diff --git a/incus/backend.func b/incus/backend.func
index c51e0c6..86353dd 100644
--- a/incus/backend.func
+++ b/incus/backend.func
@@ -1063,12 +1063,14 @@ INNEREOF" >>"${LOGFILE:-$INCUS_BUILD_LOG}" 2>&1 || { msg_error "Failed to push f
   # reported as a success against an empty container.
   set +Eeuo pipefail
   trap - ERR
+  # stdin from /dev/null: without a pty `read -p` prints no prompt at all, so a
+  # script that asks a question waited on input nobody could see or answer.
   # The trailing touch is a completion sentinel: all 552 install scripts run to
   # cleanup_lxc/customize and none exits early, so the marker appears if and
   # only if the script reached its end.
   incus exec "${CT_NAME}" -- bash -c "${_run_env}
 ${_install_script}
-touch /root/.install-${SESSION_ID}.done" 2>&1 |
+touch /root/.install-${SESSION_ID}.done" </dev/null 2>&1 |
     tee >(sed -u 's/.*\r//' >>"${LOGFILE:-$INCUS_BUILD_LOG}")
   # PIPESTATUS, not $?: the line above turns pipefail off, so $? is tee's
   # status - always 0. Every non-zero exit from the container was discarded