diff --git a/config/platform-infra/apps.yaml b/config/platform-infra/apps.yaml
index 74fdbb04..5251260d 100644
--- a/config/platform-infra/apps.yaml
+++ b/config/platform-infra/apps.yaml
@@ -105,6 +105,7 @@ install:
           identityFile: C:\Users\liang\AppData\Local\UniDesk\hyperv-vm\D601-VM\id_ed25519
           stagingDirectory: C:\Users\liang\AppData\Local\Temp\unideskcprovider-linux
         providerId: D601-VM-HOST
+        server: ws://10.89.0.1:18082/ws/provider
         user: ubuntu
         home: /home/ubuntu
         systemdUnit: unideskcprovider.service
diff --git a/config/platform-infra/k3s-clusters.yaml b/config/platform-infra/k3s-clusters.yaml
index d2bcdef3..8fee8dec 100644
--- a/config/platform-infra/k3s-clusters.yaml
+++ b/config/platform-infra/k3s-clusters.yaml
@@ -28,7 +28,7 @@ targets:
     wireguard:
       interfaceName: wg0
       packageName: wireguard-tools
-      mtu: 1380
+      mtu: 1100
       listenPort: 51820
       controlPlaneAddress: 10.89.0.1/24
       workerAddress: 10.89.0.2/24
diff --git a/scripts/src/provider-apps-linux.ts b/scripts/src/provider-apps-linux.ts
index 2e8718e3..63a45340 100644
--- a/scripts/src/provider-apps-linux.ts
+++ b/scripts/src/provider-apps-linux.ts
@@ -79,8 +79,11 @@ function bootstrapPowerShell(target: LinuxInstallTarget, remoteCommand: string,
     "$ErrorActionPreference='Stop'",
     `$key=${psQuote(target.bootstrap.identityFile)}`,
     `$guest=${psQuote(target.bootstrap.guest)}`,
-    `& ssh.exe -i $key -o BatchMode=yes -o ConnectTimeout=8 $guest ${psQuote(remoteCommand)}`,
-    "exit $LASTEXITCODE",
+    `$remote=${psQuote(remoteCommand)}`,
+    "& ssh.exe -i $key -o BatchMode=yes -o ConnectTimeout=8 $guest $remote",
+    "$code=$LASTEXITCODE",
+    "if ($code -ne 0) { throw \"remote SSH command failed with exit code $code\" }",
+    "exit $code",
   ].join("; ");
   return trans(target.bootstrap.route, ["ps", source], timeoutMs);
 }
@@ -94,6 +97,7 @@ function plan(config: ProviderAppsConfig, id: string, target: LinuxInstallTarget
     target: id,
     bootstrap: { mode: target.bootstrap.mode, route: target.bootstrap.route, guest: target.bootstrap.guest },
     providerId: target.providerId,
+    server: target.server,
     user: target.user,
     home: target.home,
     configPath: `${target.home}/.unidesk/provider.yaml`,
@@ -123,7 +127,7 @@ function apply(config: ProviderAppsConfig, id: string, target: LinuxInstallTarge
   const localToken = join(local, target.credential.targetFile);
   const configYaml = [
     `id: ${target.providerId}`,
-    `server: ${config.install.defaults.server}`,
+    `server: ${target.server}`,
     `credentialFile: ${target.credential.targetFile}`,
     `pythonRuntime: ${config.install.defaults.pythonRuntime}`,
     `autoStart: ${String(config.install.defaults.autoStart)}`,
@@ -159,6 +163,9 @@ function apply(config: ProviderAppsConfig, id: string, target: LinuxInstallTarge
       `sudo -u ${shQuote(target.user)} -H bash -lc ${shQuote(`curl -fsSL ${config.publicExposure.publicBaseUrl}${config.install.routes.linuxInstaller} | bash`)}`,
     ].join("; ");
     const installed = checked(bootstrapPowerShell(target, script, 300_000), "install Linux Provider");
+    if (!installed.stdout.includes("OK operation=unideskcprovider.install")) {
+      throw new Error(`install Linux Provider returned no completion marker: ${installed.stdout.trim() || "empty stdout"}`);
+    }
     return {
       ...plan(config, id, target),
       ok: true,
diff --git a/scripts/src/provider-apps.test.ts b/scripts/src/provider-apps.test.ts
index 8f9ac7a4..5f2012a6 100644
--- a/scripts/src/provider-apps.test.ts
+++ b/scripts/src/provider-apps.test.ts
@@ -14,6 +14,9 @@ describe("Provider Apps L1 release", () => {
     expect(config.target.id).toBe("NC01");
     expect(config.runtime.port).toBe(18121);
     expect(config.publicExposure.publicBaseUrl).toBe("https://apps.hwpod.com");
+    expect(config.install.linux.targets["D601-VM-HOST"]?.server).toBe(
+      "ws://10.89.0.1:18082/ws/provider",
+    );
   });
 
   test("serves release files and rejects unknown or mutating requests", async () => {
diff --git a/src/components/provider-apps/config.ts b/src/components/provider-apps/config.ts
index 86f54795..1a0f5788 100644
--- a/src/components/provider-apps/config.ts
+++ b/src/components/provider-apps/config.ts
@@ -69,6 +69,7 @@ export interface LinuxInstallTarget {
     stagingDirectory: string;
   };
   providerId: string;
+  server: string;
   user: string;
   home: string;
   systemdUnit: string;
@@ -218,6 +219,7 @@ function linuxInstall(value: unknown, path: string): LinuxInstallConfig {
         stagingDirectory: string(bootstrap.stagingDirectory, `${path}.targets.${targetId}.bootstrap.stagingDirectory`),
       },
       providerId,
+      server: url(target.server, `${path}.targets.${targetId}.server`, ["ws:", "wss:"]),
       user: string(target.user, `${path}.targets.${targetId}.user`),
       home: absolutePosixPath(target.home, `${path}.targets.${targetId}.home`),
       systemdUnit,