diff --git a/files/ansible-playbooks/sot-updater.yml b/files/ansible-playbooks/sot-updater.yml
index 5324037..8d2786b 100644
--- a/files/ansible-playbooks/sot-updater.yml
+++ b/files/ansible-playbooks/sot-updater.yml
@@ -198,22 +198,25 @@
       failed_when: false
       ignore_errors: true
 
-    - name: Dev1 | Normalize banner (simple literal transformation)
+    - name: Dev1 | Normalize banner → X.X.X-rYYYY (strict)
       delegate_to: localhost
       set_fact:
         dev1_fw_clean: >-
           {{
             (
               dev1_banner.stdout | default('') | trim
-              # cut off anything after the pipe
-              | regex_replace('\\s*\\|.*$', '')
-              # replace first space before 'rev' with a dash
-              | regex_replace('\\s+rev\\s+', '-r')
+              | regex_replace('\\s*\\|.*$', '')                     # drop trailing " | …"
+              | regex_replace('(^|\\s)rev\\s+([0-9]+)', '\\1-r\\2') # only lowercase 'rev' with word boundary-ish
+              | regex_search('[0-9]+\\.[0-9]+\\.[0-9]+-r[0-9]+')    # keep exactly X.X.X-rYYYY
             )
             | default('', true)
             | trim
           }}
 
+    - name: Debug Dev1 normalized firmware
+      delegate_to: localhost
+      debug:
+        msg: "Dev1 fw_version → {{ dev1_fw_clean | default('N/A') }}"
 
     - name: Publish Dev1 fw_version
       delegate_to: localhost