diff --git a/knoe/core/actions.py b/knoe/core/actions.py
index 0e5e4c1..ecd2a12 100644
--- a/knoe/core/actions.py
+++ b/knoe/core/actions.py
@@ -4749,8 +4749,9 @@ class KnoeConsoleInstaller(KnoeInstaller):
         if self._deployment_mode() != "k8s":
             return True
 
-        cmd_base, gcloud_env = inst_config._gcloud_plain(os.environ.copy())
-        token_cmd = list(cmd_base) + ["auth", "print-access-token", "--quiet"]
+        gcloud_env = inst_config._augment_env_for_brew(os.environ.copy())
+        cmd_base = ["gcloud"]
+        token_cmd = cmd_base + ["auth", "print-access-token", "--quiet"]
         try:
             token_res = subprocess.run(
                 token_cmd,
@@ -4766,7 +4767,7 @@ class KnoeConsoleInstaller(KnoeInstaller):
 
         interactive = bool(getattr(sys.stdin, "isatty", lambda: False)())
         if interactive:
-            login_cmd = list(cmd_base) + ["auth", "login", "--no-launch-browser"]
+            login_cmd = cmd_base + ["auth", "login", "--no-launch-browser"]
             self.log(
                 "[ACTION] No active gcloud session found. Starting login flow: "
                 + " ".join(shlex.quote(part) for part in login_cmd)
diff --git a/knoe/core/milestones.py b/knoe/core/milestones.py
index ca3ede7..c2523da 100644
--- a/knoe/core/milestones.py
+++ b/knoe/core/milestones.py
@@ -130,8 +130,9 @@ class DependenciesMilestone(Milestone):
         if cluster_env not in {"prod", "production", "k8s"}:
             return True
 
-        cmd_base, gcloud_env = inst_config._gcloud_plain(os.environ.copy())
-        token_cmd = list(cmd_base) + ["auth", "print-access-token", "--quiet"]
+        gcloud_env = inst_config._augment_env_for_brew(os.environ.copy())
+        cmd_base = ["gcloud"]
+        token_cmd = cmd_base + ["auth", "print-access-token", "--quiet"]
         try:
             token_res = subprocess.run(
                 token_cmd,
@@ -147,7 +148,7 @@ class DependenciesMilestone(Milestone):
 
         interactive = bool(getattr(sys.stdin, "isatty", lambda: False)())
         if interactive:
-            login_cmd = list(cmd_base) + ["auth", "login", "--no-launch-browser"]
+            login_cmd = cmd_base + ["auth", "login", "--no-launch-browser"]
             self.logger.info(
                 "[ACTION] No active gcloud session found. Starting login flow: %s",
                 " ".join(shlex.quote(part) for part in login_cmd),
diff --git a/prole-auth/src/main/java/org/prole/auth/kerberos/KerberosPasswordService.java b/prole-auth/src/main/java/org/prole/auth/kerberos/KerberosPasswordService.java
index 95d2636..8bba94f 100644
--- a/prole-auth/src/main/java/org/prole/auth/kerberos/KerberosPasswordService.java
+++ b/prole-auth/src/main/java/org/prole/auth/kerberos/KerberosPasswordService.java
@@ -42,26 +42,19 @@ public class KerberosPasswordService {
     }
   }
 
-  private static final class FixedCallbackHandler implements CallbackHandler {
-    private final String principal;
-    private final char[] password;
+    private record FixedCallbackHandler(String principal, char[] password) implements CallbackHandler {
 
-    private FixedCallbackHandler(String principal, char[] password) {
-      this.principal = principal;
-      this.password = password;
-    }
-
-    @Override
-    public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
-      for (Callback cb : callbacks) {
-        if (cb instanceof NameCallback name) {
-          name.setName(principal);
-        } else if (cb instanceof PasswordCallback pw) {
-          pw.setPassword(password);
-        } else {
-          throw new UnsupportedCallbackException(cb);
+        @Override
+        public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
+            for (Callback cb : callbacks) {
+                if (cb instanceof NameCallback name) {
+                    name.setName(principal);
+                } else if (cb instanceof PasswordCallback pw) {
+                    pw.setPassword(password);
+                } else {
+                    throw new UnsupportedCallbackException(cb);
+                }
+            }
         }
-      }
     }
-  }
 }
diff --git a/prole-auth/src/main/java/org/prole/auth/web/LoginController.java b/prole-auth/src/main/java/org/prole/auth/web/LoginController.java
index ff329b9..98a1e78 100644
--- a/prole-auth/src/main/java/org/prole/auth/web/LoginController.java
+++ b/prole-auth/src/main/java/org/prole/auth/web/LoginController.java
@@ -69,10 +69,10 @@ public class LoginController {
     String safeNext = safeNext(next).toString();
     String html = """
       <!doctype html>
-      <html lang=\"en\">
+      <html lang="en">
       <head>
-        <meta charset=\"utf-8\"/>
-        <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"/>
+        <meta charset="utf-8"/>
+        <meta name="viewport" content="width=device-width, initial-scale=1"/>
         <title>Prole Login</title>
         <style>
           body { font-family: system-ui, -apple-system, Segoe UI, Roboto, sans-serif; max-width: 720px; margin: 40px auto; padding: 0 16px; }
@@ -85,20 +85,20 @@ public class LoginController {
       </head>
       <body>
         <h1>Prole Login</h1>
-        <div class=\"box\">
+        <div class="box">
           <h2>Kerberos (recommended)</h2>
           <p>If your browser is configured for Kerberos/SPNEGO, use this.</p>
-          <p><a href=\"/auth/spnego?next=%s\"><button>Login with Kerberos</button></a></p>
+          <p><a href="/auth/spnego?next=%s"><button>Login with Kerberos</button></a></p>
         </div>
 
