diff --git a/config/k3s/kubelet.conf b/config/k3s/kubelet.conf
index f6bdcc8da..97e5275d4 100644
--- a/config/k3s/kubelet.conf
+++ b/config/k3s/kubelet.conf
@@ -7,5 +7,6 @@ maxParallelImagePulls: 2
 # Make the single-node disk contract explicit. The ext4 root reserve is managed
 # by the Kyber activation script, keeping ordinary usage below the low watermark
 # while kubelet remains the sole owner of image and container garbage collection.
+# These are kubelet's defaults, pinned here so the host headroom contract is visible.
 imageGCHighThresholdPercent: 85
 imageGCLowThresholdPercent: 80
diff --git a/home-manager/services/k3s/activate.sh b/home-manager/services/k3s/activate.sh
index 86ca6deb9..c5862f37a 100755
--- a/home-manager/services/k3s/activate.sh
+++ b/home-manager/services/k3s/activate.sh
@@ -35,10 +35,11 @@ require_sudo() {
     echo "Warning: sudo not found, skipping k3s system setup" >&2
     return 1
   fi
+  return 0
 }
 
 configure_root_ext4_reserve() {
-  local root_source root_fs_type block_count reserved_blocks target_reserved_blocks
+  local root_source root_fs_type filesystem_info block_count reserved_blocks target_reserved_blocks
   local target_reserved_percent=1
 
   root_source="$(@findmnt@ --noheadings --output SOURCE --target /)"
@@ -53,10 +54,14 @@ configure_root_ext4_reserve() {
   fi
 
   require_sudo || return 0
+  if ! filesystem_info="$(run_sudo @tune2fs@ -l "$root_source")"; then
+    echo "Warning: unable to inspect ext4 reserve on $root_source" >&2
+    return 0
+  fi
   # shellcheck disable=SC2016
-  block_count="$(run_sudo @tune2fs@ -l "$root_source" 2>/dev/null | @awk@ -F: '/^Block count:/ { gsub(/[[:space:]]/, "", $2); print $2 }')"
+  block_count="$(@awk@ -F: '/^Block count:/ { gsub(/[[:space:]]/, "", $2); print $2 }' <<<"$filesystem_info")"
   # shellcheck disable=SC2016
-  reserved_blocks="$(run_sudo @tune2fs@ -l "$root_source" 2>/dev/null | @awk@ -F: '/^Reserved block count:/ { gsub(/[[:space:]]/, "", $2); print $2 }')"
+  reserved_blocks="$(@awk@ -F: '/^Reserved block count:/ { gsub(/[[:space:]]/, "", $2); print $2 }' <<<"$filesystem_info")"
   if [ -z "$block_count" ] || [ -z "$reserved_blocks" ]; then
     echo "Warning: unable to inspect ext4 reserve on $root_source" >&2
     return 0
@@ -67,7 +72,10 @@ configure_root_ext4_reserve() {
     return 0
   fi
 
-  run_sudo @tune2fs@ -m "$target_reserved_percent" "$root_source"
+  if ! run_sudo @tune2fs@ -m "$target_reserved_percent" "$root_source"; then
+    echo "Warning: unable to configure ext4 reserve on $root_source" >&2
+    return 0
+  fi
   echo "Configured $root_source ext4 reserved blocks to ${target_reserved_percent}%"
 }
 
diff --git a/named-hosts/kyber/README.md b/named-hosts/kyber/README.md
index b6e25169b..62d6e580f 100644
--- a/named-hosts/kyber/README.md
+++ b/named-hosts/kyber/README.md
@@ -74,6 +74,7 @@ and CRI health before restarting services:
 
 ```bash
 df -h /
+cat /proc/pressure/io
 sudo tune2fs -l "$(findmnt -n -o SOURCE /)" | grep -E 'Block count|Reserved block count'
 sudo journalctl -u k3s --since '30 minutes ago' | grep -E 'image garbage collection|DiskPressure|deadline exceeded'
 sudo k3s crictl info
diff --git a/spec/k3s_service_activate_spec.sh b/spec/k3s_service_activate_spec.sh
index 5e11cd944..85692ebfd 100755
--- a/spec/k3s_service_activate_spec.sh
+++ b/spec/k3s_service_activate_spec.sh
@@ -53,6 +53,12 @@ It 'warns when sudo is unavailable'
 When run bash -c "grep 'sudo not found' '$SCRIPT'"
 The output should include 'sudo not found'
 End
+
+It 'returns success when sudo is available'
+When run bash -c "sed -n '/^require_sudo()/,/^}/p' '$SCRIPT' | grep -xF '  return 0'"
+The output should include 'return 0'
+The status should be success
+End
 End
 
 Describe 'k3s setup'
@@ -77,7 +83,7 @@ The output should include 'DRY_RUN_CMD'
 End
 
 It 'keeps one percent of the ext4 root volume reserved'
-When run bash -c "grep 'target_reserved_percent=1' '$SCRIPT'"
+When run bash -c "grep -xF '  local target_reserved_percent=1' '$SCRIPT'"
 The output should include 'target_reserved_percent=1'
 End