diff --git a/crates/integration-tests/src/lib.rs b/crates/integration-tests/src/lib.rs
index ee3a8db..f2fd930 100644
--- a/crates/integration-tests/src/lib.rs
+++ b/crates/integration-tests/src/lib.rs
@@ -66,8 +66,9 @@ pub static PARAMETERIZED_INTEGRATION_TESTS: [ParameterizedIntegrationTest];
 ///
 /// ```ignore
 /// fn test_basic_functionality() -> Result<()> {
-///     let output = run_bcvk(&["some", "args"])?;
-///     output.assert_success("test");
+///     let sh = shell()?;
+///     let bck = get_bck_command()?;
+///     cmd!(sh, "{bck} some args").run()?;
 ///     Ok(())
 /// }
 /// integration_test!(test_basic_functionality);
@@ -91,8 +92,9 @@ macro_rules! integration_test {
 ///
 /// ```ignore
 /// fn test_with_image(image: &str) -> Result<()> {
-///     let output = run_bcvk(&["command", image])?;
-///     output.assert_success("test");
+///     let sh = shell()?;
+///     let bck = get_bck_command()?;
+///     cmd!(sh, "{bck} command {image}").run()?;
 ///     Ok(())
 /// }
 /// parameterized_integration_test!(test_with_image);
diff --git a/crates/integration-tests/src/main.rs b/crates/integration-tests/src/main.rs
index 9c71461..c8c9b82 100644
--- a/crates/integration-tests/src/main.rs
+++ b/crates/integration-tests/src/main.rs
@@ -1,8 +1,9 @@
 //! Integration tests for bcvk
 
-use camino::Utf8Path;
 use std::process::Output;
 
+use camino::Utf8Path;
+
 use color_eyre::eyre::{eyre, Context};
 use color_eyre::Result;
 use libtest_mimic::{Arguments, Trial};
@@ -26,6 +27,11 @@ mod tests {
     pub mod to_disk;
 }
 
+/// Create a new xshell Shell for running commands
+pub(crate) fn shell() -> Result<Shell> {
+    Shell::new().map_err(|e| eyre!("Failed to create shell: {}", e))
+}
+
 /// Get the path to the bcvk binary, checking BCVK_PATH env var first, then falling back to "bcvk"
 pub(crate) fn get_bck_command() -> Result<String> {
     if let Some(path) = std::env::var("BCVK_PATH").ok() {
@@ -97,16 +103,6 @@ impl CapturedOutput {
         }
     }
 
-    /// Assert that the command succeeded, printing debug info on failure
-    pub fn assert_success(&self, context: &str) {
-        assert!(
-            self.output.status.success(),
-            "{} failed: {}",
-            context,
-            self.stderr
-        );
-    }
-
     /// Get the exit code
     pub fn exit_code(&self) -> Option<i32> {
         self.output.status.code()
@@ -118,47 +114,16 @@ impl CapturedOutput {
     }
 }
 
-/// Run a command, capturing output
-pub(crate) fn run_command(program: &str, args: &[&str]) -> std::io::Result<CapturedOutput> {
-    let output = std::process::Command::new(program).args(args).output()?;
-    Ok(CapturedOutput::new(output))
-}
-
-/// Run the bcvk command, capturing output
-pub(crate) fn run_bcvk(args: &[&str]) -> std::io::Result<CapturedOutput> {
-    let bck = get_bck_command().expect("Failed to get bcvk command");
-    run_command(&bck, args)
-}
-
-/// Run the bcvk command with inherited stdout/stderr (no capture)
-/// Use this when you just need to verify the command succeeded without checking output
-pub(crate) fn run_bcvk_nocapture(args: &[&str]) -> std::io::Result<()> {
-    let bck = get_bck_command().expect("Failed to get bcvk command");
-    let status = std::process::Command::new(&bck).args(args).status()?;
-    assert!(
-        status.success(),
-        "bcvk command failed with args: {:?}",
-        args
-    );
-    Ok(())
-}
-
 fn test_images_list() -> Result<()> {
     println!("Running test: bcvk images list --json");
 
-    let sh = Shell::new()?;
+    let sh = shell()?;
     let bck = get_bck_command()?;
 
     // Run the bcvk images list command with JSON output
-    let output = cmd!(sh, "{bck} images list --json").output()?;
-
-    if !output.status.success() {
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        return Err(eyre!("Failed to run 'bcvk images list --json': {}", stderr));
-    }
+    let stdout = cmd!(sh, "{bck} images list --json").read()?;
 
     // Parse the JSON output
-    let stdout = String::from_utf8(output.stdout)?;
     let images: Value = serde_json::from_str(&stdout).context("Failed to parse JSON output")?;
 
     // Verify the structure and content of the JSON
diff --git a/crates/integration-tests/src/tests/libvirt_base_disks.rs b/crates/integration-tests/src/tests/libvirt_base_disks.rs
index f8e65a0..f8a4e89 100644
--- a/crates/integration-tests/src/tests/libvirt_base_disks.rs
+++ b/crates/integration-tests/src/tests/libvirt_base_disks.rs
@@ -8,14 +8,16 @@
 
 use color_eyre::Result;
 use integration_tests::integration_test;
+use xshell::cmd;
 
 use regex::Regex;
-use std::process::Command;
 
-use crate::{get_bck_command, get_test_image, run_bcvk};
+use crate::{get_bck_command, get_test_image, shell};
 
 /// Test that base disk is created and reused for multiple VMs
 fn test_base_disk_creation_and_reuse() -> Result<()> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
     let test_image = get_test_image();
 
     // Generate unique names for test VMs
@@ -36,95 +38,84 @@ fn test_base_disk_creation_and_reuse() -> Result<()> {
 
     // Create first VM - this should create a new base disk
     println!("Creating first VM (should create base disk)...");
-    let vm1_output = run_bcvk(&[
-        "libvirt",
-        "run",
-        "--name",
-        &vm1_name,
-        "--filesystem",
-        "ext4",
-        &test_image,
-    ])?;
-
-    println!("VM1 stdout: {}", vm1_output.stdout);
-    println!("VM1 stderr: {}", vm1_output.stderr);
-
-    if !vm1_output.success() {
+    let vm1_output = cmd!(
+        sh,
+        "{bck} libvirt run --name {vm1_name} --filesystem ext4 {test_image}"
+    )
+    .ignore_status()
+    .output()?;
+
+    let vm1_stdout = String::from_utf8_lossy(&vm1_output.stdout);
+    let vm1_stderr = String::from_utf8_lossy(&vm1_output.stderr);
+
+    println!("VM1 stdout: {}", vm1_stdout);
+    println!("VM1 stderr: {}", vm1_stderr);
+
+    if !vm1_output.status.success() {
         cleanup_domain(&vm1_name);
         cleanup_domain(&vm2_name);
 
-        panic!("Failed to create first VM: {}", vm1_output.stderr);
+        panic!("Failed to create first VM: {}", vm1_stderr);
     }
 
     // Verify base disk was created
     assert!(
-        vm1_output.stdout.contains("Using base disk") || vm1_output.stdout.contains("base disk"),
+        vm1_stdout.contains("Using base disk") || vm1_stdout.contains("base disk"),
         "Should mention base disk creation"
     );
 
     // Create second VM - this should reuse the base disk
     println!("Creating second VM (should reuse base disk)...");
-    let vm2_output = run_bcvk(&[
-        "libvirt",
-        "run",
-        "--name",
-        &vm2_name,
-        "--filesystem",
-        "ext4",
-        &test_image,
-    ])?;
-
-    println!("VM2 stdout: {}", vm2_output.stdout);
-    println!("VM2 stderr: {}", vm2_output.stderr);
+    let vm2_output = cmd!(
+        sh,
+        "{bck} libvirt run --name {vm2_name} --filesystem ext4 {test_image}"
+    )
+    .ignore_status()
+    .output()?;
+
+    let vm2_stdout = String::from_utf8_lossy(&vm2_output.stdout);
+    let vm2_stderr = String::from_utf8_lossy(&vm2_output.stderr);
+
+    println!("VM2 stdout: {}", vm2_stdout);
+    println!("VM2 stderr: {}", vm2_stderr);
 
     // Cleanup before assertions
     cleanup_domain(&vm1_name);
     cleanup_domain(&vm2_name);
 
-    if !vm2_output.success() {
-        panic!("Failed to create second VM: {}", vm2_output.stderr);
+    if !vm2_output.status.success() {
+        panic!("Failed to create second VM: {}", vm2_stderr);
     }
 
     // Verify base disk was reused (should be faster and mention using existing)
     assert!(
-        vm2_output.stdout.contains("Using base disk") || vm2_output.stdout.contains("base disk"),
+        vm2_stdout.contains("Using base disk") || vm2_stdout.contains("base disk"),
         "Should mention using base disk"
     );
 
     // Test base-disks list shows creation timestamp
     println!("Testing that base-disks list shows creation timestamp...");
+    let sh = shell()?;
     let bck = get_bck_command()?;
-    let list_output = std::process::Command::new(&bck)
-        .args(["libvirt", "base-disks", "list"])
-        .output()
-        .expect("Failed to run base-disks list");
-
-    let list_stdout = String::from_utf8_lossy(&list_output.stdout);
-    let list_stderr = String::from_utf8_lossy(&list_output.stderr);
-
-    if list_output.status.success() {
-        println!("base-disks list output:\n{}", list_stdout);
+    let list_stdout = cmd!(sh, "{bck} libvirt base-disks list").read()?;
+    println!("base-disks list output:\n{}", list_stdout);
 
-        // Should have CREATED column in header
-        assert!(
-            list_stdout.contains("CREATED"),
-            "Should show CREATED column in header"
-        );
+    // Should have CREATED column in header
+    assert!(
+        list_stdout.contains("CREATED"),
+        "Should show CREATED column in header"
+    );
 
-        // Should show timestamp values (either a date or "unknown")
-        // Timestamp format is YYYY-MM-DD HH:MM
-        let re = Regex::new(r"\d{4}-\d{2}-\d{2} \d{2}:\d{2}|unknown").unwrap();
-        let has_timestamp = re.is_match(&list_stdout);
-        assert!(
-            has_timestamp,
-            "Should show timestamp values in CREATED column"
-        );
+    // Should show timestamp values (either a date or "unknown")
+    // Timestamp format is YYYY-MM-DD HH:MM
+    let re = Regex::new(r"\d{4}-\d{2}-\d{2} \d{2}:\d{2}|unknown").unwrap();
+    let has_timestamp = re.is_match(&list_stdout);
+    assert!(
+        has_timestamp,
+        "Should show timestamp values in CREATED column"
+    );
 
-        println!("✓ base-disks list shows creation timestamp");
-    } else {
-        println!("base-disks list failed: {}", list_stderr);
-        panic!("Failed to run base-disks list: {}", list_stderr);
-    }
+    println!("✓ base-disks list shows creation timestamp");
 
     println!("✓ Base disk creation and reuse test passed");
     Ok(())
@@ -133,15 +124,14 @@ integration_test!(test_base_disk_creation_and_reuse);
 
 /// Test base-disks list command
 fn test_base_disks_list_command() -> Result<()> {
+    let sh = shell()?;
     let bck = get_bck_command()?;
 
     println!("Testing base-disks list command");
 
-    let output = Command::new(&bck)
-        .args(["libvirt", "base-disks", "list"])
-        .output()
-        .expect("Failed to run base-disks list");
-
+    let output = cmd!(sh, "{bck} libvirt base-disks list")
+        .ignore_status()
+        .output()?;
     let stdout = String::from_utf8_lossy(&output.stdout);
     let stderr = String::from_utf8_lossy(&output.stderr);
 
@@ -174,15 +164,14 @@ integration_test!(test_base_disks_list_command);
 
 /// Test base-disks prune command with dry-run
 fn test_base_disks_prune_dry_run() -> Result<()> {
+    let sh = shell()?;
     let bck = get_bck_command()?;
 
     println!("Testing base-disks prune --dry-run command");
 
-    let output = Command::new(&bck)
-        .args(["libvirt", "base-disks", "prune", "--dry-run"])
-        .output()
-        .expect("Failed to run base-disks prune --dry-run");
-
+    let output = cmd!(sh, "{bck} libvirt base-disks prune --dry-run")
+        .ignore_status()
+        .output()?;
     let stdout = String::from_utf8_lossy(&output.stdout);
     let stderr = String::from_utf8_lossy(&output.stderr);
 
@@ -211,6 +200,8 @@ integration_test!(test_base_disks_prune_dry_run);
 
 /// Test that VM disks reference base disks correctly
 fn test_vm_disk_references_base() -> Result<()> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
     let test_image = get_test_image();
 
     let timestamp = std::time::SystemTime::now()
@@ -224,34 +215,23 @@ fn test_vm_disk_references_base() -> Result<()> {
     cleanup_domain(&vm_name);
 
     // Create VM
-    let output = run_bcvk(&[
-        "libvirt",
-        "run",
-        "--name",
-        &vm_name,
-        "--filesystem",
-        "ext4",
-        &test_image,
-    ])?;
-
-    if !output.success() {
+    let output = cmd!(
+        sh,
+        "{bck} libvirt run --name {vm_name} --filesystem ext4 {test_image}"
+    )
+    .ignore_status()
+    .output()?;
+
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr);
         cleanup_domain(&vm_name);
 
-        panic!("Failed to create VM: {}", output.stderr);
+        panic!("Failed to create VM: {}", stderr);
     }
 
     // Get VM disk path from domain XML
-    let dumpxml_output = Command::new("virsh")
-        .args(&["dumpxml", &vm_name])
-        .output()
-        .expect("Failed to dump domain XML");
-
-    if !dumpxml_output.status.success() {
-        cleanup_domain(&vm_name);
-        panic!("Failed to get domain XML");
-    }
-
-    let domain_xml = String::from_utf8_lossy(&dumpxml_output.stdout);
+    let sh = shell()?;
+    let domain_xml = cmd!(sh, "virsh dumpxml {vm_name}").read()?;
 
     // Parse XML using bcvk's xml_utils to extract disk path
     let dom = bcvk::xml_utils::parse_xml_dom(&domain_xml).expect("Failed to parse domain XML");
@@ -286,26 +266,34 @@ integration_test!(test_vm_disk_references_base);
 fn cleanup_domain(domain_name: &str) {
     println!("Cleaning up domain: {}", domain_name);
 
+    let sh = match shell() {
+        Ok(sh) => sh,
+        Err(_) => return,
+    };
+
     // Stop domain if running
-    let _ = Command::new("virsh")
-        .args(&["destroy", domain_name])
-        .output();
+    let _ = cmd!(sh, "virsh destroy {domain_name}")
+        .ignore_status()
+        .quiet()
+        .run();
 
     // Use bcvk libvirt rm for proper cleanup
     let bck = match get_bck_command() {
         Ok(cmd) => cmd,
         Err(_) => return,
     };
-    let cleanup_output = Command::new(&bck)
-        .args(&["libvirt", "rm", domain_name, "--force", "--stop"])
-        .output();
 
-    if let Ok(output) = cleanup_output {
-        if output.status.success() {
+    match cmd!(sh, "{bck} libvirt rm {domain_name} --force --stop")
+        .ignore_status()
+        .output()
+    {
+        Ok(output) if output.status.success() => {
             println!("Successfully cleaned up domain: {}", domain_name);
-        } else {
+        }
+        Ok(output) => {
             let stderr = String::from_utf8_lossy(&output.stderr);
             println!("Cleanup warning (may be expected): {}", stderr);
         }
+        Err(_) => {}
     }
 }
diff --git a/crates/integration-tests/src/tests/libvirt_port_forward.rs b/crates/integration-tests/src/tests/libvirt_port_forward.rs
index 52ab285..787a848 100644
--- a/crates/integration-tests/src/tests/libvirt_port_forward.rs
+++ b/crates/integration-tests/src/tests/libvirt_port_forward.rs
@@ -7,33 +7,27 @@
 
 use color_eyre::Result;
 use integration_tests::integration_test;
+use xshell::cmd;
 
-use std::process::Command;
-
-use crate::{get_bck_command, get_test_image, run_bcvk, LIBVIRT_INTEGRATION_TEST_LABEL};
+use crate::{get_bck_command, get_test_image, shell, LIBVIRT_INTEGRATION_TEST_LABEL};
 
 /// Test port forwarding argument parsing
 fn test_libvirt_port_forward_parsing() -> Result<()> {
+    let sh = shell()?;
     let bck = get_bck_command()?;
 
