diff --git a/bootstrap-all.sh b/bootstrap-all.sh
index 5e6834f..d54ddd6 100644
--- a/bootstrap-all.sh
+++ b/bootstrap-all.sh
@@ -1,72 +1,128 @@
 #!/usr/bin/bash
 # bootstrap-all.sh — push agent key + sudo to every remaining NO-KEY system.
 #
-# Groups (user determined by system type):
-#   1. subodev       → subopi* systems
-#   2. ultixfield    → ultix-field
-#   3. localuser     → everything else (cloudron, siem, ubuntu server, kali, etc.)
+# Two escalation methods:
+#   sudo  → localuser has sudo, no root password (Ubuntu Server: cloudron, siem)
+#   su    → root has a password (everything else)
 #
+# Captures per-host logs to bootstrap-logs/ for debugging.
 # You'll enter passwords interactively. Idempotent: safe to re-run.
 set -u
 cd "$(dirname "$0")" || exit 1
 
 SCRIPT=agent-bootstrap.sh
 SSH_OPTS=(-o StrictHostKeyChecking=accept-new -o ConnectTimeout=10)
+LOGDIR="bootstrap-logs"
+mkdir -p "$LOGDIR"
 
 ok=0; fail=0; faillist=""
 
-run_as_user() {
+run_with_sudo() {
   local name="$1" ip="$2" user="$3"
+  local logfile="${LOGDIR}/${name}.log"
   echo "========================================"
-  echo "  $name ($ip) — $user"
+  echo "  $name ($ip) — $user (sudo)"
   echo "========================================"
-  if scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" 2>/dev/null; then
-    if ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" 'su -c "bash /tmp/'"$SCRIPT"'"'; then
-      echo "  -> $name DONE"; ok=$((ok+1))
+  {
+    echo "=== $name ($ip) — $user via sudo ==="
+    echo "Date: $(date)"
+    echo
+    if scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" 2>&1; then
+      if ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" "sudo bash /tmp/$SCRIPT" 2>&1; then
+        echo
+        echo "RESULT: $name DONE"
+      else
+        echo
+        echo "RESULT: $name FAILED (sudo)"
+      fi
     else
-      echo "  -> $name FAILED (su to root)"; fail=$((fail+1)); faillist="$faillist $name"
+      echo "RESULT: $name FAILED (${user} SSH/password)"
     fi
+  } > "$logfile" 2>&1
+  tail -5 "$logfile"
+  if grep -q "RESULT: $name DONE" "$logfile"; then
+    ok=$((ok+1))
   else
-    echo "  -> $name FAILED (${user} SSH/password)"; fail=$((fail+1)); faillist="$faillist $name"
+    fail=$((fail+1)); faillist="$faillist $name"
   fi
+  echo "  (full log: $logfile)"
   echo
 }
 
-# === Group 1: subodev (subopi*) ===
+run_with_su() {
+  local name="$1" ip="$2" user="$3"
+  local logfile="${LOGDIR}/${name}.log"
+  echo "========================================"
+  echo "  $name ($ip) — $user (su)"
+  echo "========================================"
+  {
+    echo "=== $name ($ip) — $user via su ==="
+    echo "Date: $(date)"
+    echo
+    if scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" 2>&1; then
+      if ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" 'su -c "bash /tmp/'"$SCRIPT"'"' 2>&1; then
+        echo
+        echo "RESULT: $name DONE"
+      else
+        echo
+        echo "RESULT: $name FAILED (su)"
+      fi
+    else
+      echo "RESULT: $name FAILED (${user} SSH/password)"
+    fi
+  } > "$logfile" 2>&1
+  tail -5 "$logfile"
+  if grep -q "RESULT: $name DONE" "$logfile"; then
+    ok=$((ok+1))
+  else
+    fail=$((fail+1)); faillist="$faillist $name"
+  fi
+  echo "  (full log: $logfile)"
+  echo
+}
+
+# === Group 1: subodev via su ===
 echo "########################################"
 echo "# Group 1: subodev (subopi*)"
 echo "########################################"
 echo
-run_as_user subopi3 100.93.17.77 subodev
-run_as_user subopi-dev-3 100.64.231.65 subodev
-run_as_user subopi-dev-4 100.65.224.85 subodev
+run_with_su subopi3 100.93.17.77 subodev
+run_with_su subopi-dev-3 100.64.231.65 subodev
+run_with_su subopi-dev-4 100.65.224.85 subodev
 
-# === Group 2: ultixfield ===
+# === Group 2: ultixfield via su ===
 echo "########################################"
 echo "# Group 2: ultixfield"
 echo "########################################"
 echo
-run_as_user ultix-field 100.115.233.124 ultixfield
+run_with_su ultix-field 100.115.233.124 ultixfield
 
-# === Group 3: localuser (everything else) ===
+# === Group 3: localuser + sudo (Ubuntu Server: cloudron, siem — no root password) ===
 echo "########################################"
-echo "# Group 3: localuser (standard systems)"
+echo "# Group 3: localuser + sudo (cloudron, siem)"
 echo "########################################"
 echo
-run_as_user devbox-cloudron 100.119.72.25 localuser
-run_as_user kali-tsys 100.82.30.115 localuser
-run_as_user pfv-jetson-nano-1 100.82.230.119 localuser
-run_as_user pfvsvrpi 100.91.151.113 localuser
-run_as_user preprod-cloudron 100.95.69.89 localuser
-run_as_user preprod-hfnoc-uisp 100.77.14.7 localuser
-run_as_user preprod-siem 100.98.162.14 localuser
-run_as_user sectestbed-cloudron 100.97.140.105 localuser
-run_as_user sectestbed-siem 100.108.121.18 localuser
-run_as_user tsys-siem 100.72.35.113 localuser
+run_with_sudo devbox-cloudron 100.119.72.25 localuser
+run_with_sudo preprod-cloudron 100.95.69.89 localuser
+run_with_sudo sectestbed-cloudron 100.97.140.105 localuser
+run_with_sudo preprod-siem 100.98.162.14 localuser
+run_with_sudo sectestbed-siem 100.108.121.18 localuser
+run_with_sudo tsys-siem 100.72.35.113 localuser
+
+# === Group 4: localuser + su (root has password) ===
+echo "########################################"
+echo "# Group 4: localuser + su (root password)"
+echo "########################################"
+echo
+run_with_su kali-tsys 100.82.30.115 localuser
+run_with_su pfv-jetson-nano-1 100.82.230.119 localuser
+run_with_su pfvsvrpi 100.91.151.113 localuser
+run_with_su preprod-hfnoc-uisp 100.77.14.7 localuser
 
 echo "========================================"
 echo "Summary: $ok done, $fail failed"
 [ -n "$faillist" ] && echo "Failed:$faillist"
+echo "Logs in: $LOGDIR/"
 echo "========================================"
 echo "Blocked — need console work (separate tickets):"
 echo "  tsys-ucs-01, tsys-ucs-02 — remove 2FA first [#418]"
@@ -75,4 +131,4 @@ echo "========================================"
 echo "2FA by design (leave alone):"
 echo "  sectestbed-sandbox"
 echo "========================================"
-echo "Tell the agent to re-run access-matrix.sh to verify."
+echo "Tell the agent to re-run access-matrix.sh + check logs to verify."