diff --git a/apps/vms/unifi/unifi-cloudinit.yaml b/apps/vms/unifi/unifi-cloudinit.yaml
deleted file mode 100644
index 058669d..0000000
--- a/apps/vms/unifi/unifi-cloudinit.yaml
+++ /dev/null
@@ -1,59 +0,0 @@
-#cloud-config
-# UniFi OS Server VM cloud-init. Wrapped into a Secret (userDataSecretRef) by the kustomization's
-# secretGenerator because it exceeds KubeVirt's 2048-byte inline cloudInitNoCloud.userData limit.
-# NON-SENSITIVE (a public SSH key + a public installer script), so it is NOT SOPS-encrypted.
-#
-# install-uos resolves the LATEST UniFi OS Server linux-x64 installer from Ubiquiti's PUBLIC firmware
-# API (fw-update.ui.com/api/firmware-latest, no auth) — no per-release URL to bump (override with
-# UOS_URL=<href>). cloud-init installs the prerequisites, downloads the installer (~840MB) and runs it
-# NON-INTERACTIVELY (`yes |`). The UI comes up on https://<vip>:11443 once installed.
-hostname: unifi
-fqdn: unifi.home.keithjackson.dev
-# Break-glass OS access on the default `ubuntu` user (public key — safe to commit) for ops/debugging.
-# qemu-guest-agent (below) additionally enables `virtctl` guest access.
-ssh_pwauth: false
-ssh_authorized_keys:
-  - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCq3JM7CD3P+OExaD4sQARLDQUf5QqDRemAO0qWA3fG7O/6ncgX0d/xN95lJ5Ei8LewlzXF5cCVe43oJ5CJRjh41igWZ38XXgOQcbAbY0lZTJlJg/SAj9Xni++JY3Jws5Nslm8qCrqt1bDsP3O3Lnp4hmBVZ+1eJy3v9HlJ2/1mVOukIob/zVXQNdOpVx1+oubNqo+UYt3l1IxqF8x+2JlHt+POaTBMqbC3JDCaStkkHN20xItpydHZ2uSamXaTx2MH+rQjrABjuD6Xxbhxhx0hG2XrVDWyAuq91aZUpuDkybcuHnpQUSHeZJCMqDCd3Q8yd/dyifDZE8QcnY5hiVHJF8VzJT/r5+em+I4LESlE5WNfq80TWG42d9gw7Yi/8xT38iDm+0nArMd/laAPpH0JGvdIyMdWcVZgfWTgcT6EZ9cIK2J4N+ijrh/V+xwzApmYyMdVsu2UjMeKrJG4VZk43XKnpfJCLJ2LmwtPMKqrI+wyge9Bav2+t+taznKP141gL6YJW3gwArzj+oktK+/fbahtBAUnjh5emLb2rv0gbAHC9cNbovEIdA3A6FDME96zAlozU4AtoCTA7SA1AqIHuAOHkqGYFBV77eriO85K0J1qo0FwuByFINI6G/JtEnNa+CjJLvh0clJonw+6+iR2vB1hwfDmLLwrE7QRT7Ho9w== me@keithjackson.dev
-package_update: true
-package_upgrade: false
-packages:
-  - qemu-guest-agent
-  - podman
-  - uidmap
-  - slirp4netns
-  - ca-certificates
-  - curl
-  - jq
-  - cloud-guest-utils
-write_files:
-  # Install (or reinstall) UniFi OS Server. URL is public/no-auth; override at runtime with:
-  #   sudo UOS_URL='https://fw-download.ubnt.com/...' install-uos
-  - path: /usr/local/sbin/install-uos
-    permissions: '0755'
-    content: |
-      #!/usr/bin/env bash
-      set -euo pipefail
-      # Resolve the latest UOS linux-x64 installer from Ubiquiti's public firmware API (no auth).
-      # Override by exporting UOS_URL=<href> to pin a specific build.
-      if [ -z "${UOS_URL:-}" ]; then
-        UOS_URL="$(curl -fsSL https://fw-update.ui.com/api/firmware-latest | jq -r '
-          ._embedded.firmware
-          | map(select(.product == "unifi-os-server" and .platform == "linux-x64"))
-          | sort_by(.version_major, .version_minor, .version_patch)
-          | last._links.data.href')"
-      fi
-      [ -n "${UOS_URL}" ] && [ "${UOS_URL}" != "null" ] || { echo "could not resolve UOS installer URL"; exit 1; }
-      tmp="$(mktemp /tmp/uos-installer.XXXXXX)"
-      echo "Downloading UOS installer: ${UOS_URL}"
-      curl -fL --retry 5 --retry-delay 10 -o "$tmp" "$UOS_URL"
-      chmod +x "$tmp"
-      echo "Running UOS installer non-interactively"
-      yes | "$tmp"
-      echo "UOS install finished; 'uosserver status' should report running (UI :11443)"
-runcmd:
-  - [ systemctl, enable, --now, qemu-guest-agent ]
-  - [ systemctl, enable, --now, podman.socket ]
-  # Full unattended install; tee to the serial console AND /var/log/uos-install.log for visibility.
-  # Non-fatal so a failed install leaves the VM up for `sudo install-uos`.
-  - [ 'bash', '-lc', '/usr/local/sbin/install-uos 2>&1 | tee /var/log/uos-install.log | tee /dev/console; echo "install-uos exit=${PIPESTATUS[0]}" | tee -a /var/log/uos-install.log > /dev/console' ]
-final_message: "cloud-init finished; UOS install log at /var/log/uos-install.log (UI :11443)"