     // Test valid port forwarding formats
-    let valid_port_tests = vec![
-        vec!["--port", "8080:80"],
-        vec!["--port", "80:80"],
-        vec!["--port", "3000:3000", "--port", "8080:80"],
-        vec!["-p", "9090:90"],
+    let valid_port_tests: Vec<&[&str]> = vec![
+        &["--port", "8080:80"],
+        &["--port", "80:80"],
+        &["--port", "3000:3000", "--port", "8080:80"],
+        &["-p", "9090:90"],
     ];
 
     for ports in valid_port_tests {
-        let mut args = vec!["libvirt", "run"];
-        args.extend(ports.iter());
-        args.push("--help"); // Just test parsing, don't actually run
-
-        let output = Command::new(&bck)
-            .args(&args)
-            .output()
-            .expect("Failed to run libvirt run with port forwarding");
-
+        let output = cmd!(sh, "{bck} libvirt run {ports...} --help")
+            .ignore_status()
+            .output()?;
         let stdout = String::from_utf8_lossy(&output.stdout);
         let stderr = String::from_utf8_lossy(&output.stderr);
 
@@ -59,6 +53,7 @@ integration_test!(test_libvirt_port_forward_parsing);
 
 /// Test port forwarding error handling for invalid formats
 fn test_libvirt_port_forward_invalid() -> Result<()> {
+    let sh = shell()?;
     let bck = get_bck_command()?;
     let test_image = get_test_image();
 
@@ -72,30 +67,20 @@ fn test_libvirt_port_forward_invalid() -> Result<()> {
     );
 
     // Test invalid port forwarding formats (should fail)
-    let invalid_port_tests = vec![
-        (vec!["--port", "8080"], "missing guest port"),
-        (vec!["--port", "abc:80"], "invalid host port"),
-        (vec!["--port", "8080:xyz"], "invalid guest port"),
-        (vec!["--port", "70000:80"], "port out of range"),
+    let invalid_port_tests: Vec<(&[&str], &str)> = vec![
+        (&["--port", "8080"], "missing guest port"),
+        (&["--port", "abc:80"], "invalid host port"),
+        (&["--port", "8080:xyz"], "invalid guest port"),
+        (&["--port", "70000:80"], "port out of range"),
     ];
 
     for (ports, error_desc) in invalid_port_tests {
-        let mut args = vec![
-            "libvirt",
-            "run",
-            "--name",
-            &domain_name,
-            "--transient",
-            "--filesystem",
-            "ext4",
-        ];
-        args.extend(ports.iter());
-        args.push(&test_image);
-
-        let output = Command::new(&bck).args(&args).output().expect(&format!(
-            "Failed to run error case for port forwarding: {}",
-            error_desc
-        ));
+        let output = cmd!(
+            sh,
+            "{bck} libvirt run --name {domain_name} --transient --filesystem ext4 {ports...} {test_image}"
+        )
+        .ignore_status()
+        .output()?;
 
         // Cleanup in case domain was partially created
         cleanup_domain(&domain_name);
@@ -125,7 +110,10 @@ integration_test!(test_libvirt_port_forward_invalid);
 
 /// Test that port forwarding is correctly configured in domain XML
 fn test_libvirt_port_forward_xml() -> Result<()> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
     let test_image = get_test_image();
+    let label = LIBVIRT_INTEGRATION_TEST_LABEL;
 
     // Generate unique domain name for this test
     let domain_name = format!(
@@ -146,31 +134,24 @@ fn test_libvirt_port_forward_xml() -> Result<()> {
 
     // Create domain with port forwarding
     println!("Creating libvirt domain with port forwarding...");
-    let create_output = run_bcvk(&[
-        "libvirt",
-        "run",
-        "--name",
-        &domain_name,
-        "--label",
-        LIBVIRT_INTEGRATION_TEST_LABEL,
-        "--port",
-        "8080:80",
-        "--port",
-        "9090:8080",
-        "--filesystem",
-        "ext4",
-        &test_image,
-    ])
-    .expect("Failed to run libvirt run with port forwarding");
-
-    println!("Create stdout: {}", create_output.stdout);
-    println!("Create stderr: {}", create_output.stderr);
-
-    if !create_output.success() {
+    let create_output = cmd!(
+        sh,
+        "{bck} libvirt run --name {domain_name} --label {label} --port 8080:80 --port 9090:8080 --filesystem ext4 {test_image}"
+    )
+    .ignore_status()
+    .output()?;
+
+    let create_stdout = String::from_utf8_lossy(&create_output.stdout);
+    let create_stderr = String::from_utf8_lossy(&create_output.stderr);
+
+    println!("Create stdout: {}", create_stdout);
+    println!("Create stderr: {}", create_stderr);
+
+    if !create_output.status.success() {
         cleanup_domain(&domain_name);
         panic!(
             "Failed to create domain with port forwarding: {}",
-            create_output.stderr
+            create_stderr
         );
     }
 
@@ -178,26 +159,16 @@ fn test_libvirt_port_forward_xml() -> Result<()> {
 
     // Verify port forwarding in output
     assert!(
-        create_output.stdout.contains("Port forwarding:")
-            || create_output.stdout.contains("localhost:8080")
-            || create_output.stdout.contains("localhost:9090"),
+        create_stdout.contains("Port forwarding:")
+            || create_stdout.contains("localhost:8080")
+            || create_stdout.contains("localhost:9090"),
         "Output should mention port forwarding configuration"
     );
 
     // Check domain XML for QEMU args with port forwarding
     println!("Checking domain XML for port forwarding configuration...");
-    let dumpxml_output = Command::new("virsh")
-        .args(&["dumpxml", &domain_name])
-        .output()
-        .expect("Failed to dump domain XML");
-
-    if !dumpxml_output.status.success() {
-        cleanup_domain(&domain_name);
-        let stderr = String::from_utf8_lossy(&dumpxml_output.stderr);
-        panic!("Failed to dump domain XML: {}", stderr);
-    }
-
-    let domain_xml = String::from_utf8_lossy(&dumpxml_output.stdout);
+    let sh = shell()?;
+    let domain_xml = cmd!(sh, "virsh dumpxml {domain_name}").read()?;
 
     // Verify QEMU commandline arguments contain hostfwd
     assert!(
@@ -233,10 +204,14 @@ integration_test!(test_libvirt_port_forward_xml);
 
 /// Test actual network connectivity through forwarded ports
 fn test_libvirt_port_forward_connectivity() -> Result<()> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
     let test_image = get_test_image();
+    let label = LIBVIRT_INTEGRATION_TEST_LABEL;
 
     // Find an available port on the host
     let host_port = find_available_port()?;
+    let port_mapping = format!("{}:8080", host_port);
 
     // Generate unique domain name for this test
     let domain_name = format!(
@@ -260,30 +235,24 @@ fn test_libvirt_port_forward_connectivity() -> Result<()> {
         "Creating libvirt domain with port forwarding {}:8080...",
         host_port
     );
-    let create_output = run_bcvk(&[
-        "libvirt",
-        "run",
-        "--name",
-        &domain_name,
-        "--label",
-        LIBVIRT_INTEGRATION_TEST_LABEL,
-        "--port",
-        &format!("{}:8080", host_port),
-        "--filesystem",
-        "ext4",
-        "--ssh-wait",
-        &test_image,
-    ])
-    .expect("Failed to run libvirt run with port forwarding");
-
-    println!("Create stdout: {}", create_output.stdout);
-    println!("Create stderr: {}", create_output.stderr);
-
-    if !create_output.success() {
+    let create_output = cmd!(
+        sh,
+        "{bck} libvirt run --name {domain_name} --label {label} --port {port_mapping} --filesystem ext4 --ssh-wait {test_image}"
+    )
+    .ignore_status()
+    .output()?;
+
+    let create_stdout = String::from_utf8_lossy(&create_output.stdout);
+    let create_stderr = String::from_utf8_lossy(&create_output.stderr);
+
+    println!("Create stdout: {}", create_stdout);
+    println!("Create stderr: {}", create_stderr);
+
+    if !create_output.status.success() {
         cleanup_domain(&domain_name);
         panic!(
             "Failed to create domain with port forwarding: {}",
-            create_output.stderr
+            create_stderr
         );
     }
 
@@ -297,22 +266,18 @@ fn test_libvirt_port_forward_connectivity() -> Result<()> {
 
     // Create a test file to serve
     println!("Creating test file in VM...");
-    let create_file = run_bcvk(&[
-        "libvirt",
-        "ssh",
-        "--timeout",
-        "10",
-        &domain_name,
-        "--",
-        "sh",
-        "-c",
-        "echo 'port-forward-test-success' > /tmp/test.txt",
-    ])
-    .expect("Failed to create test file in VM");
-
-    if !create_file.success() {
+    let create_file_cmd = "echo 'port-forward-test-success' > /tmp/test.txt";
+    let create_file_output = cmd!(
+        sh,
+        "{bck} libvirt ssh --timeout 10 {domain_name} -- sh -c {create_file_cmd}"
+    )
+    .ignore_status()
+    .output()?;
+
+    if !create_file_output.status.success() {
+        let stderr = String::from_utf8_lossy(&create_file_output.stderr);
         cleanup_domain(&domain_name);
-        panic!("Failed to create test file in VM: {}", create_file.stderr);
+        panic!("Failed to create test file in VM: {}", stderr);
     }
     println!("✓ Test file created successfully");
 
@@ -323,22 +288,19 @@ fn test_libvirt_port_forward_connectivity() -> Result<()> {
     // 3. Put the command in a subshell and background it
     // 4. Use 'exec' to replace the shell with the server, making it cleaner
     println!("Starting background HTTP server...");
-    let start_server = run_bcvk(&[
-        "libvirt",
-        "ssh",
-        "--timeout",
-        "10",
-        &domain_name,
-        "--",
-        "bash",
-        "-c",
-        "(cd /tmp && exec python3 -m http.server 8080 > /tmp/http.log 2>&1 < /dev/null &) && sleep 0.1",
-    ])
-    .expect("Failed to start HTTP server in VM");
-
-    if !start_server.success() {
+    let start_server_cmd =
+        "(cd /tmp && exec python3 -m http.server 8080 > /tmp/http.log 2>&1 < /dev/null &) && sleep 0.1";
+    let start_server_output = cmd!(
+        sh,
+        "{bck} libvirt ssh --timeout 10 {domain_name} -- bash -c {start_server_cmd}"
+    )
+    .ignore_status()
+    .output()?;
+
+    if !start_server_output.status.success() {
+        let stderr = String::from_utf8_lossy(&start_server_output.stderr);
         cleanup_domain(&domain_name);
-        panic!("Failed to start HTTP server in VM: {}", start_server.stderr);
+        panic!("Failed to start HTTP server in VM: {}", stderr);
     }
     println!("✓ HTTP server command executed");
 
@@ -348,21 +310,14 @@ fn test_libvirt_port_forward_connectivity() -> Result<()> {
 
     // Test connectivity from host to forwarded port using curl
     println!("Testing connectivity to forwarded port from host...");
+    let sh = shell()?;
     let mut retry_count = 0;
     let max_retries = 5;
     let mut connection_success = false;
+    let url = format!("http://localhost:{}/test.txt", host_port);
 
     while retry_count < max_retries {
-        let curl_output = Command::new("curl")
-            .args(&[
-                "-s",
-                "-m",
-                "5", // 5 second timeout
-                &format!("http://localhost:{}/test.txt", host_port),
-            ])
-            .output();
-
-        match curl_output {
+        match cmd!(sh, "curl -s -m 5 {url}").ignore_status().output() {
             Ok(output) if output.status.success() => {
                 let response = String::from_utf8_lossy(&output.stdout);
                 println!("Received response: {}", response);
@@ -417,27 +372,35 @@ integration_test!(test_libvirt_port_forward_connectivity);
 fn cleanup_domain(domain_name: &str) {
     println!("Cleaning up domain: {}", domain_name);
 
+    let sh = match shell() {
+        Ok(sh) => sh,
+        Err(_) => return,
+    };
+
     // Stop domain if running
-    let _ = Command::new("virsh")
-        .args(&["destroy", domain_name])
-        .output();
+    let _ = cmd!(sh, "virsh destroy {domain_name}")
+        .ignore_status()
+        .quiet()
+        .run();
 
     // Use bcvk libvirt rm for proper cleanup
     let bck = match get_bck_command() {
         Ok(cmd) => cmd,
         Err(_) => return,
     };
-    let cleanup_output = Command::new(&bck)
-        .args(&["libvirt", "rm", domain_name, "--force", "--stop"])
-        .output();
 
-    if let Ok(output) = cleanup_output {
-        if output.status.success() {
+    match cmd!(sh, "{bck} libvirt rm {domain_name} --force --stop")
+        .ignore_status()
+        .output()
+    {
+        Ok(output) if output.status.success() => {
             println!("Successfully cleaned up domain: {}", domain_name);
-        } else {
+        }
+        Ok(output) => {
             let stderr = String::from_utf8_lossy(&output.stderr);
             println!("Cleanup warning (may be expected): {}", stderr);
         }
+        Err(_) => {}
     }
 }
 
diff --git a/crates/integration-tests/src/tests/libvirt_verb.rs b/crates/integration-tests/src/tests/libvirt_verb.rs
index dd7d642..f7b418f 100644
--- a/crates/integration-tests/src/tests/libvirt_verb.rs
+++ b/crates/integration-tests/src/tests/libvirt_verb.rs
@@ -9,12 +9,9 @@
 
 use color_eyre::Result;
 use integration_tests::integration_test;
+use xshell::cmd;
 
-use std::process::Command;
-
-use crate::{
-    get_bck_command, get_test_image, run_bcvk, run_bcvk_nocapture, LIBVIRT_INTEGRATION_TEST_LABEL,
-};
+use crate::{get_bck_command, get_test_image, shell, LIBVIRT_INTEGRATION_TEST_LABEL};
 use bcvk::xml_utils::parse_xml_dom;
 
 /// Generate a random alphanumeric suffix for VM names to avoid collisions
@@ -29,17 +26,14 @@ fn random_suffix() -> String {
 
 /// Test libvirt list functionality (lists domains)
 fn test_libvirt_list_functionality() -> Result<()> {
+    let sh = shell()?;
     let bck = get_bck_command()?;
 
-    let output = Command::new(&bck)
-        .args(["libvirt", "list"])
-        .output()
-        .expect("Failed to run libvirt list");
-
-    // May succeed or fail depending on libvirt availability, but should not crash
+    let output = cmd!(sh, "{bck} libvirt list").ignore_status().output()?;
     let stdout = String::from_utf8_lossy(&output.stdout);
     let stderr = String::from_utf8_lossy(&output.stderr);
 
+    // May succeed or fail depending on libvirt availability, but should not crash
     if output.status.success() {
         println!("libvirt list succeeded: {}", stdout);
         // Should show domain listing format
@@ -65,13 +59,12 @@ integration_test!(test_libvirt_list_functionality);
 
 /// Test libvirt list with JSON output
 fn test_libvirt_list_json_output() -> Result<()> {
+    let sh = shell()?;
     let bck = get_bck_command()?;
 
-    let output = Command::new(&bck)
-        .args(["libvirt", "list", "--format", "json"])
-        .output()
-        .expect("Failed to run libvirt list --format json");
-
+    let output = cmd!(sh, "{bck} libvirt list --format json")
+        .ignore_status()
+        .output()?;
     let stdout = String::from_utf8_lossy(&output.stdout);
     let stderr = String::from_utf8_lossy(&output.stderr);
 
@@ -99,29 +92,24 @@ integration_test!(test_libvirt_list_json_output);
 
 /// Test domain resource configuration options
 fn test_libvirt_run_resource_options() -> Result<()> {
+    let sh = shell()?;
     let bck = get_bck_command()?;
 
     // Test various resource configurations are accepted syntactically
-    let resource_tests = vec![
-        vec!["--memory", "1G", "--cpus", "1"],
-        vec!["--memory", "4G", "--cpus", "4"],
-        vec!["--memory", "2048M", "--cpus", "2"],
+    let resource_tests: Vec<&[&str]> = vec![
+        &["--memory", "1G", "--cpus", "1"],
+        &["--memory", "4G", "--cpus", "4"],
+        &["--memory", "2048M", "--cpus", "2"],
     ];
 
     for resources in resource_tests {
-        let mut args = vec!["libvirt", "run"];
-        args.extend(resources.iter());
-        args.push("--help"); // Just test parsing, don't actually run
-
-        let output = Command::new(&bck)
-            .args(&args)
-            .output()
-            .expect("Failed to run libvirt run with resources");
-
-        // Should show help and not fail on resource parsing
+        let output = cmd!(sh, "{bck} libvirt run {resources...} --help")
+            .ignore_status()
+            .output()?;
         let stdout = String::from_utf8_lossy(&output.stdout);
         let stderr = String::from_utf8_lossy(&output.stderr);
 
