diff --git a/spinifex/daemon/daemon_system_instance.go b/spinifex/daemon/daemon_system_instance.go
index 854391dec..8d6dccc61 100644
--- a/spinifex/daemon/daemon_system_instance.go
+++ b/spinifex/daemon/daemon_system_instance.go
@@ -80,6 +80,10 @@ func (d *Daemon) LaunchSystemInstance(input *handlers_elbv2.SystemInstanceInput)
 	instance.Reservation.SetReservationId(utils.GenerateResourceID("r"))
 	instance.Reservation.SetOwnerId(accountID)
 	instance.Reservation.Instances = []*ec2.Instance{ec2Instance}
+	// Mirror the customer-instance path (handlers/ec2/instance/service_impl.go:334)
+	// so consumers reading instance.Instance (e.g. onInstanceUpHook's NAT
+	// republish, device_map, volumes) see the same metadata for system VMs.
+	instance.Instance = ec2Instance
 
 	// Attach ENI — either use pre-created one or auto-create
 	privateIP := ""
@@ -92,6 +96,17 @@ func (d *Daemon) LaunchSystemInstance(input *handlers_elbv2.SystemInstanceInput)
 		if input.SubnetID != "" {
 			ec2Instance.SetSubnetId(input.SubnetID)
 		}
+		// The auto-create-ENI branch below populates VpcId from the freshly
+		// created ENI; do the same for pre-created ENIs so consumers reading
+		// instance.Instance.VpcId (notably onInstanceUpHook's NAT republish)
+		// work uniformly across both paths.
+		if d.vpcService != nil {
+			if eniOut, descErr := d.vpcService.DescribeNetworkInterfaces(&ec2.DescribeNetworkInterfacesInput{
+				NetworkInterfaceIds: []*string{aws.String(input.ENIID)},
+			}, eniAccountID); descErr == nil && len(eniOut.NetworkInterfaces) > 0 && eniOut.NetworkInterfaces[0].VpcId != nil {
+				ec2Instance.SetVpcId(*eniOut.NetworkInterfaces[0].VpcId)
+			}
+		}
 		// Mark ENI as attached to this instance
 		if d.vpcService != nil {
 			if _, attachErr := d.vpcService.AttachENI(eniAccountID, instance.ENIId, instance.ID, 0); attachErr != nil {