diff --git a/docs/TODO.md b/docs/TODO.md
index 441b9fa..df3c65e 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -128,6 +128,16 @@ boot LAN.
   - `nvme_tcp`/`nvme_fabrics` must be loaded before `/dev/nvme-fabrics` exists
     (dracut's `nvmf` module does this in a normal boot; at `rd.break` modprobe
     manually).
+  - **Don't double-configure the NIC in test mode.** With `ip=dhcp` on the
+    cmdline, dracut's network module brings the NIC up AND emits the "online"
+    event that the `nvmf` module's `initqueue/online` hook waits on to run
+    `nvme connect-all`. The `rd.dot1x=0` bypass used to *also* `ifup $NIC`,
+    which (a) raced dracut → `Error: ipv4: Address already assigned`, and (b)
+    didn't fire the nvmf online hook, so the namespace never auto-connected and
+    boot spun on `/dev/mapper/root` forever (manual `connect-all` worked, which
+    is what masked it). **Fixed:** the bypass branch no longer touches the NIC;
+    `ip=dhcp` owns networking and triggers nvmf autoconnect. (The secure path
+    still addresses macsec0 itself — dracut doesn't know about that interface.)
   - The target Rocky 9 kernel's erofs is built **without
     `CONFIG_EROFS_FS_ZIP`** — mounting a compressed image fails `erofs: lz4
     algorithm isn't enabled`, which silently blocks the root mount. **Fixed:**
diff --git a/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh b/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh
index 44b9383..b7f0867 100755
--- a/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh
+++ b/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh
@@ -42,10 +42,17 @@ info "dot1x-macsec: using interface $NIC, NV index $NVINDEX"
 # networks only. Remove rd.dot1x=0 from the cmdline to restore full security.
 if [ "$(getarg rd.dot1x=)" = "0" ]; then
     warn "dot1x-macsec: 802.1X/MACsec DISABLED (rd.dot1x=0) — TEST MODE, no link security"
-    ip link set "$NIC" up
-    # Plain DHCP on the physical NIC via network-legacy (mirrors how the secure
-    # path addresses macsec0); satisfies rd.neednet for the nvmf module.
-    ifup "$NIC"
+    # Networking in test mode is owned ENTIRELY by `ip=dhcp` on the cmdline:
+    # dracut's network module brings the NIC up, gets a DHCP lease, writes
+    # resolv.conf, and — crucially — emits the "online" event that dracut's
+    # nvmf module's initqueue/online hook waits on to run `nvme connect-all`.
+    # Do NOT `ifup`/`ip link set up` the NIC here: it races dracut's own
+    # bring-up ("Error: ipv4: Address already assigned") and, because it isn't
+    # dracut's network path, never fires the nvmf online hook — so the NVMe
+    # namespace never connects and the boot spins on the root device forever.
+    # (The secure path below is different: there the hook owns macsec0, which
+    # dracut knows nothing about, so it must address it itself.)
+    #
     # Static test NVMe identity (the secure path derives this from the TPM
     # cert). Match these on the nvmet target if it filters by host NQN.
     if [ ! -s /etc/nvme/hostnqn ]; then
diff --git a/serving/.env.example b/serving/.env.example
index 93e16e6..20133ca 100644
--- a/serving/.env.example
+++ b/serving/.env.example
@@ -1,7 +1,7 @@
 # Copy to .env and edit for your test LAN/bridge, then: docker compose up -d
 
 # Release being served. Must match the Packer build (fleet-<version>.efi).
-IMAGE_VERSION=0.0.0-754eced
+IMAGE_VERSION=0.0.0-67802e2
 
 # OCI release-artifact image (built by scripts/build-oci.sh). Mounted directly
 # as a Docker image volume — the default artifact source. Pin by digest in
@@ -10,7 +10,7 @@ OCI_IMAGE=git.bitasylum.org/audiobuzz/fleet-boot
 
 # Fallback only (Docker < 28 / offline): local Packer output dir, used by the
 # commented bind-mounts in docker-compose.yml. Ignored when image volumes work.
-ARTIFACT_SRC=../artifacts/0.0.0-754eced
+ARTIFACT_SRC=../artifacts/0.0.0-67802e2
 
 # SPDK NVMe/TCP target image — prebuilt + pushed by CI
 # (.gitea/workflows/spdk-image.yaml); the serving host just pulls it.