diff --git a/src/Build/Packaging/openwrt/README.md b/src/Build/Packaging/openwrt/README.md
index 6a9c2581..09d0b750 100644
--- a/src/Build/Packaging/openwrt/README.md
+++ b/src/Build/Packaging/openwrt/README.md
@@ -87,7 +87,8 @@ The test script downloads and verifies the matching OpenWrt x86/64 ext4 image,
 boots it with QEMU user networking, waits for OpenWrt network init to settle,
 gets a DHCP lease on `br-lan` or `eth0`, resolves the needed dependency closure
 from local SDK `.ipk` control metadata plus the official OpenWrt kmod feed,
-serves those packages to the guest, and installs them with `opkg`. It then runs:
+serves those packages to the guest, and installs them with `opkg`. It verifies
+that Bash is unavailable, then runs:
 
 ```sh
 veracrypt --text --version
@@ -96,8 +97,10 @@ veracrypt --text --test
 
 By default it also creates a 16 MiB AES/SHA-512 test container, opens it with
 `--filesystem=none`, verifies it appears in `veracrypt --text --list`, and
-unmounts it. Use `--skip-container` to run only the package install, version,
-and algorithm self-test path.
+unmounts it. It repeats the mount/list/unmount check through `mount.veracrypt`.
+The test password must not contain commas because the helper uses comma-separated
+options. Use `--skip-container` to run only the package install, Bash absence,
+version, and algorithm self-test path.
 
 If QEMU was extracted locally instead of installed system-wide, pass the binary
 and firmware directory explicitly:
diff --git a/src/Build/build_veracrypt_openwrt.sh b/src/Build/build_veracrypt_openwrt.sh
index de8c1a77..566b88a7 100755
--- a/src/Build/build_veracrypt_openwrt.sh
+++ b/src/Build/build_veracrypt_openwrt.sh
@@ -302,7 +302,6 @@ render_package_makefile() {
 configure_sdk() {
 	[ -f "$OPENWRT_CONFIG" ] || die "Missing OpenWrt config seed: $OPENWRT_CONFIG"
 
-	cp "$OPENWRT_CONFIG" "$SDK_DIR/.config"
 	(
 		cd "$SDK_DIR"
 		if ! PATH="$HOST_TOOLS/bin:$PATH" ./scripts/feeds update packages base; then
@@ -311,6 +310,8 @@ configure_sdk() {
 			PATH="$HOST_TOOLS/bin:$PATH" ./scripts/feeds update packages base
 		fi
 		PATH="$HOST_TOOLS/bin:$PATH" ./scripts/feeds install fuse3 lvm2 util-linux pcsc-lite
+		# Feed updates run defconfig before feed package symbols are available.
+		cp "$OPENWRT_CONFIG" "$SDK_DIR/.config"
 		PATH="$HOST_TOOLS/bin:$PATH" make defconfig
 	)
 }
diff --git a/src/Build/test_veracrypt_openwrt_qemu.py b/src/Build/test_veracrypt_openwrt_qemu.py
index 11ec0eba..096f2a66 100755
--- a/src/Build/test_veracrypt_openwrt_qemu.py
+++ b/src/Build/test_veracrypt_openwrt_qemu.py
@@ -701,7 +701,9 @@ def run_guest_tests(args, console, http_port, packages):
         timeout=120,
     )
 
-    console.run(package_download_command(packages, http_port), timeout=900)
+    # Keep the installer's set -e local so later failures report their status.
+    console.run(f"(\n{package_download_command(packages, http_port)}\n)", timeout=900)
+    console.run("! command -v bash", timeout=60)
 
     version_output = console.run("veracrypt --text --version", timeout=120)
     if "VeraCrypt " not in version_output:
@@ -714,6 +716,9 @@ def run_guest_tests(args, console, http_port, packages):
     if not args.skip_container:
         quoted_container_size = sh_quote(args.container_size)
         quoted_password = sh_quote(args.password)
+        quoted_helper_options = sh_quote(
+            f"password={args.password},pim=0,keyfiles=,protect-hidden=no,fs=none"
+        )
         console.run("dd if=/dev/urandom of=/tmp/vc-random.bin bs=1M count=1", timeout=120)
         console.run(
             "veracrypt --text --create /tmp/openwrt-test.hc "
@@ -725,16 +730,18 @@ def run_guest_tests(args, console, http_port, packages):
             timeout=360,
         )
         console.run("mkdir -p /mnt/veracrypt-test", timeout=60)
-        console.run(
+        for mount_command in (
             "veracrypt --text --mount /tmp/openwrt-test.hc /mnt/veracrypt-test "
             f"--password={quoted_password} "
             "--pim=0 --keyfiles='' --protect-hidden=no --filesystem=none --non-interactive",
-            timeout=240,
-        )
-        list_output = console.run("veracrypt --text --list", timeout=120)
-        if "/dev/mapper/veracrypt" not in list_output:
-            raise TestError("container did not appear in veracrypt --list output")
-        console.run("veracrypt --text --unmount /tmp/openwrt-test.hc", timeout=180)
+            "/sbin/mount.veracrypt /tmp/openwrt-test.hc /mnt/veracrypt-test "
+            f"-o {quoted_helper_options}",
+        ):
+            console.run(mount_command, timeout=240)
+            list_output = console.run("veracrypt --text --list", timeout=120)
+            if "/dev/mapper/veracrypt" not in list_output:
+                raise TestError("container did not appear in veracrypt --list output")
+            console.run("veracrypt --text --unmount /tmp/openwrt-test.hc", timeout=180)
 
 
 def parse_args():
@@ -786,6 +793,8 @@ def parse_args():
 
 def main():
     args = parse_args()
+    if not args.skip_container and "," in args.password:
+        raise TestError("--password cannot contain commas: mount.veracrypt uses comma-separated options")
     args.ipk = args.ipk.resolve()
     if not args.ipk.exists():
         raise TestError(f"Package does not exist: {args.ipk}")