diff --git a/atsf_agent/internal/nginx/manager.go b/atsf_agent/internal/nginx/manager.go
index 22f0c88d..c5fabc54 100644
--- a/atsf_agent/internal/nginx/manager.go
+++ b/atsf_agent/internal/nginx/manager.go
@@ -10,6 +10,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
 	"sort"
 	"strings"
 
@@ -300,19 +301,15 @@ func detectVersion(ctx context.Context, options ExecutorOptions, runner CommandR
 }
 
 func parseNginxVersion(output string) string {
-	start := strings.Index(output, "nginx/")
-	if start < 0 {
+	matches := nginxVersionPattern.FindStringSubmatch(output)
+	if len(matches) != 2 {
 		return ""
 	}
-	version := output[start+len("nginx/"):]
-	for i, r := range version {
-		if r == ' ' || r == '\n' || r == '\r' || r == '\t' {
-			return version[:i]
-		}
-	}
-	return version
+	return matches[1]
 }
 
+var nginxVersionPattern = regexp.MustCompile(`(?im)nginx version:\s*nginx/([^\s]+)`)
+
 type backupState struct {
 	RouteExisted bool
 	RouteData    []byte
diff --git a/atsf_agent/internal/nginx/manager_test.go b/atsf_agent/internal/nginx/manager_test.go
index 17a59dfd..ee780b8c 100644
--- a/atsf_agent/internal/nginx/manager_test.go
+++ b/atsf_agent/internal/nginx/manager_test.go
@@ -244,6 +244,18 @@ func TestDetectVersionFromDockerImage(t *testing.T) {
 	}
 }
 
+func TestParseNginxVersionIgnoresDockerEntrypointPaths(t *testing.T) {
+	output := strings.Join([]string{
+		"/docker-entrypoint.sh: /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh: info: can not modify /etc/nginx/conf.d/default.conf (read-only file system?)",
+		"nginx version: nginx/1.27.4",
+	}, "\n")
+
+	version := parseNginxVersion(output)
+	if version != "1.27.4" {
+		t.Fatalf("unexpected version: %s", version)
+	}
+}
+
 func TestManagerApplyWritesSupportFilesAndReplacesPlaceholder(t *testing.T) {
 	tempDir := t.TempDir()
 	manager := &Manager{