+        // Should show help and not fail on resource parsing
         if !output.status.success() {
             assert!(
                 !stderr.contains("invalid") && !stderr.contains("parse"),
@@ -144,24 +132,19 @@ integration_test!(test_libvirt_run_resource_options);
 
 /// Test domain networking configuration
 fn test_libvirt_run_networking() -> Result<()> {
+    let sh = shell()?;
     let bck = get_bck_command()?;
 
-    let network_configs = vec![
-        vec!["--network", "user"],
-        vec!["--network", "bridge"],
-        vec!["--network", "none"],
+    let network_configs: Vec<&[&str]> = vec![
+        &["--network", "user"],
+        &["--network", "bridge"],
+        &["--network", "none"],
     ];
 
     for network in network_configs {
-        let mut args = vec!["libvirt", "run"];
-        args.extend(network.iter());
-        args.push("--help"); // Just test parsing, don't actually run
-
-        let output = Command::new(&bck)
-            .args(&args)
-            .output()
-            .expect("Failed to run libvirt run with network config");
-
+        let output = cmd!(sh, "{bck} libvirt run {network...} --help")
+            .ignore_status()
+            .output()?;
         let stdout = String::from_utf8_lossy(&output.stdout);
         let stderr = String::from_utf8_lossy(&output.stderr);
 
@@ -188,17 +171,16 @@ integration_test!(test_libvirt_run_networking);
 
 /// Test SSH integration with created domains (syntax only)
 fn test_libvirt_ssh_integration() -> Result<()> {
+    let sh = shell()?;
     let bck = get_bck_command()?;
 
     // Test that SSH command integration works syntactically
-    let output = Command::new(&bck)
-        .args(["libvirt", "ssh", "test-domain", "--", "echo", "hello"])
-        .output()
-        .expect("Failed to run libvirt ssh command");
-
-    // Will likely fail since no domain exists, but should not crash
+    let output = cmd!(sh, "{bck} libvirt ssh test-domain -- echo hello")
+        .ignore_status()
+        .output()?;
     let stderr = String::from_utf8_lossy(&output.stderr);
 
+    // Will likely fail since no domain exists, but should not crash
     if !output.status.success() {
         // Should fail gracefully with domain-related error
         assert!(
@@ -216,8 +198,10 @@ integration_test!(test_libvirt_ssh_integration);
 /// Comprehensive workflow test: creates a VM and tests multiple features
 /// This consolidates several smaller tests to reduce expensive disk image creation
 fn test_libvirt_comprehensive_workflow() -> Result<()> {
-    let test_image = get_test_image();
+    let sh = shell()?;
     let bck = get_bck_command()?;
+    let test_image = get_test_image();
+    let label = LIBVIRT_INTEGRATION_TEST_LABEL;
 
     // Generate unique domain name for this test
     let domain_name = format!("test-workflow-{}", random_suffix());
@@ -232,39 +216,29 @@ fn test_libvirt_comprehensive_workflow() -> Result<()> {
 
     // Create domain with multiple features: instancetype, labels, SSH
     println!("Creating libvirt domain with instancetype and labels...");
-    let create_output = run_bcvk(&[
-        "libvirt",
-        "run",
-        "--name",
-        &domain_name,
-        "--label",
-        LIBVIRT_INTEGRATION_TEST_LABEL,
-        "--label",
-        "test-workflow",
-        "--itype",
-        "u1.small",
-        "--filesystem",
-        "ext4",
-        &test_image,
-    ])
-    .expect("Failed to run libvirt run");
-
-    println!("Create stdout: {}", create_output.stdout);
-    println!("Create stderr: {}", create_output.stderr);
-
-    if !create_output.success() {
+    let create_output = cmd!(
+        sh,
+        "{bck} libvirt run --name {domain_name} --label {label} --label test-workflow --itype u1.small --filesystem ext4 {test_image}"
+    )
+    .ignore_status()
+    .output()?;
+
+    let create_stdout = String::from_utf8_lossy(&create_output.stdout);
+    let create_stderr = String::from_utf8_lossy(&create_output.stderr);
+
+    println!("Create stdout: {}", create_stdout);
+    println!("Create stderr: {}", create_stderr);
+
+    if !create_output.status.success() {
         cleanup_domain(&domain_name);
-        panic!("Failed to create domain: {}", create_output.stderr);
+        panic!("Failed to create domain: {}", create_stderr);
     }
 
     println!("Successfully created domain: {}", domain_name);
 
     // Test 1: Verify instancetype configuration (u1.small: 1 vcpu, 2048 MB)
     println!("Test 1: Verifying instancetype configuration...");
-    let inspect_output = run_bcvk(&["libvirt", "inspect", "--format", "xml", &domain_name])
-        .expect("Failed to run libvirt inspect");
-
-    let inspect_stdout = inspect_output.stdout;
+    let inspect_stdout = cmd!(sh, "{bck} libvirt inspect --format xml {domain_name}").read()?;
     let dom = parse_xml_dom(&inspect_stdout).expect("Failed to parse domain XML");
 
     let vcpu_node = dom.find("vcpu").expect("vcpu element not found");
@@ -284,12 +258,8 @@ fn test_libvirt_comprehensive_workflow() -> Result<()> {
 
     // Test 2: Verify labels in domain XML
     println!("Test 2: Verifying label functionality...");
-    let dumpxml_output = Command::new("virsh")
-        .args(&["dumpxml", &domain_name])
-        .output()
-        .expect("Failed to dump domain XML");
-
-    let domain_xml = String::from_utf8_lossy(&dumpxml_output.stdout);
+    let sh = shell()?;
+    let domain_xml = cmd!(sh, "virsh dumpxml {domain_name}").read()?;
 
     assert!(
         domain_xml.contains("bootc:label") || domain_xml.contains("<label>"),
@@ -307,16 +277,7 @@ fn test_libvirt_comprehensive_workflow() -> Result<()> {
 
     // Test 3: Verify label filtering with libvirt list
     println!("Test 3: Testing label filtering...");
-    let list_output = Command::new(&bck)
-        .args(["libvirt", "list", "--label", "test-workflow", "-a"])
-        .output()
-        .expect("Failed to run libvirt list with label filter");
-
-    let list_stdout = String::from_utf8_lossy(&list_output.stdout);
-    assert!(
-        list_output.status.success(),
-        "libvirt list with label filter should succeed"
-    );
+    let list_stdout = cmd!(sh, "{bck} libvirt list --label test-workflow -a").read()?;
     assert!(
         list_stdout.contains(&domain_name),
         "Domain should appear in filtered list"
@@ -325,19 +286,7 @@ fn test_libvirt_comprehensive_workflow() -> Result<()> {
 
     // Test 4: Verify JSON output includes SSH metadata
     println!("Test 4: Verifying JSON output with SSH metadata...");
-    let list_json_output = Command::new(&bck)
-        .args(["libvirt", "list", "--format", "json", "-a"])
-        .output()
-        .expect("Failed to run libvirt list --format json");
-
-    let list_json_stdout = String::from_utf8_lossy(&list_json_output.stdout);
-
-    if !list_json_output.status.success() {
-        cleanup_domain(&domain_name);
-        let stderr = String::from_utf8_lossy(&list_json_output.stderr);
-        panic!("libvirt list --format json failed: {}", stderr);
-    }
-
+    let list_json_stdout = cmd!(sh, "{bck} libvirt list --format json -a").read()?;
     let domains: Vec<serde_json::Value> =
         serde_json::from_str(&list_json_stdout).expect("Failed to parse JSON output");
 
@@ -375,12 +324,7 @@ fn test_libvirt_comprehensive_workflow() -> Result<()> {
 
     // Test 5: Verify VM lifecycle (already running, test inspect)
     println!("Test 5: Verifying VM is running...");
-    let dominfo_output = Command::new("virsh")
-        .args(&["dominfo", &domain_name])
-        .output()
-        .expect("Failed to run virsh dominfo");
-
-    let info = String::from_utf8_lossy(&dominfo_output.stdout);
+    let info = cmd!(sh, "virsh dominfo {domain_name}").read()?;
     assert!(
         info.contains("running") || info.contains("idle"),
         "Domain should be running"
@@ -392,12 +336,7 @@ fn test_libvirt_comprehensive_workflow() -> Result<()> {
     let rm_test_domain = create_test_vm_and_assert("test-rm", &test_image, &domain_name)?;
 
     // Verify it's running
-    let rm_dominfo_output = Command::new("virsh")
-        .args(&["dominfo", &rm_test_domain])
-        .output()
-        .expect("Failed to run virsh dominfo for rm test VM");
-
-    let rm_info = String::from_utf8_lossy(&rm_dominfo_output.stdout);
+    let rm_info = cmd!(sh, "virsh dominfo {rm_test_domain}").read()?;
     assert!(
         rm_info.contains("running") || rm_info.contains("idle"),
         "Test VM should be running before rm test"
@@ -409,23 +348,11 @@ fn test_libvirt_comprehensive_workflow() -> Result<()> {
         "Running `bcvk libvirt rm -f {}` (without --stop)...",
         rm_test_domain
     );
-    let rm_output =
-        run_bcvk(&["libvirt", "rm", "-f", &rm_test_domain]).expect("Failed to run libvirt rm -f");
-
-    assert!(
-        rm_output.success(),
-        "rm -f should succeed in stopping and removing running VM without --stop flag. stderr: {}",
-        rm_output.stderr
-    );
+    cmd!(sh, "{bck} libvirt rm -f {rm_test_domain}").run()?;
     println!("✓ rm -f successfully stopped and removed running VM");
 
     // Verify the VM is actually removed
-    let list_check = Command::new("virsh")
-        .args(&["list", "--all", "--name"])
-        .output()
-        .expect("Failed to list domains");
-
-    let domain_list = String::from_utf8_lossy(&list_check.stdout);
+    let domain_list = cmd!(sh, "virsh list --all --name").read()?;
     assert!(
         !domain_list.contains(&rm_test_domain),
         "VM should be removed after rm -f"
@@ -437,12 +364,7 @@ fn test_libvirt_comprehensive_workflow() -> Result<()> {
     let replace_test_domain = create_test_vm_and_assert("test-replace", &test_image, &domain_name)?;
 
     // Verify initial VM exists
-    let initial_list = Command::new("virsh")
-        .args(&["list", "--all", "--name"])
-        .output()
-        .expect("Failed to list domains");
-
-    let initial_domain_list = String::from_utf8_lossy(&initial_list.stdout);
+    let initial_domain_list = cmd!(sh, "virsh list --all --name").read()?;
     assert!(
         initial_domain_list.contains(&replace_test_domain),
         "Initial VM should exist before replace"
@@ -454,37 +376,26 @@ fn test_libvirt_comprehensive_workflow() -> Result<()> {
         "Running `bcvk libvirt run --replace --name {}`...",
         replace_test_domain
     );
-    let replace_output = run_bcvk(&[
-        "libvirt",
-        "run",
-        "--replace",
-        "--name",
-        &replace_test_domain,
-        "--label",
-        LIBVIRT_INTEGRATION_TEST_LABEL,
-        "--filesystem",
-        "ext4",
-        &test_image,
-    ])
-    .expect("Failed to run libvirt run --replace");
-
-    if !replace_output.success() {
+    let replace_output = cmd!(
+        sh,
+        "{bck} libvirt run --replace --name {replace_test_domain} --label {label} --filesystem ext4 {test_image}"
+    )
+    .ignore_status()
+    .output()?;
+
+    if !replace_output.status.success() {
+        let replace_stderr = String::from_utf8_lossy(&replace_output.stderr);
         cleanup_domain(&replace_test_domain);
         cleanup_domain(&domain_name);
         panic!(
             "Failed to replace VM with --replace flag: {}",
-            replace_output.stderr
+            replace_stderr
         );
     }
     println!("✓ Successfully replaced VM with --replace flag");
 
     // Verify VM still exists with same name
-    let replaced_list = Command::new("virsh")
-        .args(&["list", "--all", "--name"])
-        .output()
-        .expect("Failed to list domains");
-
-    let replaced_domain_list = String::from_utf8_lossy(&replaced_list.stdout);
+    let replaced_domain_list = cmd!(sh, "virsh list --all --name").read()?;
     assert!(
         replaced_domain_list.contains(&replace_test_domain),
         "Replaced VM should exist with same name"
@@ -492,12 +403,7 @@ fn test_libvirt_comprehensive_workflow() -> Result<()> {
     println!("✓ Replaced VM exists with same name");
 
     // Verify it's a fresh VM (should be running)
-    let replaced_dominfo = Command::new("virsh")
-        .args(&["dominfo", &replace_test_domain])
-        .output()
-        .expect("Failed to run virsh dominfo for replaced VM");
-
-    let replaced_info = String::from_utf8_lossy(&replaced_dominfo.stdout);
+    let replaced_info = cmd!(sh, "virsh dominfo {replace_test_domain}").read()?;
     assert!(
         replaced_info.contains("running") || replaced_info.contains("idle"),
         "Replaced VM should be running"
@@ -520,62 +426,65 @@ integration_test!(test_libvirt_comprehensive_workflow);
 fn cleanup_domain(domain_name: &str) {
     println!("Cleaning up domain: {}", domain_name);
 
+    let sh = match shell() {
+        Ok(sh) => sh,
+        Err(_) => return,
+    };
+
     // Stop domain if running
-    let _ = Command::new("virsh")
-        .args(&["destroy", domain_name])
-        .output();
+    let _ = cmd!(sh, "virsh destroy {domain_name}")
+        .ignore_status()
+        .quiet()
+        .run();
 
     // Use bcvk libvirt rm for proper cleanup
     let bck = match get_bck_command() {
         Ok(cmd) => cmd,
         Err(_) => return,
     };
-    let cleanup_output = Command::new(&bck)
-        .args(&["libvirt", "rm", domain_name, "--force", "--stop"])
-        .output();
 
-    if let Ok(output) = cleanup_output {
-        if output.status.success() {
+    match cmd!(sh, "{bck} libvirt rm {domain_name} --force --stop")
+        .ignore_status()
+        .output()
+    {
+        Ok(output) if output.status.success() => {
             println!("Successfully cleaned up domain: {}", domain_name);
-        } else {
+        }
+        Ok(output) => {
             let stderr = String::from_utf8_lossy(&output.stderr);
             println!("Cleanup warning (may be expected): {}", stderr);
         }
+        Err(_) => {}
     }
 }
 
 /// Helper function to create a test VM and assert success
 ///
-/// Creates a VM using run_bcvk with the given prefix and test image.
+/// Creates a VM using cmd! with the given prefix and test image.
 /// Cleans up the original domain on error and returns the created domain name.
 fn create_test_vm_and_assert(
     domain_prefix: &str,
     test_image: &str,
     original_domain: &str,
 ) -> Result<String> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let label = LIBVIRT_INTEGRATION_TEST_LABEL;
     let domain_name = format!("{}-{}", domain_prefix, random_suffix());
 
     println!("Creating test VM: {}", domain_name);
-    let create_output = run_bcvk(&[
-        "libvirt",
-        "run",
-        "--name",
-        &domain_name,
-        "--label",
-        LIBVIRT_INTEGRATION_TEST_LABEL,
-        "--filesystem",
-        "ext4",
-        test_image,
-    ])
-    .expect("Failed to create test VM");
-
-    if !create_output.success() {
+    let create_output = cmd!(
+        sh,
+        "{bck} libvirt run --name {domain_name} --label {label} --filesystem ext4 {test_image}"
+    )
+    .ignore_status()
+    .output()?;
+
+    if !create_output.status.success() {
+        let stderr = String::from_utf8_lossy(&create_output.stderr);
         cleanup_domain(&domain_name);
         cleanup_domain(original_domain);
-        panic!(
-            "Failed to create test VM '{}': {}",
-            domain_name, create_output.stderr
-        );
+        panic!("Failed to create test VM '{}': {}", domain_name, stderr);
     }
 
     println!("✓ Test VM created: {}", domain_name);
@@ -585,21 +494,13 @@ fn create_test_vm_and_assert(
 /// Check if libvirt supports readonly virtiofs (requires libvirt 11.0+)
 /// Returns true if supported, false if not supported
 fn check_libvirt_supports_readonly_virtiofs() -> Result<bool> {
+    let sh = shell()?;
     let bck = get_bck_command()?;
 
     println!("Checking libvirt capabilities...");
-    let status_output = Command::new(&bck)
-        .args(&["libvirt", "status", "--format", "json"])
-        .output()
-        .expect("Failed to get libvirt status");
-
-    if !status_output.status.success() {
-        let stderr = String::from_utf8_lossy(&status_output.stderr);
-        panic!("Failed to get libvirt status: {}", stderr);
-    }
-
+    let status_json = cmd!(sh, "{bck} libvirt status --format json").read()?;
     let status: serde_json::Value =
-        serde_json::from_slice(&status_output.stdout).expect("Failed to parse libvirt status JSON");
+        serde_json::from_str(&status_json).expect("Failed to parse libvirt status JSON");
 
     let supports_readonly = status["supports_readonly_virtiofs"]
         .as_bool()
@@ -616,11 +517,12 @@ fn check_libvirt_supports_readonly_virtiofs() -> Result<bool> {
 
