diff --git a/files/ansible-playbooks/sot-updater-upgradecmd.yml b/files/ansible-playbooks/sot-updater-upgradecmd.yml
index 24d4ac1..87de53a 100644
--- a/files/ansible-playbooks/sot-updater-upgradecmd.yml
+++ b/files/ansible-playbooks/sot-updater-upgradecmd.yml
@@ -79,8 +79,8 @@
           - "{{ (nb_preflight.stderr_lines | default(['<no stderr>'])) }}"
           - "raw stdout (joined): {{ nb_preflight.stdout | default('') | trim }}"
 
-    # --- Abort early if cloud is unavailable (avoid requeue loops) ---
-    - name: "NB preflight | Detect cloud failure from script output"
+    # === HARD STOP ON CLOUD FAILURE (immediately after preflight) ===
+    - name: "NB preflight | Detect cloud failure (rc==3 OR 'FAIL Cloud' line)"
       when: nb_script.stat.exists
       delegate_to: localhost
       vars:
@@ -89,14 +89,15 @@
              | split('\n') | map('trim') | list }}
         _cloud_fail_line: >-
           {{ (_lines | select('match', '^FAIL\\s+Cloud\\b') | list | last | default('')) }}
+        _rc_is_3: "{{ (nb_preflight.rc | default(1)) | int == 3 }}"
       ansible.builtin.set_fact:
         cloud_fail_line: "{{ _cloud_fail_line }}"
-        cloud_ok: "{{ ( _cloud_fail_line | length ) == 0 }}"
+        cloud_bad: "{{ _rc_is_3 or (( _cloud_fail_line | length ) > 0) }}"
 
-    - name: "NB preflight | Journal + soft-close when cloud is unavailable"
+    - name: "NB preflight | Journal + STOP (cloud unavailable)"
       when:
         - nb_script.stat.exists
-        - not cloud_ok | default(true)
+        - cloud_bad | default(false)
       delegate_to: localhost
       ansible.builtin.uri:
         url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
@@ -118,6 +119,7 @@
             'task_result': (
               'preflight abort: cloud unavailable; closing without requeue. '
               ~ (cloud_fail_line | default(''))
+              ~ ' rc=' ~ ((nb_preflight.rc | default('')) | string)
             )
           } | to_json }}"
           payload_encoding: "string"
@@ -125,13 +127,12 @@
       changed_when: (rmq_cloud_unavail.json is defined) and (rmq_cloud_unavail.json.routed | default(false) | bool)
       failed_when: false
 
-    - name: "NB preflight | Stop host due to cloud unavailability"
+    - name: "NB preflight | Stop host due to cloud unavailability (no requeue)"
       when:
         - nb_script.stat.exists
-        - not cloud_ok | default(true)
+        - cloud_bad | default(false)
       ansible.builtin.meta: end_host
-
-
+    # === END HARD STOP ===
 
     # --- Debug-only: capture the exact upgrade_cmd line and stop the play ---
     - name: "NB preflight | Extract exact upgrade_cmd line"
@@ -237,8 +238,7 @@
       when:
         - nb_script.stat.exists
         - nb_ip_changed | default(false)
-        - cloud_ok | default(true)
-        - (nb_preflight.rc | default(1)) == 0
+        - (nb_preflight.rc | default(1)) == 0      # <— extra safety
       delegate_to: localhost
       uri:
         url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/app/deviceconfig.delayed/publish"
@@ -266,8 +266,7 @@
       when:
         - nb_script.stat.exists
         - nb_ip_changed | default(false)
-        - cloud_ok | default(true)
-        - (nb_preflight.rc | default(1)) == 0
+        - (nb_preflight.rc | default(1)) == 0      # <— extra safety
       delegate_to: localhost
       ansible.builtin.debug:
         msg:
@@ -280,8 +279,7 @@
       when:
         - nb_script.stat.exists
         - nb_ip_changed | default(false)
-        - cloud_ok | default(true)
-        - (nb_preflight.rc | default(1)) == 0
+        - (nb_preflight.rc | default(1)) == 0      # <— extra safety
       meta: end_host
 
     # --- If IP did not change → optional 1s pause, then continue normally ---