diff --git a/ci/test/00_setup_env_native_asan.sh b/ci/test/00_setup_env_native_asan.sh
index 2465c70bb48..58be89fa104 100755
--- a/ci/test/00_setup_env_native_asan.sh
+++ b/ci/test/00_setup_env_native_asan.sh
@@ -9,7 +9,7 @@ export LC_ALL=C.UTF-8
 export CI_IMAGE_NAME_TAG="mirror.gcr.io/ubuntu:24.04"
 
 # Only install BCC tracing packages in CI. Container has to match the host for BCC to work.
-if [[ "${INSTALL_BCC_TRACING_TOOLS}" == "true" ]]; then
+if [[ "${INSTALL_BCC_TRACING_TOOLS:-}" == "true" ]]; then
   # Required for USDT functional tests to run
   BPFCC_PACKAGE="bpfcc-tools linux-headers-$(uname --kernel-release)"
   export CI_CONTAINER_CAP="--privileged -v /sys/kernel:/sys/kernel:rw"
diff --git a/ci/test/03_test_script.sh b/ci/test/03_test_script.sh
index 9e7ee951b40..c55f4430163 100755
--- a/ci/test/03_test_script.sh
+++ b/ci/test/03_test_script.sh
@@ -168,7 +168,7 @@ if [ -n "${CI_LIMIT_STACK_SIZE}" ]; then
 fi
 
 if [ -n "$USE_VALGRIND" ]; then
-  "${BASE_ROOT_DIR}/ci/test/wrap-valgrind.sh"
+  "${BASE_ROOT_DIR}/ci/test/wrap-valgrind.py"
 fi
 
 if [ "$RUN_CHECK_DEPS" = "true" ]; then
diff --git a/ci/test/wrap-valgrind.py b/ci/test/wrap-valgrind.py
new file mode 100755
index 00000000000..6a79f2aaae1
--- /dev/null
+++ b/ci/test/wrap-valgrind.py
@@ -0,0 +1,32 @@
+#!/usr/bin/env python3
+# Copyright (c) The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or https://opensource.org/license/mit/.
+
+import os
+import shlex
+from pathlib import Path
+
+
+def main():
+    base_root = Path(os.environ["BASE_ROOT_DIR"])
+    base_out = Path(os.environ["BASE_OUTDIR"])
+    suppressions_file = base_root / "test" / "sanitizer_suppressions" / "valgrind.supp"
+    target_names = {b.name for b in (base_out / "bin").iterdir()}
+
+    for exe in base_root.rglob("*"):
+        if exe.name in target_names and exe.is_file() and os.access(exe, os.X_OK):
+            print(f"Wrap {exe} ...")
+            original_path = exe.with_name(f"{exe.name}_orig")
+            exe.rename(original_path)
+            exe.write_text(
+                "#!/usr/bin/env bash\n"
+                "exec valgrind --gen-suppressions=all --quiet --error-exitcode=1 "
+                f"--suppressions={shlex.quote(str(suppressions_file))} "
+                f'{shlex.quote(str(original_path))} "$@"\n'
+            )
+            exe.chmod(exe.stat().st_mode | 0o111)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/ci/test/wrap-valgrind.sh b/ci/test/wrap-valgrind.sh
deleted file mode 100755
index 4ed3f2d66c5..00000000000
--- a/ci/test/wrap-valgrind.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-#
-# Copyright (c) 2018-present The Bitcoin Core developers
-# Distributed under the MIT software license, see the accompanying
-# file COPYING or http://www.opensource.org/licenses/mit-license.php.
-
-export LC_ALL=C.UTF-8
-
-for b_name in "${BASE_OUTDIR}/bin"/*; do
-    # shellcheck disable=SC2044
-    for b in $(find "${BASE_ROOT_DIR}" -executable -type f -name "$(basename "$b_name")"); do
-      echo "Wrap $b ..."
-      mv "$b" "${b}_orig"
-      echo '#!/usr/bin/env bash' > "$b"
-      echo "exec valgrind --gen-suppressions=all --quiet --error-exitcode=1 --suppressions=${BASE_ROOT_DIR}/test/sanitizer_suppressions/valgrind.supp \"${b}_orig\" \"\$@\"" >> "$b"
-      chmod +x "$b"
-    done
-done