diff --git a/actions/homebrew-alias/modernize.sh b/actions/homebrew-alias/modernize.sh
index 4cb5121..b2c22ad 100644
--- a/actions/homebrew-alias/modernize.sh
+++ b/actions/homebrew-alias/modernize.sh
@@ -4,13 +4,16 @@
 # Usage:
 #   modernize.sh render <cask-file>
 #       Print the cask with only deprecated install-step block declarations
-#       renamed. Already-modern casks pass through unchanged.
+#       renamed. Already-modern casks pass through unchanged. Fails when a
+#       system_command call is left that the rewrite could not convert.
 set -euo pipefail
 
 render() {
   local file="$1"
   [ -f "$file" ] || { echo "::error::cask not found: $file" >&2; return 1; }
 
+  local out
+  out=$(mktemp)
   awk '
     /^[[:space:]]*preflight[[:space:]]+do[[:space:]]*$/ {
       sub(/preflight[[:space:]]+do[[:space:]]*$/, "preflight_steps do")
@@ -33,7 +36,18 @@ render() {
       gsub(/#\{staged_path\}/, "{{staged_path}}")
     }
     { print }
-  ' "$file"
+  ' "$file" > "$out"
+
+  # The install-step DSL has no system_command, so one left in place (an
+  # assignment such as `result = system_command ...`, which the line-start
+  # rewrite above skips) makes Homebrew reject the whole cask as invalid.
+  if grep -nE '^[^#]*\bsystem_command\b' "$out" >&2; then
+    echo "::error::$file: system_command calls above cannot be converted to install steps; make each a bare system_command line" >&2
+    rm -f "$out"
+    return 1
+  fi
+  cat "$out"
+  rm -f "$out"
 }
 
 case "${1:-}" in
diff --git a/actions/homebrew-alias/test_modernize.sh b/actions/homebrew-alias/test_modernize.sh
index 57f0ce4..0c048cc 100644
--- a/actions/homebrew-alias/test_modernize.sh
+++ b/actions/homebrew-alias/test_modernize.sh
@@ -45,5 +45,19 @@ rerendered=$(bash modernize.sh render "$tmp/modern.rb")
 bash modernize.sh render "$tmp/missing.rb" >/dev/null 2>&1 \
   && bad "missing file should fail" || ok "missing file fails"
 
+printf 'cask "example" do\nend\n\n' > "$tmp/trailing.rb"
+cmp -s "$tmp/trailing.rb" <(bash modernize.sh render "$tmp/trailing.rb") \
+  && ok "trailing blank lines preserved" || bad "trailing blank lines preserved"
+
+cat > "$tmp/assigned.rb" <<'RB'
+cask "example" do
+  postflight do
+    result = system_command "#{staged_path}/example", args: ["refresh"], must_succeed: false
+  end
+end
+RB
+bash modernize.sh render "$tmp/assigned.rb" >/dev/null 2>&1 \
+  && bad "unconvertible system_command should fail" || ok "unconvertible system_command fails"
+
 echo "----"
 if [ "$fails" -eq 0 ]; then echo "all modernization tests passed"; else echo "$fails failed"; exit 1; fi