diff --git a/parts/linux/cloud-init/artifacts/cse_main.sh b/parts/linux/cloud-init/artifacts/cse_main.sh
index 0c3ffe92253..359660c467d 100755
--- a/parts/linux/cloud-init/artifacts/cse_main.sh
+++ b/parts/linux/cloud-init/artifacts/cse_main.sh
@@ -457,6 +457,12 @@ function nodePrep {
     fi
 
     if [ -n "${OUTBOUND_COMMAND}" ]; then
+        # OUTBOUND_COMMAND is intentionally expanded unquoted here (not a scanner oversight):
+        # it is a full shell command (e.g. `curl -v --insecure --proxy-insecure <url>`) built by
+        # the RP from config.OutboundType/CloudSpecConfig (see GetOutboundCommand in baker.go),
+        # not an arbitrary string from an external caller. Quoting it would break word-splitting
+        # into argv and make the outbound connectivity check fail to execute. Do not add quotes
+        # here without also changing it to an array (e.g. OUTBOUND_COMMAND=(...)) end to end.
         retrycmd_if_failure 20 1 15 $OUTBOUND_COMMAND >> /var/log/azure/cluster-provision-cse-output.log 2>&1 || exit $ERR_OUTBOUND_CONN_FAIL;
     fi
     if [ -n "${BOOTSTRAP_PROFILE_CONTAINER_REGISTRY_SERVER}" ]; then