-
     // `probe_comfyui`'s post-install GPU check runs unconditionally in
     // `install()`, regardless of whether the `uv` block ran, so the runtime's
-    // stub Python must answer it — `plant_ready_runtime`'s default (`exit 0`,
-    // no output) is not enough. This scenario's requirements.txt (torch-stack
-    // only, below) empties the dependency list and skips the `-c` probe, but
-    // the shim answers both forms anyway for parity with the other fixtures.
-    let python = data
-        .join("runtimes")
-        .join("roots")
-        .join(RUNTIME_KEY)
-        .join("bin")
-        .join("python3");
-    write_gpu_probe_shim(&python);
+    // stub Python must answer it — `plant_ready_runtime`'s `fake-python`
+    // stand-in already does, answering both invocation forms. This scenario's
+    // requirements.txt (torch-stack only, below) empties the dependency list
+    // and skips the `-c` probe, but the stand-in answers it anyway for parity
+    // with the other fixtures.
+    plant_ready_runtime(&data, RUNTIME_KEY);
 
     // Build a real `.tar.gz`: one top-level directory holding a
     // `requirements.txt` naming only the torch stack, so `install()`'s
@@ -710,15 +730,6 @@ fn run_comfyui_reinstall(world: &mut E2eWorld, extra: &[&str]) {
 async fn used_comfyui_install(world: &mut E2eWorld) {
     let data = data_dir(world);
     plant_ready_runtime(&data, RUNTIME_KEY);
-    // Answers the post-install GPU check `install()` runs after the swap.
-    write_gpu_probe_shim(
-        &data
-            .join("runtimes")
-            .join("roots")
-            .join(RUNTIME_KEY)
-            .join("bin")
-            .join("python3"),
-    );
     let source = comfyui_source_dir(world);
     for (relative, contents) in [
         ("main.py", "old release"),
@@ -1496,7 +1507,7 @@ async fn gpu_check_fails(world: &mut E2eWorld) {
 
 #[given("the runtime's AMD GPU check passes again")]
 async fn gpu_check_passes_again(world: &mut E2eWorld) {
-    write_gpu_probe_shim(&runtime_python(world));
+    install_fake_python(&runtime_python(world));
 }
 
 fn runtime_python(world: &E2eWorld) -> PathBuf {
@@ -1505,7 +1516,7 @@ fn runtime_python(world: &E2eWorld) -> PathBuf {
         .join("roots")
         .join(RUNTIME_KEY)
         .join("bin")
-        .join("python3")
+        .join(fixture_target_name("python3"))
 }
 
 #[then("the reinstall fails and names what it replaced and the command that finishes the install")]
diff --git a/tests/e2e-cucumber/tests/e2e/remote_steps.rs b/tests/e2e-cucumber/tests/e2e/remote_steps.rs
index 83ec83663..497603cf4 100644
--- a/tests/e2e-cucumber/tests/e2e/remote_steps.rs
+++ b/tests/e2e-cucumber/tests/e2e/remote_steps.rs
@@ -13,6 +13,7 @@
 use std::path::PathBuf;
 
 use cucumber::{given, then, when};
+use e2e_cucumber::fixture_binary::fixture_target_name;
 
 use crate::E2eWorld;
 
@@ -55,20 +56,8 @@ fn plant_tailscale(world: &E2eWorld, status: Option<&str>) -> Vec<(String, Strin
         .path()
         .to_path_buf();
     let bin_dir = root.join("fake-bin");
-    std::fs::create_dir_all(&bin_dir).expect("create fake bin dir");
-
-    let built = fake_tailscale_binary();
-    let installed = bin_dir.join(if cfg!(windows) {
-        "tailscale.exe"
-    } else {
-        "tailscale"
-    });
-    std::fs::copy(&built, &installed).unwrap_or_else(|error| {
-        panic!(
-            "failed to install the tailscale stand-in from {}: {error}",
-            built.display()
-        )
-    });
+    let installed = bin_dir.join(fixture_target_name("tailscale"));
+    crate::install_fixture_binary("fake-tailscale", &installed);
 
     let mut env = vec![(
         "PATH".to_owned(),
@@ -90,27 +79,6 @@ fn plant_tailscale(world: &E2eWorld, status: Option<&str>) -> Vec<(String, Strin
     env
 }
 
-/// The stand-in is a bin target of this crate, so cargo has already built it
-/// next to the test binary.
-fn fake_tailscale_binary() -> PathBuf {
-    let mut dir = std::env::current_exe().expect("test binary path");
-    dir.pop();
-    if dir.ends_with("deps") {
-        dir.pop();
-    }
-    let candidate = dir.join(if cfg!(windows) {
-        "fake-tailscale.exe"
-    } else {
-        "fake-tailscale"
-    });
-    assert!(
-        candidate.exists(),
-        "the tailscale stand-in was not built at {}; it is a [[bin]] of this crate",
-        candidate.display()
-    );
-    candidate
-}
-
 fn run_remote(world: &mut E2eWorld, args: &[&str], env: &[(String, String)]) {
     let borrowed = env
         .iter()