diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ee028cd..75ee6da 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -136,7 +136,7 @@ jobs:
       - name: Smoke — boot alpine under confinement
         run: |
           set -euo pipefail
-          guest="$(timeout 10m ecrou run -q alpine -- uname -r | tail -n 1)"
+          guest="$(timeout 10m ecrou run --quiet alpine -- uname -r | tail -n 1)"
           host="$(uname -r)"
           echo "guest kernel: $guest / host kernel: $host"
           test -n "$guest" && test "$guest" != "$host"
@@ -151,6 +151,6 @@ jobs:
       - name: apt update && install fastfetch
         run: |
           set -euo pipefail
-          timeout 35m ecrou run -q -e DEBIAN_FRONTEND=noninteractive ubuntu -- \
+          timeout 35m ecrou run --quiet -e DEBIAN_FRONTEND=noninteractive ubuntu -- \
             "apt update && apt install -y fastfetch && fastfetch" | tee /tmp/e2e.log
           grep -E "^OS:" /tmp/e2e.log
diff --git a/SPEC.md b/SPEC.md
index 6d391ca..7fadc74 100644
--- a/SPEC.md
+++ b/SPEC.md
@@ -269,7 +269,7 @@ stop:
   with shares: zero hits. This test is the founding rule.
 - **T7, guest network.** An https fetch from the guest succeeds, DNS
   included; a published port is reachable from the host.
-- **T8, snap e2e.** CI builds the snap and runs `ecrou run -q -e
+- **T8, snap e2e.** CI builds the snap and runs `ecrou run --quiet -e
   DEBIAN_FRONTEND=noninteractive ubuntu -- "apt update && apt install
   -y fastfetch && fastfetch"` inside it: strict confinement, KVM
   through the plug, the staged e2fsprogs, apt across the TSI proxy,