diff --git a/deploy/bootstrap.sh b/deploy/bootstrap.sh
index 2e4c4bb..1f7ce48 100644
--- a/deploy/bootstrap.sh
+++ b/deploy/bootstrap.sh
@@ -3721,7 +3721,8 @@ check_postgres_major() {
   want="$(postgres_image_major)"
   [ -n "$want" ] || die "cannot read a PostgreSQL major version from ${POSTGRES_IMAGE}"
   [ -f "${PG_DATA_DIR}/${want}/docker/PG_VERSION" ] && return 0
-  found="$(cat "$PG_DATA_DIR"/*/docker/PG_VERSION 2>/dev/null | tr -d '[:space:]')"
+  # A fresh host has no cluster: the glob matches nothing and cat fails the pipeline.
+  found="$(cat "$PG_DATA_DIR"/*/docker/PG_VERSION 2>/dev/null | tr -d '[:space:]')" || true
   [ -z "$found" ] && return 0
   die "this release runs PostgreSQL ${want}, but ${PG_DATA_DIR} holds a PostgreSQL ${found} cluster.
   PostgreSQL ${want} would start an empty cluster beside it. A new major version is a dump
diff --git a/deploy/bootstrap_test.sh b/deploy/bootstrap_test.sh
index a72b3ce..ecf461a 100644
--- a/deploy/bootstrap_test.sh
+++ b/deploy/bootstrap_test.sh
@@ -2921,7 +2921,9 @@ run_major() { # data-dir
     die() { printf "DIE: %s\n" "$*"; exit 1; }
     '"$(bsfn postgres_image_major)"'
     '"$(bsfn check_postgres_major)"'
-    check_postgres_major && echo STARTS' 2>&1
+    # A plain statement, as main calls it: on the left of && errexit is off inside the function.
+    check_postgres_major
+    echo STARTS' 2>&1
 }
 pmdir="$(mktemp -d)"
 expect "an empty data directory starts" "STARTS" "$(run_major "$pmdir")"
@@ -3155,7 +3157,8 @@ run_compare() { # host pod [pod-exit]
     host_pg_counts() { printf "%s\n" "$H"; }
     pod_pg_counts() { printf "%s\n" "$P"; return "$PX"; }
     '"$(bsfn compare_pg_counts)"'
-    compare_pg_counts && echo SAME' 2>&1
+    compare_pg_counts
+    echo SAME' 2>&1
 }
 counts="audit_logs 505${nl}servers 3${nl}users 17"
 expect "the same rows in every table pass" "SAME" "$(run_compare "$counts" "$counts")"