diff --git a/docs/TODO.md b/docs/TODO.md
index df3c65e..5908aa1 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -136,8 +136,20 @@ boot LAN.
     didn't fire the nvmf online hook, so the namespace never auto-connected and
     boot spun on `/dev/mapper/root` forever (manual `connect-all` worked, which
     is what masked it). **Fixed:** the bypass branch no longer touches the NIC;
-    `ip=dhcp` owns networking and triggers nvmf autoconnect. (The secure path
-    still addresses macsec0 itself — dracut doesn't know about that interface.)
+    `ip=dhcp` owns networking. (The secure path still addresses macsec0 itself —
+    dracut doesn't know about that interface.)
+  - **dracut's `nvmf` module never auto-connects on this distro.** Its cmdline
+    hook (`92-parse-nvmf-boot-connections.sh`) parses `rd.nvmf.discover` into
+    `/etc/nvme/discovery.conf` correctly, but `initqueue/online/` is **empty** —
+    no autoconnect hook is registered, so `nvme connect-all` is never run (no
+    attempt in dmesg) and the namespace never appears. Drivers load and
+    `/dev/nvme-fabrics` exists; only the connect trigger is missing. **Fixed:**
+    `dot1x-macsec-up.sh` (rd.dot1x=0 branch) now parses the discover address and
+    queues `nvme connect-all` on the initqueue itself (retries until the
+    namespace shows up). **⚠ The secure path has the same dependency on the
+    (absent) nvmf autoconnect** — when 802.1X is re-enabled, the macsec0 path
+    must likewise drive `connect-all` (or the network-manager port #1 must wire
+    a working autoconnect). Currently only the test path is fixed.
   - The target Rocky 9 kernel's erofs is built **without
     `CONFIG_EROFS_FS_ZIP`** — mounting a compressed image fails `erofs: lz4
     algorithm isn't enabled`, which silently blocks the root mount. **Fixed:**
diff --git a/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh b/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh
index b7f0867..5121bb6 100755
--- a/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh
+++ b/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh
@@ -43,24 +43,41 @@ info "dot1x-macsec: using interface $NIC, NV index $NVINDEX"
 if [ "$(getarg rd.dot1x=)" = "0" ]; then
     warn "dot1x-macsec: 802.1X/MACsec DISABLED (rd.dot1x=0) — TEST MODE, no link security"
     # Networking in test mode is owned ENTIRELY by `ip=dhcp` on the cmdline:
-    # dracut's network module brings the NIC up, gets a DHCP lease, writes
-    # resolv.conf, and — crucially — emits the "online" event that dracut's
-    # nvmf module's initqueue/online hook waits on to run `nvme connect-all`.
-    # Do NOT `ifup`/`ip link set up` the NIC here: it races dracut's own
-    # bring-up ("Error: ipv4: Address already assigned") and, because it isn't
-    # dracut's network path, never fires the nvmf online hook — so the NVMe
-    # namespace never connects and the boot spins on the root device forever.
-    # (The secure path below is different: there the hook owns macsec0, which
-    # dracut knows nothing about, so it must address it itself.)
+    # dracut's network module brings the NIC up, gets a lease and writes
+    # resolv.conf. Do NOT `ifup`/`ip link set up` the NIC here — a second
+    # configuration races dracut's own ("Error: ipv4: Address already
+    # assigned"). (The secure path below is different: there the hook owns
+    # macsec0, which dracut knows nothing about, so it must address it itself.)
     #
     # Static test NVMe identity (the secure path derives this from the TPM
-    # cert). Match these on the nvmet target if it filters by host NQN.
+    # cert). SPDK serves "allow any host", so this is cosmetic here, but keep it
+    # so the target can host-filter if desired.
     if [ ! -s /etc/nvme/hostnqn ]; then
         mkdir -p /etc/nvme
         echo "nqn.2026-06.org.example.fleet:test-host"   > /etc/nvme/hostnqn
         echo "11111111-1111-1111-1111-111111111111"      > /etc/nvme/hostid
         info "dot1x-macsec: test hostnqn $(cat /etc/nvme/hostnqn)"
     fi
+
+    # Drive the NVMe-oF connect ourselves. This distro's dracut `nvmf` module
+    # parses rd.nvmf.discover into /etc/nvme/discovery.conf but registers NO
+    # initqueue/online autoconnect hook (that hook dir is empty), so
+    # `nvme connect-all` is never run, the root namespace never appears, and the
+    # boot spins on /dev/mapper/root forever. Queue connect-all on the main
+    # initqueue so it retries each loop until the namespace shows up (the link
+    # is already up via ip=dhcp; connect-all is idempotent once connected).
+    _disc=$(getarg rd.nvmf.discover=)        # e.g. tcp,192.168.50.10,4420
+    if [ -n "$_disc" ]; then
+        _trtype=${_disc%%,*}                 # tcp
+        _rest=${_disc#*,}                    # 192.168.50.10,4420
+        _traddr=${_rest%%,*}                 # 192.168.50.10
+        _trsvcid=${_rest##*,}                # 4420
+        info "dot1x-macsec: queueing nvme connect-all ${_trtype}/${_traddr}/${_trsvcid}"
+        /sbin/initqueue --unique --name nvmf-connect-all \
+            nvme connect-all -t "$_trtype" -a "$_traddr" -s "$_trsvcid"
+    else
+        warn "dot1x-macsec: rd.nvmf.discover not set — cannot connect NVMe root"
+    fi
     : > "$STAMP"
     exit 0
 fi
diff --git a/files/dracut/95dot1x-macsec/module-setup.sh b/files/dracut/95dot1x-macsec/module-setup.sh
index cae3e98..737b044 100755
--- a/files/dracut/95dot1x-macsec/module-setup.sh
+++ b/files/dracut/95dot1x-macsec/module-setup.sh
@@ -25,8 +25,12 @@ install() {
     # wpa stack + tpm + openssl, plus the coreutils the hook calls. dracut on
     # RHEL only bundles binaries a module requests — head/ls/grep/etc. are NOT
     # present by default, so list everything the hook uses.
+    # nvme: the rd.dot1x=0 test path drives `nvme connect-all` itself (this
+    # distro's dracut nvmf module populates discovery.conf but never registers
+    # an initqueue/online autoconnect hook). The nvmf module installs nvme too,
+    # but list it here so the hook's dependency is explicit and load-order-safe.
     inst_multiple wpa_supplicant wpa_cli tpm2_nvread openssl ip setsid \
-        grep sed cut tr sha256sum sleep mkdir
+        grep sed cut tr sha256sum sleep mkdir nvme
 
