diff --git a/template/Prepare-WinBuild2022.ps1 b/template/Prepare-WinBuild2022.ps1
index d599865..5105d97 100644
--- a/template/Prepare-WinBuild2022.ps1
+++ b/template/Prepare-WinBuild2022.ps1
@@ -289,28 +289,35 @@ else {
 $sessionOptions = New-PSSessionOption -SkipCACheck -SkipCNCheck
 
 # ── Configure HOST-side WinRM client (TrustedHosts for HTTPS Basic auth) ──────
-# HTTPS/5986 does not require AllowUnencrypted on the host side. Only TrustedHosts
-# needs appending so PS accepts the non-domain VM. Restored in the finally block.
+# Windows only: TrustedHosts must include the VM IP so PS accepts the non-domain
+# VM over HTTPS. On Linux, New-PSSession uses OMI and -SkipCACheck/-SkipCNCheck
+# in sessionOptions are sufficient — TrustedHosts does not apply.
 $prevTrustedHosts = $null
-try {
-    $prevTrustedHosts = (Get-Item WSMan:\localhost\Client\TrustedHosts -ErrorAction Stop).Value
-    # Add VM IP to TrustedHosts if not already present
-    if ($prevTrustedHosts -ne '*' -and $prevTrustedHosts -notlike "*$VMIPAddress*") {
-        $newTrusted = if ($prevTrustedHosts -eq '') { $VMIPAddress } else { "$prevTrustedHosts,$VMIPAddress" }
-        Set-Item WSMan:\localhost\Client\TrustedHosts -Value $newTrusted -Force -ErrorAction Stop
+$isLinuxHost = ($null -ne $IsWindows -and $IsWindows -eq $false)
+if (-not $isLinuxHost) {
+    try {
+        $prevTrustedHosts = (Get-Item WSMan:\localhost\Client\TrustedHosts -ErrorAction Stop).Value
+        # Add VM IP to TrustedHosts if not already present
+        if ($prevTrustedHosts -ne '*' -and $prevTrustedHosts -notlike "*$VMIPAddress*") {
+            $newTrusted = if ($prevTrustedHosts -eq '') { $VMIPAddress } else { "$prevTrustedHosts,$VMIPAddress" }
+            Set-Item WSMan:\localhost\Client\TrustedHosts -Value $newTrusted -Force -ErrorAction Stop
+        }
+        Write-Host "[Prepare] Host TrustedHosts configured."
+        Assert-Step 'HostWinRM' "TrustedHosts includes $VMIPAddress (or '*')" {
+            $th = (Get-Item WSMan:\localhost\Client\TrustedHosts).Value
+            $th -eq '*' -or $th -like "*$VMIPAddress*"
+        }
     }
-    Write-Host "[Prepare] Host TrustedHosts configured."
-    Assert-Step 'HostWinRM' "TrustedHosts includes $VMIPAddress (or '*')" {
-        $th = (Get-Item WSMan:\localhost\Client\TrustedHosts).Value
-        $th -eq '*' -or $th -like "*$VMIPAddress*"
+    catch {
+        Write-Warning "[Prepare] Could not configure host WinRM TrustedHosts (need elevation?)."
+        Write-Warning "Run once in an elevated PowerShell on the HOST:"
+        Write-Warning "  Set-Item WSMan:\localhost\Client\TrustedHosts -Value '*' -Force"
+        Write-Warning "Then re-run this script."
+        exit 1
     }
 }
-catch {
-    Write-Warning "[Prepare] Could not configure host WinRM TrustedHosts (need elevation?)."
-    Write-Warning "Run once in an elevated PowerShell on the HOST:"
-    Write-Warning "  Set-Item WSMan:\localhost\Client\TrustedHosts -Value '*' -Force"
-    Write-Warning "Then re-run this script."
-    exit 1
+else {
+    Write-Host "[Prepare] Linux host — TrustedHosts not applicable, skipping."
 }
 
 
@@ -755,11 +762,11 @@ try {
 finally {
     Remove-PSSession $session -ErrorAction SilentlyContinue
 
-    # Restore host TrustedHosts to its original value
-    if ($null -ne $prevTrustedHosts) {
+    # Restore host TrustedHosts to its original value (Windows only)
+    if (-not $isLinuxHost -and $null -ne $prevTrustedHosts) {
         Set-Item WSMan:\localhost\Client\TrustedHosts -Value $prevTrustedHosts -Force -ErrorAction SilentlyContinue
+        Write-Host "[Prepare] Host TrustedHosts restored."
     }
-    Write-Host "[Prepare] Host TrustedHosts restored."
 }
 
 
diff --git a/template/Prepare-WinBuild2025.ps1 b/template/Prepare-WinBuild2025.ps1
index d653143..03956d0 100644
--- a/template/Prepare-WinBuild2025.ps1
+++ b/template/Prepare-WinBuild2025.ps1
@@ -289,28 +289,35 @@ else {
 $sessionOptions = New-PSSessionOption -SkipCACheck -SkipCNCheck
 
