diff --git a/access-matrix.sh b/access-matrix.sh
index 5b59199..3c3821b 100644
--- a/access-matrix.sh
+++ b/access-matrix.sh
@@ -6,7 +6,7 @@ set -u
 cd /home/reachableceo/projects/PFVCluster || exit 1
 
 # Policy-excluded systems (never attempt access)
-EXCLUDE=':tsys-umbrel:tsys-cloudron:devbox-cloudron:pfv-bms:stlpc-bizoffice:ultix-highside:'
+EXCLUDE=':tsys-cloudron:pfv-bms:tsys-umbrel:stlpc-bizoffice:ultix-highside:'
 
 printf '%-28s %-16s %-18s %s\n' "NAME" "TS-IP" "ACCESS" "SUDO"
 printf '%-28s %-16s %-18s %s\n' "----" "-----" "------" "----"
diff --git a/bootstrap-all.sh b/bootstrap-all.sh
index 75fc562..9bd7cd1 100644
--- a/bootstrap-all.sh
+++ b/bootstrap-all.sh
@@ -1,10 +1,10 @@
 #!/usr/bin/bash
 # bootstrap-all.sh — push agent key + sudo to every remaining NO-KEY system.
 #
-# Three groups (user determined by system type):
-#   1. Proxmox appliances (mailgw) + Kali → root
-#   2. stlpc-* systems                   → labuser
-#   3. Everything else                    → localuser
+# Groups (user determined by system type):
+#   1. labuser      → stlpc-* systems
+#   2. subodev      → subopi* systems
+#   3. localuser    → everything else (kali, cloudron, siem, ubuntu server, etc.)
 #
 # You'll enter passwords interactively. Idempotent: safe to re-run.
 set -u
@@ -15,23 +15,6 @@ SSH_OPTS=(-o StrictHostKeyChecking=accept-new -o ConnectTimeout=10)
 
 ok=0; fail=0; faillist=""
 
-run_as_root() {
-  local name="$1" ip="$2"
-  echo "========================================"
-  echo "  $name ($ip) — root"
-  echo "========================================"
-  if scp "${SSH_OPTS[@]}" "$SCRIPT" "root@${ip}:/tmp/" 2>/dev/null; then
-    if ssh "${SSH_OPTS[@]}" "root@${ip}" "bash /tmp/$SCRIPT"; then
-      echo "  -> $name DONE"; ok=$((ok+1))
-    else
-      echo "  -> $name FAILED (script error)"; fail=$((fail+1)); faillist="$faillist $name"
-    fi
-  else
-    echo "  -> $name FAILED (root SSH/password)"; fail=$((fail+1)); faillist="$faillist $name"
-  fi
-  echo
-}
-
 run_as_user() {
   local name="$1" ip="$2" user="$3"
   echo "========================================"
@@ -49,28 +32,29 @@ run_as_user() {
   echo
 }
 
-# === Group 1: root (Proxmox appliances + Kali) ===
+# === Group 1: labuser (stlpc-*) ===
 echo "########################################"
-echo "# Group 1: root (Proxmox appliances + Kali)"
+echo "# Group 1: labuser (stlpc-*)"
 echo "########################################"
 echo
-run_as_root kali-tsys 100.82.30.115
-run_as_root preprod-proxmox-mailgw 100.114.9.49
-run_as_root sectestbed-proxmox-mailgw 100.117.24.21
-
-# === Group 2: labuser (stlpc-*) ===
-echo "########################################"
-echo "# Group 2: labuser (stlpc-*)"
-echo "########################################"
-echo
-run_as_user stlpc-artroom 100.120.77.113 labuser
 run_as_user stlpc-garage 100.72.192.22 labuser
 
+# === Group 2: subodev (subopi*) ===
+echo "########################################"
+echo "# Group 2: subodev (subopi*)"
+echo "########################################"
+echo
+run_as_user subopi3 100.93.17.77 subodev
+run_as_user subopi-dev-3 100.64.231.65 subodev
+run_as_user subopi-dev-4 100.65.224.85 subodev
+
 # === Group 3: localuser (everything else) ===
 echo "########################################"
 echo "# Group 3: localuser (standard systems)"
 echo "########################################"
 echo
+run_as_user kali-tsys 100.82.30.115 localuser
+run_as_user devbox-cloudron 100.119.72.25 localuser
 run_as_user pfv-jetson-nano-1 100.82.230.119 localuser
 run_as_user pfvsvrpi 100.91.151.113 localuser
 run_as_user preprod-cloudron 100.95.69.89 localuser
@@ -78,9 +62,6 @@ run_as_user preprod-hfnoc-uisp 100.77.14.7 localuser
 run_as_user preprod-siem 100.98.162.14 localuser
 run_as_user sectestbed-cloudron 100.97.140.105 localuser
 run_as_user sectestbed-siem 100.108.121.18 localuser
-run_as_user subopi3 100.93.17.77 localuser
-run_as_user subopi-dev-3 100.64.231.65 localuser
-run_as_user subopi-dev-4 100.65.224.85 localuser
 run_as_user tsys-siem 100.72.35.113 localuser
 run_as_user ultix-field 100.115.233.124 localuser