     # TSS libraries that tpm2_nvread dlopens
     inst_libdir_file "libtss2-*"
diff --git a/serving/.env.example b/serving/.env.example
index 20133ca..e9077aa 100644
--- a/serving/.env.example
+++ b/serving/.env.example
@@ -1,7 +1,7 @@
 # Copy to .env and edit for your test LAN/bridge, then: docker compose up -d
 
 # Release being served. Must match the Packer build (fleet-<version>.efi).
-IMAGE_VERSION=0.0.0-67802e2
+IMAGE_VERSION=0.0.0-9841455
 
 # OCI release-artifact image (built by scripts/build-oci.sh). Mounted directly
 # as a Docker image volume — the default artifact source. Pin by digest in
@@ -10,7 +10,7 @@ OCI_IMAGE=git.bitasylum.org/audiobuzz/fleet-boot
 
 # Fallback only (Docker < 28 / offline): local Packer output dir, used by the
 # commented bind-mounts in docker-compose.yml. Ignored when image volumes work.
-ARTIFACT_SRC=../artifacts/0.0.0-67802e2
+ARTIFACT_SRC=../artifacts/0.0.0-9841455
 
 # SPDK NVMe/TCP target image — prebuilt + pushed by CI
 # (.gitea/workflows/spdk-image.yaml); the serving host just pulls it.