diff --git a/pkg/cidata/cidata.TEMPLATE.d/boot.Linux/05-lima-mounts.sh b/pkg/cidata/cidata.TEMPLATE.d/boot.Linux/05-lima-mounts.sh
index b6fee307..5ddd8a8f 100755
--- a/pkg/cidata/cidata.TEMPLATE.d/boot.Linux/05-lima-mounts.sh
+++ b/pkg/cidata/cidata.TEMPLATE.d/boot.Linux/05-lima-mounts.sh
@@ -18,7 +18,7 @@ fi
 # https://github.com/abiosoft/colima/issues/1471
 if grep -q virtiofs /etc/fstab; then
 	escape_fstab.sh </etc/fstab >/etc/fstab.lima.tmp &&
-		cat /etc/fstab.lima.tmp >/etc/fstab && rm -f /etc/fstab.lima.tmp
+		cp /etc/fstab.lima.tmp /etc/fstab && rm -f /etc/fstab.lima.tmp
 	# Mount entries cc_mounts skipped due to the previously broken line (already-mounted ones
 	# are a no-op). On Oracle Linux the virtiofs module is installed later in
 	# 30-install-packages.sh (REMOUNT_VIRTIOFS=1 remounts then), so tolerate failure here.
diff --git a/pkg/cidata/cidata.TEMPLATE.d/util/unescape_fstab.sh b/pkg/cidata/cidata.TEMPLATE.d/util/unescape_fstab.sh
index 05e97131..9807a4e3 100755
--- a/pkg/cidata/cidata.TEMPLATE.d/util/unescape_fstab.sh
+++ b/pkg/cidata/cidata.TEMPLATE.d/util/unescape_fstab.sh
@@ -6,7 +6,12 @@
 # Read a string on stdin and write it to stdout with the octal escapes used in
 # /etc/fstab and /proc/mounts decoded to their literal characters:
 # "\040" -> space, "\011" -> tab, "\012" -> newline, "\134" -> backslash,
-# "\043" -> "#". The inverse of util/escape_fstab.sh.
+# "\043" -> "#".
+#
+# This decodes the full set of escapes the kernel emits in /proc/mounts and that
+# mount(8) reads from /etc/fstab -- a superset of what util/escape_fstab.sh
+# produces (only \040, \011 and \134). It round-trips that script's output
+# (unescape(escape(x)) == x) but is not its exact inverse.
 # https://github.com/torvalds/linux/blob/v6.6/fs/proc_namespace.c#L89
 
 set -eu