I'm running

installer

from the CLI yeah, but it's not easy for me to put these suspect hosts in non-SIP mode