diff --git a/chromium-setup/emmc-provisioning/scripts/deploy-to-proxmox.sh b/chromium-setup/emmc-provisioning/scripts/deploy-to-proxmox.sh
index f24b092..c522614 100755
--- a/chromium-setup/emmc-provisioning/scripts/deploy-to-proxmox.sh
+++ b/chromium-setup/emmc-provisioning/scripts/deploy-to-proxmox.sh
@@ -3,6 +3,12 @@
 # LXC container (dashboard), usbboot (rpiboot), and PiShrink. Uses hostname "cm4-provisioning"
 # to find the container on redeploy; creates with next available ID if not found.
 #
+# Redeploy (re-run) behaviour: skips steps that are already configured so you can update
+# only what changed. Always updates: host scripts, dashboard files, env, systemd/udev.
+# Skips when present: LXC creation, backups bind-mount (if same path), usbboot, PiShrink,
+# LXC python3-flask and openssh-server apt installs. Set DEPLOY_ROOTFS_STORAGE to avoid
+# storage prompt on redeploy.
+#
 # With host internet: installs usbboot and PiShrink so USB flash/backup and dashboard
 # Shrink/Compress work. The only manual step left is to add a golden image for Deploy.
 #
@@ -156,17 +162,34 @@ else
   log "LXC $CTID created and mount configured."
 fi
 
-# Optional: bind-mount host directory for backup images
+# Optional: bind-mount host directory for backup images (skip if already mounted with same path)
 if [[ -n "$BACKUPS_HOST_PATH" ]]; then
+  BACKUPS_PATH_NORM="${BACKUPS_HOST_PATH%/}"
   mkdir -p "$BACKUPS_HOST_PATH"
-  pct stop "$CTID" 2>/dev/null || true
-  pct set "$CTID" -mp1 "$BACKUPS_HOST_PATH",mp=/var/lib/cm4-provisioning/backups
-  pct start "$CTID" 2>/dev/null || true
-  log "Backups mount: host $BACKUPS_HOST_PATH -> LXC $CTID /var/lib/cm4-provisioning/backups"
+  CURRENT_MP1=$(pct config "$CTID" 2>/dev/null | sed -n 's/^mp1: *//p')
+  NEED_MOUNT=1
+  if [[ -n "$CURRENT_MP1" ]]; then
+    if [[ "$CURRENT_MP1" == *"mp=/var/lib/cm4-provisioning/backups"* ]] && { [[ "$CURRENT_MP1" == *"$BACKUPS_PATH_NORM"* ]] || [[ "$CURRENT_MP1" == *"$BACKUPS_HOST_PATH"* ]]; }; then
+      NEED_MOUNT=0
+      log "Backups mount already configured (host $BACKUPS_PATH_NORM), skipping."
+    fi
+  fi
+  if [[ "$NEED_MOUNT" -eq 1 ]]; then
+    pct stop "$CTID" 2>/dev/null || true
+    pct set "$CTID" -mp1 "$BACKUPS_HOST_PATH",mp=/var/lib/cm4-provisioning/backups
+    pct start "$CTID" 2>/dev/null || true
+    log "Backups mount: host $BACKUPS_HOST_PATH -> LXC $CTID /var/lib/cm4-provisioning/backups"
+  fi
 fi
 
-# --- Host: scripts, systemd, udev ---
-log "Host: installing scripts and systemd units ..."
+# --- Host: scripts, systemd, udev (always update so changes are applied) ---
+HOST_PROV_EXISTS=0
+[[ -f /opt/cm4-provisioning/flash-emmc-on-connect.sh ]] && HOST_PROV_EXISTS=1
+if [[ "$HOST_PROV_EXISTS" -eq 1 ]]; then
+  log "Host: updating scripts and systemd units (already configured) ..."
+else
+  log "Host: installing scripts and systemd units ..."
+fi
 mkdir -p /opt/cm4-provisioning /etc/cm4-provisioning
 cp "$DEPLOY/host/flash-emmc-on-connect.sh" /opt/cm4-provisioning/
 chmod +x /opt/cm4-provisioning/flash-emmc-on-connect.sh
@@ -200,22 +223,32 @@ touch /etc/cm4-provisioning/enabled
 mkdir -p /var/lib/cm4-provisioning/backups
 [[ -n "$BACKUPS_HOST_PATH" ]] && mkdir -p "$BACKUPS_HOST_PATH"
 
-# --- Host: install usbboot (rpiboot) so USB flash/backup works ---
-log "Host: installing usbboot (rpiboot)..."
-if bash "$DEPLOY/scripts/install-usbboot-on-host.sh" 2>&1; then
-  log "Host: usbboot installed at /opt/usbboot/rpiboot"
+# --- Host: install usbboot (rpiboot) only if not already present ---
+if [[ -x /opt/usbboot/rpiboot ]] || [[ -f /opt/usbboot/rpiboot ]]; then
+  log "Host: usbboot already installed at /opt/usbboot/rpiboot, skipping."
 else
-  log "Warning: usbboot install failed (e.g. no internet). USB flash/backup will not work until you run: bash /tmp/emmc-provisioning-deploy/scripts/install-usbboot-on-host.sh"
+  log "Host: installing usbboot (rpiboot)..."
+  if bash "$DEPLOY/scripts/install-usbboot-on-host.sh" 2>&1; then
+    log "Host: usbboot installed at /opt/usbboot/rpiboot"
+  else
+    log "Warning: usbboot install failed (e.g. no internet). USB flash/backup will not work until you run: bash /tmp/emmc-provisioning-deploy/scripts/install-usbboot-on-host.sh"
+  fi
 fi
 
