diff --git a/files/ansible-playbooks/sot-updater-upgradecmd.yml b/files/ansible-playbooks/sot-updater-upgradecmd.yml
index e682edf..3270f96 100644
--- a/files/ansible-playbooks/sot-updater-upgradecmd.yml
+++ b/files/ansible-playbooks/sot-updater-upgradecmd.yml
@@ -109,86 +109,56 @@
         nb_small: "{{ nb_kv.get('small', '') }}"
         nb_ok_line: "{{ nb_ok_line }}"
 
-    # --- Extract upgrade_cmd from nb_onedevice_update.py output (prefer stdout_lines; tolerate minor typos) ---
-    - name: "NB preflight | Capture upgrade_cmd from stdout"
+
+    # --- Extract upgrade_cmd using a localhost shell (consume stdout_lines, robust to garbling) ---
+    - name: "NB preflight | Capture upgrade_cmd from stdout (shell)"
       when: nb_script.stat.exists
       delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        # Feed nb_onedevice_update.py output (structured stdout_lines) to awk.
+        # 1) Prefer exact "NB: upgrade_cmd="
+        # 2) Fallback to any "NB: ...cmd=" (covers typos like upde_cmd)
+        # Print first match and exit; otherwise print empty line.
+        cat <<'EOF' | awk -F'=' '
+          BEGIN{found=0}
+          /^[[:space:]]*NB:[[:space:]]*upgrade_cmd[[:space:]]*=/ {
+            sub(/^[[:space:]]*NB:[[:space:]]*upgrade_cmd[[:space:]]*=/,""); print; found=1; exit
+          }
+          /^[[:space:]]*NB:.*cmd[[:space:]]*=/ {
+            sub(/^[[:space:]]*NB:[[:space:]]*/,"");
+            sub(/^[^=]+=[[:space:]]*/,""); print; found=1; exit
+          }
+          END{ if (!found) print "" }
+        '
+        EOF
+      args:
+        executable: /bin/bash
+      register: up_cmd_sh
+      changed_when: false
       vars:
-        # Prefer structured lines first
-        lines_struct: "{{ (nb_preflight.stdout_lines | default([])) }}"
-        # Fallback to raw joined text if needed
-        raw_lines: "{{ (nb_preflight.stdout | default('') | regex_replace('\r','')) | split('\n') }}"
-        all_lines: >-
-          {{
-            (lines_struct + raw_lines)
-            | map('trim')
-            | select('truthy')
-            | list
-          }}
+        # Render the heredoc content as the structured lines; safer than raw joined stdout
+        EOF: "{{ (nb_preflight.stdout_lines | default([])) | join('\n') }}"
 
-        # Try exact key first
-        line_exact: >-
+    - name: "NB preflight | Normalize + debug upgrade_cmd"
+      when: nb_script.stat.exists
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        nb_upgrade_cmd_raw: "{{ (up_cmd_sh.stdout | default('')) | regex_replace('\r','') | trim }}"
+        nb_upgrade_cmd: >-
           {{
-            all_lines
-            | select('match', '^NB:\\s*upgrade_cmd\\s*=')
-            | list
-            | last
-            | default('')
+            '' if ( (up_cmd_sh.stdout | default('') | trim) | lower ) in ['none','null',''] 
+            else (up_cmd_sh.stdout | default('') | trim)
           }}
-        # Tolerate occasional logger typo like "upde_cmd"
-        line_typo1: >-
-          {{
-            ('' if line_exact else
-              (
-                all_lines
-                | select('match', '^NB:\\s*upde_cmd\\s*=')
-                | list
-                | last
-                | default('')
-              )
-            )
-          }}
-        # Broad fallback: any "NB:" line that contains "cmd=" (last resort)
-        line_broad: >-
-          {{
-            ('' if line_exact or line_typo1 else
-              (
-                all_lines
-                | select('match', '^NB:.*\\bcmd\\s*=')
-                | list
-                | last
-                | default('')
-              )
-            )
-          }}
-
-        # Pick the first non-empty candidate and note which detector hit
-        chosen_line: "{{ line_exact or line_typo1 or line_broad }}"
-        chosen_detector: >-
-          {{
-            'exact' if line_exact else
-            ('typo1' if line_typo1 else
-            ('broad' if line_broad else 'none'))
-          }}
-
-        # Strip the "NB: <key>=" prefix regardless of which variant matched
-        up_val_raw: "{{ chosen_line | regex_replace('^NB:\\s*[^=]+=\\s*', '') | trim }}"
-        # Normalize None/null/empty → ''
-        up_val_clean: "{{ '' if (up_val_raw | lower) in ['none','null',''] else up_val_raw }}"
-      set_fact:
-        nb_upgrade_cmd_line: "{{ chosen_line }}"
-        nb_upgrade_cmd_source: "{{ chosen_detector }}"
-        nb_upgrade_cmd: "{{ up_val_clean }}"
-        nb_upgrade_cmd_len: "{{ (up_val_clean | length) }}"
-
+        nb_upgrade_cmd_len: "{{ ( (up_cmd_sh.stdout | default('') | trim) | length ) }}"
     - name: "NB preflight | Debug upgrade_cmd"
       when: nb_script.stat.exists
       delegate_to: localhost
       ansible.builtin.debug:
         msg:
-          - "upgrade_cmd detector: {{ nb_upgrade_cmd_source | default('none') }}"
-          - "upgrade_cmd line: {{ nb_upgrade_cmd_line | default('<none>') }}"
-          - "upgrade_cmd parsed: '{{ nb_upgrade_cmd | default('') }}' (len={{ nb_upgrade_cmd_len | default(0) }})"
+          - "upgrade_cmd raw: '{{ nb_upgrade_cmd_raw }}'"
+          - "upgrade_cmd parsed: '{{ nb_upgrade_cmd }}' (len={{ nb_upgrade_cmd_len }})"
+
 
     # --- Detect "cloud vs NetBox (before update) was different" (regex-free, robust)
     - name: "NB preflight | Detect whether IP changed (pre-update)"