diff --git a/bin/disinto b/bin/disinto
index bbe6d43..5487d75 100755
--- a/bin/disinto
+++ b/bin/disinto
@@ -1226,13 +1226,14 @@ disinto_up() {
   if [ -f "$enc_file" ] && command -v sops &>/dev/null && [ ! -f "$env_file" ]; then
     tmp_env="${env_file}"
     sops -d --output-type dotenv "$enc_file" > "$tmp_env"
+    trap '[ -n "${tmp_env:-}" ] && rm -f "$tmp_env"' EXIT
     echo "Decrypted secrets for compose"
   fi
 
   docker compose -f "$compose_file" up -d "$@"
   echo "Stack is up"
 
-  # Clean up temp .env
+  # Clean up temp .env (also handled by EXIT trap if compose fails)
   if [ -n "$tmp_env" ] && [ -f "$tmp_env" ]; then
     rm -f "$tmp_env"
     echo "Removed temporary .env"
diff --git a/docker/agents/Dockerfile b/docker/agents/Dockerfile
index 2dc8a22..18cc7f2 100644
--- a/docker/agents/Dockerfile
+++ b/docker/agents/Dockerfile
@@ -4,9 +4,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     bash curl git jq tmux cron python3 openssh-client ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
-# Claude CLI
+# Claude CLI — install and verify
 RUN curl -fsSL https://cli.anthropic.com/install.sh | sh \
-    && mv /root/.claude/local/claude /usr/local/bin/claude || true
+    && cp "$(find /root -name claude -type f 2>/dev/null | head -1)" /usr/local/bin/claude \
+    && claude --version
 
 # Non-root user
 RUN useradd -m -u 1000 -s /bin/bash agent