diff --git a/scripts/reset-dev-env.sh b/scripts/reset-dev-env.sh
index 5bece6c74..79a767b21 100755
--- a/scripts/reset-dev-env.sh
+++ b/scripts/reset-dev-env.sh
@@ -212,8 +212,16 @@ if [ ! -f ~/.ssh/spinifex-key.pub ]; then
     ssh-keygen -t ed25519 -f ~/.ssh/spinifex-key -N ""
 fi
 
+# Trust the Spinifex CA certificate so TLS connections to predastore/awsgw work
+if [ -f "$HOME/spinifex/config/ca.pem" ]; then
+    echo "Adding Spinifex CA certificate to system trust store..."
+    sudo cp "$HOME/spinifex/config/ca.pem" /usr/local/share/ca-certificates/spinifex-ca.crt
+    sudo update-ca-certificates
+fi
+
 # Enable pprof for development
-PPROF_ENABLED=1 PPROF_OUTPUT=/tmp/spinifex-vm.prof ./scripts/start-dev.sh --build
+#PPROF_ENABLED=1 PPROF_OUTPUT=/tmp/spinifex-vm.prof ./scripts/start-dev.sh --build
+./scripts/start-dev.sh --build
 
 export AWS_PROFILE=spinifex
 
diff --git a/tests/e2e/run-e2e.sh b/tests/e2e/run-e2e.sh
index cce30786d..55fe16bcc 100755
--- a/tests/e2e/run-e2e.sh
+++ b/tests/e2e/run-e2e.sh
@@ -2996,13 +2996,15 @@ echo "  PASS: Bastion → private instance SSH works (hostname: $PRIV_HOSTNAME)"
     NAT_GW_ID=$(echo "$NAT_GW_OUTPUT" | jq -r '.NatGateway.NatGatewayId')
     echo "  NAT Gateway: $NAT_GW_ID"
 
-    # Create route table for private subnet with NAT GW route
+    # Create route table, associate with private subnet, THEN add NAT GW route.
+    # Order matters: CreateRoute publishes SNAT events for associated subnets,
+    # so the association must exist before the route is added.
     NAT_RTB=$(aws ec2 create-route-table --vpc-id "$DEFAULT_VPC" \
         --query 'RouteTable.RouteTableId' --output text)
-    aws ec2 create-route --route-table-id "$NAT_RTB" \
-        --destination-cidr-block 0.0.0.0/0 --nat-gateway-id "$NAT_GW_ID" > /dev/null
     NAT_RTB_ASSOC=$(aws ec2 associate-route-table --route-table-id "$NAT_RTB" \
         --subnet-id "$PRIV_SUBNET_ID" --query 'AssociationId' --output text)
+    aws ec2 create-route --route-table-id "$NAT_RTB" \
+        --destination-cidr-block 0.0.0.0/0 --nat-gateway-id "$NAT_GW_ID" > /dev/null
     echo "  Route: 0.0.0.0/0 → $NAT_GW_ID (rtb: $NAT_RTB, assoc: $NAT_RTB_ASSOC)"
 
     # Verify OVN SNAT rule exists