diff --git a/setup/scripts/interview b/setup/scripts/interview
index f604432..a9cebcf 100755
--- a/setup/scripts/interview
+++ b/setup/scripts/interview
@@ -122,7 +122,12 @@ if [[ -n "$nvidia_card" ]]; then
                     fi
                     second="$(gum input --password --header "MOK password again")"
                     if [[ "$first" == "$second" ]]; then
-                        mok_hash="$(mokutil --generate-hash="$first")"
+                        # Fed on stdin, never as an argument: an argument sits
+                        # in /proc/<pid>/cmdline for any local process to read
+                        # while mokutil runs. mokutil prints its two prompts on
+                        # stdout too, so the hash is the last line.
+                        mok_hash="$(printf '%s\n%s\n' "$first" "$first" \
+                            | mokutil --generate-hash | tail -n 1)"
                         break
                     fi
                     printf 'Those did not match.\n'