 /// Test VM startup and shutdown with libvirt run
 fn test_libvirt_run_vm_lifecycle() -> Result<()> {
+    let sh = shell()?;
     let bck = get_bck_command()?;
     let test_volume = "test-vm-lifecycle";
     let domain_name = format!("bootc-{}", test_volume);
 
-    // Guard to ensure cleanup always runs
+    // Guard to ensure cleanup always runs (uses std::process::Command in Drop)
     struct VmCleanupGuard {
         domain_name: String,
         bck: String,
@@ -629,11 +531,11 @@ fn test_libvirt_run_vm_lifecycle() -> Result<()> {
         fn drop(&mut self) {
             // Try to stop the VM first
             let _ = std::process::Command::new("virsh")
-                .args(&["destroy", &self.domain_name])
+                .args(["destroy", &self.domain_name])
                 .output();
             // Use bcvk libvirt rm for cleanup
             let cleanup_output = std::process::Command::new(&self.bck)
-                .args(&["libvirt", "rm", &self.domain_name, "--force", "--stop"])
+                .args(["libvirt", "rm", &self.domain_name, "--force", "--stop"])
                 .output();
             if let Ok(output) = cleanup_output {
                 if output.status.success() {
@@ -644,36 +546,25 @@ fn test_libvirt_run_vm_lifecycle() -> Result<()> {
     }
 
     // Cleanup any existing test domain
-    let _ = std::process::Command::new("virsh")
-        .args(&["destroy", &domain_name])
-        .output();
-    let _ = std::process::Command::new(&bck)
-        .args(&["libvirt", "rm", &domain_name, "--force", "--stop"])
-        .output();
+    let _ = cmd!(sh, "virsh destroy {domain_name}")
+        .ignore_status()
+        .quiet()
+        .run();
+    let _ = cmd!(sh, "{bck} libvirt rm {domain_name} --force --stop")
+        .ignore_status()
+        .quiet()
+        .run();
 
     // Create a minimal test volume (skip if no bootc container available)
     let test_image = &get_test_image();
+    let label = LIBVIRT_INTEGRATION_TEST_LABEL;
 
     // First try to create a domain from container image
-    let output = std::process::Command::new(&bck)
-        .args(&[
-            "libvirt",
-            "run",
-            "--filesystem",
-            "ext4",
-            "--name",
-            &domain_name,
-            "--label",
-            LIBVIRT_INTEGRATION_TEST_LABEL,
-            test_image,
-        ])
-        .output()
-        .expect("Failed to run libvirt run");
-
-    if !output.status.success() {
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        panic!("Failed to create VM: {}", stderr);
-    }
+    cmd!(
+        sh,
+        "{bck} libvirt run --filesystem ext4 --name {domain_name} --label {label} {test_image}"
+    )
+    .run()?;
 
     println!("Created VM domain: {}", domain_name);
 
@@ -684,12 +575,7 @@ fn test_libvirt_run_vm_lifecycle() -> Result<()> {
     };
 
     // Verify domain is running (libvirt run starts the domain by default)
-    let dominfo_output = std::process::Command::new("virsh")
-        .args(&["dominfo", &domain_name])
-        .output()
-        .expect("Failed to run virsh dominfo");
-
-    let info = String::from_utf8_lossy(&dominfo_output.stdout);
+    let info = cmd!(sh, "virsh dominfo {domain_name}").read()?;
     assert!(info.contains("State:"), "Should show domain state");
     assert!(
         info.contains("running") || info.contains("idle"),
@@ -701,15 +587,7 @@ fn test_libvirt_run_vm_lifecycle() -> Result<()> {
     std::thread::sleep(std::time::Duration::from_secs(5));
 
     // Stop the domain
-    let stop_output = std::process::Command::new("virsh")
-        .args(&["destroy", &domain_name])
-        .output()
-        .expect("Failed to run virsh destroy");
-
-    if !stop_output.status.success() {
-        let stderr = String::from_utf8_lossy(&stop_output.stderr);
-        panic!("Failed to stop domain: {}", stderr);
-    }
+    cmd!(sh, "virsh destroy {domain_name}").run()?;
     println!("Successfully stopped VM: {}", domain_name);
 
     println!("VM lifecycle test completed");
@@ -724,7 +602,10 @@ fn test_libvirt_run_bind_storage_ro() -> Result<()> {
         return Ok(());
     }
 
+    let sh = shell()?;
+    let bck = get_bck_command()?;
     let test_image = get_test_image();
+    let label = LIBVIRT_INTEGRATION_TEST_LABEL;
 
     // Generate unique domain name for this test
     let domain_name = format!("test-bind-storage-{}", random_suffix());
@@ -736,29 +617,24 @@ fn test_libvirt_run_bind_storage_ro() -> Result<()> {
 
     // Create domain with --bind-storage-ro flag
     println!("Creating libvirt domain with --bind-storage-ro...");
-    let create_output = run_bcvk(&[
-        "libvirt",
-        "run",
-        "--name",
-        &domain_name,
-        "--label",
-        LIBVIRT_INTEGRATION_TEST_LABEL,
-        "--bind-storage-ro",
-        "--filesystem",
-        "ext4",
-        "--ssh-wait",
-        &test_image,
-    ])
-    .expect("Failed to run libvirt run with --bind-storage-ro");
-
-    println!("Create stdout: {}", create_output.stdout);
-    println!("Create stderr: {}", create_output.stderr);
-
-    if !create_output.success() {
+    let create_output = cmd!(
+        sh,
+        "{bck} libvirt run --name {domain_name} --label {label} --bind-storage-ro --filesystem ext4 --ssh-wait {test_image}"
+    )
+    .ignore_status()
+    .output()?;
+
+    let create_stdout = String::from_utf8_lossy(&create_output.stdout);
+    let create_stderr = String::from_utf8_lossy(&create_output.stderr);
+
+    println!("Create stdout: {}", create_stdout);
+    println!("Create stderr: {}", create_stderr);
+
+    if !create_output.status.success() {
         cleanup_domain(&domain_name);
         panic!(
             "Failed to create domain with --bind-storage-ro: {}",
-            create_output.stderr
+            create_stderr
         );
     }
 
@@ -766,18 +642,8 @@ fn test_libvirt_run_bind_storage_ro() -> Result<()> {
 
     // Check that the domain was created with virtiofs filesystem
     println!("Checking domain XML for virtiofs filesystem...");
-    let dumpxml_output = Command::new("virsh")
-        .args(&["dumpxml", &domain_name])
-        .output()
-        .expect("Failed to dump domain XML");
-
-    if !dumpxml_output.status.success() {
-        cleanup_domain(&domain_name);
-        let stderr = String::from_utf8_lossy(&dumpxml_output.stderr);
-        panic!("Failed to dump domain XML: {}", stderr);
-    }
-
-    let domain_xml = String::from_utf8_lossy(&dumpxml_output.stdout);
+    let sh = shell()?;
+    let domain_xml = cmd!(sh, "virsh dumpxml {domain_name}").read()?;
     println!(
         "Domain XML snippet: {}",
         &domain_xml[..std::cmp::min(500, domain_xml.len())]
@@ -824,31 +690,23 @@ fn test_libvirt_run_bind_storage_ro() -> Result<()> {
     println!(
         "Verifying container storage is automatically mounted at /run/host-container-storage..."
     );
-    run_bcvk_nocapture(&[
-        "libvirt",
-        "ssh",
-        &domain_name,
-        "--",
-        "ls",
-        "-la",
-        "/run/host-container-storage/overlay",
-    ])
-    .expect("Failed to verify automatic mount of container storage");
+    cmd!(
+        sh,
+        "{bck} libvirt ssh {domain_name} -- ls -la /run/host-container-storage/overlay"
+    )
+    .run()?;
 
     // Verify that the mount is read-only
     println!("Verifying that the mount is read-only...");
-    let ro_test_st = run_bcvk(&[
-        "libvirt",
-        "ssh",
-        &domain_name,
-        "--",
-        "touch",
-        "/run/host-container-storage/test-write",
-    ])
-    .expect("Failed to run SSH command to test read-only mount");
+    let ro_test_output = cmd!(
+        sh,
+        "{bck} libvirt ssh {domain_name} -- touch /run/host-container-storage/test-write"
+    )
+    .ignore_status()
+    .output()?;
 
     assert!(
-        !ro_test_st.success(),
+        !ro_test_output.status.success(),
         "Mount should be read-only, but write operation succeeded"
     );
     println!("✓ Mount is correctly configured as read-only.");
@@ -863,7 +721,10 @@ integration_test!(test_libvirt_run_bind_storage_ro);
 
 /// Test that STORAGE_OPTS credentials are NOT injected when --bind-storage-ro is not used
 fn test_libvirt_run_no_storage_opts_without_bind_storage() -> Result<()> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
     let test_image = get_test_image();
+    let label = LIBVIRT_INTEGRATION_TEST_LABEL;
 
     // Generate unique domain name for this test
     let domain_name = format!("test-no-storage-opts-{}", random_suffix());
@@ -878,27 +739,24 @@ fn test_libvirt_run_no_storage_opts_without_bind_storage() -> Result<()> {
 
     // Create domain WITHOUT --bind-storage-ro flag
     println!("Creating libvirt domain without --bind-storage-ro...");
-    let create_output = run_bcvk(&[
-        "libvirt",
-        "run",
-        "--name",
-        &domain_name,
-        "--label",
-        LIBVIRT_INTEGRATION_TEST_LABEL,
-        "--filesystem",
-        "ext4",
-        &test_image,
-    ])
-    .expect("Failed to run libvirt run");
-
-    println!("Create stdout: {}", create_output.stdout);
-    println!("Create stderr: {}", create_output.stderr);
-
-    if !create_output.success() {
+    let create_output = cmd!(
+        sh,
+        "{bck} libvirt run --name {domain_name} --label {label} --filesystem ext4 {test_image}"
+    )
+    .ignore_status()
+    .output()?;
+
+    let create_stdout = String::from_utf8_lossy(&create_output.stdout);
+    let create_stderr = String::from_utf8_lossy(&create_output.stderr);
+
+    println!("Create stdout: {}", create_stdout);
+    println!("Create stderr: {}", create_stderr);
+
+    if !create_output.status.success() {
         cleanup_domain(&domain_name);
         panic!(
             "Failed to create domain without --bind-storage-ro: {}",
-            create_output.stderr
+            create_stderr
         );
     }
 
@@ -906,18 +764,8 @@ fn test_libvirt_run_no_storage_opts_without_bind_storage() -> Result<()> {
 
     // Dump the domain XML to verify STORAGE_OPTS credentials are not present
     println!("Dumping domain XML to verify no STORAGE_OPTS credentials...");
-    let dumpxml_output = Command::new("virsh")
-        .args(&["dumpxml", &domain_name])
-        .output()
-        .expect("Failed to dump domain XML");
-
-    if !dumpxml_output.status.success() {
-        cleanup_domain(&domain_name);
-        let stderr = String::from_utf8_lossy(&dumpxml_output.stderr);
-        panic!("Failed to dump domain XML: {}", stderr);
-    }
-
-    let domain_xml = String::from_utf8_lossy(&dumpxml_output.stdout);
+    let sh = shell()?;
+    let domain_xml = cmd!(sh, "virsh dumpxml {domain_name}").read()?;
 
     // Verify that the domain XML does NOT contain STORAGE_OPTS related credentials
     // The bugfix ensures storage_opts_tmpfiles_d_lines() is only added when --bind-storage-ro is true
@@ -961,23 +809,11 @@ integration_test!(test_libvirt_run_no_storage_opts_without_bind_storage);
 
 /// Test print-firmware command (hidden debugging command)
 fn test_libvirt_print_firmware() -> Result<()> {
+    let sh = shell()?;
     let bck = get_bck_command()?;
 
     // Test YAML output (default)
-    let yaml_output = Command::new(&bck)
-        .args(["libvirt", "print-firmware"])
-        .output()
-        .expect("Failed to run libvirt print-firmware");
-
-    let stdout = String::from_utf8_lossy(&yaml_output.stdout);
-    let stderr = String::from_utf8_lossy(&yaml_output.stderr);
-
-    // Should succeed and produce YAML output
-    assert!(
-        yaml_output.status.success(),
-        "libvirt print-firmware should succeed. stderr: {}",
-        stderr
-    );
+    let stdout = cmd!(sh, "{bck} libvirt print-firmware").read()?;
 
     // Verify YAML output contains expected fields
     assert!(
@@ -988,31 +824,18 @@ fn test_libvirt_print_firmware() -> Result<()> {
     println!("libvirt print-firmware YAML output:\n{}", stdout);
 
     // Test JSON output
-    let json_output = Command::new(&bck)
-        .args(["libvirt", "print-firmware", "--format", "json"])
-        .output()
-        .expect("Failed to run libvirt print-firmware --format json");
-
-    let json_stdout = String::from_utf8_lossy(&json_output.stdout);
+    let json_stdout = cmd!(sh, "{bck} libvirt print-firmware --format json").read()?;
 
-    if json_output.status.success() {
-        // Verify it's valid JSON
-        let json_result: std::result::Result<serde_json::Value, _> =
-            serde_json::from_str(&json_stdout);
-        assert!(
-            json_result.is_ok(),
-            "libvirt print-firmware --format json should produce valid JSON: {}",
-            json_stdout
-        );
+    // Verify it's valid JSON
+    let json_value: serde_json::Value = serde_json::from_str(&json_stdout)
+        .expect("libvirt print-firmware --format json should produce valid JSON");
 
-        let json_value = json_result.unwrap();
-        assert!(
-            json_value.get("architecture").is_some(),
-            "JSON output should contain architecture field"
-        );
+    assert!(
+        json_value.get("architecture").is_some(),
+        "JSON output should contain architecture field"
+    );
 
-        println!("libvirt print-firmware JSON output:\n{}", json_stdout);
-    }
+    println!("libvirt print-firmware JSON output:\n{}", json_stdout);
 
     println!("libvirt print-firmware test passed");
     Ok(())
@@ -1021,26 +844,24 @@ integration_test!(test_libvirt_print_firmware);
 
 /// Test error handling for invalid configurations
 fn test_libvirt_error_handling() -> Result<()> {
+    let sh = shell()?;
     let bck = get_bck_command()?;
 
-    let error_cases = vec![
+    let error_cases: Vec<(&[&str], &str)> = vec![
         // Missing required arguments
-        (vec!["libvirt", "run"], "missing image"),
-        (vec!["libvirt", "ssh"], "missing domain"),
+        (&["libvirt", "run"], "missing image"),
+        (&["libvirt", "ssh"], "missing domain"),
         // Invalid resource specs
         (
-            vec!["libvirt", "run", "--memory", "invalid", "test-image"],
+            &["libvirt", "run", "--memory", "invalid", "test-image"],
             "invalid memory",
         ),
         // Invalid format
-        (vec!["libvirt", "list", "--format", "bad"], "invalid format"),
+        (&["libvirt", "list", "--format", "bad"], "invalid format"),
     ];
 
     for (args, error_desc) in error_cases {
-        let output = Command::new(&bck)
-            .args(&args)
-            .output()
-            .expect(&format!("Failed to run error case: {}", error_desc));
+        let output = cmd!(sh, "{bck} {args...}").ignore_status().output()?;
 
         assert!(
             !output.status.success(),
@@ -1063,7 +884,10 @@ integration_test!(test_libvirt_error_handling);
 
