diff --git a/files/ansible-playbooks/sot-updater.yml b/files/ansible-playbooks/sot-updater.yml
index fcc351b..421f61c 100644
--- a/files/ansible-playbooks/sot-updater.yml
+++ b/files/ansible-playbooks/sot-updater.yml
@@ -491,6 +491,7 @@
             if ((dev1_fw_backup_raw.stdout | default('') | trim | length) > 0)
             else 'unavailable'
           }}
+      changed_when: false
 
     - name: Dev1 | fw_version_backup raw debug
       delegate_to: localhost
@@ -506,7 +507,6 @@
         msg:
           - "fw_version_backup_value={{ fw_version_backup_value | default('unset') }}"
 
-
     - name: Scan tracking | Dev1 fw_version_backup outcome
       delegate_to: localhost
       set_fact:
@@ -1357,6 +1357,156 @@
           payload_encoding: "string"
       changed_when: false
 
+
+    # ----------------------- Dev2 bootbanks backup firmux → indoor_fwver_backup -----------------------
+    - name: Dev2 | Read bootbanks backup firmux (tunnel)
+      when:
+        - tunnel_ok | default(false)
+        - dev2_passfile_used != 'NONE'
+      delegate_to: localhost
+      shell: |
+        PORT="{{ _local_port }}"
+        sshpass -f "{{ dev2_passfile_used }}" ssh {{ ssh_opts_common }} \
+          -o ConnectTimeout={{ ssh_timeout }} \
+          -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \
+          "jq -r '.backup.firmux // empty' /var/run/bootbanks.json 2>/dev/null || true"
+      args:
+        executable: /bin/bash
+      register: dev2_fwver_backup_tunnel
+      changed_when: false
+      failed_when: false
+      ignore_errors: true
+
+    - name: Dev2 | Read bootbanks backup firmux (LLDP IPv4)
+      when:
+        - tunnel_ok | default(false)
+        - dev2_passfile_used == 'NONE'
+        - (lldp_dev2_ip | default('') | length) > 0
+        - dev2_passfile_used_lldp is defined
+        - dev2_passfile_used_lldp != 'NONE'
+      delegate_to: localhost
+      shell: |
+        sshpass -f "{{ dev2_passfile_used_lldp }}" ssh \
+          -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
+          -o ConnectTimeout=15 \
+          "{{ dev2_ssh_user }}@{{ lldp_dev2_ip }}" \
+          "jq -r '.backup.firmux // empty' /var/run/bootbanks.json 2>/dev/null || true"
+      args:
+        executable: /bin/bash
+      register: dev2_fwver_backup_lldp
+      changed_when: false
+      failed_when: false
+      ignore_errors: true
+
+    - name: Dev2 | Read bootbanks backup firmux (LLDP IPv6 via Dev1)
+      when:
+        - tunnel_ok | default(false)
+        - dev2_passfile_used == 'NONE'
+        - (dev2_passfile_used_lldp is not defined or dev2_passfile_used_lldp == 'NONE')
+        - lldp_dev2_ip6 is defined
+        - lldp_dev2_ip6 | length > 0
+        - dev2_passfile_used_lldp6 is defined
+        - dev2_passfile_used_lldp6 != 'NONE'
+      delegate_to: localhost
+      shell: |
+        IP6="{{ lldp_dev2_ip6 }}"
+        F="{{ dev2_passfile_used_lldp6 }}"
+        if [ -z "$IP6" ] || [ -z "$F" ] || [ "$F" = "NONE" ]; then
+          exit 0
+        fi
+
+        sshpass -p '{{ dev1_pass }}' ssh {{ ssh_opts_common }} \
+          "{{ dev1_user }}@{{ ansible_host|default(inventory_hostname) }}" \
+          "sshpass -f '/tmp/${F}' ssh \
+             -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
+             -o ConnectTimeout={{ ssh_timeout }} \
+             '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' \
+             'jq -r \".backup.firmux // empty\" /var/run/bootbanks.json 2>/dev/null || true'"
+      args:
+        executable: /bin/bash
+      register: dev2_fwver_backup_lldp6
+      changed_when: false
+      failed_when: false
+      ignore_errors: true
+
+    - name: Dev2 | Select bootbanks backup firmux output
+      delegate_to: localhost
+      set_fact:
+        indoor_fwver_backup_raw: >-
+          {{
+            (dev2_fwver_backup_tunnel.stdout | default('') | trim)
+            if (
+              (dev2_fwver_backup_tunnel is defined) and
+              ((dev2_fwver_backup_tunnel.stdout | default('') | trim | length) > 0)
+            )
+            else (
+              (dev2_fwver_backup_lldp.stdout | default('') | trim)
+              if (
+                (dev2_fwver_backup_lldp is defined) and
+                ((dev2_fwver_backup_lldp.stdout | default('') | trim | length) > 0)
+              )
+              else (dev2_fwver_backup_lldp6.stdout | default('') | trim)
+            )
+          }}
+      changed_when: false
+
+    - name: Dev2 | Normalize indoor_fwver_backup value
+      delegate_to: localhost
+      set_fact:
+        indoor_fwver_backup_value: >-
+          {{
+            (indoor_fwver_backup_raw | default('') | trim)
+            if ((indoor_fwver_backup_raw | default('') | trim | length) > 0)
+            else 'unavailable'
+          }}
+      changed_when: false
+
+    - name: Dev2 | indoor_fwver_backup raw debug
+      delegate_to: localhost
+      debug:
+        msg:
+          - "tunnel rc={{ dev2_fwver_backup_tunnel.rc | default('n/a') }} out={{ dev2_fwver_backup_tunnel.stdout | default('') | trim }} err={{ dev2_fwver_backup_tunnel.stderr | default('') | trim }}"
+          - "lldp4 rc={{ dev2_fwver_backup_lldp.rc | default('n/a') }} out={{ dev2_fwver_backup_lldp.stdout | default('') | trim }} err={{ dev2_fwver_backup_lldp.stderr | default('') | trim }}"
+          - "lldp6 rc={{ dev2_fwver_backup_lldp6.rc | default('n/a') }} out={{ dev2_fwver_backup_lldp6.stdout | default('') | trim }} err={{ dev2_fwver_backup_lldp6.stderr | default('') | trim }}"
+
+    - name: Dev2 | indoor_fwver_backup final debug
+      delegate_to: localhost
+      debug:
+        msg:
+          - "indoor_fwver_backup_value={{ indoor_fwver_backup_value | default('unset') }}"
+
+    # ----------------------- Scan tracking: Dev2 indoor_fwver_backup -----------------------
+    - name: Scan tracking | Dev2 indoor_fwver_backup outcome
+      delegate_to: localhost
+      set_fact:
+        scan_ok: "{{ scan_ok + (['indoor_fwver_backup'] if ((indoor_fwver_backup_value | default('unavailable')) != 'unavailable') else []) }}"
+        scan_fail: "{{ scan_fail + (['indoor_fwver_backup=unavailable'] if ((indoor_fwver_backup_value | default('unavailable')) == 'unavailable') else []) }}"
+      changed_when: false
+
+    - name: Publish Dev2 indoor_fwver_backup
+      delegate_to: localhost
+      uri:
+        url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost|urlencode }}/{{ rmq_exchange|urlencode }}/publish"
+        method: POST
+        user: "{{ rmq_user }}"
+        password: "{{ rmq_pass }}"
+        force_basic_auth: true
+        status_code: 200
+        headers: { content-type: "application/json" }
+        body_format: json
+        body:
+          properties: { content_type: "application/json" }
+          routing_key: "{{ control_queue }}"
+          payload: "{{ {
+            'inscope_device': (ansible_hostname|default(inventory_hostname)),
+            'task_name': 'custom_field_set',
+            'task_add1': 'indoor_fwver_backup',
+            'task_result': indoor_fwver_backup_value
+          } | to_json }}"
+          payload_encoding: "string"
+      changed_when: false
+
+
     # ----------------------- Dev2 fw_printenv size → indoor_bootenv -----------------------
     - name: Dev2 | Read fw_printenv size (tunnel)
       when: