diff --git a/roles/sys-ctl-hlth-runtime/README.md b/roles/sys-ctl-hlth-runtime/README.md
index f0721cbfda..f6125fa4ee 100644
--- a/roles/sys-ctl-hlth-runtime/README.md
+++ b/roles/sys-ctl-hlth-runtime/README.md
@@ -6,7 +6,7 @@ This role checks the language runtime inside every running Docker container. It
 
 ## Overview
 
-The role installs a check script with a `systemd` service and timer. The check fails, and the failure notifier from [`sys-ctl-alm-compose`](../sys-ctl-alm-compose/README.md) alerts, when a container runs PHP below the security floor of its release line or on an end-of-life line, or when a service that declares `php_hardening` in its `meta/volumes.yml` still reports `expose_php` or `session.upload_progress.enabled` as on. The floors live in `HEALTH_RUNTIME_FLOORS` in [main.yml](./vars/main.yml).
+The role installs a check script with a `systemd` service and timer. The check fails, and the failure notifier from [`sys-ctl-alm-compose`](../sys-ctl-alm-compose/README.md) alerts, when a container runs PHP below the security floor of its release line or on an end-of-life line, or when a service that declares `php_hardening` in its `meta/volumes.yml` still reports `expose_php` or `session.upload_progress.enabled` as on. The floors, the lowest patched release of each `major.minor` line, live in `HEALTH_RUNTIME_FLOORS` in [main.yml](./vars/main.yml).
 
 ## Cosmos
 
diff --git a/roles/sys-ctl-hlth-runtime/TODO.md b/roles/sys-ctl-hlth-runtime/TODO.md
index a249b5e35e..52d1d825ad 100644
--- a/roles/sys-ctl-hlth-runtime/TODO.md
+++ b/roles/sys-ctl-hlth-runtime/TODO.md
@@ -1,6 +1,6 @@
 # To-dos
 
 - Extend `HEALTH_RUNTIME_FLOORS`, the container probe and `make security-runtimes` to `node`, `python`, `ruby` and `java`.
-- Verify the web SAPI where an image splits it from the CLI. `web-app-lam` mounts the hardening ini into `/etc/php/8.4/apache2/conf.d`, which the Debian CLI does not scan, so `php` in that container reads the CLI configuration instead of the one Apache loads.
+- Verify the web SAPI where an image splits it from the CLI. `web-app-lam` mounts the hardening ini into both `/etc/php/8.4/apache2/conf.d` and `/etc/php/8.4/cli/conf.d`, and the probe reads only the CLI copy, so a wrong Apache target would still pass.
 - Run `make security-runtimes` in a scheduled CI workflow.
 - Scan the pinned images for CVEs (Trivy or Grype) in the scheduled CI and report new criticals as issues.
diff --git a/roles/sys-ctl-hlth-runtime/vars/main.yml b/roles/sys-ctl-hlth-runtime/vars/main.yml
index 90c7f0fc1c..c0ca639b9c 100644
--- a/roles/sys-ctl-hlth-runtime/vars/main.yml
+++ b/roles/sys-ctl-hlth-runtime/vars/main.yml
@@ -1,6 +1,5 @@
 ---
 system_service_id: sys-ctl-hlth-runtime
-# Lowest patched release per runtime line; a line older than every listed one is end of life
 HEALTH_RUNTIME_FLOORS:
   php:
     "8.2": "8.2.35"
diff --git a/roles/web-app-lam/meta/volumes.yml b/roles/web-app-lam/meta/volumes.yml
index 15633aec53..a974fe8c68 100644
--- a/roles/web-app-lam/meta/volumes.yml
+++ b/roles/web-app-lam/meta/volumes.yml
@@ -6,3 +6,5 @@ php_hardening:
   mounts:
     - service: lam
       target: /etc/php/8.4/apache2/conf.d/zz-infinito-hardening.ini
+    - service: lam
+      target: /etc/php/8.4/cli/conf.d/zz-infinito-hardening.ini
diff --git a/tests/unit/python/utils/docker/test_image_runtime.py b/tests/unit/python/utils/docker/test_image_runtime.py
index 150bb040d8..077659ce38 100644
--- a/tests/unit/python/utils/docker/test_image_runtime.py
+++ b/tests/unit/python/utils/docker/test_image_runtime.py
@@ -66,6 +66,20 @@ class TestPhpRuntime(TestCase):
             )
         )
 
+    def test_apk_options_before_add_still_name_the_line(self):
+        self.assertEqual(
+            runtime.php_runtime(["RUN apk --no-cache add php7 php7-fpm"]),
+            _php(lines=["7"]),
+        )
+
+    def test_apk_in_a_path_or_comment_is_no_package_install(self):
+        for instruction in (
+            "RUN rm -rf /var/cache/apk/* && cp php7 /srv/add",
+            "RUN echo php7 # apk cache: add nothing",
+        ):
+            with self.subTest(instruction=instruction):
+                self.assertIsNone(runtime.php_runtime([instruction]))
+
     def test_a_pinned_alpine_package_names_its_line(self):
         found = runtime.php_runtime(["RUN apk add --no-cache php84=8.4.27-r0 nginx;"])
         self.assertEqual(found, _php(lines=["8.4"]))
diff --git a/utils/docker/image/runtime.py b/utils/docker/image/runtime.py
index b582f7761e..e776388426 100644
--- a/utils/docker/image/runtime.py
+++ b/utils/docker/image/runtime.py
@@ -21,7 +21,7 @@ USER_AGENT = "infinito-nexus-runtime-report"
 PHP_VERSION_PATTERN = re.compile(r"\bPHP_VERSION=([0-9][^\s\"';]*)")
 PHP_BASE_PATTERN = re.compile(r"\bPHP_BASE=(\d+\.\d+)(?![\d.])")
 PACKAGE_INSTALL_PATTERN = re.compile(
-    r"\b(?:apk\s+add|(?:apt-get|apt|dnf|microdnf|yum)\s+(?:-\S+\s+)*install)\b"
+    r"\b(?:apk\s+(?:-\S+\s+)*add|(?:apt-get|apt|dnf|microdnf|yum)\s+(?:-\S+\s+)*install)\b"
 )
 PHP_PACKAGE_PATTERN = re.compile(
     r"(?<!\S)(?:[\w.+]+-)*php(\d)(?:\.?(\d))?(?:-[\w.+-]+)?(?:=\S*?)?(?=[;&|\\]*(?:\s|$))"