diff --git a/bootstrap/provisioning/main.tf b/bootstrap/provisioning/main.tf
index aaa22d6..c91606c 100644
--- a/bootstrap/provisioning/main.tf
+++ b/bootstrap/provisioning/main.tf
@@ -123,7 +123,8 @@ resource "null_resource" "pimox_template_vm_create" {
     pimox_user       = var.pimox_user
     ssh_key_path     = var.pimox_ssh_key_path
     qm_bin           = var.pimox_qm_bin
-    builder_version  = "4"
+    builder_version  = "5"
+    config_hash      = local.config_hash
     vmid             = tostring(var.pimox_template_vmid)
     name             = var.pimox_template_name
     cores            = tostring(var.pimox_template_cores)
@@ -172,23 +173,27 @@ fi
 
 if sudo "$qm_cmd" status "$vmid" >/dev/null 2>&1; then
   if sudo "$qm_cmd" config "$vmid" | grep -q '^template: 1$'; then
-    sudo "$qm_cmd" set "$vmid" --agent enabled=1
-    exit 0
-  fi
-  if [ "$replace_existing" != "true" ]; then
-    echo "VM $vmid already exists and is not a template. Set pimox_template_replace_existing=true to rebuild it." >&2
-    exit 1
-  fi
-  sudo "$qm_cmd" stop "$vmid" >/dev/null 2>&1 || true
-  elapsed=0
-  while [ "$elapsed" -lt 300 ]; do
-    if sudo "$qm_cmd" status "$vmid" | grep -q 'status: stopped'; then
-      break
+    if [ "$replace_existing" != "true" ]; then
+      sudo "$qm_cmd" set "$vmid" --agent enabled=1
+      exit 0
     fi
-    sleep 5
-    elapsed=$((elapsed + 5))
-  done
-  sudo "$qm_cmd" destroy "$vmid" --purge 1 >/dev/null 2>&1 || sudo "$qm_cmd" destroy "$vmid"
+    sudo "$qm_cmd" destroy "$vmid" --purge 1 >/dev/null 2>&1 || sudo "$qm_cmd" destroy "$vmid"
+  else
+    if [ "$replace_existing" != "true" ]; then
+      echo "VM $vmid already exists and is not a template. Set pimox_template_replace_existing=true to rebuild it." >&2
+      exit 1
+    fi
+    sudo "$qm_cmd" stop "$vmid" >/dev/null 2>&1 || true
+    elapsed=0
+    while [ "$elapsed" -lt 300 ]; do
+      if sudo "$qm_cmd" status "$vmid" | grep -q 'status: stopped'; then
+        break
+      fi
+      sleep 5
+      elapsed=$((elapsed + 5))
+    done
+    sudo "$qm_cmd" destroy "$vmid" --purge 1 >/dev/null 2>&1 || sudo "$qm_cmd" destroy "$vmid"
+  fi
 fi
 
 sudo "$qm_cmd" create "$vmid" \
@@ -227,7 +232,8 @@ resource "null_resource" "pimox_template_vm_seal" {
     guest_host      = var.pimox_template_build_host
     guest_user      = var.pimox_template_build_user
     guest_key_path  = var.pimox_template_build_ssh_key_path
-    seal_version    = "4"
+    seal_version    = "5"
+    config_hash     = local.config_hash
     timeout         = var.pimox_template_build_timeout
     timeout_seconds = tostring(var.pimox_template_build_timeout_seconds)
     guest_ip_prefix = var.pimox_template_guest_ip_prefix
@@ -346,7 +352,7 @@ resource "null_resource" "pimox_template_vm_finalize" {
     pimox_user        = var.pimox_user
     ssh_key_path      = var.pimox_ssh_key_path
     qm_bin            = var.pimox_qm_bin
-    finalizer_version = "2"
+    finalizer_version = "3"
     vmid              = tostring(var.pimox_template_vmid)
   }
 
diff --git a/bootstrap/provisioning/templates/golden-node-prepare.sh.tftpl b/bootstrap/provisioning/templates/golden-node-prepare.sh.tftpl
index 1aedb7d..25df0c7 100644
--- a/bootstrap/provisioning/templates/golden-node-prepare.sh.tftpl
+++ b/bootstrap/provisioning/templates/golden-node-prepare.sh.tftpl
@@ -130,41 +130,96 @@ configure_containerd() {
   containerd config default >/etc/containerd/config.toml
   sed -i 's/SystemdCgroup = false/SystemdCgroup = true/g' /etc/containerd/config.toml
 
-  config_version="$(awk -F= '/^[[:space:]]*version[[:space:]]*=/ { gsub(/[[:space:]]/, "", $2); print $2; exit }' /etc/containerd/config.toml)"
+  reset_containerd_registry_tables
+  config_version="$(containerd_config_version)"
   if [ "$config_version" = "3" ]; then
-    registry_table='[plugins."io.containerd.cri.v1.images".registry]'
+    ensure_containerd_registry_config_path "io.containerd.cri.v1.images" '[plugins."io.containerd.cri.v1.images".registry]'
   else
-    registry_table='[plugins."io.containerd.grpc.v1.cri".registry]'
+    ensure_containerd_registry_config_path "io.containerd.grpc.v1.cri" '[plugins."io.containerd.grpc.v1.cri".registry]'
   fi
+}
 
-  awk -v registry_table="$registry_table" '
-    $0 == registry_table { in_registry = 1; found = 1; print; next }
-    in_registry && /^\[/ {
+containerd_config_version() {
+  awk -F= '
+    /^[[:space:]]*version[[:space:]]*=/ {
+      gsub(/[[:space:]]/, "", $2)
+      print $2
+      exit
+    }
+  ' /etc/containerd/config.toml
+}
+
+reset_containerd_registry_tables() {
+  awk '
+    function is_registry_table(line) {
+      return line ~ /^[[:space:]]*\[plugins\./ &&
+        line ~ /[.]registry([.\]]|$)/ &&
+        (line ~ /io[.]containerd[.]grpc[.]v1[.]cri/ ||
+         line ~ /io[.]containerd[.]cri[.]v1[.]images/)
+    }
+    is_registry_table($0) { skip = 1; next }
+    skip && /^[[:space:]]*\[/ { skip = 0 }
+    !skip { print }
+  ' /etc/containerd/config.toml >/etc/containerd/config.toml.homelab
+  mv /etc/containerd/config.toml.homelab /etc/containerd/config.toml
+}
+
+ensure_containerd_registry_config_path() {
+  plugin="$1"
+  append_section="$2"
+
+  awk -v plugin="$plugin" -v append_section="$append_section" '
+    function is_table(line) {
+      return line ~ /^[[:space:]]*\[/
+    }
+    function is_target_registry(line) {
+      return is_table(line) &&
+        index(line, plugin) > 0 &&
+        line ~ /[.]registry[[:space:]]*\]/
+    }
+    BEGIN {
+      in_target = 0
+      found = 0
+      wrote = 0
+    }
+    is_target_registry($0) {
+      if (in_target && !wrote) {
+        print "  config_path = \"/etc/containerd/certs.d\""
+      }
+      in_target = 1
+      wrote = 0
+      found = 1
+      print
+      next
+    }
+    in_target && is_table($0) {
       if (!wrote) {
         print "  config_path = \"/etc/containerd/certs.d\""
       }
-      in_registry = 0
+      in_target = 0
       wrote = 0
     }
-    in_registry && /^[[:space:]]*config_path[[:space:]]*=/ {
+    in_target && $0 ~ /^[[:space:]]*config_path[[:space:]]*=/ {
       print "  config_path = \"/etc/containerd/certs.d\""
       wrote = 1
       next
     }
     { print }
     END {
-      if (in_registry && !wrote) {
+      if (in_target && !wrote) {
         print "  config_path = \"/etc/containerd/certs.d\""
       }
       if (!found) {
         print ""
-        print registry_table
+        print append_section
         print "  config_path = \"/etc/containerd/certs.d\""
       }
     }
   ' /etc/containerd/config.toml >/etc/containerd/config.toml.homelab
   mv /etc/containerd/config.toml.homelab /etc/containerd/config.toml
+}
 
+write_containerd_registry_hosts() {
   cat >/etc/containerd/certs.d/${registry_endpoint}/hosts.toml <<'HOSTS'
 server = "http://${registry_endpoint}"
 
@@ -197,4 +252,5 @@ configure_kernel_boot_options
 install_kubernetes_tools
 install_containerd_runtime
 configure_containerd
+write_containerd_registry_hosts
 enable_services