 # ── Configure HOST-side WinRM client (TrustedHosts for HTTPS Basic auth) ──────
-# HTTPS/5986 does not require AllowUnencrypted on the host side. Only TrustedHosts
-# needs appending so PS accepts the non-domain VM. Restored in the finally block.
+# Windows only: TrustedHosts must include the VM IP so PS accepts the non-domain
+# VM over HTTPS. On Linux, New-PSSession uses OMI and -SkipCACheck/-SkipCNCheck
+# in sessionOptions are sufficient — TrustedHosts does not apply.
 $prevTrustedHosts = $null
-try {
-    $prevTrustedHosts = (Get-Item WSMan:\localhost\Client\TrustedHosts -ErrorAction Stop).Value
-    # Add VM IP to TrustedHosts if not already present
-    if ($prevTrustedHosts -ne '*' -and $prevTrustedHosts -notlike "*$VMIPAddress*") {
-        $newTrusted = if ($prevTrustedHosts -eq '') { $VMIPAddress } else { "$prevTrustedHosts,$VMIPAddress" }
-        Set-Item WSMan:\localhost\Client\TrustedHosts -Value $newTrusted -Force -ErrorAction Stop
+$isLinuxHost = ($null -ne $IsWindows -and $IsWindows -eq $false)
+if (-not $isLinuxHost) {
+    try {
+        $prevTrustedHosts = (Get-Item WSMan:\localhost\Client\TrustedHosts -ErrorAction Stop).Value
+        # Add VM IP to TrustedHosts if not already present
+        if ($prevTrustedHosts -ne '*' -and $prevTrustedHosts -notlike "*$VMIPAddress*") {
+            $newTrusted = if ($prevTrustedHosts -eq '') { $VMIPAddress } else { "$prevTrustedHosts,$VMIPAddress" }
+            Set-Item WSMan:\localhost\Client\TrustedHosts -Value $newTrusted -Force -ErrorAction Stop
+        }
+        Write-Host "[Prepare] Host TrustedHosts configured."
+        Assert-Step 'HostWinRM' "TrustedHosts includes $VMIPAddress (or '*')" {
+            $th = (Get-Item WSMan:\localhost\Client\TrustedHosts).Value
+            $th -eq '*' -or $th -like "*$VMIPAddress*"
+        }
     }
-    Write-Host "[Prepare] Host TrustedHosts configured."
-    Assert-Step 'HostWinRM' "TrustedHosts includes $VMIPAddress (or '*')" {
-        $th = (Get-Item WSMan:\localhost\Client\TrustedHosts).Value
-        $th -eq '*' -or $th -like "*$VMIPAddress*"
+    catch {
+        Write-Warning "[Prepare] Could not configure host WinRM TrustedHosts (need elevation?)."
+        Write-Warning "Run once in an elevated PowerShell on the HOST:"
+        Write-Warning "  Set-Item WSMan:\localhost\Client\TrustedHosts -Value '*' -Force"
+        Write-Warning "Then re-run this script."
+        exit 1
     }
 }
-catch {
-    Write-Warning "[Prepare] Could not configure host WinRM TrustedHosts (need elevation?)."
-    Write-Warning "Run once in an elevated PowerShell on the HOST:"
-    Write-Warning "  Set-Item WSMan:\localhost\Client\TrustedHosts -Value '*' -Force"
-    Write-Warning "Then re-run this script."
-    exit 1
+else {
+    Write-Host "[Prepare] Linux host — TrustedHosts not applicable, skipping."
 }
 
 
@@ -759,11 +766,11 @@ try {
 finally {
     Remove-PSSession $session -ErrorAction SilentlyContinue
 
-    # Restore host TrustedHosts to its original value
-    if ($null -ne $prevTrustedHosts) {
+    # Restore host TrustedHosts to its original value (Windows only)
+    if (-not $isLinuxHost -and $null -ne $prevTrustedHosts) {
         Set-Item WSMan:\localhost\Client\TrustedHosts -Value $prevTrustedHosts -Force -ErrorAction SilentlyContinue
+        Write-Host "[Prepare] Host TrustedHosts restored."
     }
-    Write-Host "[Prepare] Host TrustedHosts restored."
 }