diff --git a/scripts/bootstrap/bootstrap-local.sh b/scripts/bootstrap/bootstrap-local.sh
index b93a09f30..701aa739c 100755
--- a/scripts/bootstrap/bootstrap-local.sh
+++ b/scripts/bootstrap/bootstrap-local.sh
@@ -441,28 +441,39 @@ phase_5_haproxy() {
         become_flag=(--ask-become-pass)
     fi
 
-    # Detect the Incus network actually present on the R720. The
-    # group_vars default is `veza-net` but the operator's R720 may
-    # already have a different bridge name (e.g. `incusbr0`). Probe
-    # via the existing forgejo container (whose network we know
-    # works) and fall back to `incus network list`.
+    # Detect the Incus network actually present on the R720. Try in
+    # order :
+    #   1. No sudo (operator in `incus-admin` group)
+    #   2. sudo -n  (NOPASSWD sudo configured)
+    #   3. Give up and let the playbook use the group_vars default
+    # Probe is via the existing forgejo container (whose network we
+    # know is the right one) ; fall back to listing managed bridges.
     info "detecting Incus network on R720"
     local detected_net=""
-    detected_net=$(ssh "$ssh_target" \
-        "sudo incus config device get forgejo eth0 network 2>/dev/null" \
-        | tr -d '[:space:]' || true)
+    local _try_cmds=(
+        "incus config device get forgejo eth0 network 2>/dev/null"
+        "sudo -n incus config device get forgejo eth0 network 2>/dev/null"
+    )
+    for cmd in "${_try_cmds[@]}"; do
+        detected_net=$(ssh "$ssh_target" "$cmd" 2>/dev/null | tr -d '[:space:]' || true)
+        [[ -n "$detected_net" && "$detected_net" != "None" ]] && break
+    done
     if [[ -z "$detected_net" || "$detected_net" == "None" ]]; then
-        # Pick the first managed bridge that incus knows about.
-        detected_net=$(ssh "$ssh_target" \
-            "sudo incus network list -f csv 2>/dev/null | awk -F, '\$2==\"bridge\" && \$3==\"YES\" {print \$1; exit}'" \
-            | tr -d '[:space:]' || true)
+        # Fallback : first managed bridge.
+        for cmd in \
+            "incus network list -f csv 2>/dev/null | awk -F, '\$2==\"bridge\" && \$3==\"YES\" {print \$1; exit}'" \
+            "sudo -n incus network list -f csv 2>/dev/null | awk -F, '\$2==\"bridge\" && \$3==\"YES\" {print \$1; exit}'"
+        do
+            detected_net=$(ssh "$ssh_target" "$cmd" 2>/dev/null | tr -d '[:space:]' || true)
+            [[ -n "$detected_net" ]] && break
+        done
     fi
     local extra_vars=()
     if [[ -n "$detected_net" ]]; then
         ok "Incus network detected : $detected_net"
         extra_vars+=("--extra-vars" "veza_incus_network=$detected_net")
     else
-        warn "could not auto-detect Incus network ; playbook will use the group_vars default"
+        warn "could not auto-detect Incus network ; playbook will use the group_vars default (net-veza)"
     fi
 
     info "running ansible-playbook playbooks/haproxy.yml (5–10 min)"