diff --git a/files/ansible-playbooks/afterupgrade_check.yml b/files/ansible-playbooks/afterupgrade_check.yml
index 55e3b04..78d8722 100644
--- a/files/ansible-playbooks/afterupgrade_check.yml
+++ b/files/ansible-playbooks/afterupgrade_check.yml
@@ -23,6 +23,9 @@
     # Do NOT self-reference max_attempts. We’ll normalize below.
     max_attempts_default: 3
 
+    # --- Hardcoded cloud API bearer (per request) ---
+    cloud_api_bearer: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6InBhdmVsLmxAOGRldmljZXMuY29tIiwic3ViIjoyMiwiaWF0IjoxNzU5NzMxMzk1LCJleHAiOjE3NjIzMjMzOTV9.C7XV-QHIsLPZTxavv1eU361p0KTpiEPfDv3AUTmAqG8"
+
   tasks:
     # ---- Normalize metadata safely (no self-referential defaults) ----
     - name: Normalize metadata (no clever transforms)
@@ -125,6 +128,63 @@
       ansible.builtin.set_fact:
         version_match: "{{ (target_version_effective | length > 0) and (target_version_effective in (banner_probe.stdout | default(''))) }}"
 
+    # ---- Read eth0 MAC (only after confirmed version match) ----
+    - name: Read eth0 MAC address via SSH
+      when: nc_probe.rc == 0 and banner_probe.rc == 0 and (version_match | bool)
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        USER="{{ ssh_user }}"
+        HOST="{{ ansible_host | default(inventory_hostname) }}"
+        sshpass -p '{{ ssh_pass }}' \
+        ssh -o StrictHostKeyChecking=no -o PubkeyAuthentication=no -o ConnectTimeout={{ ssh_timeout }} \
+          "${USER}@${HOST}" \
+          "cat /sys/class/net/eth0/address | tr -d '\n'"
+      register: mac_probe
+      changed_when: false
+      ignore_errors: true
+
+    - name: Set eth0_macaddress fact
+      when: mac_probe is defined and mac_probe.rc == 0
+      ansible.builtin.set_fact:
+        eth0_macaddress: "{{ (mac_probe.stdout | default('') | trim) }}"
+
+    - name: Debug eth0_macaddress
+      when: eth0_macaddress is defined
+      ansible.builtin.debug:
+        msg: "eth0_macaddress={{ eth0_macaddress }}"
+
+    # ---- Cloud bandwidth-control PATCH (only after match & MAC present) ----
+    - name: Build URL-encoded MAC for cloud API
+      when: eth0_macaddress is defined and (version_match | bool) and nc_probe.rc == 0 and banner_probe.rc == 0
+      ansible.builtin.set_fact:
+        enc_mac: "{{ eth0_macaddress | regex_replace(':', '%3A') }}"
+
+    - name: PATCH bandwidth-control in cloud (egress 40 / ingress 10)
+      when: enc_mac is defined and (version_match | bool) and nc_probe.rc == 0 and banner_probe.rc == 0
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        curl -sS -L --request PATCH --post301 --post302 \
+          "https://cloud.ikeja.co.za/v1/external/devices/{{ enc_mac }}/bandwidth-control" \
+          --header "Authorization: Bearer {{ cloud_api_bearer }}" \
+          --header "Content-Type: application/json" \
+          --header "Accept: application/json" \
+          --fail-with-body \
+          --data '{"egress":{"isEnabled":true,"speedMbps":40},"ingress":{"isEnabled":true,"speedMbps":10}}'
+      register: cloud_patch
+      changed_when: false
+      ignore_errors: true
+
+    - name: Flag cloud change result
+      when: enc_mac is defined and (version_match | bool) and nc_probe.rc == 0 and banner_probe.rc == 0
+      ansible.builtin.set_fact:
+        cloud_change_ok: "{{ (cloud_patch is defined and (cloud_patch.rc | default(1)) == 0) }}"
+
+    - name: Debug cloud change result
+      when: cloud_change_ok is defined
+      ansible.builtin.debug:
+        msg: "cloud_change={{ 'Ok' if cloud_change_ok else 'NOT ok' }}"
 
     # ---- Journaling paths ----
     # Success: banner matches expected full target_version
@@ -139,6 +199,7 @@
             afterupgrade_check SUCCESS (attempt {{ attempt }}/{{ effective_max_attempts }}):
             Banner='{{ (banner_probe.stdout | default('') | trim) }}' Target='{{ target_version_effective }}'
             Correlation={{ correlation_id }} Original={{ original_emitted_at }}
+            {{ 'cloud change Ok' if (cloud_change_ok | default(false)) else 'cloud change NOT ok' }}
 
     - name: Publish success journal to control queue
       when: journal_success_payload is defined
diff --git a/files/ansible-playbooks/afterupgrade_withcurl.yml b/files/ansible-playbooks/afterupgrade_check_original.yml
similarity index 81%
rename from files/ansible-playbooks/afterupgrade_withcurl.yml
rename to files/ansible-playbooks/afterupgrade_check_original.yml
index 3396cf8..55e3b04 100644
--- a/files/ansible-playbooks/afterupgrade_withcurl.yml
+++ b/files/ansible-playbooks/afterupgrade_check_original.yml
@@ -13,18 +13,6 @@
     rmq_exchange: "controls"
     control_queue: "queue_controls"
 
