diff --git a/.github/bump_vllm_metal.sh b/.github/bump_vllm_metal.sh
index b217e408f..d2aedf4bc 100755
--- a/.github/bump_vllm_metal.sh
+++ b/.github/bump_vllm_metal.sh
@@ -3,7 +3,7 @@
 # darwin (Apple Silicon) install path. The macOS/Metal build
 # (backend/python/vllm/install.sh, Darwin branch) installs vllm-metal, which is
 # version-locked to a specific vLLM source release. install.sh derives that vLLM
-# version at build time from vllm-metal's own installer (`vllm_v=`) at the pinned
+# version at build time from vllm-metal's own installer at the pinned
 # tag, so there is only ONE value to bump here -- mirroring bump_vllm_wheel.sh,
 # which bumps the Linux cu130 wheel pin.
 #
@@ -32,10 +32,10 @@ LATEST_TAG=$(gh_curl -H "Accept: application/vnd.github+json" \
 # The coupled vLLM source version lives in vllm-metal's installer at that tag.
 NEW_VLLM_VERSION=$(gh_curl \
     "https://raw.githubusercontent.com/$REPO/$LATEST_TAG/install.sh" \
-    | grep -oE 'vllm_v="[0-9]+\.[0-9]+\.[0-9]+"' | head -1 | cut -d'"' -f2)
+    | "$(dirname "${BASH_SOURCE[0]}")/../scripts/lib/extract-vllm-metal-version.sh")
 
 if [ -z "$LATEST_TAG" ] || [ -z "$NEW_VLLM_VERSION" ]; then
-    echo "Could not resolve vllm-metal tag ($LATEST_TAG) or its vllm_v ($NEW_VLLM_VERSION)." >&2
+    echo "Could not resolve vllm-metal tag ($LATEST_TAG) or its vLLM version ($NEW_VLLM_VERSION)." >&2
     exit 1
 fi
 
diff --git a/backend/python/vllm/install.sh b/backend/python/vllm/install.sh
index 009ef5b02..a7f459016 100755
--- a/backend/python/vllm/install.sh
+++ b/backend/python/vllm/install.sh
@@ -122,11 +122,11 @@ if [ "$(uname -s)" = "Darwin" ]; then
     VLLM_METAL_VERSION="v0.3.0.dev20260726174827"
 
     # The coupled vLLM source version is whatever this vllm-metal release builds
-    # against -- it declares it in its own installer as `vllm_v=`. Derive it from
+    # against. Derive it from
     # the PINNED tag rather than hardcoding a second value that could drift. The
     # tag is immutable, so this stays reproducible across rebuilds.
     VLLM_VERSION=$(curl -fsSL "https://raw.githubusercontent.com/vllm-project/vllm-metal/${VLLM_METAL_VERSION}/install.sh" \
-        | grep -oE 'vllm_v="[0-9]+\.[0-9]+\.[0-9]+"' | head -n1 | cut -d'"' -f2)
+        | "$backend_dir/../../../scripts/lib/extract-vllm-metal-version.sh")
     if [ -z "${VLLM_VERSION}" ]; then
         echo "ERROR: could not derive the vLLM version from vllm-metal ${VLLM_METAL_VERSION}" >&2
         exit 1
diff --git a/scripts/build/extract-vllm-metal-version_test.sh b/scripts/build/extract-vllm-metal-version_test.sh
new file mode 100755
index 000000000..f04bcfea3
--- /dev/null
+++ b/scripts/build/extract-vllm-metal-version_test.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+set -euo pipefail
+
+repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+extractor="$repo_root/scripts/lib/extract-vllm-metal-version.sh"
+
+assert_version() {
+    local expected=$1
+    local input=$2
+    local actual
+
+    actual=$(printf '%s\n' "$input" | "$extractor")
+    if [ "$actual" != "$expected" ]; then
+        echo "expected version $expected, got $actual" >&2
+        exit 1
+    fi
+}
+
+assert_version "0.23.0" 'vllm_v="0.23.0"'
+assert_version "0.26.0" '  local vllm_v="0.26.0"'
+assert_version "0.26.0" 'VLLM_VERSION="0.26.0"'
+assert_version "0.26.1" '  VLLM_VERSION = "0.26.1" # comment'
+
+if printf '%s\n' 'VLLM_VERSION="not-a-version"' | "$extractor"; then
+    echo "malformed versions must be rejected" >&2
+    exit 1
+fi
+
+if printf '%s\n' 'VLLM_VERSION="0.26.0"garbage' | "$extractor"; then
+    echo "trailing assignment content must be rejected" >&2
+    exit 1
+fi
diff --git a/scripts/lib/extract-vllm-metal-version.sh b/scripts/lib/extract-vllm-metal-version.sh
new file mode 100755
index 000000000..a5e101c63
--- /dev/null
+++ b/scripts/lib/extract-vllm-metal-version.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+set -euo pipefail
+
+grep -m1 -oE '^[[:space:]]*(local[[:space:]]+)?(vllm_v|VLLM_VERSION)[[:space:]]*=[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+"[[:space:]]*(#.*)?$' \
+    | grep -oE '[0-9]+\.[0-9]+\.[0-9]+'