diff --git a/ansible/group_vars/all/vars.yml b/ansible/group_vars/all/vars.yml
index 204fb8c..6da6b0d 100644
--- a/ansible/group_vars/all/vars.yml
+++ b/ansible/group_vars/all/vars.yml
@@ -1,6 +1,10 @@
 remote_user: david
 ansible_user: "{{ remote_user }}"
-ansible_become: true
+# become is set at the play level in site.yml, NOT here — ansible_become as a
+# connection variable takes precedence over a task's own `become: false`
+# keyword, which silently broke every become:false task in this repo (they
+# all ran as root regardless). Play-level `become:` correctly loses to a
+# task-level override.
 
 meshcore_description: "meshcore management"
 
diff --git a/ansible/host_vars/dm-ashwell/vars.yml b/ansible/host_vars/dm-ashwell/vars.yml
index abcde90..45bac93 100644
--- a/ansible/host_vars/dm-ashwell/vars.yml
+++ b/ansible/host_vars/dm-ashwell/vars.yml
@@ -3,6 +3,3 @@ serial_port: /dev/serial/by-id/usb-Espressif_USB_JTAG_serial_debug_unit_1C:DB:D4
 # Deployed-location wifi
 wifi_ssid_location: "awesome"
 wifi_password_location: "{{ vault_wifi_location }}"
-
-# Predates the current upstream installer's system-service layout
-meshcore_capture_layout: "legacy"
diff --git a/ansible/roles/base/tasks/main.yml b/ansible/roles/base/tasks/main.yml
index e229ed5..e9733cc 100644
--- a/ansible/roles/base/tasks/main.yml
+++ b/ansible/roles/base/tasks/main.yml
@@ -17,6 +17,15 @@
     state: present
   become: true
 
+- name: Install libffi headers (armv6 has no prebuilt cffi wheel, needs to compile it)
+  apt:
+    name:
+      - libffi-dev
+      - pkg-config
+    state: present
+  become: true
+  when: ansible_architecture == "armv6l"
+
 - name: Set MOTD
   template:
     src: motd.j2
diff --git a/ansible/roles/meshcore_capture/tasks/main.yml b/ansible/roles/meshcore_capture/tasks/main.yml
index 8379a86..b628c90 100644
--- a/ansible/roles/meshcore_capture/tasks/main.yml
+++ b/ansible/roles/meshcore_capture/tasks/main.yml
@@ -29,7 +29,9 @@
 - name: Write .env.local config (legacy layout)
   template:
     src: env.local.j2
-    dest: "{{ ansible_env.HOME }}/.meshcore-packet-capture/.env.local"
+    dest: "/home/{{ remote_user }}/.meshcore-packet-capture/.env.local"
+    owner: "{{ remote_user }}"
+    group: "{{ remote_user }}"
     mode: "0640"
   become: false
   when: meshcore_capture_layout == 'legacy'
@@ -56,11 +58,12 @@
 
 - name: Deploy meshcore-capture-update script
   copy:
-    content: >-
+    content: |
       #!/usr/bin/env bash
-
       bash <(curl -fsSL https://raw.githubusercontent.com/agessaman/meshcore-packet-capture/main/install.sh){{ ' --update' if meshcore_capture_layout != 'legacy' else '' }}
-    dest: "{{ ansible_env.HOME }}/meshcore-capture-update.sh"
+    dest: "/home/{{ remote_user }}/meshcore-capture-update.sh"
+    owner: "{{ remote_user }}"
+    group: "{{ remote_user }}"
     mode: "0755"
   become: false
 