 /// Test transient VM functionality
 fn test_libvirt_run_transient_vm() -> Result<()> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
     let test_image = get_test_image();
+    let label = LIBVIRT_INTEGRATION_TEST_LABEL;
 
     // Generate unique domain name for this test
     let domain_name = format!("test-transient-{}", random_suffix());
@@ -1075,47 +899,31 @@ fn test_libvirt_run_transient_vm() -> Result<()> {
 
     // Create transient domain
     println!("Creating transient libvirt domain...");
-    let create_output = run_bcvk(&[
-        "libvirt",
-        "run",
-        "--name",
-        &domain_name,
-        "--label",
-        LIBVIRT_INTEGRATION_TEST_LABEL,
-        "--transient",
-        "--filesystem",
-        "ext4",
-        &test_image,
-    ])
-    .expect("Failed to run libvirt run with --transient");
-
-    println!("Create stdout: {}", create_output.stdout);
-    println!("Create stderr: {}", create_output.stderr);
-
-    if !create_output.success() {
+    let create_output = cmd!(
+        sh,
+        "{bck} libvirt run --name {domain_name} --label {label} --transient --filesystem ext4 {test_image}"
+    )
+    .ignore_status()
+    .output()?;
+
+    let create_stdout = String::from_utf8_lossy(&create_output.stdout);
+    let create_stderr = String::from_utf8_lossy(&create_output.stderr);
+
+    println!("Create stdout: {}", create_stdout);
+    println!("Create stderr: {}", create_stderr);
+
+    if !create_output.status.success() {
         cleanup_domain(&domain_name);
-        panic!(
-            "Failed to create transient domain: {}",
-            create_output.stderr
-        );
+        panic!("Failed to create transient domain: {}", create_stderr);
     }
 
     println!("Successfully created transient domain: {}", domain_name);
 
+    let sh = shell()?;
+
     // Verify domain is transient using virsh dominfo
     println!("Verifying domain is marked as transient...");
-    let dominfo_output = Command::new("virsh")
-        .args(&["dominfo", &domain_name])
-        .output()
-        .expect("Failed to run virsh dominfo");
-
-    if !dominfo_output.status.success() {
-        cleanup_domain(&domain_name);
-        let stderr = String::from_utf8_lossy(&dominfo_output.stderr);
-        panic!("Failed to get domain info: {}", stderr);
-    }
-
-    let dominfo = String::from_utf8_lossy(&dominfo_output.stdout);
+    let dominfo = cmd!(sh, "virsh dominfo {domain_name}").read()?;
     println!("Domain info:\n{}", dominfo);
 
     // Verify "Persistent: no" appears in dominfo
@@ -1128,12 +936,7 @@ fn test_libvirt_run_transient_vm() -> Result<()> {
 
     // Verify domain XML contains transient disk element
     println!("Checking domain XML for transient disk configuration...");
-    let dumpxml_output = Command::new("virsh")
-        .args(&["dumpxml", &domain_name])
-        .output()
-        .expect("Failed to dump domain XML");
-
-    let domain_xml = String::from_utf8_lossy(&dumpxml_output.stdout);
+    let domain_xml = cmd!(sh, "virsh dumpxml {domain_name}").read()?;
 
     // Parse the XML properly using our XML parser
     let xml_dom = parse_xml_dom(&domain_xml).expect("Failed to parse domain XML");
@@ -1156,15 +959,7 @@ fn test_libvirt_run_transient_vm() -> Result<()> {
 
     // Stop the domain (this should make it disappear since it's transient)
     println!("Stopping transient domain (should disappear)...");
-    let destroy_output = Command::new("virsh")
-        .args(&["destroy", &domain_name])
-        .output()
-        .expect("Failed to run virsh destroy");
-
-    if !destroy_output.status.success() {
-        let stderr = String::from_utf8_lossy(&destroy_output.stderr);
-        panic!("Failed to stop domain: {}", stderr);
-    }
+    cmd!(sh, "virsh destroy {domain_name}").run()?;
 
     // Poll for domain disappearance with timeout
     println!("Verifying domain has disappeared...");
@@ -1173,12 +968,7 @@ fn test_libvirt_run_transient_vm() -> Result<()> {
     let mut domain_disappeared = false;
 
     while start_time.elapsed() < timeout {
-        let list_output = Command::new("virsh")
-            .args(&["list", "--all", "--name"])
-            .output()
-            .expect("Failed to list domains");
-
-        let domain_list = String::from_utf8_lossy(&list_output.stdout);
+        let domain_list = cmd!(sh, "virsh list --all --name").ignore_status().read()?;
         if !domain_list.contains(&domain_name) {
             domain_disappeared = true;
             break;
@@ -1218,7 +1008,10 @@ integration_test!(test_libvirt_run_transient_vm);
 /// 2. Replace it with another transient VM using --replace
 /// 3. Verify the replacement works (no errors about undefine on transient domains)
 fn test_libvirt_run_transient_replace() -> Result<()> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
     let test_image = get_test_image();
+    let label = LIBVIRT_INTEGRATION_TEST_LABEL;
 
     // Generate unique domain name for this test
     let domain_name = format!("test-transient-replace-{}", random_suffix());
@@ -1233,36 +1026,24 @@ fn test_libvirt_run_transient_replace() -> Result<()> {
 
     // Create initial transient domain
     println!("Creating initial transient domain...");
-    let create_output = run_bcvk(&[
-        "libvirt",
-        "run",
-        "--name",
-        &domain_name,
-        "--label",
-        LIBVIRT_INTEGRATION_TEST_LABEL,
-        "--transient",
-        "--filesystem",
-        "ext4",
-        &test_image,
-    ])
-    .expect("Failed to run libvirt run with --transient");
-
-    if !create_output.success() {
+    let create_output = cmd!(
+        sh,
+        "{bck} libvirt run --name {domain_name} --label {label} --transient --filesystem ext4 {test_image}"
+    )
+    .ignore_status()
+    .output()?;
+
+    if !create_output.status.success() {
+        let stderr = String::from_utf8_lossy(&create_output.stderr);
         cleanup_domain(&domain_name);
-        panic!(
-            "Failed to create initial transient domain: {}",
-            create_output.stderr
-        );
+        panic!("Failed to create initial transient domain: {}", stderr);
     }
     println!("✓ Initial transient domain created: {}", domain_name);
 
-    // Verify domain is transient
-    let dominfo_output = Command::new("virsh")
-        .args(&["dominfo", &domain_name])
-        .output()
-        .expect("Failed to run virsh dominfo");
+    let sh = shell()?;
 
-    let dominfo = String::from_utf8_lossy(&dominfo_output.stdout);
+    // Verify domain is transient
+    let dominfo = cmd!(sh, "virsh dominfo {domain_name}").read()?;
     assert!(
         dominfo.contains("Persistent:") && dominfo.contains("no"),
         "Domain should be transient. dominfo: {}",
@@ -1272,45 +1053,27 @@ fn test_libvirt_run_transient_replace() -> Result<()> {
 
     // Now replace the transient domain with another transient domain
     println!("Replacing transient domain with --transient --replace...");
-    let replace_output = run_bcvk(&[
-        "libvirt",
-        "run",
-        "--name",
-        &domain_name,
-        "--label",
-        LIBVIRT_INTEGRATION_TEST_LABEL,
-        "--transient",
-        "--replace",
-        "--filesystem",
-        "ext4",
-        &test_image,
-    ])
-    .expect("Failed to run libvirt run with --transient --replace");
-
-    println!("Replace stdout: {}", replace_output.stdout);
-    println!("Replace stderr: {}", replace_output.stderr);
-
-    if !replace_output.success() {
-        cleanup_domain(&domain_name);
-        panic!(
-            "Failed to replace transient domain: {}",
-            replace_output.stderr
-        );
-    }
-    println!("✓ Successfully replaced transient domain");
+    let replace_output = cmd!(
+        sh,
+        "{bck} libvirt run --name {domain_name} --label {label} --transient --replace --filesystem ext4 {test_image}"
+    )
+    .ignore_status()
+    .output()?;
 
-    // Verify the new domain exists and is transient
-    let dominfo_output = Command::new("virsh")
-        .args(&["dominfo", &domain_name])
-        .output()
-        .expect("Failed to run virsh dominfo after replace");
+    let replace_stdout = String::from_utf8_lossy(&replace_output.stdout);
+    let replace_stderr = String::from_utf8_lossy(&replace_output.stderr);
+
+    println!("Replace stdout: {}", replace_stdout);
+    println!("Replace stderr: {}", replace_stderr);
 
-    if !dominfo_output.status.success() {
+    if !replace_output.status.success() {
         cleanup_domain(&domain_name);
-        panic!("Domain should exist after --transient --replace");
+        panic!("Failed to replace transient domain: {}", replace_stderr);
     }
+    println!("✓ Successfully replaced transient domain");
 
-    let dominfo = String::from_utf8_lossy(&dominfo_output.stdout);
+    // Verify the new domain exists and is transient
+    let dominfo = cmd!(sh, "virsh dominfo {domain_name}").read()?;
     assert!(
         dominfo.contains("Persistent:") && dominfo.contains("no"),
         "Replaced domain should still be transient. dominfo: {}",
@@ -1345,7 +1108,10 @@ fn test_libvirt_run_bind_mounts() -> Result<()> {
         return Ok(());
     }
 
+    let sh = shell()?;
+    let bck = get_bck_command()?;
     let test_image = get_test_image();
+    let label = LIBVIRT_INTEGRATION_TEST_LABEL;
 
     // Generate unique domain name for this test
     let domain_name = format!("test-bind-mounts-{}", random_suffix());
@@ -1371,33 +1137,27 @@ fn test_libvirt_run_bind_mounts() -> Result<()> {
 
     // Create domain with bind mounts and test karg
     println!("Creating libvirt domain with bind mounts and karg...");
-    let create_output = run_bcvk(&[
-        "libvirt",
-        "run",
-        "--name",
-        &domain_name,
-        "--label",
-        LIBVIRT_INTEGRATION_TEST_LABEL,
-        "--filesystem",
-        "ext4",
-        "--karg",
-        "bcvk.test-install-karg=1",
-        "--bind",
-        &format!("{}:/var/mnt/test-rw", rw_dir_path),
-        "--bind-ro",
-        &format!("{}:/var/mnt/test-ro", ro_dir_path),
-        &test_image,
-    ])
-    .expect("Failed to run libvirt run with bind mounts");
-
-    println!("Create stdout: {}", create_output.stdout);
-    println!("Create stderr: {}", create_output.stderr);
-
-    if !create_output.success() {
+    let rw_bind = format!("{}:/var/mnt/test-rw", rw_dir_path);
+    let ro_bind = format!("{}:/var/mnt/test-ro", ro_dir_path);
+
+    let create_output = cmd!(
+        sh,
+        "{bck} libvirt run --name {domain_name} --label {label} --filesystem ext4 --karg bcvk.test-install-karg=1 --bind {rw_bind} --bind-ro {ro_bind} {test_image}"
+    )
+    .ignore_status()
+    .output()?;
+
+    let create_stdout = String::from_utf8_lossy(&create_output.stdout);
+    let create_stderr = String::from_utf8_lossy(&create_output.stderr);
+
+    println!("Create stdout: {}", create_stdout);
+    println!("Create stderr: {}", create_stderr);
+
+    if !create_output.status.success() {
         cleanup_domain(&domain_name);
         panic!(
             "Failed to create domain with bind mounts: {}",
-            create_output.stderr
+            create_stderr
         );
     }
 
@@ -1405,18 +1165,8 @@ fn test_libvirt_run_bind_mounts() -> Result<()> {
 
     // Check domain XML for virtiofs filesystems and SMBIOS credentials
     println!("Checking domain XML for virtiofs and SMBIOS credentials...");
-    let dumpxml_output = Command::new("virsh")
-        .args(&["dumpxml", &domain_name])
-        .output()
-        .expect("Failed to dump domain XML");
-
-    if !dumpxml_output.status.success() {
-        cleanup_domain(&domain_name);
-        let stderr = String::from_utf8_lossy(&dumpxml_output.stderr);
-        panic!("Failed to dump domain XML: {}", stderr);
-    }
-
-    let domain_xml = String::from_utf8_lossy(&dumpxml_output.stdout);
+    let sh = shell()?;
+    let domain_xml = cmd!(sh, "virsh dumpxml {domain_name}").read()?;
 
     // Verify virtiofs filesystems are present
     assert!(
@@ -1438,85 +1188,46 @@ fn test_libvirt_run_bind_mounts() -> Result<()> {
 
     // Debug: Check systemd credentials
     println!("Debugging: Checking systemd credentials...");
-    let _creds_check = run_bcvk(&[
-        "libvirt",
-        "ssh",
-        &domain_name,
-        "--",
-        "ls",
-        "-la",
-        "/run/credentials",
-    ])
-    .expect("Failed to check credentials");
+    let _ = cmd!(
+        sh,
+        "{bck} libvirt ssh {domain_name} -- ls -la /run/credentials"
+    )
+    .ignore_status()
+    .run();
 
     // Debug: Check mount units
     println!("Debugging: Checking mount units...");
-    let _units_check = run_bcvk(&[
-        "libvirt",
-        "ssh",
-        &domain_name,
-        "--",
-        "systemctl",
-        "list-units",
-        "*.mount",
-    ])
-    .expect("Failed to check mount units");
+    let _ = cmd!(
+        sh,
+        "{bck} libvirt ssh {domain_name} -- systemctl list-units *.mount"
+    )
+    .ignore_status()
+    .run();
 
     // Debug: Check mount status
     println!("Debugging: Checking if mounts exist...");
-    let _mount_check = run_bcvk(&[
-        "libvirt",
-        "ssh",
-        &domain_name,
-        "--",
-        "mount",
-        "|",
-        "grep",
-        "virtiofs",
-    ])
-    .expect("Failed to check mounts");
+    let _ = cmd!(sh, "{bck} libvirt ssh {domain_name} -- mount")
+        .ignore_status()
+        .run();
 
     // Test read-write bind mount - verify file exists and is readable
     println!("Testing read-write bind mount...");
-    let rw_read_test = run_bcvk(&[
-        "libvirt",
-        "ssh",
-        &domain_name,
-        "--",
-        "cat",
-        "/var/mnt/test-rw/rw-test.txt",
-    ])
-    .expect("Failed to read from rw bind mount");
+    let rw_read_stdout = cmd!(
+        sh,
+        "{bck} libvirt ssh {domain_name} -- cat /var/mnt/test-rw/rw-test.txt"
+    )
+    .read()?;
 
     assert!(
-        rw_read_test.success(),
-        "Should be able to read from rw bind mount. stderr: {}",
-        rw_read_test.stderr
-    );
-    assert!(
-        rw_read_test.stdout.contains("read-write content"),
+        rw_read_stdout.contains("read-write content"),
         "Should read correct content from rw bind mount"
     );
     println!("✓ RW bind mount is readable");
 
     // Test write access on read-write mount
     println!("Testing write access on read-write bind mount...");
-    let rw_write_test = run_bcvk(&[
-        "libvirt",
-        "ssh",
-        &domain_name,
-        "--",
-        "sh",
-        "-c",
-        "echo 'new content' > /var/mnt/test-rw/write-test.txt",
-    ])
-    .expect("Failed to write to rw bind mount");
-
-    assert!(
-        rw_write_test.success(),
-        "Should be able to write to rw bind mount. stderr: {}",
-        rw_write_test.stderr
-    );
+    let write_cmd = "echo 'new content' > /var/mnt/test-rw/write-test.txt";
+    cmd!(sh, "{bck} libvirt ssh {domain_name} -- sh -c {write_cmd}").run()?;
     println!("✓ RW bind mount is writable");
 
     // Verify written file exists on host
@@ -1529,62 +1240,42 @@ fn test_libvirt_run_bind_mounts() -> Result<()> {
 