-    # --- Manual run defaults (so we can execute without -e) ---
-    # These are safe to leave here; anything passed via -e will still override them.
-    attempt: 1
-    max_attempts: 3
-    current_delay_sec: 300
-    correlation_id: "6f680073dc7c"
-    original_emitted_at: "2025-10-30T18:46:52Z"
-    target_version: "2.2.3 rev 9800"
-    # Intentionally keep this empty to exercise the target_version_effective logic.
-    target_version_full: ""
-    schema_version: 1
-
     # Probing/SSH defaults
     tcp_port: 22
     nc_timeout: 5
@@ -35,9 +23,6 @@
     # Do NOT self-reference max_attempts. We’ll normalize below.
     max_attempts_default: 3
 
-    # --- Hardcoded cloud API bearer (per request) ---
-    cloud_api_bearer: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6InBhdmVsLmxAOGRldmljZXMuY29tIiwic3ViIjoyMiwiaWF0IjoxNzU5NzMxMzk1LCJleHAiOjE3NjIzMjMzOTV9.C7XV-QHIsLPZTxavv1eU361p0KTpiEPfDv3AUTmAqG8"
-
   tasks:
     # ---- Normalize metadata safely (no self-referential defaults) ----
     - name: Normalize metadata (no clever transforms)
@@ -140,63 +125,6 @@
       ansible.builtin.set_fact:
         version_match: "{{ (target_version_effective | length > 0) and (target_version_effective in (banner_probe.stdout | default(''))) }}"
 
-    # ---- Read eth0 MAC (only after confirmed version match) ----
-    - name: Read eth0 MAC address via SSH
-      when: nc_probe.rc == 0 and banner_probe.rc == 0 and (version_match | bool)
-      delegate_to: localhost
-      ansible.builtin.shell: |
-        set -e
-        USER="{{ ssh_user }}"
-        HOST="{{ ansible_host | default(inventory_hostname) }}"
-        sshpass -p '{{ ssh_pass }}' \
-        ssh -o StrictHostKeyChecking=no -o PubkeyAuthentication=no -o ConnectTimeout={{ ssh_timeout }} \
-          "${USER}@${HOST}" \
-          "cat /sys/class/net/eth0/address | tr -d '\n'"
-      register: mac_probe
-      changed_when: false
-      ignore_errors: true
-
-    - name: Set eth0_macaddress fact
-      when: mac_probe is defined and mac_probe.rc == 0
-      ansible.builtin.set_fact:
-        eth0_macaddress: "{{ (mac_probe.stdout | default('') | trim) }}"
-
-    - name: Debug eth0_macaddress
-      when: eth0_macaddress is defined
-      ansible.builtin.debug:
-        msg: "eth0_macaddress={{ eth0_macaddress }}"
-
-    # ---- Cloud bandwidth-control PATCH (only after match & MAC present) ----
-    - name: Build URL-encoded MAC for cloud API
-      when: eth0_macaddress is defined and (version_match | bool) and nc_probe.rc == 0 and banner_probe.rc == 0
-      ansible.builtin.set_fact:
-        enc_mac: "{{ eth0_macaddress | regex_replace(':', '%3A') }}"
-
-    - name: PATCH bandwidth-control in cloud (egress 40 / ingress 10)
-      when: enc_mac is defined and (version_match | bool) and nc_probe.rc == 0 and banner_probe.rc == 0
-      delegate_to: localhost
-      ansible.builtin.shell: |
-        set -e
-        curl -sS -L --request PATCH --post301 --post302 \
-          "https://cloud.ikeja.co.za/v1/external/devices/{{ enc_mac }}/bandwidth-control" \
-          --header "Authorization: Bearer {{ cloud_api_bearer }}" \
-          --header "Content-Type: application/json" \
-          --header "Accept: application/json" \
-          --fail-with-body \
-          --data '{"egress":{"isEnabled":true,"speedMbps":40},"ingress":{"isEnabled":true,"speedMbps":10}}'
-      register: cloud_patch
-      changed_when: false
-      ignore_errors: true
-
-    - name: Flag cloud change result
-      when: enc_mac is defined and (version_match | bool) and nc_probe.rc == 0 and banner_probe.rc == 0
-      ansible.builtin.set_fact:
-        cloud_change_ok: "{{ (cloud_patch is defined and (cloud_patch.rc | default(1)) == 0) }}"
-
-    - name: Debug cloud change result
-      when: cloud_change_ok is defined
-      ansible.builtin.debug:
-        msg: "cloud_change={{ 'Ok' if cloud_change_ok else 'NOT ok' }}"
 
     # ---- Journaling paths ----
     # Success: banner matches expected full target_version
@@ -211,7 +139,6 @@
             afterupgrade_check SUCCESS (attempt {{ attempt }}/{{ effective_max_attempts }}):
             Banner='{{ (banner_probe.stdout | default('') | trim) }}' Target='{{ target_version_effective }}'
             Correlation={{ correlation_id }} Original={{ original_emitted_at }}
-            {{ 'cloud change Ok' if (cloud_change_ok | default(false)) else 'cloud change NOT ok' }}
 
     - name: Publish success journal to control queue
       when: journal_success_payload is defined