diff --git a/PUBLIC_SOURCE_EXPORT.md b/PUBLIC_SOURCE_EXPORT.md
index c119145..6f63664 100644
--- a/PUBLIC_SOURCE_EXPORT.md
+++ b/PUBLIC_SOURCE_EXPORT.md
@@ -1,3 +1,3 @@
 # Public source export
 
-This source snapshot was generated from the private canonical repository at revision `df9538cc820b70cece4f17eb9034739917560f96`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
+This source snapshot was generated from the private canonical repository at revision `d013be0be977c530311fae02934026709d8a952f`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
diff --git a/PUBLIC_SOURCE_MANIFEST.json b/PUBLIC_SOURCE_MANIFEST.json
index 63ad069..2b3460b 100644
--- a/PUBLIC_SOURCE_MANIFEST.json
+++ b/PUBLIC_SOURCE_MANIFEST.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sourceRevision": "df9538cc820b70cece4f17eb9034739917560f96",
+  "sourceRevision": "d013be0be977c530311fae02934026709d8a952f",
   "files": [
     {
       "path": ".dockerignore",
@@ -1619,8 +1619,8 @@
     },
     {
       "path": "backend/tests/test_runner_build_launcher_refresh.py",
-      "sha256": "cf05c9a595b126cdd140f1803c37913157104a9c5ef0c8295a258961ad413f97",
-      "bytes": 20307
+      "sha256": "887c1efb5a51e4c63eecd09a7927dfa4048e66a0dce4ceaf77b11f49f59eae5c",
+      "bytes": 22199
     },
     {
       "path": "backend/tests/test_runner_capacity_controller.py",
diff --git a/backend/tests/test_runner_build_launcher_refresh.py b/backend/tests/test_runner_build_launcher_refresh.py
index 004b6ff..5bbbc45 100644
--- a/backend/tests/test_runner_build_launcher_refresh.py
+++ b/backend/tests/test_runner_build_launcher_refresh.py
@@ -172,6 +172,12 @@ def launcher(monkeypatch, tmp_path):
     original = copy.deepcopy(containers["itworx-ci-build"])
 
     def docker(args, **_k):
+        if args[:2] == ["docker", "exec"]:
+            assert args == [
+                "docker", "exec", "-e", "DOCKER_HOST=" + module._DIND_DOCKER_HOST,
+                module.DIND_NAME, "docker", "ps", "-a", "-q",
+            ]
+            return ""
         if args[:3] == ["docker", "image", "inspect"]:
             return json.dumps([{"Id": args[-1]}])
         if args[:2] == ["docker", "inspect"]:
@@ -426,6 +432,43 @@ class Interrupted(BaseException):
     pass
 
 
+@pytest.mark.parametrize("operation", ["refresh", "recovery"])
+@pytest.mark.parametrize("inventory", ["stopped_container", "connection_failure"])
+def test_launcher_inventory_uses_trusted_socket_and_fails_closed(
+    launcher, monkeypatch, operation, inventory
+):
+    module, containers, rows, _, effects, _ = launcher
+    if operation == "recovery":
+        preflight = module._build_launcher_preflight("refresh")
+        module._apply_build_launcher("refresh", preflight["preflightSha256"])
+        receipt = module._build_launcher_receipt()
+        receipt["status"] = "created"
+        module._write_private_atomic(module._build_launcher_receipt_path(), module._canonical_bytes(receipt))
+    before = copy.deepcopy(containers), copy.deepcopy(rows)
+    effects.clear()
+    original = module._run
+
+    def inventory_result(args, **kwargs):
+        if args[:2] == ["docker", "exec"]:
+            assert args == [
+                "docker", "exec", "-e", "DOCKER_HOST=" + module._DIND_DOCKER_HOST,
+                module.DIND_NAME, "docker", "ps", "-a", "-q",
+            ]
+            if inventory == "connection_failure":
+                raise module.RunnerFleetSpecializeError("runner_fleet_specialization_command_failed")
+            return "f" * 64
+        return original(args, **kwargs)
+
+    monkeypatch.setattr(module, "_run", inventory_result)
+    with pytest.raises(module.RunnerFleetSpecializeError):
+        if operation == "recovery":
+            module._build_launcher_recovery_preflight()
+        else:
+            module._build_launcher_preflight("refresh")
+    assert effects == []
+    assert (containers, rows) == before
+
+
 @pytest.mark.parametrize(
     "point",
     ["backup", "prepared", "rename", "create", "created", "before_applied", "applied"],