diff --git a/bin/gstack-config b/bin/gstack-config
index 250453536..3521825f4 100755
--- a/bin/gstack-config
+++ b/bin/gstack-config
@@ -192,18 +192,17 @@ lookup_default() {
 # Brain-integration helpers (T5+T10+T16)
 # ──────────────────────────────────────────────────────────────────────
 
-# Portable sha256 hex on stdin: Linux ships sha256sum, macOS ships shasum.
-_sha256_hex() {
-  if command -v sha256sum >/dev/null 2>&1; then sha256sum | awk '{print $1}'; else shasum -a 256 | awk '{print $1}'; fi
-}
-
 # Compute sha8 of a string. Used for endpoint hashing.
 # shasum is macOS/perl; most Linux distros ship only coreutils sha256sum —
 # resolve whichever exists (same fallback chain as the codex-probe timeout
 # wrapper). Without this, any Linux user with a git email hit exit 127 in
 # resolve-user-slug's Layer-3 fallback.
 sha8_of() {
-  printf '%s' "$1" | _sha256_hex | cut -c1-8
+  if command -v sha256sum >/dev/null 2>&1; then
+    printf '%s' "$1" | sha256sum | cut -c1-8
+  else
+    printf '%s' "$1" | shasum -a 256 | cut -c1-8
+  fi
 }
 
 # Detect the active brain endpoint hash. Reads ~/.claude.json for the gbrain
@@ -237,7 +236,11 @@ endpoint_hash_with_collision_check() {
   _claude_json="$HOME/.claude.json"
   if [ -n "$_matching" ] && [ -f "$_claude_json" ] && command -v jq >/dev/null 2>&1; then
     _url=$(jq -r '.mcpServers.gbrain.url // .mcpServers.gbrain.transport.url // empty' "$_claude_json" 2>/dev/null)
-    _sha16=$(printf '%s' "$_url" | _sha256_hex | cut -c1-16)
+    if command -v sha256sum >/dev/null 2>&1; then
+      _sha16=$(printf '%s' "$_url" | sha256sum | cut -c1-16)
+    else
+      _sha16=$(printf '%s' "$_url" | shasum -a 256 | cut -c1-16)
+    fi
     # Look for any sha16-namespaced key that conflicts. If a stored sha16 exists
     # and differs from current sha16, that's the collision evidence; emit sha16.
     _stored16=$(grep -E "^(brain_trust_policy|user_slug_at)@${_sha16}" "$CONFIG_FILE" 2>/dev/null | head -1 || true)