diff --git a/core/core.func b/core/core.func
index d221067..22285ce 100644
--- a/core/core.func
+++ b/core/core.func
@@ -2418,7 +2418,9 @@ apt_update_safe() {
 # with it. APT_CONFIG is read after apt.conf.d and dies with the process, so an
 # early exit cannot leave a drop-in behind.
 _cs_conffile_list() {
-  find "${_CS_CONFFILE_ROOT:-/etc}" -maxdepth 6 \( -name '*.dpkg-dist' -o -name '*.dpkg-new' \) 2>/dev/null | sort
+  # 2>/dev/null hides find's message about an unreadable /etc/credstore, not its
+  # exit status, which pipefail then passes on as if sort had failed.
+  { find "${_CS_CONFFILE_ROOT:-/etc}" -maxdepth 6 \( -name '*.dpkg-dist' -o -name '*.dpkg-new' \) 2>/dev/null || true; } | sort
 }
 
 apt_conffile_guard() {
diff --git a/lib/runtime.func b/lib/runtime.func
index e1080c1..f6b72a5 100644
--- a/lib/runtime.func
+++ b/lib/runtime.func
@@ -1954,7 +1954,8 @@ get_php_fpm_socket() {
     echo "/run/php/php${PHP_VERSION}-fpm.sock"
     return 0
   fi
-  sock=$(find /run/php -maxdepth 1 -name "php*-fpm.sock" -type s 2>/dev/null | sort -V | tail -1)
+  # Unguarded, a missing /run/php aborts the caller before the message below.
+  sock=$({ find /run/php -maxdepth 1 -name "php*-fpm.sock" -type s 2>/dev/null || true; } | sort -V | tail -1)
   if [[ -z "$sock" ]]; then
     msg_error "No active PHP-FPM socket found under /run/php"
     return 1
diff --git a/pve/vm-app.func b/pve/vm-app.func
index 11ee8cc..b1464fb 100644
--- a/pve/vm-app.func
+++ b/pve/vm-app.func
@@ -55,7 +55,7 @@ list_available_apps() {
     find /tmp/proxmoxved-repo/install -name '*-install.sh' -printf '%f\n' |
       grep -vE "$exclude_pattern" |
       sed 's/-install\.sh$//' |
-      sort
+      sort || true
     return 0
   fi
 
@@ -70,7 +70,7 @@ list_available_apps() {
       grep -E '^[a-z0-9_-]+-install\.sh$' |
       grep -vE "$exclude_pattern" |
       sed 's/-install\.sh$//' |
-      sort
+      sort || true
     return 0
   fi
 
@@ -84,7 +84,7 @@ list_available_apps() {
       grep -E '^[a-z0-9_-]+-install\.sh$' |
       grep -vE "$exclude_pattern" |
       sed 's/-install\.sh$//' |
-      sort
+      sort || true
     return 0
   fi