diff --git a/defaults.inc b/defaults.inc
index 4fe4dfc..e0089a0 100755
--- a/defaults.inc
+++ b/defaults.inc
@@ -3,7 +3,7 @@
 
 action="${1:-}"
 FOLDER='/opt/idssys/ta-proxmenu'
-VERS='2026.7.28-3'
+VERS='2026.7.28-4'
 
 noupdate=' '
 
diff --git a/inc/rmm.inc b/inc/rmm.inc
new file mode 100644
index 0000000..57134ef
--- /dev/null
+++ b/inc/rmm.inc
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+TAPM_RMM_TOKEN_FROM_URL() {
+	local url="${1:-}"
+	local token_pattern
+
+	token_pattern='TKN([0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12})/RUN(/|$)'
+	if [[ "$url" =~ $token_pattern ]]; then
+		printf '%s' "${BASH_REMATCH[1],,}"
+		return 0
+	fi
+	return 1
+}
+
+TAPM_RMM_ENSURE_SUDO() {
+	if command -v sudo >/dev/null 2>&1; then
+		return 0
+	fi
+	command -v apt-get >/dev/null 2>&1 || return 1
+
+	printf 'The RMM installer requires sudo; installing it now...\n'
+	apt-get update &&
+		DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends sudo
+}
diff --git a/proxmenu-scripts.sh b/proxmenu-scripts.sh
index 129daa3..352d662 100755
--- a/proxmenu-scripts.sh
+++ b/proxmenu-scripts.sh
@@ -7,6 +7,7 @@ source /opt/idssys/ta-proxmenu/defaults.inc
 source /opt/idssys/ta-proxmenu/inc/git-update.inc
 source /opt/idssys/ta-proxmenu/inc/ha-status.inc
 source /opt/idssys/ta-proxmenu/inc/post-install.inc
+source /opt/idssys/ta-proxmenu/inc/rmm.inc
 source /opt/idssys/ta-proxmenu/inc/deploy-iso-nfs-lxc.sh
 source /opt/idssys/ta-proxmenu/inc/deploy-pulse-lxc.sh
 source /opt/idssys/ta-proxmenu/inc/virtio-helpers.inc
@@ -356,6 +357,7 @@ INSTALL_RMM() {
 	local RMMURL=''
 	local TOKEN=''
 	local installer
+	local installer_dir
 	local temp_dir
 
 	echo
@@ -369,17 +371,16 @@ INSTALL_RMM() {
 	read -r -s RMMURL
 	echo
 	[[ -n "$RMMURL" ]] || { echo "No URL supplied."; FINISH_FAILED_ACTION; return; }
-	if [[ "$RMMURL" != *TKN* || "$RMMURL" != */RUN* ]]; then
+	if ! TOKEN="$(TAPM_RMM_TOKEN_FROM_URL "$RMMURL")"; then
 		echo "Unable to extract the RMM token from the URL."
-		unset RMMURL
+		unset RMMURL TOKEN
 		FINISH_FAILED_ACTION
 		return
 	fi
-	TOKEN="${RMMURL#*TKN}"
-	TOKEN="${TOKEN%%/RUN*}"
-	if [[ -z "$TOKEN" ]]; then
+
+	if ! TAPM_RMM_ENSURE_SUDO; then
 		unset RMMURL TOKEN
-		echo "The RMM token is empty."
+		echo -e "${idsCL[LightRed]}Unable to install the sudo dependency required by the RMM installer.${idsCL[Default]}"
 		FINISH_FAILED_ACTION
 		return
 	fi
@@ -390,7 +391,16 @@ INSTALL_RMM() {
 		return
 	fi
 	temp_dir="$TAPM_TEMP_DIR"
-	installer="${temp_dir}/rmminstall"
+	# Preserve the token-bearing portion of the original URL because the
+	# vendor installer also attempts to derive TOKEN from its own pathname.
+	installer_dir="${temp_dir}/ITSPlatform_TKN${TOKEN}/RUN"
+	if ! mkdir -p "$installer_dir" || ! chmod 0700 "$installer_dir"; then
+		unset RMMURL TOKEN
+		TAPM_CLEAN_TEMP_DIR "$temp_dir"
+		FINISH_FAILED_ACTION
+		return
+	fi
+	installer="${installer_dir}/setup"
 	if ! TAPM_DOWNLOAD_HTTPS "$RMMURL" "$installer" 'RMM installer'; then
 		unset RMMURL TOKEN
 		TAPM_CLEAN_TEMP_DIR "$temp_dir"
diff --git a/tests/test-rmm.sh b/tests/test-rmm.sh
new file mode 100644
index 0000000..020616a
--- /dev/null
+++ b/tests/test-rmm.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+TEST_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd -P)"
+# shellcheck source=../inc/rmm.inc
+source "${TEST_ROOT}/inc/rmm.inc"
+
+example_token='a81581f5-2e8c-465a-9eff-a094a75d5bbf'
+example_url="https://prod.setup.itsupport247.net/linux/BareboneAgent/64/TA_Green_Bay-Technology_Arch_Corporate_Linux_Server_ITSPlatform_TKN${example_token}/RUN/setup"
+
+actual_token="$(TAPM_RMM_TOKEN_FROM_URL "$example_url")"
+if [[ "$actual_token" != "$example_token" ]]; then
+	printf 'FAIL: extracted %q, want %q\n' "$actual_token" "$example_token" >&2
+	exit 1
+fi
+
+if TAPM_RMM_TOKEN_FROM_URL 'https://prod.setup.itsupport247.net/linux/setup' >/dev/null; then
+	printf 'FAIL: accepted an RMM URL without a token\n' >&2
+	exit 1
+fi
+
+if TAPM_RMM_TOKEN_FROM_URL \
+	'https://prod.setup.itsupport247.net/TKNnot-a-token/RUN/setup' >/dev/null; then
+	printf 'FAIL: accepted a malformed RMM token\n' >&2
+	exit 1
+fi
+
+printf 'PASS: RMM token extraction\n'