diff --git a/core/src/main/resources/hudson/model/UpdateCenter/CoreUpdateMonitor/message.jelly b/core/src/main/resources/hudson/model/UpdateCenter/CoreUpdateMonitor/message.jelly
index f11ee8837cdd..efaa6159136e 100644
--- a/core/src/main/resources/hudson/model/UpdateCenter/CoreUpdateMonitor/message.jelly
+++ b/core/src/main/resources/hudson/model/UpdateCenter/CoreUpdateMonitor/message.jelly
@@ -53,11 +53,13 @@ THE SOFTWARE.
       <j:otherwise>
         <j:set var="changelog_url" value="${app.CHANGELOG_URL}"/>
         ${%NewVersionAvailable(ucData.core.version,ucData.core.url,changelog_url)}
-        <j:if test="${ucData.canUpgrade()}">
-        <form method="post" action="${rootURL}/updateCenter/upgrade">
-          <f:submit value="${%Or Upgrade Automatically}"/>
-        </form>
-        </j:if>
+        <l:isAdmin>
+          <j:if test="${ucData.canUpgrade()}">
+            <form method="post" action="${rootURL}/updateCenter/upgrade">
+              <f:submit value="${%Or Upgrade Automatically}"/>
+            </form>
+          </j:if>
+        </l:isAdmin>
       </j:otherwise>
     </j:choose>
   </div>
diff --git a/core/src/main/resources/jenkins/security/UpdateSiteWarningsMonitor/message.groovy b/core/src/main/resources/jenkins/security/UpdateSiteWarningsMonitor/message.groovy
index 56cbb0bb4ddd..89b634002006 100644
--- a/core/src/main/resources/jenkins/security/UpdateSiteWarningsMonitor/message.groovy
+++ b/core/src/main/resources/jenkins/security/UpdateSiteWarningsMonitor/message.groovy
@@ -42,7 +42,7 @@ def listWarnings(warnings, boolean core) {
             }
         }
     }
-    if (fixables == warnings.size) {
+    if (fixables == warnings.size()) {
         dd {
             if (fixables == 1) {
                 raw(_(core ? "allFixable1Core" : "allFixable1", rootURL))
diff --git a/core/src/main/resources/lib/form/helpLink.jelly b/core/src/main/resources/lib/form/helpLink.jelly
index e7f2aa213c54..a388baf05f87 100644
--- a/core/src/main/resources/lib/form/helpLink.jelly
+++ b/core/src/main/resources/lib/form/helpLink.jelly
@@ -55,7 +55,7 @@ THE SOFTWARE.
   </st:documentation>
   <j:choose>
     <j:when test="${attrs.url!=null}">
-      <j:set var="altText" value="${attrs.featureName != null ? '%Help for feature:' + ' ' + h.escape(attrs.featureName) : '%Help'}" />
+      <j:set var="altText" value="${attrs.featureName != null ? '%Help for feature:' + ' ' + attrs.featureName : '%Help'}" />
       <a href="#" class="jenkins-help-button" tooltip="${altText}" helpURL="${rootURL}${attrs.url}">
         <!-- .jenkins-help-button span element is required as it's restyled in CSS -->
         <span>?</span>
diff --git a/test/src/test/java/jenkins/security/Security2779Test.java b/test/src/test/java/jenkins/security/Security2779Test.java
index ef8ef8fef7d5..8e2460687aaf 100644
--- a/test/src/test/java/jenkins/security/Security2779Test.java
+++ b/test/src/test/java/jenkins/security/Security2779Test.java
@@ -49,7 +49,7 @@ private void noCrossSiteScriptingInHelp(String selector) throws Exception {
 
         // assert leading space to identify unintentional double-escaping (&amp;lt;) as test failure
         assertThat("tooltip does not contain dangerous HTML", jsResultString, not(containsString(" <img src=x")));
-        assertThat("tooltip contains safe text", jsResultString, containsString("lt;img src=x"));
+        assertThat("tooltip contains safe text", jsResultString, containsString(" &lt;img src=x"));
     }
 
     @TestExtension