@@ -69,6 +72,8 @@
     content: |
       #!/usr/bin/env bash
       sudo journalctl -u {{ 'meshcore-capture' if meshcore_capture_layout == 'legacy' else 'meshcore-packet-capture' }} -f
-    dest: "{{ ansible_env.HOME }}/meshcore-capture-logs.sh"
+    dest: "/home/{{ remote_user }}/meshcore-capture-logs.sh"
+    owner: "{{ remote_user }}"
+    group: "{{ remote_user }}"
     mode: "0755"
   become: false
diff --git a/ansible/roles/meshcore_capture/templates/99-user.toml.j2 b/ansible/roles/meshcore_capture/templates/99-user.toml.j2
index 6afa11d..4cfdcfd 100644
--- a/ansible/roles/meshcore_capture/templates/99-user.toml.j2
+++ b/ansible/roles/meshcore_capture/templates/99-user.toml.j2
@@ -1,9 +1,10 @@
 # MeshCore Packet Capture - user overrides
 # Managed by Ansible - local changes will be overwritten on next playbook run
 #
-# [[broker]] tables merge by name across config.d/*.toml, so the letsmesh-us
-# and letsmesh-eu entries below only add owner identity to the connection
-# details already installed as config.d/10-letsmesh.toml.
+# Defines every broker fully (not relying on config.d/10-letsmesh.toml being
+# auto-installed) — whether that preset exists depends on which path the
+# installer took (fresh install vs migrate), so a partial override here would
+# silently no-op on nodes where it wasn't created.
 
 [general]
 iata = "{{ packetcapture_iata }}"
@@ -22,17 +23,45 @@ advert_interval_hours = {{ packetcapture_advert_interval_hours }}
 owner_public_key = "{{ packetcapture_owner_public_key }}"
 owner_email = "{{ packetcapture_owner_email }}"
 
+# LetsMesh.net Packet Analyzer (US)
 [[broker]]
 name = "letsmesh-us"
+enabled = true
+server = "mqtt-us-v1.letsmesh.net"
+port = 443
+transport = "websockets"
+keepalive = 120
+qos = 0
+retain = true
+
+[broker.tls]
+enabled = true
+verify = true
 
 [broker.auth]
+method = "token"
+audience = "mqtt-us-v1.letsmesh.net"
 owner = "{{ packetcapture_owner_public_key }}"
 email = "{{ packetcapture_owner_email }}"
 
+# LetsMesh.net Packet Analyzer (EU)
 [[broker]]
 name = "letsmesh-eu"
+enabled = true
+server = "mqtt-eu-v1.letsmesh.net"
+port = 443
+transport = "websockets"
+keepalive = 120
+qos = 0
+retain = true
+
+[broker.tls]
+enabled = true
+verify = true
 
 [broker.auth]
+method = "token"
+audience = "mqtt-eu-v1.letsmesh.net"
 owner = "{{ packetcapture_owner_public_key }}"
 email = "{{ packetcapture_owner_email }}"
 
diff --git a/ansible/roles/meshcore_cli/tasks/main.yml b/ansible/roles/meshcore_cli/tasks/main.yml
index 3e42cfe..baf26ee 100644
--- a/ansible/roles/meshcore_cli/tasks/main.yml
+++ b/ansible/roles/meshcore_cli/tasks/main.yml
@@ -11,5 +11,5 @@
   shell: pipx install meshcore-cli
   args:
     executable: /bin/bash
-    creates: "{{ ansible_env.HOME }}/.local/bin/meshcore-cli"
+    creates: "/home/{{ remote_user }}/.local/bin/meshcore-cli"
   become: false
diff --git a/ansible/roles/scripts/tasks/main.yml b/ansible/roles/scripts/tasks/main.yml
index ae6b639..3fa8611 100644
--- a/ansible/roles/scripts/tasks/main.yml
+++ b/ansible/roles/scripts/tasks/main.yml
@@ -2,13 +2,17 @@
 - name: Deploy voltage.sh
   copy:
     src: voltage.sh
-    dest: "{{ ansible_env.HOME }}/voltage.sh"
+    dest: "/home/{{ remote_user }}/voltage.sh"
+    owner: "{{ remote_user }}"
+    group: "{{ remote_user }}"
     mode: "0755"
   become: false
 
 - name: Deploy bandwidth.sh
   copy:
     src: bandwidth.sh
-    dest: "{{ ansible_env.HOME }}/bandwidth.sh"
+    dest: "/home/{{ remote_user }}/bandwidth.sh"
+    owner: "{{ remote_user }}"
+    group: "{{ remote_user }}"
     mode: "0755"
   become: false
diff --git a/ansible/site.yml b/ansible/site.yml
index 9221ab2..e0b4289 100644
--- a/ansible/site.yml
+++ b/ansible/site.yml
@@ -1,6 +1,7 @@
 ---
 - name: Deploy MeshCore monitoring nodes
   hosts: meshcore
+  become: true
   vars_prompt:
     - name: tailscale_auth_key
       prompt: "Tailscale auth key (leave blank to skip)"