Lab, Secure Boot VM: the deployed Debian booted under Secure Boot through the chainload, but its console was garbled after the network GRUB had switched the display mode; GRUB menus now use the firmware's text console (terminal_output console), which also suits serial/SOL. phone-home over HTTPS failed once on that first boot (TLS: bad record MAC on the region's side; the same request works from the machine since), and cloud-init spends its 10 tries within milliseconds. Its content is not secret and its token only works from the machine's address, so it goes over HTTP again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>