diff --git a/files/ansible-playbooks/afterupgrade_check.yml b/files/ansible-playbooks/afterupgrade_check.yml
index 9be8afb..55e3b04 100644
--- a/files/ansible-playbooks/afterupgrade_check.yml
+++ b/files/ansible-playbooks/afterupgrade_check.yml
@@ -35,6 +35,13 @@
         # preserve the original string verbatim for all subsequent retries
         target_version_full: "{{ target_version | default('') }}"
 
+    - name: Derive effective target version (avoid extra-var masking)
+      ansible.builtin.set_fact:
+        target_version_effective: >-
+          {{ (target_version_full | default('') | trim)
+              if (target_version_full | default('') | trim)
+              else (target_version | default('') | trim) }}
+
     - name: Show received metadata
       ansible.builtin.debug:
         msg:
@@ -116,7 +123,8 @@
     - name: Evaluate version match (full-string contains check)
       when: nc_probe.rc == 0 and banner_probe.rc == 0
       ansible.builtin.set_fact:
-        version_match: "{{ (target_version_full | length > 0) and (target_version_full in (banner_probe.stdout | default(''))) }}"
+        version_match: "{{ (target_version_effective | length > 0) and (target_version_effective in (banner_probe.stdout | default(''))) }}"
+
 
     # ---- Journaling paths ----
     # Success: banner matches expected full target_version
@@ -129,7 +137,7 @@
           task_name: "journal_add"
           task_result: >-
             afterupgrade_check SUCCESS (attempt {{ attempt }}/{{ effective_max_attempts }}):
-            Banner='{{ (banner_probe.stdout | default('') | trim) }}' Target='{{ target_version_full }}'
+            Banner='{{ (banner_probe.stdout | default('') | trim) }}' Target='{{ target_version_effective }}'
             Correlation={{ correlation_id }} Original={{ original_emitted_at }}
 
     - name: Publish success journal to control queue
@@ -195,7 +203,7 @@
           task_name: "journal_add"
           task_result: >-
             afterupgrade_check MISMATCH (attempt {{ attempt }}/{{ effective_max_attempts }}):
-            Expected='{{ target_version_full }}' Got='{{ (banner_probe.stdout | default('') | trim) }}'
+            Expected='{{ target_version_effective }}' Got='{{ (banner_probe.stdout | default('') | trim) }}'
             Correlation={{ correlation_id }} Original={{ original_emitted_at }}
 
     - name: Publish mismatch journal to control queue
diff --git a/files/ansible-playbooks/update-rebootin223.yml b/files/ansible-playbooks/update-rebootin223.yml
index 5fe3ca1..33acc74 100644
--- a/files/ansible-playbooks/update-rebootin223.yml
+++ b/files/ansible-playbooks/update-rebootin223.yml
@@ -653,23 +653,6 @@
           when: nbq2_payload_obj is defined
           delegate_to: localhost
 
-        - name: Init after-upgrade scheduling vars
-          ansible.builtin.set_fact:
-            au_attempt: 1
-            au_max_attempts: 3
-            # If a reboot was scheduled on the target, wait reboot_seconds + 300s (5m).
-            # Because this task runs with delegate_to: localhost, read from hostvars.
-            au_delay_sec: >-
-              {{
-                (
-                  (hostvars[inventory_hostname].reboot_seconds | default(0) | int)
-                  + 300
-                )
-                if (hostvars[inventory_hostname].reboot_seconds is defined)
-                else 300
-              }}
-          when: nbq2_payload_obj is defined
-          delegate_to: localhost
 
         # NEW: compute values that the payload will reference
         - name: Generate correlation ID and original emitted timestamp
@@ -679,25 +662,11 @@
           when: nbq2_payload_obj is defined
           delegate_to: localhost
 
-        - name: Build after-upgrade check payload (attempt 1)
-          ansible.builtin.set_fact:
-            afterupgrade_payload:
-              task_name: "afterupgrade_check"
-              inscope_device: "{{ ansible_hostname | default(inventory_hostname) }}"
-              target_version: "{{ fw_banner_repr }}"
-              attempt: "{{ au_attempt | default(1) }}"
-              max_attempts: "{{ au_max_attempts | default(3) }}"
-              current_delay_sec: "{{ au_delay_sec | default(300) }}"
-              correlation_id: "{{ au_correlation_id }}"
-              original_emitted_at: "{{ au_original_emitted_at }}"
-              schema_version: 1
-          when: nbq2_payload_obj is defined
-          delegate_to: localhost
 
         - name: Build after-upgrade check payload (attempt 1)
           ansible.builtin.set_fact:
             au_attempt: 1
-            au_delay_sec: 300
+            au_delay_sec: "{{ au_delay_sec | default(300) }}"
             au_correlation_id: "{{ lookup('pipe', 'date +%s%N | sha1sum | cut -c1-12') }}"
             au_original_emitted_at: "{{ lookup('pipe', 'date -u +%FT%TZ') }}"
             afterupgrade_payload:
@@ -719,6 +688,15 @@
           when: afterupgrade_payload is defined
           delegate_to: localhost
 
+        - name: DEBUG after-upgrade payload and timing
+          delegate_to: localhost
+          ansible.builtin.debug:
+            msg:
+              - "afterupgrade_payload={{ afterupgrade_payload | to_nice_json }}"
+              - "au_delay_sec={{ au_delay_sec }}"
+              - "reboot_seconds(host)={{ hostvars[inventory_hostname].reboot_seconds | default('undefined') }}"
+
+
         - name: Publish delayed after-upgrade check to holding exchange
           ansible.builtin.uri:
             url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ 'deviceconfig.delayed' | urlencode }}/publish"