diff --git a/src/index.ts b/src/index.ts
index 2a714f47c39..00f89758418 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import process from "node:process";
 import { fileURLToPath } from "node:url";
-import { isRootHelpInvocation, isRootVersionInvocation } from "./cli/argv.js";
+
 import { assertNotRoot } from "./cli/root-guard.js";
 import { formatUncaughtError } from "./infra/errors.js";
 import { runFatalErrorHooks } from "./infra/fatal-error-hooks.js";
@@ -52,10 +52,12 @@ export async function runLegacyCliEntry(
   deps?: LegacyCliDeps,
 ): Promise<void> {
   // Block root execution on the legacy path too, matching src/entry.ts.
-  // Allow --help and --version so users can still discover the override env var.
-  if (!isRootHelpInvocation(argv) && !isRootVersionInvocation(argv)) {
-    assertNotRoot();
-  }
+  // Unlike entry.ts (which has fast-path help/version exits before startup),
+  // this path always calls runCli() which runs startup work (dotenv loading,
+  // debug capture init) before rendering help/version output.  Block
+  // unconditionally — the assertNotRoot error message already shows the
+  // OPENCLAW_ALLOW_ROOT=1 escape hatch.
+  assertNotRoot();
 
   const { runCli } = deps ?? (await loadLegacyCliDeps());
   await runCli(argv);