diff --git a/scripts/extract-artifacts.sh b/scripts/extract-artifacts.sh
index 1fc52be..10e2b74 100755
--- a/scripts/extract-artifacts.sh
+++ b/scripts/extract-artifacts.sh
@@ -82,7 +82,12 @@ DOT1X_FRAGMENT=""
 if [ "$DISABLE_DOT1X" = "true" ]; then
     echo "==> WARNING: building TEST cmdline with rd.dot1x=0 (802.1X + MACsec DISABLED)" >&2
     echo "             open-port NVMe-oF boot test only — do NOT ship this UKI." >&2
-    DOT1X_FRAGMENT="rd.dot1x=0 "
+    # ip=dhcp: with auth disabled, dracut brings the NIC up by DHCP (writes
+    # resolv.conf, satisfies rd.neednet) so the nvmf module can connect. The
+    # cmdline otherwise has no ip=, so nothing configures the NIC. Test-only —
+    # in the secure build the hook owns the link (macsec0); ip=dhcp must NOT be
+    # set there.
+    DOT1X_FRAGMENT="rd.dot1x=0 ip=dhcp "
 fi
 printf '%s' \
   "$DOT1X_FRAGMENT" \
diff --git a/serving/.env.example b/serving/.env.example
index e28ef7c..c50c2b2 100644
--- a/serving/.env.example
+++ b/serving/.env.example
@@ -1,7 +1,7 @@
 # Copy to .env and edit for your test LAN/bridge, then: docker compose up -d
 
 # Release being served. Must match the Packer build (fleet-<version>.efi).
-IMAGE_VERSION=0.0.0-e98d881
+IMAGE_VERSION=0.0.0-cbd92ba
 
 # OCI release-artifact image (built by scripts/build-oci.sh). Mounted directly
 # as a Docker image volume — the default artifact source. Pin by digest in
@@ -10,7 +10,7 @@ OCI_IMAGE=git.bitasylum.org/audiobuzz/fleet-boot
 
 # Fallback only (Docker < 28 / offline): local Packer output dir, used by the
 # commented bind-mounts in docker-compose.yml. Ignored when image volumes work.
-ARTIFACT_SRC=../artifacts/0.0.0-e98d881
+ARTIFACT_SRC=../artifacts/0.0.0-cbd92ba
 
 # SPDK NVMe/TCP target image — prebuilt + pushed by CI
 # (.gitea/workflows/spdk-image.yaml); the serving host just pulls it.