diff --git a/.changes/education/host-run-7296-r11-teach-pointer-read-7b2d54e1.md b/.changes/education/host-run-7296-r11-teach-pointer-read-7b2d54e1.md
new file mode 100644
index 00000000000..539c728922a
--- /dev/null
+++ b/.changes/education/host-run-7296-r11-teach-pointer-read-7b2d54e1.md
@@ -0,0 +1,7 @@
+---
+bump: patch
+---
+
+### Changed
+
+- **teach:** the workspace-root ladder reads the `${CLAUDE_PLUGIN_DATA}/workspace-root` pointer file with the Read tool in a call of its own, never chained with `list-workspaces.sh` in one Bash call. The eval sandbox denied that chained call in 4 of 9 with-arm runs of `te-root-declared-substitution` ([#7296](https://github.com/melodic-software/claude-code-plugins/issues/7296)).
diff --git a/plugins/education/skills/teach/SKILL.md b/plugins/education/skills/teach/SKILL.md
index eaa3182430a..b1eb7eb1901 100644
--- a/plugins/education/skills/teach/SKILL.md
+++ b/plugins/education/skills/teach/SKILL.md
@@ -125,8 +125,10 @@ surfaced to the user, never merged.
    at a configured root. Persist the answer in the pointer file
    `${CLAUDE_PLUGIN_DATA}/workspace-root` (never a `pluginConfigs` write), a machine-local cache
    that also records the migration-offer outcome, and recommend making it durable via
-   `/education:setup`. Non-interactive or headless sessions skip this rung silently; when plugin data is unavailable,
-   fall through silently.
+   `/education:setup`. Read the pointer file with the Read tool in a call of its own, never
+   through Bash and never chained with `list-workspaces.sh` or another command. Non-interactive
+   or headless sessions skip this rung silently; when plugin data is unavailable, fall through
+   silently.
 4. **OS Documents default, `topic` mode only.** Run
    `bash "${CLAUDE_PLUGIN_ROOT}/skills/teach/scripts/list-workspaces.sh" --default-root`. It
    resolves the platform Documents directory (Windows: the Documents known folder resolved