     // Test read-only bind mount - verify file exists and is readable
     println!("Testing read-only bind mount...");
-    let ro_read_test = run_bcvk(&[
-        "libvirt",
-        "ssh",
-        &domain_name,
-        "--",
-        "cat",
-        "/var/mnt/test-ro/ro-test.txt",
-    ])
-    .expect("Failed to read from ro bind mount");
+    let ro_read_stdout = cmd!(
+        sh,
+        "{bck} libvirt ssh {domain_name} -- cat /var/mnt/test-ro/ro-test.txt"
+    )
+    .read()?;
 
     assert!(
-        ro_read_test.success(),
-        "Should be able to read from ro bind mount. stderr: {}",
-        ro_read_test.stderr
-    );
-    assert!(
-        ro_read_test.stdout.contains("read-only content"),
+        ro_read_stdout.contains("read-only content"),
         "Should read correct content from ro bind mount"
     );
     println!("✓ RO bind mount is readable");
 
     // Test that read-only mount rejects writes
     println!("Testing that read-only bind mount rejects writes...");
-    let ro_write_test = run_bcvk(&[
-        "libvirt",
-        "ssh",
-        &domain_name,
-        "--",
-        "sh",
-        "-c",
-        "echo 'should fail' > /var/mnt/test-ro/write-test.txt 2>&1",
-    ])
-    .expect("Failed to test write to ro bind mount");
+    let ro_write_cmd = "echo 'should fail' > /var/mnt/test-ro/write-test.txt 2>&1";
+    let ro_write_output = cmd!(
+        sh,
+        "{bck} libvirt ssh {domain_name} -- sh -c {ro_write_cmd}"
+    )
+    .ignore_status()
+    .output()?;
 
     assert!(
-        !ro_write_test.success(),
-        "Write to read-only bind mount should fail. stdout: {}, stderr: {}",
-        ro_write_test.stdout,
-        ro_write_test.stderr
+        !ro_write_output.status.success(),
+        "Write to read-only bind mount should fail"
     );
     println!("✓ RO bind mount correctly rejects writes");
 
     // Test kernel argument was applied
     println!("Validating kernel argument...");
-    let cmdline_output = run_bcvk(&["libvirt", "ssh", &domain_name, "--", "cat", "/proc/cmdline"])
-        .expect("Failed to read kernel cmdline");
+    let cmdline_stdout = cmd!(sh, "{bck} libvirt ssh {domain_name} -- cat /proc/cmdline").read()?;
 
     assert!(
-        cmdline_output.success(),
-        "Failed to read /proc/cmdline. stderr: {}",
-        cmdline_output.stderr
-    );
-    assert!(
-        cmdline_output.stdout.contains("bcvk.test-install-karg=1"),
+        cmdline_stdout.contains("bcvk.test-install-karg=1"),
         "Expected bcvk.test-install-karg=1 in kernel cmdline.\nActual: {}",
-        cmdline_output.stdout
+        cmdline_stdout
     );
     println!("✓ Kernel argument validated");
 
diff --git a/crates/integration-tests/src/tests/mount_feature.rs b/crates/integration-tests/src/tests/mount_feature.rs
index db01c55..c276776 100644
--- a/crates/integration-tests/src/tests/mount_feature.rs
+++ b/crates/integration-tests/src/tests/mount_feature.rs
@@ -21,7 +21,9 @@ use integration_tests::integration_test;
 use std::fs;
 use tempfile::TempDir;
 
-use crate::{get_test_image, run_bcvk, INTEGRATION_TEST_LABEL};
+use xshell::cmd;
+
+use crate::{get_bck_command, get_test_image, shell, INTEGRATION_TEST_LABEL};
 
 /// Create a systemd unit that verifies a mount exists and tests writability
 fn create_mount_verify_unit(
@@ -95,27 +97,20 @@ fn test_mount_feature_bind() -> Result<()> {
 
     println!("Testing bind mount with temp directory: {}", temp_dir_path);
 
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let label = INTEGRATION_TEST_LABEL;
+    let image = get_test_image();
+    let bind_arg = format!("{}:testmount", temp_dir_path);
+
     // Run with bind mount and verification unit
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run",
-        "--rm",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        "--console",
-        "-K",
-        "--bind",
-        &format!("{}:testmount", temp_dir_path),
-        "--systemd-units",
-        units_dir_path.as_str(),
-        "--karg",
-        "systemd.unit=verify-mount-testmount.service",
-        "--karg",
-        "systemd.journald.forward_to_console=1",
-        &get_test_image(),
-    ])?;
-
-    assert!(output.stdout.contains("ok mount verify"));
+    let stdout = cmd!(
+        sh,
+        "{bck} ephemeral run --rm --label {label} --console -K --bind {bind_arg} --systemd-units {units_dir_path} --karg systemd.unit=verify-mount-testmount.service --karg systemd.journald.forward_to_console=1 {image}"
+    )
+    .read()?;
+
+    assert!(stdout.contains("ok mount verify"));
 
     println!("Successfully tested and verified bind mount feature");
     Ok(())
@@ -144,27 +139,20 @@ fn test_mount_feature_ro_bind() -> Result<()> {
         temp_dir_path
     );
 
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let label = INTEGRATION_TEST_LABEL;
+    let image = get_test_image();
+    let ro_bind_arg = format!("{}:romount", temp_dir_path);
+
     // Run with read-only bind mount and verification unit
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run",
-        "--rm",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        "--console",
-        "-K",
-        "--ro-bind",
-        &format!("{}:romount", temp_dir_path),
-        "--systemd-units",
-        units_dir_path.as_str(),
-        "--karg",
-        "systemd.unit=verify-ro-mount-romount.service",
-        "--karg",
-        "systemd.journald.forward_to_console=1",
-        &get_test_image(),
-    ])?;
-
-    assert!(output.stdout.contains("ok mount verify"));
+    let stdout = cmd!(
+        sh,
+        "{bck} ephemeral run --rm --label {label} --console -K --ro-bind {ro_bind_arg} --systemd-units {units_dir_path} --karg systemd.unit=verify-ro-mount-romount.service --karg systemd.journald.forward_to_console=1 {image}"
+    )
+    .read()?;
+
+    assert!(stdout.contains("ok mount verify"));
     Ok(())
 }
 integration_test!(test_mount_feature_ro_bind);
diff --git a/crates/integration-tests/src/tests/run_ephemeral.rs b/crates/integration-tests/src/tests/run_ephemeral.rs
index 6df7c7b..dd80c65 100644
--- a/crates/integration-tests/src/tests/run_ephemeral.rs
+++ b/crates/integration-tests/src/tests/run_ephemeral.rs
@@ -16,151 +16,125 @@
 
 use color_eyre::Result;
 use integration_tests::integration_test;
+use xshell::cmd;
 
-use std::process::Command;
 use tracing::debug;
 
-use crate::{get_test_image, run_bcvk, INTEGRATION_TEST_LABEL};
+use crate::{get_bck_command, get_test_image, shell, INTEGRATION_TEST_LABEL};
 
 pub fn get_container_kernel_version(image: &str) -> String {
     // Run container to get its kernel version
-    let output = Command::new("podman")
-        .args([
-            "run",
-            "--rm",
-            image,
-            "sh",
-            "-c",
-            "ls -1 /usr/lib/modules | head -1",
-        ])
-        .output()
-        .expect("Failed to get container kernel version");
-
-    assert!(
-        output.status.success(),
-        "Failed to get kernel version from container: {}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-
-    String::from_utf8_lossy(&output.stdout).trim().to_string()
+    let sh = shell().expect("Failed to create shell");
+    cmd!(
+        sh,
+        "podman run --rm {image} sh -c 'ls -1 /usr/lib/modules | head -1'"
+    )
+    .read()
+    .expect("Failed to get container kernel version")
 }
 
 fn test_run_ephemeral_correct_kernel() -> Result<()> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
     let image = get_test_image();
+    let label = INTEGRATION_TEST_LABEL;
     let container_kernel = get_container_kernel_version(&image);
     eprintln!("Container kernel version: {}", container_kernel);
 
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run",
-        "--rm",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        &image,
-        "--karg",
-        "systemd.unit=poweroff.target",
-    ])?;
-
-    output.assert_success("ephemeral run");
+    cmd!(
+        sh,
+        "{bck} ephemeral run --rm --label {label} {image} --karg systemd.unit=poweroff.target"
+    )
+    .run()?;
     Ok(())
 }
 integration_test!(test_run_ephemeral_correct_kernel);
 
 fn test_run_ephemeral_poweroff() -> Result<()> {
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run",
-        "--rm",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        &get_test_image(),
-        "--karg",
-        "systemd.unit=poweroff.target",
-    ])?;
-
-    output.assert_success("ephemeral run");
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let image = get_test_image();
+    let label = INTEGRATION_TEST_LABEL;
+
+    cmd!(
+        sh,
+        "{bck} ephemeral run --rm --label {label} {image} --karg systemd.unit=poweroff.target"
+    )
+    .run()?;
     Ok(())
 }
 integration_test!(test_run_ephemeral_poweroff);
 
 fn test_run_ephemeral_with_memory_limit() -> Result<()> {
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run",
-        "--rm",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        "--memory",
-        "1024",
-        "--karg",
-        "systemd.unit=poweroff.target",
-        &get_test_image(),
-    ])?;
-
-    output.assert_success("ephemeral run with memory limit");
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let image = get_test_image();
+    let label = INTEGRATION_TEST_LABEL;
+
+    cmd!(
+        sh,
+        "{bck} ephemeral run --rm --label {label} --memory 1024 --karg systemd.unit=poweroff.target {image}"
+    )
+    .run()?;
     Ok(())
 }
 integration_test!(test_run_ephemeral_with_memory_limit);
 
 fn test_run_ephemeral_with_vcpus() -> Result<()> {
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run",
-        "--rm",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        "--vcpus",
-        "2",
-        "--karg",
-        "systemd.unit=poweroff.target",
-        &get_test_image(),
-    ])?;
-
-    output.assert_success("ephemeral run with vcpus");
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let image = get_test_image();
+    let label = INTEGRATION_TEST_LABEL;
+
+    cmd!(
+        sh,
+        "{bck} ephemeral run --rm --label {label} --vcpus 2 --karg systemd.unit=poweroff.target {image}"
+    )
+    .run()?;
     Ok(())
 }
 integration_test!(test_run_ephemeral_with_vcpus);
 
 fn test_run_ephemeral_execute() -> Result<()> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let image = get_test_image();
+    let label = INTEGRATION_TEST_LABEL;
     let script =
         "/bin/sh -c \"echo 'Hello from VM'; echo 'Current date:'; date; echo 'Script completed successfully'\"";
 
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run",
-        "--rm",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        "--execute",
-        script,
-        &get_test_image(),
-    ])?;
-
-    output.assert_success("ephemeral run with --execute");
+    let stdout = cmd!(
+        sh,
+        "{bck} ephemeral run --rm --label {label} --execute {script} {image}"
+    )
+    .read()?;
 
     assert!(
-        output.stdout.contains("Hello from VM"),
+        stdout.contains("Hello from VM"),
         "Script output 'Hello from VM' not found in stdout: {}",
-        output.stdout
+        stdout
     );
 
     assert!(
-        output.stdout.contains("Script completed successfully"),
+        stdout.contains("Script completed successfully"),
         "Script completion message not found in stdout: {}",
-        output.stdout
+        stdout
     );
 
     assert!(
-        output.stdout.contains("Current date:"),
+        stdout.contains("Current date:"),
         "Date output header not found in stdout: {}",
-        output.stdout
+        stdout
     );
     Ok(())
 }
 integration_test!(test_run_ephemeral_execute);
 
 fn test_run_ephemeral_container_ssh_access() -> Result<()> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
     let image = get_test_image();
+    let label = INTEGRATION_TEST_LABEL;
     let container_name = format!(
         "ssh-test-{}",
         std::time::SystemTime::now()
@@ -169,73 +143,53 @@ fn test_run_ephemeral_container_ssh_access() -> Result<()> {
             .as_secs()
     );
 
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run",
-        "--ssh-keygen",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        "--detach",
-        "--name",
-        &container_name,
-        &image,
-    ])?;
-
-    if !output.success() {
-        panic!("Failed to start detached VM: {}", output.stderr);
-    }
-
-    let ssh_output = run_bcvk(&[
-        "ephemeral",
-        "ssh",
-        &container_name,
-        "echo",
-        "SSH_TEST_SUCCESS",
-    ])?;
-
-    debug!("SSH exit status: {:?}", ssh_output.exit_code());
+    cmd!(
+        sh,
+        "{bck} ephemeral run --ssh-keygen --label {label} --detach --name {container_name} {image}"
+    )
+    .run()?;
+
+    let stdout = cmd!(
+        sh,
+        "{bck} ephemeral ssh {container_name} echo SSH_TEST_SUCCESS"
+    )
+    .read()?;
 
     // Cleanup: stop the container
-    let _ = Command::new("podman")
-        .args(["stop", &container_name])
-        .output();
+    let _ = cmd!(sh, "podman stop {container_name}")
+        .ignore_status()
+        .quiet()
+        .run();
 
-    assert!(ssh_output.success());
-    assert!(ssh_output.stdout.contains("SSH_TEST_SUCCESS"));
+    assert!(stdout.contains("SSH_TEST_SUCCESS"));
     Ok(())
 }
 integration_test!(test_run_ephemeral_container_ssh_access);
 
 fn test_run_ephemeral_with_instancetype() -> Result<()> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let image = get_test_image();
+    let label = INTEGRATION_TEST_LABEL;
     // Test u1.nano: 1 vCPU, 512 MiB memory
     // Calculate physical memory from /sys/firmware/memmap (System RAM regions)
     let script = "/bin/sh -c 'echo CPUs:$(grep -c ^processor /proc/cpuinfo); total=0; for dir in /sys/firmware/memmap/*; do type=$(cat \"$dir/type\" 2>/dev/null); if [ \"$type\" = \"System RAM\" ]; then start=$(cat \"$dir/start\"); end=$(cat \"$dir/end\"); start_dec=$((start)); end_dec=$((end)); size=$((end_dec - start_dec + 1)); total=$((total + size)); fi; done; total_kb=$((total / 1024)); echo PhysicalMemKB:$total_kb'";
 
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run",
-        "--rm",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        "--itype",
-        "u1.nano",
-        "--execute",
-        script,
-        &get_test_image(),
-    ])?;
-
-    output.assert_success("ephemeral run with instance type u1.nano");
+    let stdout = cmd!(
+        sh,
+        "{bck} ephemeral run --rm --label {label} --itype u1.nano --execute {script} {image}"
+    )
+    .read()?;
 
     // Verify vCPUs (should be 1)
     assert!(
-        output.stdout.contains("CPUs:1"),
+        stdout.contains("CPUs:1"),
         "Expected 1 vCPU for u1.nano, output: {}",
-        output.stdout
+        stdout
     );
 
     // Verify physical memory (should be exactly 512 MiB = 524288 kB)
-    let mem_line = output
-        .stdout
+    let mem_line = stdout
         .lines()
         .find(|line| line.contains("PhysicalMemKB:"))
         .expect("PhysicalMemKB line not found in output");
@@ -270,30 +224,30 @@ fn test_run_ephemeral_with_instancetype() -> Result<()> {
 integration_test!(test_run_ephemeral_with_instancetype);
 
 fn test_run_ephemeral_instancetype_invalid() -> Result<()> {
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run",
-        "--rm",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        "--itype",
-        "invalid.type",
-        "--karg",
-        "systemd.unit=poweroff.target",
-        &get_test_image(),
-    ])?;
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let image = get_test_image();
+    let label = INTEGRATION_TEST_LABEL;
+
+    let output = cmd!(
+        sh,
+        "{bck} ephemeral run --rm --label {label} --itype invalid.type --karg systemd.unit=poweroff.target {image}"
+    )
+    .ignore_status()
+    .output()?;
 
     // Should fail with invalid instance type
     assert!(
-        !output.success(),
+        !output.status.success(),
         "Expected failure with invalid instance type, but succeeded"
     );
 
     // Error message should mention the invalid type
+    let stderr = String::from_utf8_lossy(&output.stderr);
     assert!(
-        output.stderr.contains("invalid.type") || output.stderr.contains("Unknown instance type"),
+        stderr.contains("invalid.type") || stderr.contains("Unknown instance type"),
         "Error message should mention invalid instance type: {}",
-        output.stderr
+        stderr
     );
 
     Ok(())
@@ -305,12 +259,16 @@ integration_test!(test_run_ephemeral_instancetype_invalid);
 /// This tests compatibility with bootc images that only ship a Unified Kernel Image,
 /// verifying that bcvk can extract kernel/initramfs from the UKI using objcopy.
 fn test_run_ephemeral_uki_only() -> Result<()> {
+    let sh = shell()?;
     let base_image = get_test_image();
     let uki_image = "bcvk-test-uki-only:latest";
 
