diff --git a/ansible/roles/bootstrap-image-prepull/tasks/main.yml b/ansible/roles/bootstrap-image-prepull/tasks/main.yml
index 1b03a1d..a44f0fa 100644
--- a/ansible/roles/bootstrap-image-prepull/tasks/main.yml
+++ b/ansible/roles/bootstrap-image-prepull/tasks/main.yml
@@ -1,7 +1,7 @@
 ---
 - name: Pull bootstrap images into containerd
   shell: |
-    if /usr/local/bin/ctr -n k8s.io images ls -q | grep -Fx -- "{{ item }}" >/dev/null; then
+    if /usr/local/bin/k3s crictl inspecti "{{ item }}" >/dev/null 2>&1; then
       echo "already present"
       exit 0
     fi
@@ -11,7 +11,7 @@
 
     for attempt in 1 2 3 4 5 6 7 8 9 10; do
       echo "pull attempt ${attempt}: {{ item }}"
-      if timeout 240s /usr/local/bin/ctr -n k8s.io images pull "{{ item }}"; then
+      if timeout 240s /usr/local/bin/k3s crictl pull "{{ item }}"; then
         echo "pulled image"
         exit 0
       fi
diff --git a/ansible/roles/common/tasks/main.yml b/ansible/roles/common/tasks/main.yml
index e553d72..654ffb6 100644
--- a/ansible/roles/common/tasks/main.yml
+++ b/ansible/roles/common/tasks/main.yml
@@ -26,7 +26,7 @@
       {{ cloud_init_wait.stderr | default('') }}
   when:
     - cloud_init_binary.rc == 0
-    - cloud_init_wait.rc == 1 or 'status: error' in (cloud_init_wait.stdout | default(''))
+    - "'status: error' in (cloud_init_wait.stdout | default(''))"
 
 - name: Persist primary interface MTU for registry egress
   copy:
diff --git a/ansible/roles/kube-vip-deploy/tasks/main.yml b/ansible/roles/kube-vip-deploy/tasks/main.yml
index c8dcf1a..d7019eb 100644
--- a/ansible/roles/kube-vip-deploy/tasks/main.yml
+++ b/ansible/roles/kube-vip-deploy/tasks/main.yml
@@ -1,7 +1,7 @@
 ---
 - name: Pre-pull kube-vip bootstrap images into containerd
   shell: |
-    if /usr/local/bin/ctr -n k8s.io images ls -q | grep -Fx -- "{{ item }}" >/dev/null; then
+    if /usr/local/bin/k3s crictl inspecti "{{ item }}" >/dev/null 2>&1; then
       echo "already present"
       exit 0
     fi
@@ -11,7 +11,7 @@
 
     for attempt in 1 2 3 4 5; do
       echo "pull attempt ${attempt}: {{ item }}"
-      if timeout 180s /usr/local/bin/ctr -n k8s.io images pull "{{ item }}"; then
+      if timeout 180s /usr/local/bin/k3s crictl pull "{{ item }}"; then
         echo "pulled image"
         exit 0
       fi
diff --git a/ansible/roles/rancher-image-prepull/tasks/main.yml b/ansible/roles/rancher-image-prepull/tasks/main.yml
index b5d88cb..9adc390 100644
--- a/ansible/roles/rancher-image-prepull/tasks/main.yml
+++ b/ansible/roles/rancher-image-prepull/tasks/main.yml
@@ -1,7 +1,7 @@
 ---
 - name: Pull Rancher images into containerd
   shell: |
-    if /usr/local/bin/ctr -n k8s.io images ls -q | grep -Fx -- "{{ item }}" >/dev/null; then
+    if /usr/local/bin/k3s crictl inspecti "{{ item }}" >/dev/null 2>&1; then
       echo "already present"
       exit 0
     fi
@@ -11,7 +11,7 @@
 
     for attempt in 1 2 3 4 5 6 7 8 9 10; do
       echo "pull attempt ${attempt}: {{ item }}"
-      if timeout 240s /usr/local/bin/ctr -n k8s.io images pull "{{ item }}"; then
+      if timeout 240s /usr/local/bin/k3s crictl pull "{{ item }}"; then
         echo "pulled image"
         exit 0
       fi