diff --git a/.gitea/workflows/deploy-k8s-bootstrap.yaml b/.gitea/workflows/deploy-k8s-bootstrap.yaml
index eaf554d..6bf57ea 100644
--- a/.gitea/workflows/deploy-k8s-bootstrap.yaml
+++ b/.gitea/workflows/deploy-k8s-bootstrap.yaml
@@ -6,14 +6,14 @@ on:
     branches:
       - main
     paths:
-      - 'k8s-bootstrap/**'
-      - '.gitea/workflows/deploy-k8s-bootstrap.yaml'
+      - "k8s-bootstrap/**"
+      - ".gitea/workflows/deploy-k8s-bootstrap.yaml"
   pull_request:
     branches:
       - main
     paths:
-      - 'k8s-bootstrap/**'
-      - '.gitea/workflows/deploy-k8s-bootstrap.yaml'
+      - "k8s-bootstrap/**"
+      - ".gitea/workflows/deploy-k8s-bootstrap.yaml"
 
 jobs:
   preview:
@@ -27,10 +27,10 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '24'
+          node-version: "24"
 
       - name: Restore Stack Config
-        run: echo "${{ secrets.K8S_BOOTSTRAP_DEV_YAML }}" | base64 -d > k8s-bootstrap/Pulumi.dev.yaml
+        run: echo "${{ secrets.K8S_BOOTSTRAP_PULUMI_DEV_YAML }}" | base64 -d > k8s-bootstrap/Pulumi.dev.yaml
 
       - name: Install Dependencies
         run: npm install
@@ -57,10 +57,10 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '24'
+          node-version: "24"
 
       - name: Restore Stack Config
-        run: echo "${{ secrets.K8S_BOOTSTRAP_DEV_YAML }}" | base64 -d > k8s-bootstrap/Pulumi.dev.yaml
+        run: echo "${{ secrets.K8S_BOOTSTRAP_PULUMI_DEV_YAML }}" | base64 -d > k8s-bootstrap/Pulumi.dev.yaml
 
       - name: Install Dependencies
         run: npm install
diff --git a/k8s-bootstrap/index.ts b/k8s-bootstrap/index.ts
index 343d541..d4ae119 100644
--- a/k8s-bootstrap/index.ts
+++ b/k8s-bootstrap/index.ts
@@ -23,11 +23,11 @@ const pve2ApiToken = infraRef.requireOutput(
 ) as pulumi.Output<string>;
 
 // Node IPs — static DHCP leases set in the router
-const master1Ip = config.require("master1Ip");
-const master2Ip = config.require("master2Ip");
-const master3Ip = config.require("master3Ip");
-const worker1Ip = config.require("worker1Ip");
-const worker2Ip = config.require("worker2Ip");
+const master1Ip = infraRef.requireOutput("master1Ip");
+const master2Ip = infraRef.requireOutput("master2Ip");
+const master3Ip = infraRef.requireOutput("master3Ip");
+const worker1Ip = infraRef.requireOutput("worker1Ip");
+const worker2Ip = infraRef.requireOutput("worker2Ip");
 
 // Pre-shared k3s cluster token
 const k3sToken = config.requireSecret("k3sToken");
@@ -47,7 +47,9 @@ const worker1VmId = vmIdsOutput.apply((ids) => String(ids.worker1));
 const worker2VmId = vmIdsOutput.apply((ids) => String(ids.worker2));
 
 // SSH connection helper
-function conn(ip: string): command.types.input.remote.ConnectionArgs {
+function conn(
+  ip: pulumi.Input<string>,
+): command.types.input.remote.ConnectionArgs {
   return { host: ip, user: "ubuntu", privateKey: ciRunnerPrivateKey };
 }
 
@@ -97,7 +99,7 @@ const allStarts = [
 const waitMaster1Ssh = new command.local.Command(
   "wait-ssh-master-1",
   {
-    create: `for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${master1Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
+    create: pulumi.interpolate`for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${master1Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
     triggers: [master1VmId],
     interpreter: ["/bin/bash", "-c"],
   },
@@ -131,7 +133,7 @@ const waitK3sMaster1Ready = new command.remote.Command(
 const waitMaster2Ssh = new command.local.Command(
   "wait-ssh-master-2",
   {
-    create: `for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${master2Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
+    create: pulumi.interpolate`for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${master2Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
     triggers: [master2VmId],
     interpreter: ["/bin/bash", "-c"],
   },
@@ -141,7 +143,7 @@ const waitMaster2Ssh = new command.local.Command(
 const waitMaster3Ssh = new command.local.Command(
   "wait-ssh-master-3",
   {
-    create: `for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${master3Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
+    create: pulumi.interpolate`for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${master3Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
     triggers: [master3VmId],
     interpreter: ["/bin/bash", "-c"],
   },
@@ -175,7 +177,7 @@ const joinMaster3 = new command.remote.Command(
 const waitWorker1Ssh = new command.local.Command(
   "wait-ssh-worker-1",
   {
-    create: `for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${worker1Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
+    create: pulumi.interpolate`for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${worker1Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
     triggers: [worker1VmId],
     interpreter: ["/bin/bash", "-c"],
   },
@@ -185,7 +187,7 @@ const waitWorker1Ssh = new command.local.Command(
 const waitWorker2Ssh = new command.local.Command(
   "wait-ssh-worker-2",
   {
-    create: `for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${worker2Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
+    create: pulumi.interpolate`for i in $(seq 1 60); do (timeout 5 bash -c "echo > /dev/tcp/${worker2Ip}/22") 2>/dev/null && exit 0; sleep 5; done; exit 1`,
     triggers: [worker2VmId],
     interpreter: ["/bin/bash", "-c"],
   },
@@ -227,7 +229,7 @@ const getKubeconfig = new command.remote.Command(
 );
 
 export const kubeconfig = pulumi.secret(
-  getKubeconfig.stdout.apply((kc) =>
-    kc.replace(/127\.0\.0\.1/g, master1Ip).trim(),
-  ),
+  pulumi
+    .all([getKubeconfig.stdout, master1Ip])
+    .apply(([kc, ip]) => kc.replaceAll("127.0.0.1", ip as string).trim()),
 );
diff --git a/k8s-bootstrap/tsconfig.json b/k8s-bootstrap/tsconfig.json
index 80b5662..5e2c0b7 100644
--- a/k8s-bootstrap/tsconfig.json
+++ b/k8s-bootstrap/tsconfig.json
@@ -2,7 +2,7 @@
     "compilerOptions": {
         "strict": true,
         "outDir": "bin",
-        "target": "es2020",
+        "target": "es2024",
         "module": "nodenext",
         "moduleResolution": "nodenext",
         "sourceMap": true,