diff --git a/packages/control-plane/core/bootstrap.ts b/packages/control-plane/core/bootstrap.ts
index 76360528..ef42a6dc 100644
--- a/packages/control-plane/core/bootstrap.ts
+++ b/packages/control-plane/core/bootstrap.ts
@@ -536,7 +536,7 @@ APTCONF
 # rewrite before the first update, or the package lists are silently incomplete and
 # the docker.io install fails later for a reason that looks unrelated.
 ec2_mirror=$(grep -rhoE 'https?://[a-z0-9-]+\.ec2\.archive\.ubuntu\.com' \
-  /etc/apt/sources.list /etc/apt/sources.list.d/ 2>/dev/null | head -1)
+  /etc/apt/sources.list /etc/apt/sources.list.d/ 2>/dev/null | head -1 || true)
 if [ -n "$ec2_mirror" ] && ! curl -fsS -m 10 -o /dev/null "$ec2_mirror/ubuntu/dists/noble/InRelease"; then
   echo "blitz: $ec2_mirror is unreachable; falling back to archive.ubuntu.com"
   sed -i -E 's|https?://[a-z0-9-]+\.ec2\.archive\.ubuntu\.com|http://archive.ubuntu.com|g' \
diff --git a/packages/control-plane/test/bootstrap.test.ts b/packages/control-plane/test/bootstrap.test.ts
index 1c29f9f4..c96d574c 100644
--- a/packages/control-plane/test/bootstrap.test.ts
+++ b/packages/control-plane/test/bootstrap.test.ts
@@ -61,6 +61,7 @@ describe("production VM bootstrap", () => {
     const userData = registryUserData();
 
     expect(userData).toContain("apt_watchdog install -y docker.io curl");
+    expect(userData).toContain("2>/dev/null | head -1 || true)");
     expect(userData).toContain("systemctl enable --now docker");
     expect(userData).toContain("/dev/disk/by-id/scsi-0HC_Volume_*");
     expect(userData).toContain("/var/lib/blitz/authorized_key");