diff --git a/terraform/ec2.tf b/terraform/ec2.tf
index 73b2304..b92bbbc 100644
--- a/terraform/ec2.tf
+++ b/terraform/ec2.tf
@@ -2,6 +2,7 @@ resource "aws_instance" "this" {
   ami                         = var.ami_id
   instance_type               = "t4g.small"
   subnet_id                   = aws_subnet.public.id
+  private_ip                  = local.collector_private_ip
   vpc_security_group_ids      = [aws_security_group.this.id]
   iam_instance_profile        = aws_iam_instance_profile.this.name
   associate_public_ip_address = true
diff --git a/terraform/locals.tf b/terraform/locals.tf
index 8b3bdc6..77ef71a 100644
--- a/terraform/locals.tf
+++ b/terraform/locals.tf
@@ -18,6 +18,7 @@ locals {
 
   vpc_cidr                 = "10.40.0.0/16"
   public_subnet_cidr       = "10.40.10.0/24"
+  collector_private_ip     = "10.40.10.254"
   office_lan_cidrs         = ["10.10.0.0/16", "10.30.0.0/16"]
   ronkonkoma_wan_ip        = "47.21.61.4"
   customer_gateway_bgp_asn = 65000
diff --git a/terraform/user_data.sh.tftpl b/terraform/user_data.sh.tftpl
index a2f8a6c..24b8158 100644
--- a/terraform/user_data.sh.tftpl
+++ b/terraform/user_data.sh.tftpl
@@ -3,7 +3,12 @@ set -euxo pipefail
 
 # Vector: listen on UDP/TCP 514 and IPFIX 2055/2056, parse, ship to Firehose.
 curl -sSL https://setup.vector.dev | bash
-dnf install -y vector
+# First boot races AL2023's rpm lock during Vector GPG import.
+for i in 1 2 3 4 5; do
+  dnf install -y vector && break
+  sleep $((i * 5))
+done
+rpm -q vector
 
 install -d -m 0755 /etc/vector /var/lib/vector
 cat > /etc/vector/vector.yaml <<'VECTOREOF'
diff --git a/terraform/vector.yaml.tftpl b/terraform/vector.yaml.tftpl
index 9b82c63..4adfd52 100644
--- a/terraform/vector.yaml.tftpl
+++ b/terraform/vector.yaml.tftpl
@@ -114,7 +114,7 @@ transforms:
         "dst": null,
         "proto": "ipfix",
         "action": null,
-        "raw": encode_base64(payload) ?? payload
+        "raw": encode_base64(payload)
       }
 
   parse_netflow_locust:
@@ -131,7 +131,7 @@ transforms:
         "dst": null,
         "proto": "ipfix",
         "action": null,
-        "raw": encode_base64(payload) ?? payload
+        "raw": encode_base64(payload)
       }
 
 sinks:
@@ -142,5 +142,7 @@ sinks:
     stream_name: ${firehose_stream}
     encoding:
       codec: json
+    healthcheck:
+      enabled: false
     request:
       timeout_secs: 30