diff --git a/migration/vyos-unifi-switch b/migration/vyos-unifi-switch
index df18ee6..a911844 100755
--- a/migration/vyos-unifi-switch
+++ b/migration/vyos-unifi-switch
@@ -171,7 +171,15 @@ health_checks() {
   # no PPPoE stanza is a lab/partial delta, and failing it on a missing
   # pppoe0 would make the script untestable anywhere but the live cutover.
   # Announced loudly, because a quietly skipped check is worse than no check.
-  if grep -qE "^set interfaces (pppoe|bonding bond0 vif 5)" "$DELTA"; then
+  # A box whose delta holds its WAN interfaces DOWN is the backup: it has no
+  # route out by design, and demanding one reverts a perfectly correct config.
+  # This tore down vyos002 on the first successful cutover -- vyos001 went live
+  # and its backup was judged unhealthy for lacking the WAN it is deliberately
+  # not carrying. Same mistake as requiring the failover line: checks that do
+  # not apply to the box being checked.
+  if grep -qE "^set interfaces (pppoe pppoe0|bonding bond0 vif 53) disable$" "$DELTA"; then
+    say "  note  this box holds its WAN down (backup); skipping WAN checks"
+  elif grep -qE "^set interfaces (pppoe|bonding bond0 vif 5)" "$DELTA"; then
     # What matters is that SOME WAN works, not that every WAN works.
     #
     # This reverted a cutover that had genuinely succeeded. The 10 gig line came