diff --git a/tests/infrastructure/scripts/setup-storage-server.sh b/tests/infrastructure/scripts/setup-storage-server.sh
index 8e76149..654dda9 100644
--- a/tests/infrastructure/scripts/setup-storage-server.sh
+++ b/tests/infrastructure/scripts/setup-storage-server.sh
@@ -38,8 +38,21 @@ done
 # sshd accepts logins before cloud-init's first-boot work (and its apt/dpkg
 # locks) is finished; a degraded cloud-init result is fine for our purposes,
 # and a hung cloud-init must fail fast, not eat the job timeout.
+echo "Waiting for cloud-init to finish (up to 300s)..."
 timeout 300 ssh ${SSH_OPTS} "ubuntu@${STORAGE_IP}" \
-    "sudo cloud-init status --wait" || true
+    "sudo cloud-init status --wait" \
+    || echo "WARNING: cloud-init did not finish cleanly within 300s — continuing"
+
+echo "Network probe from the storage VM:"
+ssh ${SSH_OPTS} "ubuntu@${STORAGE_IP}" '
+    ip -4 -brief addr; ip route show default
+    ping -c1 -W2 "$(ip route show default | awk "{print \$3; exit}")" >/dev/null 2>&1 \
+        && echo "gateway ping:  OK" || echo "gateway ping:  FAIL"
+    ping -c1 -W2 1.1.1.1 >/dev/null 2>&1 \
+        && echo "internet ping: OK" || echo "internet ping: FAIL"
+    getent hosts archive.ubuntu.com >/dev/null 2>&1 \
+        && echo "DNS resolve:   OK" || echo "DNS resolve:   FAIL (resolv.conf: $(grep ^nameserver /etc/resolv.conf | tr "\n" " "))"
+' || true
 
 echo "Copying answer files..."
 ssh ${SSH_OPTS} "ubuntu@${STORAGE_IP}" \
@@ -53,11 +66,23 @@ ssh ${SSH_OPTS} "ubuntu@${STORAGE_IP}" \
 set -euo pipefail
 export DEBIAN_FRONTEND=noninteractive
 
-# cloud-init's first-boot apt activity can hold the dpkg lock briefly
-for i in $(seq 1 30); do
-    apt-get update -qq >/dev/null 2>&1 && break
+# cloud-init's first-boot apt activity can hold the dpkg lock briefly;
+# a network/DNS failure must fail fast with the real apt error, not fall
+# through to a misleading "package not found" from empty lists.
+echo "Updating apt package lists..."
+for i in $(seq 1 12); do
+    if apt_out=$(apt-get update -qq 2>&1); then
+        break
+    fi
+    echo "apt-get update attempt $i/12 failed"
+    if [ "$i" -eq 12 ]; then
+        echo "$apt_out" >&2
+        echo "ERROR: apt-get update never succeeded — check CI VLAN egress/DNS" >&2
+        exit 1
+    fi
     sleep 5
 done
+echo "Installing nfs-kernel-server, tgt, docker.io..."
 apt-get install -y -qq nfs-kernel-server tgt docker.io >/dev/null
 
 # Ubuntu's nfs-kernel-server package does not create /etc/exports.d
@@ -80,6 +105,7 @@ systemctl enable --now nfs-kernel-server tgt >/dev/null || {
 }
 systemctl restart tgt
 
+echo "Starting answer server container..."
 docker rm -f pvetest-answer-server >/dev/null 2>&1 || true
 docker run -d --name pvetest-answer-server --restart unless-stopped \
     --network host \