diff --git a/files/ansible-playbooks/sot-updater.yml b/files/ansible-playbooks/sot-updater.yml
index 934c21f..4f5d650 100644
--- a/files/ansible-playbooks/sot-updater.yml
+++ b/files/ansible-playbooks/sot-updater.yml
@@ -130,11 +130,53 @@
       register: pick_port
       changed_when: false
 
-    - name: Record chosen local port & ControlMaster path (or note failure)
+    # --- replace the single failing "Record chosen local port & ControlMaster path" task with these ---
+
+    - name: Record chosen local port
       delegate_to: localhost
       set_fact:
         _local_port: "{{ (pick_port.stdout | default('') | trim) }}"
-        _ctrl_dir: "{{ lookup('ansible.builtin.pipe', 'mktemp -d') }}"
+
+    - name: Create ControlMaster socket dir (mktemp -d)
+      delegate_to: localhost
+      ansible.builtin.shell: "mktemp -d"
+      register: mktemp_dir
+      changed_when: false
+      failed_when: false
+      ignore_errors: true
+
+    - name: Set _ctrl_dir fact (from mktemp) or leave empty
+      delegate_to: localhost
+      set_fact:
+        _ctrl_dir: "{{ (mktemp_dir.stdout | default('') | trim) }}"
+
+    - name: Journal if mktemp failed (no ctrl_dir)
+      when: _ctrl_dir | length == 0
+      delegate_to: localhost
+      ansible.builtin.uri:
+        url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
+        method: POST
+        user: "{{ rmq_user }}"
+        password: "{{ rmq_pass }}"
+        force_basic_auth: true
+        status_code: 200
+        headers: { content-type: "application/json" }
+        body_format: json
+        body:
+          properties: { content_type: "application/json" }
+          routing_key: "{{ control_queue }}"
+          payload: "{{ {
+            'inscope_device': (ansible_hostname | default(inventory_hostname)),
+            'task_name': 'journal_entry',
+            'task_result': 'mktemp_dir_failed',
+            'task_add1': (mktemp_dir.stderr | default(mktemp_dir.stdout) | trim)[:256]
+          } | to_json }}"
+          payload_encoding: "string"
+
+    - name: Compose ControlMaster socket path (only if we have a dir)
+      when: _ctrl_dir | length > 0
+      delegate_to: localhost
+      set_fact:
         _ctrl_sock: "{{ _ctrl_dir }}/ssh_tunnel_ctl"
 
     - name: Journal if no free local port was found (continue anyway)