diff --git a/src/extensions/index.spec.ts b/src/extensions/index.spec.ts
index bafb8e8..ab4738a 100644
--- a/src/extensions/index.spec.ts
+++ b/src/extensions/index.spec.ts
@@ -1,14 +1,20 @@
+import { execFileSync } from 'node:child_process'
 import { mkdirSync, mkdtempSync, readdirSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 
-import { describe, it, expect, beforeEach } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-import { findEditorCli, findOldExtensionDirs, removeExtensionDirs } from './index'
+import { findEditorCli, findOldExtensionDirs, removeExtensionDirs, runInstallExtension } from './index'
+
+vi.mock('node:child_process', () => ({
+  execFileSync: vi.fn(),
+}))
 
 let tempDir: string
 
 beforeEach(() => {
+  vi.mocked(execFileSync).mockReset()
   tempDir = mkdtempSync(join(tmpdir(), 'mdm-ext-test-'))
 })
 
@@ -29,6 +35,28 @@ describe('findEditorCli', () => {
   })
 })
 
+describe('runInstallExtension', () => {
+  it('runs the editor CLI from the user home directory on macOS', () => {
+    runInstallExtension(
+      '/usr/local/bin/cursor',
+      'testuser',
+      '/Users/testuser',
+      '/Users/testuser/.cursor/extensions',
+      'darwin',
+    )
+
+    expect(execFileSync).toHaveBeenCalledWith(
+      'sudo',
+      ['-H', '-u', 'testuser', '/usr/local/bin/cursor', '--install-extension', 'glean.glean'],
+      {
+        cwd: '/Users/testuser',
+        stdio: 'pipe',
+        timeout: 120_000,
+      },
+    )
+  })
+})
+
 describe('findOldExtensionDirs', () => {
   it('returns paths matching glean.glean-*', () => {
     const extensionsDir = join(tempDir, 'extensions')
diff --git a/src/extensions/index.ts b/src/extensions/index.ts
index 2e81a0f..13eb7c1 100644
--- a/src/extensions/index.ts
+++ b/src/extensions/index.ts
@@ -143,9 +143,10 @@ export function removeExtensionDirs(dirs: string[]): void {
   }
 }
 
-function runInstallExtension(
+export function runInstallExtension(
   cliPath: string,
   username: string,
+  userHomeDir: string,
   extensionsDir: string,
   platform: Platform,
 ): void {
@@ -156,6 +157,7 @@ function runInstallExtension(
     })
   } else {
     execFileSync('sudo', ['-H', '-u', username, cliPath, '--install-extension', EXTENSION_ID], {
+      cwd: userHomeDir,
       stdio: 'pipe',
       timeout: INSTALL_TIMEOUT_MS,
     })
@@ -187,7 +189,7 @@ export function installExtensions(options: InstallExtensionsOptions): ExtensionI
     try {
       const extensionsDir = join(userHomeDir, editor.extensionsDirName, 'extensions')
       const oldDirs = new Set(findOldExtensionDirs(extensionsDir))
-      runInstallExtension(cliPath, username, extensionsDir, platform)
+      runInstallExtension(cliPath, username, userHomeDir, extensionsDir, platform)
       const currentDirs = new Set(findOldExtensionDirs(extensionsDir))
       // Only clean old versions if the install actually added a new version dir.
       // If no new dirs appeared (no-op / already current), keep everything to