diff --git a/build/systemd/spinifex-daemon.service b/build/systemd/spinifex-daemon.service
index c37d28224..84307522e 100644
--- a/build/systemd/spinifex-daemon.service
+++ b/build/systemd/spinifex-daemon.service
@@ -34,13 +34,14 @@ LockPersonality=yes
 RestrictRealtime=yes
 RestrictNamespaces=yes
 ProtectClock=yes
-ProtectKernelTunables=yes
+# Required for dhcpcd (issue dhcpcd[867]: br-wan: if_init: Read-only file system)
+ProtectKernelTunables=no
 ProtectKernelModules=yes
 ProtectKernelLogs=yes
 ProtectControlGroups=yes
 ProtectProc=invisible
 SystemCallArchitectures=native
-MemoryDenyWriteExecute=yes
+MemoryDenyWriteExecute=no
 # AF_PACKET is required by dhcpcd (raw L2 BOOTP before the iface has an IP).
 RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK AF_PACKET
 ProtectHostname=yes
diff --git a/spinifex/handlers/ec2/vpc/external_ipam_dhcp.go b/spinifex/handlers/ec2/vpc/external_ipam_dhcp.go
index b46846a18..7cda46c71 100644
--- a/spinifex/handlers/ec2/vpc/external_ipam_dhcp.go
+++ b/spinifex/handlers/ec2/vpc/external_ipam_dhcp.go
@@ -51,12 +51,17 @@ func ObtainDHCPLease(bridge, clientID string) (string, error) {
 	//   --noconfigure   = don't add IP to interface (OVN handles traffic)
 	//   -1              = exit after obtaining a lease (don't daemonize)
 	//   -4              = IPv4 only
-	//   -I clientID     = unique client identifier per ENI
+	//	 -T				 = TEST MODE
+	//   -I clientID     = unique client identifier per ENI (Required to generate different IP from the DHCP server)
 	//   -t 15           = 15 second timeout
 	cmd := exec.Command("sudo", dhcpcdBin,
 		"--noconfigure",
 		"-1",
 		"-4",
+
+		// Previous bug, if dhcpcd already running (e.g dhcp mode set on an interface, will send cmd to daemon, not STDOUT)
+		"-T",
+
 		"-I", clientID,
 		"-t", "15",
 		bridge,