diff --git a/scripts/extract-artifacts.sh b/scripts/extract-artifacts.sh
index 44d1aac..1c5459e 100755
--- a/scripts/extract-artifacts.sh
+++ b/scripts/extract-artifacts.sh
@@ -138,7 +138,10 @@ if ! getfattr -h -n security.selinux "$WORK/root/usr/bin/bash" >/dev/null 2>&1;
     echo "       An enforcing boot would deny login. Check guestfish/tar xattr flags." >&2
     exit 1
 fi
-echo "==> SELinux labels preserved (bash: $(getfattr -h --only-values -n security.selinux "$WORK/root/usr/bin/bash" 2>/dev/null))"
+# tr -d '\0': SELinux xattr values are NUL-terminated; without stripping it bash
+# warns "ignored null byte in input" on the command substitution (cosmetic only —
+# the label check above already passed).
+echo "==> SELinux labels preserved (bash: $(getfattr -h --only-values -n security.selinux "$WORK/root/usr/bin/bash" 2>/dev/null | tr -d '\0'))"
 
 echo "==> Building reproducible erofs image"
 # UNCOMPRESSED on purpose: the target Rocky 9 kernel's erofs is built without