diff --git a/diskless.pkr.hcl b/diskless.pkr.hcl
index c48eb98..eb68350 100644
--- a/diskless.pkr.hcl
+++ b/diskless.pkr.hcl
@@ -210,22 +210,20 @@ build {
       # No local bootloader regeneration wanted on kernel updates inside CI
       "command -v grub2-mkconfig >/dev/null && echo 'GRUB updates not used on diskless hosts' || true",
 
-      # ---- DEBUG (temporary): why isn't nvmf-connect.service landing? -----
-      "echo '=== 95dot1x-macsec module dir on build VM ==='; ls -la /usr/lib/dracut/modules.d/95dot1x-macsec/ || true",
-      "echo '=== module-setup.sh nvmf/unitdir lines ==='; grep -n 'nvmf-connect\\|_unitdir\\|systemdsystemunitdir' /usr/lib/dracut/modules.d/95dot1x-macsec/module-setup.sh || echo NONE",
-
       # ---- Build the fleet-generic initramfs ------------------------------
       # %%{ escapes the rpm query tags so Packer's HCL template engine treats
       # them as literals (a bare %{...} is parsed as a template directive).
       "KVER=$(rpm -q --qf '%%{VERSION}-%%{RELEASE}.%%{ARCH}\\n' kernel | sort -V | tail -1)",
-      "dracut --debug -f --no-hostonly --kver \"$KVER\" /boot/initramfs-generic.img 2>/tmp/dracut.log",
-      "echo '=== ALL nvmf-connect mentions in dracut.log (install AND any later removal) ==='; grep -n 'nvmf-connect' /tmp/dracut.log || echo NONE",
-      "echo '=== final image: nvmf/dot1x survivors ==='; lsinitrd /boot/initramfs-generic.img | grep -iE 'nvmf|dot1x|sbin/nvmf' || echo 'NO nvmf/dot1x files survived'",
-      "lsinitrd /boot/initramfs-generic.img | grep -E 'macsec|wpa_supplicant|tpm2_nvread|nvme.tcp|erofs|veritysetup' ",
-      # Assert the test-mode NVMe-oF connect unit made it in (the dracut module
-      # installs it; this initramfs is systemd-driven so the connect is a
-      # systemd unit, not a dracut hook). Hard-fail if missing.
-      "lsinitrd /boot/initramfs-generic.img | grep -q 'nvmf-connect.service' || { echo 'ERROR: nvmf-connect.service missing from initramfs' >&2; exit 1; }",
+      "dracut -f --no-hostonly --kver \"$KVER\" /boot/initramfs-generic.img",
+      # Capture the listing to a file and grep THAT — never `lsinitrd | grep -q`.
+      # grep -q closes the pipe on first match, lsinitrd dies of SIGPIPE, and
+      # under pipefail the pipeline reports failure even when the file is
+      # present (a false negative that wrongly failed the build for many runs).
+      "lsinitrd /boot/initramfs-generic.img > /tmp/lsinitrd.txt",
+      "grep -E 'macsec|wpa_supplicant|tpm2_nvread|nvme.tcp|erofs|veritysetup' /tmp/lsinitrd.txt",
+      # Assert the test-mode NVMe-oF connect unit made it in (systemd-driven
+      # initramfs → the connect is a systemd unit, not a dracut hook).
+      "grep -q 'nvmf-connect.service' /tmp/lsinitrd.txt || { echo 'ERROR: nvmf-connect.service missing from initramfs' >&2; exit 1; }",
 
       # ---- Build hygiene ---------------------------------------------------
       "dnf clean all",
diff --git a/docs/TODO.md b/docs/TODO.md
index bfcf2d4..363e979 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -162,6 +162,17 @@ boot LAN.
     `${systemdsystemunitdir:-/usr/lib/systemd/system}` fallback and `return 1`
     if the unit didn't land, so the build fails loudly instead of shipping a UKI
     that can't connect its root.
+    Second gotcha: the build assertion `lsinitrd … | grep -q 'nvmf-connect.service'`
+    was a **false negative** — `grep -q` exits on first match, closes the pipe,
+    `lsinitrd` dies of SIGPIPE, and under `pipefail` the pipeline reports failure
+    even though the unit IS present. This masked the fact that the systemd unit
+    install was working all along. Fix: `lsinitrd > file; grep -q … file` (no
+    pipe). Never `lsinitrd | grep -q` under pipefail.
+    Bonus: the survivor listing confirmed nvme-cli's native autoconnect bits ARE
+    in the initramfs (`/usr/sbin/nvmf-autoconnect.sh`,
+    `/etc/udev/rules.d/95-nvmf-initqueue.rules`) — so the fully-native
+    `rd.nvmf.discover` autoconnect path is available as a fallback if the unit
+    doesn't fire on boot.
     **⚠ The secure path has the same dependency on the
     (absent) nvmf autoconnect** — when 802.1X is re-enabled, the macsec0 path
     must likewise drive `connect-all` (or the network-manager port #1 must wire