diff --git a/build/systemd/spinifex-vpcd.service b/build/systemd/spinifex-vpcd.service
index 94be72214..697d3e84d 100644
--- a/build/systemd/spinifex-vpcd.service
+++ b/build/systemd/spinifex-vpcd.service
@@ -18,14 +18,14 @@ Environment=SPINIFEX_BASE_DIR=/var/lib/spinifex/vpcd/
 
 # Filesystem access — NoNewPrivileges omitted (vpcd uses sudo for ovs-vsctl, ovn-nbctl, systemctl)
 ProtectSystem=full
-PrivateDevices=yes
+PrivateDevices=no
 ReadOnlyPaths=/etc/spinifex/spinifex.toml /etc/spinifex/ca.pem
 ReadWritePaths=/var/lib/spinifex/vpcd /var/log/spinifex
 
 # Hardening
 ProtectHome=yes
 PrivateTmp=yes
-RestrictSUIDSGID=yes
+RestrictSUIDSGID=no
 LockPersonality=yes
 RestrictRealtime=yes
 RestrictNamespaces=yes
@@ -36,7 +36,7 @@ ProtectKernelLogs=yes
 ProtectControlGroups=yes
 ProtectProc=invisible
 SystemCallArchitectures=native
-MemoryDenyWriteExecute=yes
+MemoryDenyWriteExecute=no
 # AF_PACKET: required by the in-process DHCP client (github.com/insomniacslk/dhcp
 # / nclient4) for raw L2 BOOTP on br-wan before an IP is configured on the
 # interface. See docs/development/bugs/dhcp-allocate-error.md.
@@ -44,8 +44,10 @@ RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK AF_PACKET
 # CAP_NET_RAW: open AF_PACKET sockets.
 # CAP_NET_BIND_SERVICE: covers unicast RENEW to UDP :68.
 # CAP_NET_ADMIN: already used for ovs-vsctl / ip link wiring on the bridge.
-AmbientCapabilities=CAP_NET_RAW
-CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_NET_BIND_SERVICE
+# Note, disabled for now, sudo issue with ovs
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW CAP_NET_BIND_SERVICE CAP_SETUID CAP_SETGID
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_NET_BIND_SERVICE CAP_SETUID CAP_SETGID
+NoNewPrivileges=no
 ProtectHostname=yes
 KeyringMode=private
 RemoveIPC=yes
diff --git a/scripts/smoke-test.sh b/scripts/smoke-test.sh
index 7c06694dc..df99f6fd7 100755
--- a/scripts/smoke-test.sh
+++ b/scripts/smoke-test.sh
@@ -38,14 +38,17 @@ if [ ! -f "$SSH_KEY.pub" ]; then
 fi
 
 echo "==> Importing SSH key"
-aws ec2 import-key-pair --key-name spinifex-key \
+! aws ec2 import-key-pair --key-name spinifex-key \
     --public-key-material "fileb://$SSH_KEY.pub"
 aws ec2 describe-key-pairs
 
+# --- Import AMI ---
 # --- Import AMI ---
 echo "==> Importing AMI"
+
 LOCAL_IMAGE="$HOME/images/ubuntu-24.04.img"
 ARCH=$(uname -m)
+
 case "$ARCH" in
     x86_64)        IMG_ARCH="x86_64"; IMAGE_NAME="ubuntu-24.04-x86_64" ;;
     aarch64|arm64) IMG_ARCH="arm64";  IMAGE_NAME="ubuntu-24.04-arm64"  ;;
@@ -55,13 +58,23 @@ case "$ARCH" in
         ;;
 esac
 
-if [ -f "$LOCAL_IMAGE" ]; then
-    echo "  Using local image: $LOCAL_IMAGE"
-    sudo /usr/local/bin/spx admin images import \
-        --file "$LOCAL_IMAGE" --distro ubuntu --version 24.04 --arch "$IMG_ARCH"
+AMI_NAME="ami-${IMAGE_NAME}"
+
+EXISTING_AMI_ID=$(aws ec2 describe-images \
+    --query "Images[?Name=='${AMI_NAME}'] | [0].ImageId" \
+    --output text)
+
+if [ -n "$EXISTING_AMI_ID" ] && [ "$EXISTING_AMI_ID" != "None" ]; then
+    echo "  AMI already exists, skipping import: $AMI_NAME ($EXISTING_AMI_ID)"
 else
-    echo "  Downloading image: $IMAGE_NAME"
-    sudo /usr/local/bin/spx admin images import --name "$IMAGE_NAME"
+    if [ -f "$LOCAL_IMAGE" ]; then
+        echo "  Using local image: $LOCAL_IMAGE"
+        sudo /usr/local/bin/spx admin images import \
+            --file "$LOCAL_IMAGE" --distro ubuntu --version 24.04 --arch "$IMG_ARCH"
+    else
+        echo "  Downloading image: $IMAGE_NAME"
+        sudo /usr/local/bin/spx admin images import --name "$IMAGE_NAME"
+    fi
 fi
 
 # --- Launch smoke-test instance ---
@@ -72,7 +85,10 @@ else
     INSTANCE_TYPE="t3.small"
 fi
 
-AMI_ID=$(aws ec2 describe-images --query "Images[0].ImageId" --output text)
+AMI_ID=$(aws ec2 describe-images \
+    --query "Images[?Name=='${AMI_NAME}'] | [0].ImageId" \
+    --output text)
+
 if [ -z "$AMI_ID" ] || [ "$AMI_ID" = "None" ]; then
     echo "❌ No AMI found"
     exit 1