diff --git a/.terraformignore b/.terraformignore
new file mode 100644
index 00000000..eb9f6ac1
--- /dev/null
+++ b/.terraformignore
@@ -0,0 +1,9 @@
+/**
+!tf/
+tf/.terraform*
+tf/*.tfvars*
+!systems/
+#systems/*/*.nix
+systems/*/secrets.yaml
+!ci/
+/**.nix
diff --git a/flake.lock b/flake.lock
index eba949b2..9d79aaf2 100644
--- a/flake.lock
+++ b/flake.lock
@@ -41,11 +41,11 @@
     "ci": {
       "flake": false,
       "locked": {
-        "lastModified": 1752719221,
-        "narHash": "sha256-jUmXg9P/2dVGjrKxhVJ/3dzFJZ969QrfpHDPe+f6cLU=",
+        "lastModified": 1756937251,
+        "narHash": "sha256-VIqMPRwLI2eCJFi8f3CqUk7jrTJ2AcWlI9z4d/H9+Do=",
         "owner": "arcnmx",
         "repo": "ci",
-        "rev": "ada9995f7539a7d22d71b6f04227fd34a54d2ac0",
+        "rev": "6ea24db22eb6735ed616d69de6dc435fce60d322",
         "type": "github"
       },
       "original": {
diff --git a/overlays/krb5.nix b/overlays/krb5.nix
index 5a47195e..bc9caa51 100644
--- a/overlays/krb5.nix
+++ b/overlays/krb5.nix
@@ -18,7 +18,7 @@ in {
         rust189warning
       ];
     });
-  in if _389-ds-base.version == "3.1.3"
+  in if _389-ds-base.version == "3.1.3" && _389-ds-base.patches or [] == []
     then drv
     else lib.warn "389-ds-base patch probably no longer needed" _389-ds-base;
 }
diff --git a/systems/logistics/default.nix b/systems/logistics/default.nix
index d4149a85..a4fe2dbe 100644
--- a/systems/logistics/default.nix
+++ b/systems/logistics/default.nix
@@ -4,6 +4,10 @@ _: {
   modules = [
     ./nixos.nix
   ];
+  access.online = {
+    # temporarily offline for server migration
+    available = false;
+  };
   exports = {
     services = {
       nginx.enable = true;
diff --git a/tf/terraform.tf b/tf/terraform.tf
index e6aba245..74f192cd 100644
--- a/tf/terraform.tf
+++ b/tf/terraform.tf
@@ -8,7 +8,8 @@ terraform {
     }
     cloudflare = {
       source  = "cloudflare/cloudflare"
-      version = ">= 4.22.0"
+      # XXX: 5.0 requires manual migration
+      version = "~> 4.22"
     }
     proxmox = {
       source  = "bpg/proxmox"