diff --git a/files/ansible-playbooks/sot-updater.yml b/files/ansible-playbooks/sot-updater.yml
index 68c3e5e..6bad8d6 100644
--- a/files/ansible-playbooks/sot-updater.yml
+++ b/files/ansible-playbooks/sot-updater.yml
@@ -146,7 +146,7 @@
           {{
             dict(
               nb_tokens
-              | select('match', '^[a-zA-Z_]+=') 
+              | select('match', '^[a-zA-Z_]+=')
               | map('split', '=', 1)
               | map('list')
             )
@@ -541,7 +541,7 @@
         msg:
           - "LLDP-derived Dev2 IP (best-effort): {{ (lldp_ip_raw.stdout | default('') | trim) if ((lldp_ip_raw.stdout | default('') | trim | length) > 0) else '<none>' }}"
 
-    # ------ NEW: Try direct SSH to LLDP IP from localhost (no extra tunnel) ------
+    # ------ NEW: Try direct SSH to LLDP IP from localhost (two-step, two-passfiles) ------
     - name: Set LLDP IP fact
       when:
         - tunnel_ok | default(false)
@@ -550,28 +550,54 @@
       set_fact:
         lldp_dev2_ip: "{{ lldp_ip_raw.stdout | default('') | trim }}"
 
-    - name: Try DEV2 login via direct LLDP IP
+    # Step 1: try basicpass
+    - name: Dev2 | LLDP auth with basicpass
       when:
         - tunnel_ok | default(false)
         - dev2_passfile_used == 'NONE'
         - lldp_dev2_ip | length > 0
       delegate_to: localhost
       shell: |
-        for f in basicpass basicpass2; do
-          if timeout 20s sshpass -f "$f" ssh {{ ssh_opts_common }} \
-               -o ConnectionAttempts=1 -o ConnectTimeout=10 \
-               "{{ dev2_ssh_user }}@{{ lldp_dev2_ip }}" "echo ok" >/dev/null 2>&1; then
-            echo "$f"; exit 0
-          fi
-        done
-        exit 1
-      register: dev2_auth_lldp
+        timeout 20s sshpass -f basicpass ssh {{ ssh_opts_common }} \
+          -o ConnectionAttempts=1 -o ConnectTimeout=10 \
+          "{{ dev2_ssh_user }}@{{ lldp_dev2_ip }}" "echo ok"
+      register: lldp_auth_basic
       changed_when: false
       failed_when: false
       ignore_errors: true
 
-    # Debug 1: what happened during LLDP auth try
-    - name: Dev2 | LLDP path selection debug
+    # Step 2: if basicpass failed, try basicpass2
+    - name: Dev2 | LLDP auth with basicpass2 (if first failed)
+      when:
+        - tunnel_ok | default(false)
+        - dev2_passfile_used == 'NONE'
+        - lldp_dev2_ip | length > 0
+        - (lldp_auth_basic.rc | default(1)) != 0
+      delegate_to: localhost
+      shell: |
+        timeout 20s sshpass -f basicpass2 ssh {{ ssh_opts_common }} \
+          -o ConnectionAttempts=1 -o ConnectTimeout=10 \
+          "{{ dev2_ssh_user }}@{{ lldp_dev2_ip }}" "echo ok"
+      register: lldp_auth_basic2
+      changed_when: false
+      failed_when: false
+      ignore_errors: true
+
+    # Decide which passfile we’ll use for LLDP path
+    - name: Dev2 | LLDP passfile decision
+      when:
+        - tunnel_ok | default(false)
+        - dev2_passfile_used == 'NONE'
+        - lldp_dev2_ip | length > 0
+      delegate_to: localhost
+      set_fact:
+        dev2_passfile_used_lldp: >-
+          {{
+            'basicpass' if ((lldp_auth_basic.rc | default(1)) == 0)
+            else ('basicpass2' if ((lldp_auth_basic2.rc | default(1)) == 0) else 'NONE')
+          }}
+
+    - name: Dev2 | LLDP decision debug
       when:
         - tunnel_ok | default(false)
         - dev2_passfile_used == 'NONE'
@@ -580,27 +606,8 @@
       debug:
         msg:
           - "LLDP candidate IP={{ lldp_dev2_ip }}"
-          - "LLDP auth rc={{ dev2_auth_lldp.rc | default('n/a') }}"
-          - "passfile (if any) will follow in next step"
-
-    - name: Set dev2_passfile_used_lldp
-      when:
-        - tunnel_ok | default(false)
-        - dev2_passfile_used == 'NONE'
-        - lldp_dev2_ip | length > 0
-      delegate_to: localhost
-      set_fact:
-        dev2_passfile_used_lldp: "{{ (dev2_auth_lldp.rc | default(1)) == 0 | ternary(dev2_auth_lldp.stdout | default('') | trim, 'NONE') }}"
-
-    # Debug 2: which passfile will be used for firmux read
-    - name: Dev2 | LLDP passfile decision
-      when:
-        - tunnel_ok | default(false)
-        - dev2_passfile_used == 'NONE'
-        - lldp_dev2_ip | length > 0
-      delegate_to: localhost
-      debug:
-        msg:
+          - "LLDP basicpass rc={{ lldp_auth_basic.rc | default('n/a') }}"
+          - "LLDP basicpass2 rc={{ lldp_auth_basic2.rc | default('n/a') }}"
           - "Using passfile for LLDP path: {{ dev2_passfile_used_lldp }}"
 
     # Optional quick TCP check so you see port reachability (no fail)
@@ -616,6 +623,7 @@
       failed_when: false
       ignore_errors: true
 
+    # Read firmux via LLDP IP using the decided passfile (with hard timeout)
     - name: Dev2 | Read firmux (direct LLDP IP)
       when:
         - tunnel_ok | default(false)
@@ -629,24 +637,22 @@
           "{{ dev2_ssh_user }}@{{ lldp_dev2_ip }}" \
           "cat /usr/lib/release/firmux 2>/dev/null || true"
       register: dev2_firmux_lldp
+      changed_when: false
       failed_when: false
       ignore_errors: true
 
-
-    - name: Dev2 | Read firmux (direct LLDP IP)
-      when:
-        - tunnel_ok | default(false)
-        - dev2_passfile_used == 'NONE'
-        - lldp_dev2_ip | length > 0
-        - dev2_passfile_used_lldp != 'NONE'
+    # ---------------- Primary-tunnel firmux read (unchanged) ----------------
+    - name: Dev2 | Read firmux
+      when: tunnel_ok|default(false) and dev2_passfile_used != 'NONE'
       delegate_to: localhost
       shell: |
-        sshpass -f "{{ dev2_passfile_used_lldp }}" ssh \
+        PORT="{{ _local_port }}"
+        sshpass -f "{{ dev2_passfile_used }}" ssh \
           -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
           -o ConnectTimeout=15 \
-          "{{ dev2_ssh_user }}@{{ lldp_dev2_ip }}" \
+          -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \
           "cat /usr/lib/release/firmux 2>/dev/null || true"
-      register: dev2_firmux_lldp
+      register: dev2_firmux
       failed_when: false
       ignore_errors: true