-        <div class=\"box\">
+        <div class="box">
           <h2>Fallback form</h2>
           <p>Only available when enabled by configuration.</p>
-          <form method=\"post\" action=\"/auth/form\">
-            <input type=\"hidden\" name=\"next\" value=\"%s\"/>
-            <div class=\"row\"><label>Username</label><input name=\"username\" autocomplete=\"username\"/></div>
-            <div class=\"row\"><label>Password</label><input name=\"password\" type=\"password\" autocomplete=\"current-password\"/></div>
-            <button type=\"submit\">Login</button>
+          <form method="post" action="/auth/form">
+            <input type="hidden" name="next" value="%s"/>
+            <div class="row"><label>Username</label><input name="username" autocomplete="username"/></div>
+            <div class="row"><label>Password</label><input name="password" type="password" autocomplete="current-password"/></div>
+            <button type="submit">Login</button>
           </form>
         </div>
       </body>
diff --git a/tests/installer/test_actions_helpers.py b/tests/installer/test_actions_helpers.py
index 22e189c..32ce35a 100644
--- a/tests/installer/test_actions_helpers.py
+++ b/tests/installer/test_actions_helpers.py
@@ -257,7 +257,7 @@ class TestServiceNamespace:
         inst = _TestableInstaller()
         with mock.patch.dict(os.environ, {}, clear=False):
             os.environ.pop("SERVICE_NAMESPACE", None)
-            assert inst._service_namespace() == "default"
+            assert inst._service_namespace() == "knoe-system"
 
 
 # ---------------------------------------------------------------------------
@@ -1041,10 +1041,18 @@ class TestStepDependencies:
 
         inst = _TestableSilentInstaller(inputs={"init_cluster.cluster_env": "prod"})
 
+        def _unexpected_gcloud_plain(*_a, **_k):
+            raise AssertionError("_gcloud_plain should not be called for auth preflight")
+
         monkeypatch.setattr(
             actions_mod.inst_config,
             "_gcloud_plain",
-            lambda _env: (["gcloud"], {"PATH": "x"}),
+            _unexpected_gcloud_plain,
+        )
+        monkeypatch.setattr(
+            actions_mod.inst_config,
+            "_augment_env_for_brew",
+            lambda _env: {"PATH": "x"},
         )
         monkeypatch.setattr(
             actions_mod.subprocess,
@@ -1066,10 +1074,18 @@ class TestStepDependencies:
 
         inst = _TestableSilentInstaller(inputs={"init_cluster.cluster_env": "prod"})
 
+        def _unexpected_gcloud_plain(*_a, **_k):
+            raise AssertionError("_gcloud_plain should not be called for auth preflight")
+
         monkeypatch.setattr(
             actions_mod.inst_config,
             "_gcloud_plain",
-            lambda _env: (["gcloud"], {"PATH": "x"}),
+            _unexpected_gcloud_plain,
+        )
+        monkeypatch.setattr(
+            actions_mod.inst_config,
+            "_augment_env_for_brew",
+            lambda _env: {"PATH": "x"},
         )
         responses = [
             subprocess.CompletedProcess([], 1, stdout="", stderr="no auth"),
diff --git a/tests/installer/test_milestones_extended.py b/tests/installer/test_milestones_extended.py
index 94e8599..04d4caa 100644
--- a/tests/installer/test_milestones_extended.py
+++ b/tests/installer/test_milestones_extended.py
@@ -660,9 +660,13 @@ def test_dependencies_k8s_fails_without_gcloud_auth_session():
 
     no_token = MagicMock(returncode=1, stdout="", stderr="not logged in")
 
+    def _unexpected_gcloud_plain(*_a, **_k):
+        raise AssertionError("_gcloud_plain should not be called for auth preflight")
+
     with patch("knoe.config.get_dep_info", return_value=(True, "/usr/bin/gcloud", "1.0")), \
          patch("knoe.config.DEPENDENCIES", [dep]), \
-         patch("knoe.config._gcloud_plain", return_value=(["gcloud"], {"PATH": "x"})), \
+         patch("knoe.config._augment_env_for_brew", return_value={"PATH": "x"}), \
+         patch("knoe.config._gcloud_plain", side_effect=_unexpected_gcloud_plain), \
          patch("knoe.core.milestones.subprocess.run", return_value=no_token), \
          patch("knoe.core.milestones.sys.stdin.isatty", return_value=False):
         milestone.execute(state)
@@ -683,9 +687,13 @@ def test_dependencies_k8s_interactive_login_recovers_auth_session():
     no_token = MagicMock(returncode=1, stdout="", stderr="not logged in")
     with_token = MagicMock(returncode=0, stdout="tok123\n", stderr="")
 
+    def _unexpected_gcloud_plain(*_a, **_k):
+        raise AssertionError("_gcloud_plain should not be called for auth preflight")
+
     with patch("knoe.config.get_dep_info", return_value=(True, "/usr/bin/gcloud", "1.0")), \
          patch("knoe.config.DEPENDENCIES", [dep]), \
-         patch("knoe.config._gcloud_plain", return_value=(["gcloud"], {"PATH": "x"})), \
+         patch("knoe.config._augment_env_for_brew", return_value={"PATH": "x"}), \
+         patch("knoe.config._gcloud_plain", side_effect=_unexpected_gcloud_plain), \
          patch("knoe.core.milestones.subprocess.run", side_effect=[no_token, with_token]), \
          patch("knoe.core.milestones.sys.stdin.isatty", return_value=True), \
          patch.object(milestone, "_run_cmd", return_value=0) as run_cmd_mock: