diff --git a/files/ansible-playbooks/ptsd-migrate-wrapper.yml b/files/ansible-playbooks/ptsd-migrate-wrapper.yml
new file mode 100644
index 0000000..34c2e40
--- /dev/null
+++ b/files/ansible-playbooks/ptsd-migrate-wrapper.yml
@@ -0,0 +1,72 @@
+# ptsd-migrate-wrapper.yml
+# Single nbplay invocation:
+#   Phase 1: Cloud -> NetBox sync (via sot-updater-iponly.yml in wrapper mode)
+#   Phase 2: Refresh ansible_host from nb_ip, reset_connection
+#   Phase 3: Run full ptsd-migrate.yml unchanged
+
+- hosts: all
+  gather_facts: no
+  tasks: []
+
+- import_playbook: sot-updater-iponly.yml
+  vars:
+    sot_wrapper_mode: true
+
+
+- name: Phase 2 | Refresh in-memory target IP after iponly
+  hosts: all
+  gather_facts: no
+
+  tasks:
+    - name: "Wrapper | Extract nb_ip from nb_onedevice_update.py stdout"
+      vars:
+        _lines: "{{ (nb_preflight.stdout_lines | default([])) | map('regex_replace','\r','') | map('trim') | list }}"
+        _ok_line: "{{ (_lines | select('match','^OK\\s+') | list | last | default('')) }}"
+        _fail_line: "{{ (_lines | select('match','^FAIL\\s+') | list | last | default('')) }}"
+        _ip_raw: "{{ _ok_line | regex_search('(?:^|\\s)ip=([0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+)(?:\\s|$)', '\\1') | default('') }}"
+        _ip: >-
+          {%- if _ip_raw is string -%}
+            {{ _ip_raw }}
+          {%- elif _ip_raw is sequence and (_ip_raw | length) > 0 -%}
+            {{ _ip_raw[0] }}
+          {%- else -%}
+            ""
+          {%- endif -%}
+      set_fact:
+        wrapper_ok_line: "{{ _ok_line }}"
+        wrapper_fail_line: "{{ _fail_line }}"
+        wrapper_nb_ip: "{{ _ip | trim }}"
+
+    - name: "Wrapper | Debug extracted values"
+      ansible.builtin.debug:
+        msg:
+          - "wrapper_ok_line='{{ wrapper_ok_line }}'"
+          - "wrapper_fail_line='{{ wrapper_fail_line | default('') }}'"
+          - "wrapper_nb_ip='{{ wrapper_nb_ip }}'"
+
+    - name: "Wrapper | Stop host if cloud reports no fresh IP"
+      when: (wrapper_fail_line | default('') | length) > 0
+      meta: end_host
+
+    - name: "Wrapper | Assert IP extracted successfully"
+      ansible.builtin.assert:
+        that:
+          - nb_script is defined
+          - nb_script.stat.exists | default(false)
+          - (wrapper_ok_line | length) > 0
+          - (wrapper_nb_ip | length) > 0
+        fail_msg: >-
+          Wrapper stop: could not extract IP from nb_onedevice_update.py output.
+          ok_line='{{ wrapper_ok_line | default('') }}'
+          fail_line='{{ wrapper_fail_line | default('') }}'
+          stdout_tail={{ (nb_preflight.stdout_lines | default([]))[-12:] }}
+
+    - name: "Wrapper | Override ansible_host to refreshed IP ({{ wrapper_nb_ip }})"
+      set_fact:
+        ansible_host: "{{ wrapper_nb_ip }}"
+
+    - name: "Wrapper | Reset SSH connection context (ensure new ansible_host is used)"
+      meta: reset_connection
+
+
+- import_playbook: ptsd-migrate.yml
diff --git a/files/ansible-playbooks/restart-cloud-agent-long.yml b/files/ansible-playbooks/restart-cloud-agent-long.yml
index 074417a..210bb34 100644
--- a/files/ansible-playbooks/restart-cloud-agent-long.yml
+++ b/files/ansible-playbooks/restart-cloud-agent-long.yml
@@ -14,7 +14,7 @@
 
     - name: Wait 3s before restoring
       ansible.builtin.pause:
-        seconds: 300
+        seconds: 200
 
     - name: Move /root/cloud-agent back to /tmp/launchd/services/
       ansible.builtin.raw: |