diff --git a/files/ansible-playbooks/update-indoor2.yml b/files/ansible-playbooks/update-indoor2.yml
index b19be2b..1c5d8e5 100644
--- a/files/ansible-playbooks/update-indoor2.yml
+++ b/files/ansible-playbooks/update-indoor2.yml
@@ -812,6 +812,33 @@
         _blocked: true
         _journal: "{{ _journal + [ 'Preparation markers already present on DEV2 (count=' ~ (dev2_prep_count.stdout | trim) ~ '). Skipping staging/write' ] }}"
 
+    - name: Check bootenv-updated marker on DEV2 (/tmp/bootenv_updated)
+      when: dev2_passfile_used != "NONE"
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        HOST="{{ dev2_ssh_host }}"
+        PORT="{{ dev2_ssh_port }}"
+        sshpass -f "{{ dev2_passfile_used }}" ssh \
+          -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
+          -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
+          -o ConnectTimeout=10 \
+          -p "$PORT" "{{ dev2_ssh_user }}@${HOST}" \
+          "[ -f '/tmp/bootenv_updated' ] && echo PRESENT || echo ABSENT"
+      args:
+        executable: /bin/bash
+      register: dev2_bootenv_marker
+      changed_when: false
+      ignore_errors: true
+
+    - name: Soft-block if bootenv-updated marker is present on DEV2
+      when: dev2_bootenv_marker is defined
+            and (dev2_bootenv_marker.stdout | default('') | trim) == 'PRESENT'
+      ansible.builtin.set_fact:
+        _prep_blocked: true
+        _blocked: true
+        _journal: "{{ _journal + [ 'Bootenv updated marker present on DEV2 (/tmp/bootenv_updated). Skipping image staging/write' ] }}"
+
     - name: Refresh ARP 1 on DEV1’s LAN (send unsolicited ARP from temporary IP)
       when: dev2_conn_method == "tunnel"
       ansible.builtin.raw: arping -U -I eth0 192.168.1.11 -c 3