diff --git a/migration/vyos-unifi-switch b/migration/vyos-unifi-switch
index b4848e5..c4e1d67 100755
--- a/migration/vyos-unifi-switch
+++ b/migration/vyos-unifi-switch
@@ -117,9 +117,18 @@ usg_still_alive() {
   local found=0 ip dev targets
   targets="$(grep -oE "vrrp group [a-z0-9]+ address [0-9.]+" "$DELTA" 2>/dev/null | awk '{print $NF}')"
   if [ -z "$targets" ]; then
-    warn "this delta claims no VIPs, so there is nothing to probe."
-    warn "That is expected in the lab and WRONG for the real cutover."
-    return 1
+    # A delta with no VIPs cannot be probed, which means the single guard
+    # against two devices sharing a gateway address is inert. Refuse by
+    # default: an unprobeable delta on the real boxes is a broken delta, and
+    # "warn and continue" would let the one failure this script exists to
+    # prevent through unnoticed. The override is for the lab only.
+    if [ "${ALLOW_NO_VIP_DELTA:-0}" = "1" ]; then
+      warn "delta claims no VIPs; proceeding because ALLOW_NO_VIP_DELTA=1 (lab only)"
+      return 1
+    fi
+    die "this delta claims no VIPs, so the gateway-address guard cannot run.
+       On the real boxes that means a broken delta. If this really is a lab
+       run, re-invoke with ALLOW_NO_VIP_DELTA=1."
   fi
   for ip in $targets; do
     dev="$(ip -4 route get "$ip" 2>/dev/null | sed -n 's/.* dev \([^ ]*\).*/\1/p' | head -1)"