diff --git a/.gitea/workflows/terraform-apply.yml b/.gitea/workflows/terraform-apply.yml
index 43ab4b5..0095094 100644
--- a/.gitea/workflows/terraform-apply.yml
+++ b/.gitea/workflows/terraform-apply.yml
@@ -57,7 +57,7 @@ jobs:
           set -euo pipefail
           for attempt in 1 2; do
             echo "Terraform plan attempt $attempt/2"
-            if timeout 20m terraform plan -parallelism=1 -out=tfplan; then
+            if timeout 20m terraform plan -refresh=false -parallelism=1 -out=tfplan; then
               exit 0
             fi
             if [ "$attempt" -eq 1 ]; then
diff --git a/.gitea/workflows/terraform-plan.yml b/.gitea/workflows/terraform-plan.yml
index eee7cf2..0701861 100644
--- a/.gitea/workflows/terraform-plan.yml
+++ b/.gitea/workflows/terraform-plan.yml
@@ -71,7 +71,7 @@ jobs:
           set -euo pipefail
           for attempt in 1 2; do
             echo "Terraform plan attempt $attempt/2"
-            if timeout 20m terraform plan -parallelism=1 -out=tfplan; then
+            if timeout 20m terraform plan -refresh=false -parallelism=1 -out=tfplan; then
               exit 0
             fi
             if [ "$attempt" -eq 1 ]; then
diff --git a/nixos/kubeadm/scripts/rebuild-and-bootstrap.sh b/nixos/kubeadm/scripts/rebuild-and-bootstrap.sh
index 1b60dbc..ff873cc 100755
--- a/nixos/kubeadm/scripts/rebuild-and-bootstrap.sh
+++ b/nixos/kubeadm/scripts/rebuild-and-bootstrap.sh
@@ -164,7 +164,7 @@ rebuild_node() {
   timeout "$REBUILD_TIMEOUT" nixos-rebuild switch \
     --flake "$FLAKE_DIR#$node_name" \
     --target-host "$ACTIVE_SSH_USER@$node_ip" \
-    --sudo
+    --use-remote-sudo
 }
 
 rebuild_node_with_retry() {