diff --git a/apps/vms/unifi/30-virtualmachine.yaml b/apps/vms/unifi/30-virtualmachine.yaml
index fec037e..d01f8c1 100644
--- a/apps/vms/unifi/30-virtualmachine.yaml
+++ b/apps/vms/unifi/30-virtualmachine.yaml
@@ -95,8 +95,22 @@ spec:
               disk:
                 bus: virtio
           interfaces:
+            # MAC PINNED 2026-09-18, and this is a root-cause fix, not cosmetics.
+            # KubeVirt generates a fresh MAC for every VMI when none is pinned. cloud-init writes
+            # /etc/netplan/50-cloud-init.yaml with a `match` on the MAC it saw, and it will NOT rewrite
+            # that file while the NoCloud instance-id is unchanged — and the instance-id here is
+            # domain.firmware.uuid, which is stable across restarts by design. So each VMI recreation
+            # handed the guest a NEW MAC that the retained netplan did not match, leaving enp1s0
+            # administratively DOWN with no address and no DHCP attempt.
+            # That is exactly what the evidence shows for the boot of 2026-09-12: cloud-init's own
+            # device table reports `enp1s0 | Up: False | Address: .`, no apt failures are logged
+            # (because the per-instance modules were skipped), yet UOS is installed and
+            # qemu-guest-agent runs — both of which required a working network on an EARLIER VMI.
+            # Pinning the MAC to the value the current VMI already holds makes the guest's netplan
+            # match permanently, so this cannot recur on the next recreation.
             - name: default
               masquerade: {}
+              macAddress: a6:d7:c0:b3:72:fa
               # Declaring ports on a masquerade iface (a) restricts pod->VM forwarding to exactly
               # these and (b) surfaces them as containerPorts on the virt-launcher pod so the
               # LoadBalancer Services + CiliumNetworkPolicy ingress can target/match them.
diff --git a/apps/vms/unifi/unifi-uos-installer.sops.yaml b/apps/vms/unifi/unifi-uos-installer.sops.yaml
index 33403ac..89d5f03 100644
--- a/apps/vms/unifi/unifi-uos-installer.sops.yaml
+++ b/apps/vms/unifi/unifi-uos-installer.sops.yaml
@@ -5,8 +5,8 @@ metadata:
     namespace: unifi
 type: Opaque
 stringData:
-    installer-url: ENC[AES256_GCM,data:CGCWLMiHlF57/w==,iv:/tilBVekwbHkAjSBi5UKUljfaqPo/hXhNqMYS4LY/kA=,tag:b7SeEM30ua/HvutGHYEdXg==,type:str]
-    console-password: ENC[AES256_GCM,data:gkPbmZ4g7he2WA==,iv:T9PUgAmOsrt4LUB+5vXBr9ctOPsXP5z/vMWr2ls+3ko=,tag:83HDr4kCrUF7u83fpIkm4A==,type:str]
+    installer-url: ENC[AES256_GCM,data:2sdkFOPxQ4ZrBQ==,iv:OnEip59rvdSulZASp5J8Gj2M55wuYD9TcACd63lqwBA=,tag:hJ437ZbPEnee/t48Sm6eBg==,type:str]
+    console-password: ENC[AES256_GCM,data:XwTpKiqnzBz/ydaa+Mbv,iv:A2sWqkDaM+GD4e0t8wKC75UM15WprYmNHNEpNyb+m/c=,tag:VKlGvpyRIQ4dqcgWTpuqiQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -16,14 +16,14 @@ sops:
         - recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIV3hvNUVRTWxINmtaQkp5
-            a0VkYitYNHFWUGRhYncxVXl4MFdET1VmQTJZCnVXaDhaRHpQVkdHWG4xUElqRFNG
-            VUhPU3dpa0VMWGxQdUxGeDZuNFZWVm8KLS0tIEFMY2RNVDBvMG51SkhqVzlXUjRR
-            TG9kcHdSTU5QOGpnLzkyVW9hUWJLem8KW536eEsviMq5/uyg3/RT/PrEgr4PBL3E
-            yNemOTU76DdU81/neHb/6NVWT44ffLoCltgSrCQ0ieBwDAorjQ3bEg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRYlFOZ25ycWRCWUpyMjdQ
+            OFMrWUNyMWJOVlF3MU9DY1phWnhZQ1YyeFVZCkc0WTVia2RyTkhreFYyS3Bya08r
+            bWwvMWt5a3E5OXh5b0xIT0FKQUE0d0UKLS0tIDJSaEc5YndEOFgrbkhlZm5TRVI5
+            RVo1bWwxL0lCR2NpUENUdGovREF1K1UKnJHnFsUkg4drovNCB5xSqVUaQF48b1No
+            tI5+ABiIv3fjuuf+hW7lOm7M1F3jAwlNAgbe8wBqS2C9Wx5MV1kGDA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-09-19T01:51:00Z"
-    mac: ENC[AES256_GCM,data:yKGOdLKnIUUeSyJuzyp4CiJFhTyIJv6S8PTEdnioCpeSoRpptWYQIKR8BUrYx1/4NnghvOEyS5o0nRT56dq7vf2G+CoRf03/alDW/YHUjkAfIRjorPCO638mjdIPDytfsTBOyBXnjzjMlhHwoDjHskk+J66Qm42xFd476w9cYig=,iv:M1SwKW2ZUehklgUP+n3fefb2XoDDPBs5HnTklVh3KwM=,tag:q6eoA+pdHnwWKxQODCN7jQ==,type:str]
+    lastmodified: "2026-09-19T02:30:07Z"
+    mac: ENC[AES256_GCM,data://GkUcyrDWgcNE769Q37CT95NQYQ6KVHN31+ZQBu+S1FD1Gk7GCyHyaGPRzUjcQk60WgD12brLwr9F0e021L40NTK/ZHvsnBtFd8WpydUNLOuCitJShlMX1/VsXZvP0FHeV0/PZlb1Qebzunhgkwt8B4FUJ0D+yycNzlDrFz1Ko=,iv:iVJLPIKs4inK+dzDd06ewC8euHXMwcmwIip4ntnEmp4=,tag:X93BJEVMrIlYoQO3KiZJ0g==,type:str]
     pgp: []
     encrypted_regex: ^(data|stringData)$
     version: 3.9.4