diff --git a/scripts/iso/felhom-bootstrap.sh b/scripts/iso/felhom-bootstrap.sh
index ff9752a..7d68192 100644
--- a/scripts/iso/felhom-bootstrap.sh
+++ b/scripts/iso/felhom-bootstrap.sh
@@ -197,6 +197,13 @@ sweep_nics() {
         render_candidate_interfaces "$n" > "${INTERFACES_FILE}.felhom-tmp" \
             && mv "${INTERFACES_FILE}.felhom-tmp" "$INTERFACES_FILE"
         ifreload -a 2>/dev/null
+        # Drill finding (2026-07-22, nested leg): the installer's fallback bakes a DEFAULT ROUTE via
+        # 192.168.100.1, and dhclient-script does not replace an existing default route — the probe
+        # then rides the dead gateway and fails even though the lease landed. A candidate must be
+        # judged on the lease's OWN addressing/routing, so clear vmbr0 first; the restore path (and
+        # any next candidate) re-applies the configured state via ifreload.
+        ip addr flush dev vmbr0 2>/dev/null
+        ip route flush dev vmbr0 2>/dev/null
         timeout "$SWEEP_DHCP_TIMEOUT" dhclient -1 vmbr0 2>/dev/null
         local drc=$?
         if [[ $drc -eq 0 ]] && hub_reachable; then