diff --git a/files/ansible-playbooks/update-indoor.yml b/files/ansible-playbooks/update-indoor.yml
index b0427e4..62d859a 100644
--- a/files/ansible-playbooks/update-indoor.yml
+++ b/files/ansible-playbooks/update-indoor.yml
@@ -559,6 +559,13 @@
         _prep_blocked: false
         _blocked: false
 
+    # >>> NEW: soft-block on auth failure (no valid credentials) <<<
+    - name: Soft-block if DEV2 auth failed (no valid credentials)
+      when: dev2_passfile_used == "NONE"
+      ansible.builtin.set_fact:
+        _blocked: true
+        _journal: "{{ (_journal | default([])) + [ 'No valid credentials for DEV2; skipping staging/write/flip' ] }}"
+
     - name: Build specific image marker path on DEV2 (/tmp/prepared_for_<image>)
       ansible.builtin.set_fact:
         _marker_specific: "/tmp/prepared_for_{{ image_filename | regex_replace('\\.bin$','') }}"
@@ -618,6 +625,27 @@
       ansible.builtin.debug:
         msg: "DEV2 firmux={{ (dev2_firmux.stdout | default('')) | trim }}"
 
+    # --- PRE-FLIGHT: derive target core and compare with current; block if equal ---
+    - name: Derive expected target_version core (early, from image filename)
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        expected_fw_core_early: "{{ (image_filename | regex_search('[0-9]+\\.[0-9]+\\.[0-9]+-r[0-9]+')) | default('', true) }}"
+
+    - name: Parse current firmware core from DEV2 firmux (early)
+      when: dev2_firmux is defined
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        current_fw_core: "{{ (dev2_firmux.stdout | default('') | regex_search('[0-9]+\\.[0-9]+\\.[0-9]+-r[0-9]+')) | default('', true) }}"
+
+    - name: Soft-block if current firmware already matches target (skip staging/write/flip)
+      when:
+        - (expected_fw_core_early | length) > 0
+        - (current_fw_core | length) > 0
+        - current_fw_core == expected_fw_core_early
+      ansible.builtin.set_fact:
+        _blocked: true
+        _journal: "{{ (_journal | default([])) + [ 'Device already running target image: ' ~ current_fw_core ~ ' — skipping write/flip' ] }}"
+
     # ---------------------------- Normalize rebootin early (HOURS) ----------------------------
     # Strict: rebootin is integer HOURS only. Always add +20s grace to the schedule.
 
@@ -737,14 +765,18 @@
       register: local_md5
       changed_when: false
 
-    - name: Verify local md5 matches expected
-      when: local_img.stat.exists
+    # >>> CHANGED: soft-block on local md5 mismatch; debug on match <<<
+    - name: Local md5 matches expected (debug)
+      when: local_img.stat.exists and ((local_md5.stdout | trim) == image_md5)
       delegate_to: localhost
-      ansible.builtin.assert:
-        that:
-          - (local_md5.stdout | trim) == image_md5
-        fail_msg: "Local md5 does not match expected got {{ local_md5.stdout | trim }} expected {{ image_md5 }}"
-        success_msg: "Local md5 matches expected"
+      ansible.builtin.debug:
+        msg: "Local md5 matches expected"
+
+    - name: Soft-block if local md5 does not match expected
+      when: local_img.stat.exists and ((local_md5.stdout | trim) != image_md5)
+      ansible.builtin.set_fact:
+        _blocked: true
+        _journal: "{{ (_journal | default([])) + [ 'Local md5 mismatch: have=' ~ (local_md5.stdout | trim) ~ ' expected=' ~ image_md5 ] }}"
 
     # Optional SHA256 local
     - name: Compute local sha256 of the image (if provided)