diff --git a/roles/sys-svc-container/files/test-dns.sh b/roles/sys-svc-container/files/test-dns.sh
index cb365cef44..14acb7cbef 100644
--- a/roles/sys-svc-container/files/test-dns.sh
+++ b/roles/sys-svc-container/files/test-dns.sh
@@ -4,8 +4,8 @@ set -euo pipefail
 # ------------------------------------------------------------
 # Optional env overrides (with safe defaults)
 # ------------------------------------------------------------
-: "${BUSYBOX_IMAGE:=busybox:1.37}"
-: "${NODE_IMAGE:=node:26-alpine}"
+: "${BUSYBOX_IMAGE:?Missing Busybox image}"
+: "${NODE_IMAGE:?Missing Busybox image}"
 
 # ------------------------------------------------------------
 # Required env (must already be present in the container)
diff --git a/tasks/stages/01_constructor.yml b/tasks/stages/01_constructor.yml
index 69857e754a..e596c2171b 100644
--- a/tasks/stages/01_constructor.yml
+++ b/tasks/stages/01_constructor.yml
@@ -9,15 +9,15 @@
   ansible.builtin.set_fact:
     DOCKER_IN_CONTAINER: "{{ (systemd_detect_virt_container.rc | default(1) | int) == 0 }}"
 
-- name: Display selected initial host vars
+- name: "Debug: dump status + ansible_env + vars"
   ansible.builtin.debug:
     msg: |
-      status: {{ lookup('status') | to_nice_yaml(indent=2) }}
-      RUNTIME: {{ RUNTIME }}
-      DOCKER_IN_CONTAINER: {{ DOCKER_IN_CONTAINER }}
-      TLS_ENABLED: {{ TLS_ENABLED }}
-      ASYNC_ENABLED: {{ ASYNC_ENABLED }}
-      SOFTWARE_NAME: {{ SOFTWARE_NAME }}
+      status:
+      {{ lookup('status') | to_nice_yaml(indent=2) }}
+      ansible_env:
+      {{ ansible_env | to_nice_yaml(indent=2) }}
+      vars:
+      {{ vars | to_nice_yaml(indent=2) }}
   when: MODE_DEBUG | bool
 
 - name: Check DNS resolution for test domain