diff --git a/release-gate/release-script.test.mjs b/release-gate/release-script.test.mjs
index ef1df1b..40cb81c 100644
--- a/release-gate/release-script.test.mjs
+++ b/release-gate/release-script.test.mjs
@@ -139,6 +139,15 @@ test('production canary keeps stable 8081 live and switches only after verified
   assert.match(source, /nginx -t/);
   assert.match(source, /CANARY_PROXY_PORT=18082/);
   assert.match(source, /CANARY_TUNNEL_REMOTE_PORT=19082/);
+  assert.match(
+    source,
+    /edge_ssh\(\) \{\s*#.*\n\s*#.*\n\s*ssh -n -o BatchMode=yes/,
+  );
+  assert.match(
+    source,
+    /ssh -o BatchMode=yes -o ConnectTimeout=10 "\$\{EDGE_HOST\}" \/bin\/bash <<EDGE_SWITCH/,
+  );
+  assert.doesNotMatch(source, /edge_ssh \/bin\/bash <<EDGE_SWITCH/);
   assert.match(source, /CANARY_USERNAMES="john"/);
   assert.match(source, /CANARY_WECHAT_USER_IDS="wx_ul610et8"/);
   assert.match(source, /route-probe\?\$\{probe_query\}/);
diff --git a/scripts/release-portal-canary-prod.sh b/scripts/release-portal-canary-prod.sh
index 6667028..6c24f81 100755
--- a/scripts/release-portal-canary-prod.sh
+++ b/scripts/release-portal-canary-prod.sh
@@ -261,7 +261,9 @@ candidate_healthy() {
 }
 
 edge_ssh() {
-  ssh -o BatchMode=yes -o ConnectTimeout=10 "${EDGE_HOST}" "$@"
+  # This remote release script itself arrives on stdin. Ordinary nested SSH
+  # commands must not consume the unparsed remainder of that script.
+  ssh -n -o BatchMode=yes -o ConnectTimeout=10 "${EDGE_HOST}" "$@"
 }
 
 write_canary_tunnel_plist() {
@@ -586,7 +588,9 @@ done
 [[ "${counts:-unknown unknown}" == "0 0" ]]
 
 say "Switch the committed 105 nginx upstreams to the isolated canary tunnel"
-edge_ssh /bin/bash <<EDGE_SWITCH
+# Unlike ordinary edge_ssh calls, this command intentionally receives only the
+# bounded EDGE_SWITCH heredoc on stdin.
+ssh -o BatchMode=yes -o ConnectTimeout=10 "${EDGE_HOST}" /bin/bash <<EDGE_SWITCH
 set -euo pipefail
 for config in '${EDGE_MOBILE_CONFIG}' '${EDGE_WECHAT_CONFIG}'; do
   before_count="\$(grep -cF 'proxy_pass http://58.38.22.103:8081;' "\${config}")"