diff --git a/bin/netupgrade b/bin/netupgrade
index 6714ca2..17b15a5 100755
--- a/bin/netupgrade
+++ b/bin/netupgrade
@@ -289,15 +289,12 @@ runCmd() { # $1=host $2=name $3=cmd
 			fi
 		;;
 		apk)
-			if [ "${YES}" -eq 1 ]; then
-				YESARG="-y"
-			fi
 			echo "apk update" | tee -a "${LOGFILENAME}"
 			if ! runSSH "${HOST}" apk update | tee -a "${LOGFILENAME}"; then
 				ERROR=1
 			fi
-			echo "apk upgrade ${YESARG}" | tee -a "${LOGFILENAME}"
-			if ! runSSH "${HOST}" apk upgrade ${YESARG} | tee -a "${LOGFILENAME}"; then
+			echo "apk upgrade" | tee -a "${LOGFILENAME}"
+			if ! runSSH "${HOST}" apk upgrade | tee -a "${LOGFILENAME}"; then
 				ERROR=1
 			fi
 		;;
@@ -309,8 +306,8 @@ runCmd() { # $1=host $2=name $3=cmd
 		;;
 		docker-stacks)
 			echo "docker stacks update in ${CMDVAL}" | tee -a "${LOGFILENAME}"
-			if ! runSSH "${HOST}" sh -s -- "${CMDVAL}" <<'EOF' | tee -a "${LOGFILENAME}"
-stack_root="$1"
+			if ! ssh "${SSH_USER}@${HOST}" "STACK_ROOT=$(printf '%q' "${CMDVAL}") bash -s" <<'EOF' | tee -a "${LOGFILENAME}"
+stack_root="${STACK_ROOT}"
 
 for dir in "$stack_root"/*; do
 	[ -d "$dir" ] || continue
diff --git a/state.md b/state.md
index de6914d..7a6f5a0 100644
--- a/state.md
+++ b/state.md
@@ -119,13 +119,13 @@ Supported action types currently include:
 - SSH calls were centralized through a `runSSH` helper and `SSH_USER` is now configurable, defaulting to `root`
 - The `pacman` orphan cleanup now runs entirely on the remote host instead of evaluating orphan detection locally
 - The `pacman` orphan cleanup remote command now avoids nested `bash -lc` argument-passing issues by selecting between two simple remote `sh -c` commands, one with `--noconfirm` and one without
-- The `docker-stacks` action was rewritten to use a remote shell script with the stack directory passed as an argument
+- The `docker-stacks` action uses a remote shell script sent over SSH stdin, with the stack directory exported as a remote environment assignment before `bash -s`, to keep path handling working after recent SSH command-construction changes
 - Unknown actions and reboot SSH failures now propagate error status more consistently
 - A focused code review identified the next recommended work items and suggested splitting them into separate commits rather than combining them in one larger hardening change
 - `whiptail` checklist defaults are now passed explicitly as `ON`/`OFF`, and selected items are parsed through a dedicated helper instead of relying on raw shell word splitting
 - The CLI help and README now clarify that `-f` preselects all nodes in the interactive checklist
 - Log summary generation no longer uses `sed -i` interpolation; the script now writes a temporary file with the summary header plus the existing log content and replaces the original log atomically
-- The `apk` action now applies `-y` to `apk upgrade` when the CLI `-y` flag is set, making its behavior consistent with the documented intent for supported package managers
+- The `apk` action no longer passes `-y` to `apk upgrade`, because current Alpine `apk` does not accept that option there; `-y` remains a best-effort flag for other supported package managers
 - The `apt` action now uses `apt-get autoremove --purge` and no longer runs `apt-get purge` without arguments, which makes the cleanup step more meaningful and avoids a misleading command in the log
 - The `pacman` action was further hardened by simplifying orphan cleanup command construction, reducing quoting-related regressions while still skipping removal when no orphan packages are present