     // Build the UKI-only test image from the fixture Dockerfile
     let fixture_path =
         std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("fixtures/Dockerfile.uki-only");
+    let fixture_dir = fixture_path.parent().unwrap();
+    let dockerfile = fixture_path.to_str().unwrap();
+    let build_arg = format!("BASE_IMAGE={}", base_image);
 
     debug!(
         "Building UKI-only test image from {} using base {}",
@@ -318,40 +276,19 @@ fn test_run_ephemeral_uki_only() -> Result<()> {
         base_image
     );
 
-    let build_output = Command::new("podman")
-        .args([
-            "build",
-            "-f",
-            fixture_path.to_str().unwrap(),
-            "-t",
-            uki_image,
-            "--build-arg",
-            &format!("BASE_IMAGE={}", base_image),
-            fixture_path.parent().unwrap().to_str().unwrap(),
-        ])
-        .output()
-        .expect("Failed to run podman build");
-
-    assert!(
-        build_output.status.success(),
-        "Failed to build UKI-only test image: {}",
-        String::from_utf8_lossy(&build_output.stderr)
-    );
+    cmd!(
+        sh,
+        "podman build -f {dockerfile} -t {uki_image} --build-arg {build_arg} {fixture_dir}"
+    )
+    .run()?;
 
     // Verify the image has a UKI in /boot/EFI/Linux/ and no vmlinuz
-    let verify_output = Command::new("podman")
-        .args([
-            "run",
-            "--rm",
-            uki_image,
-            "sh",
-            "-c",
-            "ls /usr/lib/modules/*/vmlinuz 2>/dev/null && echo HAS_VMLINUZ || echo NO_VMLINUZ; ls /boot/EFI/Linux/*.efi 2>/dev/null && echo HAS_UKI || echo NO_UKI",
-        ])
-        .output()
-        .expect("Failed to verify image contents");
-
-    let verify_stdout = String::from_utf8_lossy(&verify_output.stdout);
+    let verify_stdout = cmd!(
+        sh,
+        "podman run --rm {uki_image} sh -c 'ls /usr/lib/modules/*/vmlinuz 2>/dev/null && echo HAS_VMLINUZ || echo NO_VMLINUZ; ls /boot/EFI/Linux/*.efi 2>/dev/null && echo HAS_UKI || echo NO_UKI'"
+    )
+    .read()?;
+
     debug!("Image verification: {}", verify_stdout);
     assert!(
         verify_stdout.contains("NO_VMLINUZ"),
@@ -365,28 +302,25 @@ fn test_run_ephemeral_uki_only() -> Result<()> {
     );
 
     // Run ephemeral VM from UKI-only image
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run",
-        "--rm",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        "--execute",
-        "echo UKI_BOOT_SUCCESS",
-        uki_image,
-    ])?;
-
-    output.assert_success("ephemeral run with UKI-only image");
+    let label = INTEGRATION_TEST_LABEL;
+    let bck = get_bck_command()?;
+    let stdout = cmd!(
+        sh,
+        "{bck} ephemeral run --rm --label {label} --execute 'echo UKI_BOOT_SUCCESS' {uki_image}"
+    )
+    .read()?;
+
     assert!(
-        output.stdout.contains("UKI_BOOT_SUCCESS"),
+        stdout.contains("UKI_BOOT_SUCCESS"),
         "UKI boot should output success message: {}",
-        output.stdout
+        stdout
     );
 
     // Cleanup the test image
-    let _ = Command::new("podman")
-        .args(["rmi", "-f", uki_image])
-        .output();
+    let _ = cmd!(sh, "podman rmi -f {uki_image}")
+        .ignore_status()
+        .quiet()
+        .run();
 
     Ok(())
 }
@@ -401,34 +335,25 @@ fn test_run_ephemeral_centos_uki() -> Result<()> {
 
     debug!("Testing ephemeral boot with {}", CENTOS_UKI_IMAGE);
 
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let label = INTEGRATION_TEST_LABEL;
+
     // Pull the image first (it's not in the standard test image set)
-    let pull_output = Command::new("podman")
-        .args(["pull", "-q", CENTOS_UKI_IMAGE])
-        .output()
-        .expect("Failed to run podman pull");
+    cmd!(sh, "podman pull -q {CENTOS_UKI_IMAGE}").run()?;
 
-    assert!(
-        pull_output.status.success(),
-        "Failed to pull CentOS UKI image: {}",
-        String::from_utf8_lossy(&pull_output.stderr)
-    );
+    let script =
+        "echo CENTOS_UKI_BOOT_SUCCESS && cat /etc/os-release | grep -E '^(ID|VERSION_ID)='";
+    let stdout = cmd!(
+        sh,
+        "{bck} ephemeral run --rm --label {label} --execute {script} {CENTOS_UKI_IMAGE}"
+    )
+    .read()?;
 
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run",
-        "--rm",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        "--execute",
-        "echo CENTOS_UKI_BOOT_SUCCESS && cat /etc/os-release | grep -E '^(ID|VERSION_ID)='",
-        CENTOS_UKI_IMAGE,
-    ])?;
-
-    output.assert_success("ephemeral run with CentOS 10 UKI image");
     assert!(
-        output.stdout.contains("CENTOS_UKI_BOOT_SUCCESS"),
+        stdout.contains("CENTOS_UKI_BOOT_SUCCESS"),
         "CentOS UKI boot should output success message: {}",
-        output.stdout
+        stdout
     );
 
     Ok(())
@@ -440,22 +365,20 @@ integration_test!(test_run_ephemeral_centos_uki);
 /// - /etc is overlayfs with tmpfs upper (writable)
 /// - /var is tmpfs (not overlayfs, so podman can use overlayfs inside)
 fn test_run_ephemeral_mount_layout() -> Result<()> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let image = get_test_image();
+    let label = INTEGRATION_TEST_LABEL;
+
     // Check each mount point individually using findmnt
     // Running all three at once with -J can hang on some configurations
 
     // Check root mount
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run",
-        "--rm",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        "--execute",
-        "findmnt -n -o FSTYPE,OPTIONS /",
-        &get_test_image(),
-    ])?;
-    output.assert_success("check root mount");
-    let root_line = output.stdout.trim();
+    let root_line = cmd!(
+        sh,
+        "{bck} ephemeral run --rm --label {label} --execute 'findmnt -n -o FSTYPE,OPTIONS /' {image}"
+    )
+    .read()?;
     assert!(
         root_line.starts_with("virtiofs"),
         "Root should be virtiofs, got: {}",
@@ -468,41 +391,29 @@ fn test_run_ephemeral_mount_layout() -> Result<()> {
     );
 
     // Check /etc mount
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run",
-        "--rm",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        "--execute",
-        "findmnt -n -o FSTYPE /etc",
-        &get_test_image(),
-    ])?;
-    output.assert_success("check /etc mount");
+    let etc_fstype = cmd!(
+        sh,
+        "{bck} ephemeral run --rm --label {label} --execute 'findmnt -n -o FSTYPE /etc' {image}"
+    )
+    .read()?;
     assert_eq!(
-        output.stdout.trim(),
+        etc_fstype.trim(),
         "overlay",
         "/etc should be overlay, got: {}",
-        output.stdout
+        etc_fstype
     );
 
     // Check /var mount - should be tmpfs, NOT overlay
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run",
-        "--rm",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        "--execute",
-        "findmnt -n -o FSTYPE /var",
-        &get_test_image(),
-    ])?;
-    output.assert_success("check /var mount");
+    let var_fstype = cmd!(
+        sh,
+        "{bck} ephemeral run --rm --label {label} --execute 'findmnt -n -o FSTYPE /var' {image}"
+    )
+    .read()?;
     assert_eq!(
-        output.stdout.trim(),
+        var_fstype.trim(),
         "tmpfs",
         "/var should be tmpfs (not overlay), got: {}",
-        output.stdout
+        var_fstype
     );
 
     Ok(())
diff --git a/crates/integration-tests/src/tests/run_ephemeral_ssh.rs b/crates/integration-tests/src/tests/run_ephemeral_ssh.rs
index 6703d7e..eeebdd7 100644
--- a/crates/integration-tests/src/tests/run_ephemeral_ssh.rs
+++ b/crates/integration-tests/src/tests/run_ephemeral_ssh.rs
@@ -16,28 +16,28 @@
 
 use color_eyre::Result;
 use integration_tests::{integration_test, parameterized_integration_test};
+use xshell::cmd;
 
-use std::process::Command;
 use std::time::{Duration, Instant};
 
-use crate::{get_test_image, run_bcvk, INTEGRATION_TEST_LABEL};
+use crate::{get_bck_command, get_test_image, shell, INTEGRATION_TEST_LABEL};
 
 /// Poll until a container is removed or timeout is reached
 ///
 /// Returns Ok(()) if container is removed within timeout, Err otherwise.
 /// Timeout is set to 60 seconds to account for slow CI runners.
 fn wait_for_container_removal(container_name: &str) -> Result<()> {
+    let sh = shell()?;
     let timeout = Duration::from_secs(60);
     let start = Instant::now();
     let poll_interval = Duration::from_millis(100);
+    let format_arg = "{{.Names}}";
 
     loop {
-        let output = Command::new("podman")
-            .args(["ps", "-a", "--format", "{{.Names}}"])
-            .output()
-            .expect("Failed to list containers");
+        let containers = cmd!(sh, "podman ps -a --format {format_arg}")
+            .ignore_status()
+            .read()?;
 
-        let containers = String::from_utf8_lossy(&output.stdout);
         if !containers.lines().any(|line| line == container_name) {
             return Ok(());
         }
@@ -56,52 +56,37 @@ fn wait_for_container_removal(container_name: &str) -> Result<()> {
 
 /// Build a test fixture image with the kernel removed
 fn build_broken_image() -> Result<String> {
+    let sh = shell()?;
     let fixture_path = concat!(env!("CARGO_MANIFEST_DIR"), "/fixtures/Dockerfile.no-kernel");
     let image_name = format!("localhost/bcvk-test-no-kernel:{}", std::process::id());
+    let build_arg = format!("BASE_IMAGE={}", get_test_image());
 
-    let output = Command::new("podman")
-        .args([
-            "build",
-            "-f",
-            fixture_path,
-            "-t",
-            &image_name,
-            "--build-arg",
-            &format!("BASE_IMAGE={}", get_test_image()),
-            ".",
-        ])
-        .output()?;
-
-    if !output.status.success() {
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        return Err(color_eyre::eyre::eyre!(
-            "Failed to build broken test image: {}",
-            stderr
-        ));
-    }
+    cmd!(
+        sh,
+        "podman build -f {fixture_path} -t {image_name} --build-arg {build_arg} ."
+    )
+    .run()?;
 
     Ok(image_name)
 }
 
 /// Test running a non-interactive command via SSH
 fn test_run_ephemeral_ssh_command() -> Result<()> {
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run-ssh",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        &get_test_image(),
-        "--",
-        "echo",
-        "hello world from SSH",
-    ])?;
-
-    output.assert_success("ephemeral run-ssh");
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let image = get_test_image();
+    let label = INTEGRATION_TEST_LABEL;
+
+    let stdout = cmd!(
+        sh,
+        "{bck} ephemeral run-ssh --label {label} {image} -- echo 'hello world from SSH'"
+    )
+    .read()?;
 
     assert!(
-        output.stdout.contains("hello world from SSH"),
+        stdout.contains("hello world from SSH"),
         "Expected output not found. Got: {}",
-        output.stdout
+        stdout
     );
     Ok(())
 }
@@ -109,22 +94,17 @@ integration_test!(test_run_ephemeral_ssh_command);
 
 /// Test that the container is cleaned up when SSH exits
 fn test_run_ephemeral_ssh_cleanup() -> Result<()> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let image = get_test_image();
+    let label = INTEGRATION_TEST_LABEL;
     let container_name = format!("test-ssh-cleanup-{}", std::process::id());
 
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run-ssh",
-        "--name",
-        &container_name,
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        &get_test_image(),
-        "--",
-        "echo",
-        "testing cleanup",
-    ])?;
-
-    output.assert_success("ephemeral run-ssh");
+    cmd!(
+        sh,
+        "{bck} ephemeral run-ssh --name {container_name} --label {label} {image} -- echo 'testing cleanup'"
+    )
+    .run()?;
 
     // Poll for container removal with timeout
     wait_for_container_removal(&container_name)?;
@@ -135,37 +115,35 @@ integration_test!(test_run_ephemeral_ssh_cleanup);
 
 /// Test running system commands via SSH
 fn test_run_ephemeral_ssh_system_command() -> Result<()> {
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run-ssh",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        &get_test_image(),
-        "--",
-        "/bin/sh",
-        "-c",
-        "systemctl is-system-running || true",
-    ])?;
-
-    output.assert_success("ephemeral run-ssh");
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let image = get_test_image();
+    let label = INTEGRATION_TEST_LABEL;
+
+    cmd!(
+        sh,
+        "{bck} ephemeral run-ssh --label {label} {image} -- /bin/sh -c 'systemctl is-system-running || true'"
+    )
+    .run()?;
     Ok(())
 }
 integration_test!(test_run_ephemeral_ssh_system_command);
 
 /// Test that ephemeral run-ssh properly forwards exit codes
 fn test_run_ephemeral_ssh_exit_code() -> Result<()> {
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run-ssh",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        &get_test_image(),
-        "--",
-        "exit",
-        "42",
-    ])?;
-
-    let exit_code = output.exit_code().expect("Failed to get exit code");
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let image = get_test_image();
+    let label = INTEGRATION_TEST_LABEL;
+
+    let output = cmd!(
+        sh,
+        "{bck} ephemeral run-ssh --label {label} {image} -- exit 42"
+    )
+    .ignore_status()
+    .output()?;
+
+    let exit_code = output.status.code().expect("Failed to get exit code");
     assert_eq!(
         exit_code, 42,
         "Exit code not properly forwarded. Expected 42, got {}",
@@ -180,33 +158,35 @@ integration_test!(test_run_ephemeral_ssh_exit_code);
 /// that our systemd version compatibility fix works correctly with both newer
 /// systemd (Fedora) and older systemd (CentOS Stream 9)
 fn test_run_ephemeral_ssh_cross_distro_compatibility(image: &str) -> Result<()> {
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run-ssh",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        image,
-        "--",
-        "systemctl",
-        "--version",
-    ])?;
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let label = INTEGRATION_TEST_LABEL;
+
+    let output = cmd!(
+        sh,
+        "{bck} ephemeral run-ssh --label {label} {image} -- systemctl --version"
+    )
+    .output()?;
+
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let stderr = String::from_utf8_lossy(&output.stderr);
 
     assert!(
-        output.success(),
+        output.status.success(),
         "SSH test failed for image {}: {}",
         image,
-        output.stderr
+        stderr
     );
 
     assert!(
-        output.stdout.contains("systemd"),
+        stdout.contains("systemd"),
         "systemd version not found for image {}. Got: {}",
         image,
-        output.stdout
+        stdout
     );
 
     // Log systemd version for diagnostic purposes
-    if let Some(version_line) = output.stdout.lines().next() {
+    if let Some(version_line) = stdout.lines().next() {
         eprintln!("Image {} systemd version: {}", image, version_line);
 
         let version_parts: Vec<&str> = version_line.split_whitespace().collect();
@@ -273,25 +253,23 @@ echo "All checks passed!"
         .to_str()
         .expect("Failed to convert path to string");
 
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let image = get_test_image();
+    let label = INTEGRATION_TEST_LABEL;
+    let bind_arg = format!("{}:testscripts", mount_path);
+
     // Run the test via SSH with the script mounted via virtiofs
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run-ssh",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        "--bind",
-        &format!("{}:testscripts", mount_path),
-        &get_test_image(),
-        "--",
-        "/run/virtiofs-mnt-testscripts/check_run_tmpfs.sh",
-    ])?;
-
-    output.assert_success("ephemeral run-ssh with tmpfs check");
+    let stdout = cmd!(
+        sh,
+        "{bck} ephemeral run-ssh --label {label} --bind {bind_arg} {image} -- /run/virtiofs-mnt-testscripts/check_run_tmpfs.sh"
+    )
+    .read()?;
 
     assert!(
-        output.stdout.contains("All checks passed!"),
+        stdout.contains("All checks passed!"),
         "Test script did not complete successfully. Output: {}",
-        output.stdout
+        stdout
     );
 
