diff --git a/internal/install-shell.mjs b/internal/install-shell.mjs
index 708fdde4e..e8e206a95 100644
--- a/internal/install-shell.mjs
+++ b/internal/install-shell.mjs
@@ -30,7 +30,7 @@
  * Usage:  node internal/install-shell.mjs [wrapper] [--no-token]
  *         default wrapper: app-wrapper-material
  */
-import { cpSync, existsSync, rmSync, readdirSync, readFileSync } from 'node:fs'
+import { cpSync, existsSync, rmSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { join, resolve, dirname } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -84,6 +84,16 @@ for (const layout of new Set(nested)) {
   console.log(`[install-shell] nested layout: layouts/${layout} → public/${layout}/`)
 }
 
+// SUBPATH-PORTABLE imports: `../<layout>/` resolves only at the web-root (../ cannot escape
+// root); served under a subpath (e.g. as a go-base plugin at /plugin-assets/doxa-maps-spa/)
+// it 404s. The layouts are copied as SIBLINGS of index.html, so `./<layout>/` is correct at
+// EVERY depth. Rewrite the copied entry so the shell works both at root and under any subpath.
+{
+  let entrySrc = readFileSync(join(dst, 'index.html'), 'utf8')
+  for (const layout of new Set(nested)) entrySrc = entrySrc.split(`../${layout}/`).join(`./${layout}/`)
+  writeFileSync(join(dst, 'index.html'), entrySrc)
+}
+
 // ⭐ The wrapper is copied to the ROOT of public/, but generate-tree then fans the
 // tree out into public/<name>/<bundle>/ — and in an earlier build order those
 // wrapper files got picked up and duplicated INTO every bundle folder. That put