diff --git a/ansible.cfg b/ansible.cfg
index 867da36..e98f90f 100644
--- a/ansible.cfg
+++ b/ansible.cfg
@@ -7,6 +7,7 @@ retry_files_enabled = False
 stdout_callback = default
 result_format = yaml
 interpreter_python = auto_silent
+deprecation_warnings = False
 
 [ssh_connection]
 pipelining = True
diff --git a/playbooks/test-connection.yml b/playbooks/test-connection.yml
index 4af006f..dea9d8b 100644
--- a/playbooks/test-connection.yml
+++ b/playbooks/test-connection.yml
@@ -1,8 +1,7 @@
 ---
 # ============================================================================
-# test-connection.yml — diagnostic (no host changes).
-# Confirms repo pull + Infisical auth. Resolves Infisical creds safely from
-# env vars OR ansible vars (via the `vars` dict) without erroring on undefined.
+# test-connection.yml — diagnostic (no host changes). Repo pull + Infisical.
+# Reads Infisical creds from env vars first, then falls back to extra-vars.
 # ============================================================================
 
 - name: "Semaphore diagnostics — repo + Infisical"
@@ -14,28 +13,28 @@
       ansible.builtin.find:
         paths: "{{ playbook_dir | dirname }}"
         excludes: ".git"
-        recurse: false
+        recurse: true
       register: repo_files
 
     - name: "[repo] Repo pulled OK"
       ansible.builtin.debug:
-        msg: "Repo files: {{ repo_files.files | map(attribute='path') | map('basename') | list }}"
+        msg: "Repo files: {{ repo_files.files | map(attribute='path') | map('regex_replace','^.*/repository_1_template_1/','') | list }}"
 
-    # Resolve creds: prefer env var, else look in the vars dict (extra-vars), else ''
-    - name: "[resolve] Gather Infisical creds from env or vars (no undefined errors)"
+    - name: "[resolve] Resolve Infisical creds (env var, else extra-var, else empty)"
       ansible.builtin.set_fact:
-        infisical_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') or (vars['INFISICAL_CLIENT_ID'] | default('')) }}"
-        infisical_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') or (vars['INFISICAL_CLIENT_SECRET'] | default('')) }}"
-        infisical_project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') or (vars['INFISICAL_PROJECT_ID'] | default('')) }}"
-        infisical_url: "{{ lookup('env','INFISICAL_URL') or (vars['INFISICAL_URL'] | default('http://192.168.122.41:8080')) }}"
-        infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') or (vars['INFISICAL_ENV_SLUG'] | default('dev')) }}"
+        infisical_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') | default(lookup('vars','INFISICAL_CLIENT_ID', default=''), true) }}"
+        infisical_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') | default(lookup('vars','INFISICAL_CLIENT_SECRET', default=''), true) }}"
+        infisical_project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') | default(lookup('vars','INFISICAL_PROJECT_ID', default=''), true) }}"
+        infisical_url: "{{ lookup('env','INFISICAL_URL') | default(lookup('vars','INFISICAL_URL', default='http://192.168.122.41:8080'), true) }}"
+        infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') | default(lookup('vars','INFISICAL_ENV_SLUG', default='dev'), true) }}"
 
-    - name: "[diag] Which channel carried the client id? (lengths only)"
+    - name: "[diag] Cred source (lengths only, no secrets)"
       ansible.builtin.debug:
         msg:
-          - "env var length: {{ lookup('env','INFISICAL_CLIENT_ID') | length }}"
-          - "vars-dict has key: {{ 'INFISICAL_CLIENT_ID' in vars }}"
-          - "resolved id length: {{ infisical_client_id | length }}"
+          - "env INFISICAL_CLIENT_ID length: {{ lookup('env','INFISICAL_CLIENT_ID') | length }}"
+          - "resolved client_id length: {{ infisical_client_id | length }}"
+          - "resolved project_id length: {{ infisical_project_id | length }}"
+          - "url: {{ infisical_url }}  env_slug: {{ infisical_env_slug }}"
 
     - name: "[infisical] Assert creds resolved"
       ansible.builtin.assert:
@@ -43,7 +42,7 @@
           - infisical_client_id | length > 0
           - infisical_client_secret | length > 0
           - infisical_project_id | length > 0
-        fail_msg: "Infisical creds not reaching playbook via env OR vars. See [diag] above."
+        fail_msg: "Infisical creds still empty — see [diag]. If env length is 0, Semaphore isn't exporting the Variable Group as env vars."
 
     - name: "[infisical] Log in"
       infisical.vault.login: