diff --git a/files/ansible-playbooks/sot-updater.yml b/files/ansible-playbooks/sot-updater.yml
index ed98390..c2e2657 100644
--- a/files/ansible-playbooks/sot-updater.yml
+++ b/files/ansible-playbooks/sot-updater.yml
@@ -2644,6 +2644,118 @@
         dev2_passfile_used_lldp6: "{{ dev2_passfile_used_lldp6 | default('NONE') }}"
       changed_when: false
 
+    # ----------------------- Dev2 payredirect config flag -> payredirect -----------------------
+    - name: Dev2 | Read payredirect enabled flag
+      when:
+        - (dev2_passfile_used | default('NONE')) != 'NONE'
+          or ((dev2_passfile_used_lldp | default('NONE')) != 'NONE')
+          or ((dev2_passfile_used_lldp6 | default('NONE')) != 'NONE')
+      delegate_to: localhost
+      shell: |
+        set -o pipefail
+
+        # Choose connection method (tunnel > LLDP IPv4 > LLDP IPv6)
+        if [ "{{ dev2_passfile_used | default('NONE') }}" != "NONE" ]; then
+          PORT="{{ _local_port }}"
+          sshpass -f "{{ dev2_passfile_used }}" ssh {{ ssh_opts_common }} \
+            -o ConnectTimeout={{ ssh_timeout }} \
+            -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \
+            "cat /tmp/config.json 2>/dev/null | grep -i block -A2 | grep enab | head -n1 || true"
+          exit 0
+        fi
+
+        if [ "{{ dev2_passfile_used_lldp | default('NONE') }}" != "NONE" ] && [ -n "{{ lldp_dev2_ip | default('') }}" ]; then
+          sshpass -f "{{ dev2_passfile_used_lldp }}" ssh \
+            -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
+            -o ConnectTimeout=15 \
+            "{{ dev2_ssh_user }}@{{ lldp_dev2_ip }}" \
+            "cat /tmp/config.json 2>/dev/null | grep -i block -A2 | grep enab | head -n1 || true"
+          exit 0
+        fi
+
+        if [ "{{ dev2_passfile_used_lldp6 | default('NONE') }}" != "NONE" ] && [ -n "{{ lldp_dev2_ip6 | default('') }}" ]; then
+          IP6="{{ lldp_dev2_ip6 }}"
+          F="{{ dev2_passfile_used_lldp6 }}"
+          sshpass -p '{{ dev1_pass }}' ssh {{ ssh_opts_common }} \
+            "{{ dev1_user }}@{{ ansible_host|default(inventory_hostname) }}" \
+            "sshpass -f '/tmp/${F}' ssh \
+               -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
+               -o ConnectTimeout={{ ssh_timeout }} \
+               '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' \
+               \"cat /tmp/config.json 2>/dev/null | grep -i block -A2 | grep enab | head -n1 || true\""
+          exit 0
+        fi
+
+        exit 0
+      args:
+        executable: /bin/bash
+      register: dev2_payredirect_raw
+      changed_when: false
+      failed_when: false
+      ignore_errors: true
+
+    - name: Dev2 | Normalize payredirect value
+      delegate_to: localhost
+      vars:
+        payredirect_raw_clean: "{{ dev2_payredirect_raw.stdout | default('') | trim | lower }}"
+      set_fact:
+        payredirect_value: >-
+          {%- if ('\"enabled\"' in payredirect_raw_clean) and ('true' in payredirect_raw_clean) -%}
+            true
+          {%- elif ('\"enabled\"' in payredirect_raw_clean) and ('false' in payredirect_raw_clean) -%}
+            false
+          {%- else -%}
+            na
+          {%- endif -%}
+      changed_when: false
+
+    - name: Dev2 | payredirect debug
+      delegate_to: localhost
+      debug:
+        msg:
+          - "payredirect_raw={{ dev2_payredirect_raw.stdout | default('') | trim }}"
+          - "payredirect_value={{ payredirect_value | default('na') }}"
+
+    - name: Scan tracking | Dev2 payredirect outcome
+      delegate_to: localhost
+      set_fact:
+        scan_ok: "{{ scan_ok + (['payredirect'] if ((payredirect_value | default('na')) != 'na') else []) }}"
+        scan_fail: "{{ scan_fail + (['payredirect=na'] if ((payredirect_value | default('na')) == 'na') else []) }}"
+      changed_when: false
+
+    - name: Publish Dev2 payredirect custom field
+      when:
+        - (not (nb_baseline_ok | default(false))) or ((payredirect_value) != (nb_custom_fields_current.get('payredirect')))
+      delegate_to: localhost
+      uri:
+        url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost|urlencode }}/{{ rmq_exchange|urlencode }}/publish"
+        method: POST
+        user: "{{ rmq_user }}"
+        password: "{{ rmq_pass }}"
+        force_basic_auth: true
+        status_code: 200
+        headers: { content-type: "application/json" }
+        body_format: json
+        body:
+          properties: { content_type: "application/json" }
+          routing_key: "{{ control_queue }}"
+          payload: "{{ {
+            'inscope_device': (ansible_hostname|default(inventory_hostname)),
+            'task_name': 'custom_field_set',
+            'task_add1': 'payredirect',
+            'task_result': payredirect_value
+          } | to_json }}"
+          payload_encoding: "string"
+      changed_when: false
+
+    - name: Delta tracking | Mark changed payredirect
+      when:
+        - (not (nb_baseline_ok | default(false))) or ((payredirect_value) != (nb_custom_fields_current.get('payredirect')))
+      delegate_to: localhost
+      set_fact:
+        non_ts_diff_found: true
+      changed_when: false
+
     # ----------------------- Dev2 indoor_ip resolution (ppp0/eth0.4000 preferred) -----------------------
     - name: Indoor | Compute fallback connected IP (as used for Dev2 reachability)
       delegate_to: localhost