     Ok(())
@@ -310,50 +288,44 @@ fn test_run_ephemeral_ssh_broken_image_cleanup() -> Result<()> {
     let broken_image = build_broken_image()?;
     eprintln!("Built broken image: {}", broken_image);
 
+    let sh = shell()?;
+    let bck = get_bck_command()?;
     let container_name = format!("test-broken-cleanup-{}", std::process::id());
+    let label = INTEGRATION_TEST_LABEL;
 
     // Try to run ephemeral SSH with the broken image - this should fail
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run-ssh",
-        "--name",
-        &container_name,
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        &broken_image,
-        "--",
-        "echo",
-        "should not reach here",
-    ])?;
+    let output = cmd!(
+        sh,
+        "{bck} ephemeral run-ssh --name {container_name} --label {label} {broken_image} -- echo should_not_reach_here"
+    )
+    .ignore_status()
+    .output()?;
+
+    let stderr = String::from_utf8_lossy(&output.stderr);
 
     // The command should fail (no kernel found)
     assert!(
-        !output.success(),
+        !output.status.success(),
         "Expected ephemeral run-ssh to fail with broken image, but it succeeded"
     );
 
     // Verify the error message indicates the problem
     assert!(
-        output
-            .stderr
-            .contains("Failed to read kernel modules directory")
-            || output
-                .stderr
-                .contains("Container exited before SSH became available")
-            || output
-                .stderr
-                .contains("Monitor process exited unexpectedly"),
+        stderr.contains("Failed to read kernel modules directory")
+            || stderr.contains("Container exited before SSH became available")
+            || stderr.contains("Monitor process exited unexpectedly"),
         "Expected error about missing kernel or container failure, got: {}",
-        output.stderr
+        stderr
     );
 
     // Poll for container removal with timeout
     wait_for_container_removal(&container_name)?;
 
     // Clean up the test image
-    let _ = Command::new("podman")
-        .args(["rmi", "-f", &broken_image])
-        .output();
+    let _ = cmd!(sh, "podman rmi -f {broken_image}")
+        .ignore_status()
+        .quiet()
+        .run();
 
     Ok(())
 }
@@ -364,36 +336,21 @@ integration_test!(test_run_ephemeral_ssh_broken_image_cleanup);
 /// Verifies that ephemeral bootc VMs can access the network and resolve DNS correctly.
 /// Uses HTTP request to quay.io to test both DNS resolution and network connectivity.
 fn test_run_ephemeral_dns_resolution() -> Result<()> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let image = get_test_image();
+    let label = INTEGRATION_TEST_LABEL;
+
     // Test DNS + network by connecting to quay.io
     // Use curl or wget, whichever is available
     // Any HTTP response (including 401) proves DNS resolution and network connectivity work
-    let network_test = run_bcvk(&[
-        "ephemeral",
-        "run-ssh",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        &get_test_image(),
-        "--",
-        "/bin/sh",
-        "-c",
-        r#"
-        if command -v curl >/dev/null 2>&1; then
-            curl -sS --max-time 10 https://quay.io/v2/ >/dev/null
-        elif command -v wget >/dev/null 2>&1; then
-            wget -q --timeout=10 -O /dev/null https://quay.io/v2/
-        else
-            echo "Neither curl nor wget available"
-            exit 1
-        fi
-        "#,
-    ])?;
+    let dns_test_script = r#"if command -v curl >/dev/null 2>&1; then curl -sS --max-time 10 https://quay.io/v2/ >/dev/null; elif command -v wget >/dev/null 2>&1; then wget -q --timeout=10 -O /dev/null https://quay.io/v2/; else echo 'Neither curl nor wget available'; exit 1; fi"#;
 
-    assert!(
-        network_test.success(),
-        "Network connectivity test (HTTP request to quay.io) failed: stdout: {}\nstderr: {}",
-        network_test.stdout,
-        network_test.stderr
-    );
+    cmd!(
+        sh,
+        "{bck} ephemeral run-ssh --label {label} {image} -- /bin/sh -c {dns_test_script}"
+    )
+    .run()?;
 
     Ok(())
 }
@@ -411,36 +368,36 @@ fn test_run_ephemeral_ssh_timeout() -> Result<()> {
     eprintln!("Testing SSH timeout with masked sshd.service...");
     eprintln!("This test takes ~240 seconds to complete...");
 
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let image = get_test_image();
+    let label = INTEGRATION_TEST_LABEL;
+
     let start = Instant::now();
 
-    let output = run_bcvk(&[
-        "ephemeral",
-        "run-ssh",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        "--karg",
-        "systemd.mask=sshd.service",
-        &get_test_image(),
-        "--",
-        "echo",
-        "should not reach here",
-    ])?;
+    let output = cmd!(
+        sh,
+        "{bck} ephemeral run-ssh --label {label} --karg systemd.mask=sshd.service {image} -- echo should_not_reach_here"
+    )
+    .ignore_status()
+    .output()?;
 
     let elapsed = start.elapsed();
+    let stderr = String::from_utf8_lossy(&output.stderr);
 
     // Command should fail (SSH timeout)
     assert!(
-        !output.success(),
+        !output.status.success(),
         "Expected ephemeral run-ssh to fail with SSH timeout, but it succeeded"
     );
 
     // Verify the error message mentions timeout or readiness failure
     assert!(
-        output.stderr.contains("Timeout waiting for readiness")
-            || output.stderr.contains("timeout")
-            || output.stderr.contains("failed after"),
+        stderr.contains("Timeout waiting for readiness")
+            || stderr.contains("timeout")
+            || stderr.contains("failed after"),
         "Expected error about timeout, got: {}",
-        output.stderr
+        stderr
     );
 
     // Verify timeout duration is approximately 240 seconds (±20s tolerance for CI variability)
diff --git a/crates/integration-tests/src/tests/to_disk.rs b/crates/integration-tests/src/tests/to_disk.rs
index 7bce282..ea6fe8f 100644
--- a/crates/integration-tests/src/tests/to_disk.rs
+++ b/crates/integration-tests/src/tests/to_disk.rs
@@ -17,11 +17,11 @@
 use camino::Utf8PathBuf;
 use color_eyre::Result;
 use integration_tests::{integration_test, parameterized_integration_test};
+use xshell::cmd;
 
-use std::process::Command;
 use tempfile::TempDir;
 
-use crate::{get_test_image, run_bcvk, CapturedOutput, INTEGRATION_TEST_LABEL};
+use crate::{get_bck_command, get_test_image, shell, CapturedOutput, INTEGRATION_TEST_LABEL};
 
 /// Validate that a disk image was created successfully with proper bootc installation
 ///
@@ -44,20 +44,8 @@ fn validate_disk_image(
     let is_qcow2 = disk_path.as_str().ends_with(".qcow2");
     if !is_qcow2 {
         // Verify the disk has partitions using sfdisk -l
-        let sfdisk_output = Command::new("sfdisk")
-            .arg("-l")
-            .arg(disk_path.as_str())
-            .output()
-            .expect("Failed to run sfdisk");
-
-        let sfdisk_stdout = String::from_utf8_lossy(&sfdisk_output.stdout);
-
-        assert!(
-            sfdisk_output.status.success(),
-            "{}: sfdisk failed with exit code: {:?}",
-            context,
-            sfdisk_output.status.code()
-        );
+        let sh = shell().expect("Failed to create shell");
+        let sfdisk_stdout = cmd!(sh, "sfdisk -l {disk_path}").read()?;
 
         assert!(
             sfdisk_stdout.contains("Disk ")
@@ -89,17 +77,23 @@ fn validate_disk_image(
 
 /// Test actual bootc installation to a disk image
 fn test_to_disk() -> Result<()> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let label = INTEGRATION_TEST_LABEL;
+    let image = get_test_image();
+
     let temp_dir = TempDir::new().expect("Failed to create temp directory");
     let disk_path = Utf8PathBuf::try_from(temp_dir.path().join("test-disk.img"))
         .expect("temp path is not UTF-8");
 
-    let output = run_bcvk(&[
-        "to-disk",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        &get_test_image(),
-        disk_path.as_str(),
-    ])?;
+    let raw_output = cmd!(sh, "{bck} to-disk --label {label} {image} {disk_path}")
+        .ignore_status()
+        .output()?;
+    let output = CapturedOutput::new(std::process::Output {
+        status: raw_output.status,
+        stdout: raw_output.stdout,
+        stderr: raw_output.stderr,
+    });
 
     assert!(
         output.success(),
@@ -116,18 +110,26 @@ integration_test!(test_to_disk);
 
 /// Test bootc installation to a qcow2 disk image
 fn test_to_disk_qcow2() -> Result<()> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let label = INTEGRATION_TEST_LABEL;
+    let image = get_test_image();
+
     let temp_dir = TempDir::new().expect("Failed to create temp directory");
     let disk_path = Utf8PathBuf::try_from(temp_dir.path().join("test-disk.qcow2"))
         .expect("temp path is not UTF-8");
 
-    let output = run_bcvk(&[
-        "to-disk",
-        "--format=qcow2",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        &get_test_image(),
-        disk_path.as_str(),
-    ])?;
+    let raw_output = cmd!(
+        sh,
+        "{bck} to-disk --format=qcow2 --label {label} {image} {disk_path}"
+    )
+    .ignore_status()
+    .output()?;
+    let output = CapturedOutput::new(std::process::Output {
+        status: raw_output.status,
+        stdout: raw_output.stdout,
+        stderr: raw_output.stderr,
+    });
 
     assert!(
         output.success(),
@@ -138,18 +140,7 @@ fn test_to_disk_qcow2() -> Result<()> {
     );
 
     // Verify the file is actually qcow2 format using qemu-img info
-    let qemu_img_output = Command::new("qemu-img")
-        .args(["info", disk_path.as_str()])
-        .output()
-        .expect("Failed to run qemu-img info");
-
-    let qemu_img_stdout = String::from_utf8_lossy(&qemu_img_output.stdout);
-
-    assert!(
-        qemu_img_output.status.success(),
-        "qemu-img info failed with exit code: {:?}",
-        qemu_img_output.status.code()
-    );
+    let qemu_img_stdout = cmd!(sh, "qemu-img info {disk_path}").read()?;
 
     assert!(
         qemu_img_stdout.contains("file format: qcow2"),
@@ -164,18 +155,24 @@ integration_test!(test_to_disk_qcow2);
 
 /// Test disk image caching functionality
 fn test_to_disk_caching() -> Result<()> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let label = INTEGRATION_TEST_LABEL;
+    let image = get_test_image();
+
     let temp_dir = TempDir::new().expect("Failed to create temp directory");
     let disk_path = Utf8PathBuf::try_from(temp_dir.path().join("test-disk-cache.img"))
         .expect("temp path is not UTF-8");
 
     // First run: Create the disk image
-    let output1 = run_bcvk(&[
-        "to-disk",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        &get_test_image(),
-        disk_path.as_str(),
-    ])?;
+    let raw_output1 = cmd!(sh, "{bck} to-disk --label {label} {image} {disk_path}")
+        .ignore_status()
+        .output()?;
+    let output1 = CapturedOutput::new(std::process::Output {
+        status: raw_output1.status,
+        stdout: raw_output1.stdout,
+        stderr: raw_output1.stderr,
+    });
 
     assert!(
         output1.success(),
@@ -196,13 +193,14 @@ fn test_to_disk_caching() -> Result<()> {
     );
 
     // Second run: Should reuse the cached disk
-    let output2 = run_bcvk(&[
-        "to-disk",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        &get_test_image(),
-        disk_path.as_str(),
-    ])?;
+    let raw_output2 = cmd!(sh, "{bck} to-disk --label {label} {image} {disk_path}")
+        .ignore_status()
+        .output()?;
+    let output2 = CapturedOutput::new(std::process::Output {
+        status: raw_output2.status,
+        stdout: raw_output2.stdout,
+        stderr: raw_output2.stderr,
+    });
 
     assert!(
         output2.success(),
@@ -236,43 +234,31 @@ integration_test!(test_to_disk_caching);
 
 /// Test that different image references with the same digest create separate cached disks
 fn test_to_disk_different_imgref_same_digest() -> Result<()> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let label = INTEGRATION_TEST_LABEL;
     let temp_dir = TempDir::new().expect("Failed to create temp directory");
 
     // First, pull the test image
     let test_image = get_test_image();
-    let output = Command::new("podman")
-        .args(["pull", &test_image])
-        .output()
-        .expect("Failed to run podman pull");
-    assert!(
-        output.status.success(),
-        "Failed to pull test image: {}",
-        String::from_utf8_lossy(&output.stderr)
-    );
+    cmd!(sh, "podman pull {test_image}").run()?;
 
     // Create a second tag pointing to the same digest
     let second_tag = format!("{}-alias", test_image);
-    let output = Command::new("podman")
-        .args(["tag", &test_image, &second_tag])
-        .output()
-        .expect("Failed to run podman tag");
-    assert!(
-        output.status.success(),
-        "Failed to tag image: {}",
-        String::from_utf8_lossy(&output.stderr)
-    );
+    cmd!(sh, "podman tag {test_image} {second_tag}").run()?;
 
     // Create first disk with original image reference
     let disk_path = Utf8PathBuf::try_from(temp_dir.path().join("test-disk.img"))
         .expect("temp path is not UTF-8");
 
-    let output1 = run_bcvk(&[
-        "to-disk",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        &test_image,
-        disk_path.as_str(),
-    ])?;
+    let raw_output1 = cmd!(sh, "{bck} to-disk --label {label} {test_image} {disk_path}")
+        .ignore_status()
+        .output()?;
+    let output1 = CapturedOutput::new(std::process::Output {
+        status: raw_output1.status,
+        stdout: raw_output1.stdout,
+        stderr: raw_output1.stderr,
+    });
 
     assert!(
         output1.success(),
@@ -288,14 +274,17 @@ fn test_to_disk_different_imgref_same_digest() -> Result<()> {
 
     // Use --dry-run with the aliased image reference (same digest, different imgref)
     // to verify it would regenerate instead of reusing the cache
-    let output2 = run_bcvk(&[
-        "to-disk",
-        "--dry-run",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        &second_tag,
-        disk_path.as_str(),
-    ])?;
+    let raw_output2 = cmd!(
+        sh,
+        "{bck} to-disk --dry-run --label {label} {second_tag} {disk_path}"
+    )
+    .ignore_status()
+    .output()?;
+    let output2 = CapturedOutput::new(std::process::Output {
+        status: raw_output2.status,
+        stdout: raw_output2.stdout,
+        stderr: raw_output2.stderr,
+    });
 
     assert!(
         output2.success(),
@@ -314,7 +303,10 @@ fn test_to_disk_different_imgref_same_digest() -> Result<()> {
     );
 
     // Clean up: remove the aliased tag
-    let _ = Command::new("podman").args(["rmi", &second_tag]).output();
+    let _ = cmd!(sh, "podman rmi {second_tag}")
+        .ignore_status()
+        .quiet()
+        .run();
 
     Ok(())
 }
@@ -325,19 +317,26 @@ integration_test!(test_to_disk_different_imgref_same_digest);
 /// This parameterized test runs to-disk with multiple container images,
 /// particularly testing AlmaLinux which had cross-device link issues (issue #125)
 fn test_to_disk_for_image(image: &str) -> Result<()> {
+    let sh = shell()?;
+    let bck = get_bck_command()?;
+    let label = INTEGRATION_TEST_LABEL;
+
     let temp_dir = TempDir::new().expect("Failed to create temp directory");
     let disk_path = Utf8PathBuf::try_from(temp_dir.path().join("test-disk.img"))
         .expect("temp path is not UTF-8");
 
-    let output = run_bcvk(&[
-        "to-disk",
-        "--label",
-        INTEGRATION_TEST_LABEL,
-        // Not all iamges have one
-        "--filesystem=ext4",
-        image,
-        disk_path.as_str(),
-    ])?;
+    // Not all images have a default filesystem, so explicitly specify ext4
+    let raw_output = cmd!(
+        sh,
+        "{bck} to-disk --label {label} --filesystem=ext4 {image} {disk_path}"
+    )
+    .ignore_status()
+    .output()?;
+    let output = CapturedOutput::new(std::process::Output {
+        status: raw_output.status,
+        stdout: raw_output.stdout,
+        stderr: raw_output.stderr,
+    });
 
     assert!(
         output.success(),