diff --git a/scripts/reset-dev-env.sh b/scripts/reset-dev-env.sh
index 7dfff0bfc..1d927c25a 100755
--- a/scripts/reset-dev-env.sh
+++ b/scripts/reset-dev-env.sh
@@ -112,33 +112,46 @@ echo "Removing ~/spinifex"
 rm -rf ~/spinifex
 
 # --- Re-initialize ---
-# Detect WAN interface (default route) for external bridge.
+# Detect WAN interface (default route).
 WAN_IFACE=$(ip -4 route show default | awk '{print $5}' | head -1)
 WAN_GW=$(ip -4 route show default | awk '{print $3}' | head -1)
 
 echo "Detected WAN interface: ${WAN_IFACE:-none}, gateway: ${WAN_GW:-none}"
 
-# Detect SSH/management NIC: the interface carrying the active SSH session.
-# If SSH_CONNECTION is set (remote session), extract the server IP and find its NIC.
-# If not set (local console), fall back to the WAN NIC (assume single-NIC host).
-SSH_NIC=""
-if [ -n "${SSH_CONNECTION:-}" ]; then
-    SSH_IP=$(echo "$SSH_CONNECTION" | awk '{print $3}')
-    SSH_NIC=$(ip -o -4 addr show | awk -v ip="$SSH_IP" '$0 ~ ip"/" {print $2}' | head -1)
+# Check if WAN interface is already a bridge (tofu-cluster / production setup).
+# If so, setup-ovn.sh auto-detects it. If it's a physical NIC, we need to
+# decide between direct bridge and macvlan based on SSH safety.
+WAN_IS_BRIDGE=false
+if [ -n "$WAN_IFACE" ]; then
+    if ip -d link show "$WAN_IFACE" 2>/dev/null | grep -q "bridge"; then
+        WAN_IS_BRIDGE=true
+    fi
 fi
-if [ -z "$SSH_NIC" ]; then
-    SSH_NIC="$WAN_IFACE"
-fi
-echo "Detected SSH/management NIC: ${SSH_NIC:-none}"
 
-# Choose bridge mode: direct bridge when WAN NIC != SSH NIC (dedicated WAN NIC
-# available). Macvlan fallback when they're the same (single-NIC host).
-BRIDGE_MODE_FLAG=""
-if [ -n "$WAN_IFACE" ] && [ "$WAN_IFACE" != "$SSH_NIC" ]; then
-    BRIDGE_MODE_FLAG="--direct"
-    echo "  Bridge mode: direct (WAN=$WAN_IFACE != SSH=$SSH_NIC)"
-else
-    echo "  Bridge mode: macvlan (WAN=$WAN_IFACE == SSH=$SSH_NIC)"
+# Build setup-ovn.sh flags based on detected topology
+SETUP_OVN_FLAGS=""
+if [ "$WAN_IS_BRIDGE" = true ]; then
+    # WAN is already a bridge (e.g. br-wan from cloud-init) — setup-ovn.sh
+    # auto-detects it, no explicit flags needed.
+    echo "  WAN is a bridge: $WAN_IFACE (auto-detected)"
+elif [ -n "$WAN_IFACE" ]; then
+    # WAN is a physical NIC. Detect SSH NIC to decide bridge strategy.
+    SSH_NIC=""
+    if [ -n "${SSH_CONNECTION:-}" ]; then
+        SSH_IP=$(echo "$SSH_CONNECTION" | awk '{print $3}')
+        SSH_NIC=$(ip -o -4 addr show | awk -v ip="$SSH_IP" '$0 ~ ip"/" {print $2}' | head -1)
+    fi
+    if [ -z "$SSH_NIC" ]; then
+        SSH_NIC="$WAN_IFACE"
+    fi
+
+    if [ "$WAN_IFACE" != "$SSH_NIC" ]; then
+        SETUP_OVN_FLAGS="--wan-bridge=br-wan --wan-iface=$WAN_IFACE"
+        echo "  Bridge mode: direct (WAN=$WAN_IFACE != SSH=$SSH_NIC)"
+    else
+        SETUP_OVN_FLAGS="--macvlan --wan-iface=$WAN_IFACE"
+        echo "  Bridge mode: macvlan (WAN=$WAN_IFACE == SSH=$SSH_NIC)"
+    fi
 fi
 
 # Chassis ID must match what vpcd derives from the node name in spinifex.toml.
@@ -149,13 +162,7 @@ NODE_NAME="node1"
 CHASSIS_ID="chassis-${NODE_NAME}"
 
 echo "Re-initializing OVN (chassis-id: $CHASSIS_ID)"
-if [ -n "$WAN_IFACE" ]; then
-    echo "  Using $WAN_IFACE for br-external"
-    ./scripts/setup-ovn.sh --management --external-bridge --external-iface="$WAN_IFACE" $BRIDGE_MODE_FLAG --chassis-id="$CHASSIS_ID"
-else
-    echo "  No WAN interface detected, management-only"
-    ./scripts/setup-ovn.sh --management --chassis-id="$CHASSIS_ID"
-fi
+./scripts/setup-ovn.sh --management $SETUP_OVN_FLAGS --chassis-id="$CHASSIS_ID"
 
 echo "Initializing platform"
 ADMIN_INIT_ARGS="--region $REGION --az ${REGION}a --node node1 --nodes 1"
diff --git a/scripts/stop-dev.sh b/scripts/stop-dev.sh
index b7e46ce07..65fd1b54a 100755
--- a/scripts/stop-dev.sh
+++ b/scripts/stop-dev.sh
@@ -161,9 +161,18 @@ if pidof systemd >/dev/null 2>&1; then
         sudo systemctl stop ovn-central 2>/dev/null && echo "✅ ovn-central stopped" || true
     fi
 
-    # Only stop OVS if br-external does NOT have an IP (safe to tear down)
-    if sudo ovs-vsctl br-exists br-external 2>/dev/null && ip -4 addr show br-external 2>/dev/null | grep -q "inet "; then
-        echo "⚠️  Skipping openvswitch-switch stop (br-external has WAN IP — stopping would kill connectivity)"
+    # Only stop OVS if the WAN bridge does NOT have an IP (safe to tear down).
+    # Check all OVS bridges — any bridge with a WAN IP means OVS is infrastructure.
+    WAN_BRIDGE_HAS_IP=false
+    for br in $(sudo ovs-vsctl list-br 2>/dev/null); do
+        if [ "$br" = "br-int" ]; then continue; fi
+        if ip -4 addr show "$br" 2>/dev/null | grep -q "inet "; then
+            WAN_BRIDGE_HAS_IP=true
+            break
+        fi
+    done
+    if [ "$WAN_BRIDGE_HAS_IP" = true ]; then
+        echo "⚠️  Skipping openvswitch-switch stop ($br has WAN IP — stopping would kill connectivity)"
     else
         sudo systemctl stop openvswitch-switch 2>/dev/null && echo "✅ openvswitch-switch stopped" || true
     fi