diff --git a/bastion/completions/labctl.bash b/bastion/completions/labctl.bash
index 21f615e..9f7b49b 100644
--- a/bastion/completions/labctl.bash
+++ b/bastion/completions/labctl.bash
@@ -62,7 +62,7 @@ _labctl() {
       COMPREPLY=($(compgen -W "--role --os --disk -h --help" -- "$cur"))
       return ;;
     "provision debug")
-      COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
+      COMPREPLY=($(compgen -W "--sshd -h --help" -- "$cur"))
       return ;;
     "provision forget")
       COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
diff --git a/bastion/completions/labctl.fish b/bastion/completions/labctl.fish
index a1d4aab..3a14103 100644
--- a/bastion/completions/labctl.fish
+++ b/bastion/completions/labctl.fish
@@ -137,6 +137,9 @@ complete -c labctl -n "__labctl_in_cmd provision reprovision" -l role -d 'Machin
 complete -c labctl -n "__labctl_in_cmd provision reprovision" -l os -d 'Operating system' -xa 'fedora-43 ubuntu-26.04'
 complete -c labctl -n "__labctl_in_cmd provision reprovision" -l disk -d 'Target disk device (auto-detect if omitted)' -x
 
+# provision debug options
+complete -c labctl -n "__labctl_in_cmd provision debug" -l sshd -d 'Start SSH + nc listener automatically, report IP to bastion'
+
 # provision makeiso options
 complete -c labctl -n "__labctl_in_cmd provision makeiso" -l arch -d 'Target architecture(s)' -xa 'x86_64 aarch64'
 complete -c labctl -n "__labctl_in_cmd provision makeiso" -l local -d 'Build ISO locally instead of using bastion-hosted URL'
diff --git a/bastion/src/bastion/src/templates/debug.ks.ts b/bastion/src/bastion/src/templates/debug.ks.ts
index 27b0b4b..083cc19 100644
--- a/bastion/src/bastion/src/templates/debug.ks.ts
+++ b/bastion/src/bastion/src/templates/debug.ks.ts
@@ -17,10 +17,17 @@ export function renderDebugKickstart(params: DebugKickstartParams): string {
     : "";
 
   const sshdSetup = params.sshd ? `
-%post --nochroot --log=/tmp/debug-sshd.log
+%pre --log=/tmp/debug-sshd.log
 #!/bin/bash
 set -x
 
+# Wait for network to come up
+for i in $(seq 1 30); do
+    IP_ADDR=$(ip -4 addr show | awk '/inet / && !/127.0.0/ {split($2,a,"/"); print a[1]; exit}')
+    [ -n "$IP_ADDR" ] && break
+    sleep 1
+done
+
 # Generate host keys (self-contained, no mounted FS needed)
 ssh-keygen -t ed25519 -f /tmp/ssh_host_ed25519_key -N "" -q
 ssh-keygen -t rsa -f /tmp/ssh_host_rsa_key -N "" -q
@@ -52,8 +59,6 @@ echo "sshd started on port 22"
 echo "nc shell listener on port 2323"
 
 # Report IP to bastion
-sleep 2
-IP_ADDR=$(ip -4 addr show | awk '/inet / && !/127.0.0/ {split($2,a,"/"); print a[1]; exit}')
 MAC_ADDR=$(ip link show | awk '/ether/ && !/00:00:00:00/ {print $2; exit}')
 curl -sf -X POST "http://${params.serverIp}:${params.httpPort}/api/progress" \\
     -H "Content-Type: application/json" \\