-# --- Host: install PiShrink so dashboard Shrink/Compress work ---
-log "Host: installing PiShrink..."
-if bash "$DEPLOY/scripts/install-pishrink-on-host.sh" 2>&1; then
-  log "Host: PiShrink installed"
+# --- Host: install PiShrink only if not already present ---
+if [[ -x /usr/local/bin/pishrink.sh ]] || [[ -f /usr/local/bin/pishrink.sh ]]; then
+  log "Host: PiShrink already installed, skipping."
   grep -q "SHRINK_BACKUP" /opt/cm4-provisioning/env || echo "SHRINK_BACKUP=1" >> /opt/cm4-provisioning/env
   grep -q "PISHRINK_COMPRESS" /opt/cm4-provisioning/env || echo "PISHRINK_COMPRESS=xz" >> /opt/cm4-provisioning/env
 else
-  log "Warning: PiShrink install failed (e.g. no internet). Dashboard Shrink/Compress will report 'PiShrink not installed' until you run: bash /tmp/emmc-provisioning-deploy/scripts/install-pishrink-on-host.sh"
+  log "Host: installing PiShrink..."
+  if bash "$DEPLOY/scripts/install-pishrink-on-host.sh" 2>&1; then
+    log "Host: PiShrink installed"
+    grep -q "SHRINK_BACKUP" /opt/cm4-provisioning/env || echo "SHRINK_BACKUP=1" >> /opt/cm4-provisioning/env
+    grep -q "PISHRINK_COMPRESS" /opt/cm4-provisioning/env || echo "PISHRINK_COMPRESS=xz" >> /opt/cm4-provisioning/env
+  else
+    log "Warning: PiShrink install failed (e.g. no internet). Dashboard Shrink/Compress will report 'PiShrink not installed' until you run: bash /tmp/emmc-provisioning-deploy/scripts/install-pishrink-on-host.sh"
+  fi
 fi
 
 # --- Start LXC if stopped ---
@@ -238,9 +271,13 @@ pct push "$CTID" "$DEPLOY/dashboard/app.py" /opt/cm4-provisioning/dashboard/app.
 pct push "$CTID" "$DEPLOY/dashboard/templates/index.html" /opt/cm4-provisioning/dashboard/templates/index.html
 pct push "$CTID" "$DEPLOY/dashboard/cm4-dashboard.service" /opt/cm4-provisioning/dashboard/cm4-dashboard.service
 
-# --- LXC: Flask and systemd ---
-log "LXC: installing python3-flask and enabling cm4-dashboard ..."
-pct exec "$CTID" -- bash -c 'apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3-flask'
+# --- LXC: Flask and systemd (skip apt install if flask already present) ---
+if pct exec "$CTID" -- dpkg -l python3-flask 2>/dev/null | grep -q '^ii'; then
+  log "LXC: python3-flask already installed, skipping apt install."
+else
+  log "LXC: installing python3-flask ..."
+  pct exec "$CTID" -- bash -c 'apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3-flask'
+fi
 pct exec "$CTID" -- cp /opt/cm4-provisioning/dashboard/cm4-dashboard.service /etc/systemd/system/
 pct exec "$CTID" -- systemctl daemon-reload
 pct exec "$CTID" -- systemctl enable --now cm4-dashboard
@@ -249,7 +286,12 @@ log "LXC: cm4-dashboard enabled and started."
 # --- LXC: optional SSH (root password + SSH key from deploy env) ---
 if [[ -n "${DEPLOY_SSH_KEY_B64:-}" ]] || [[ -n "${DEPLOY_LXC_PWD_B64:-}" ]]; then
   log "LXC: configuring SSH (root login, password, authorized_keys)..."
-  pct exec "$CTID" -- bash -c 'apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq openssh-server 2>/dev/null; systemctl enable ssh 2>/dev/null; systemctl start ssh 2>/dev/null' || true
+  if pct exec "$CTID" -- dpkg -l openssh-server 2>/dev/null | grep -q '^ii'; then
+    log "LXC: openssh-server already installed, skipping apt install."
+  else
+    pct exec "$CTID" -- bash -c 'apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq openssh-server 2>/dev/null' || true
+  fi
+  pct exec "$CTID" -- bash -c 'systemctl enable ssh 2>/dev/null; systemctl start ssh 2>/dev/null' || true
   pct exec "$CTID" -- bash -c 'sed -i "s/^#*PermitRootLogin.*/PermitRootLogin yes/" /etc/ssh/sshd_config 2>/dev/null; grep -q "^PermitRootLogin" /etc/ssh/sshd_config || echo "PermitRootLogin yes" >> /etc/ssh/sshd_config; systemctl restart ssh 2>/dev/null || systemctl restart sshd 2>/dev/null' || true
   if [[ -n "${DEPLOY_LXC_PWD_B64:-}" ]]; then
     PWD_RAW=$(echo "$DEPLOY_LXC_PWD_B64" | base64 -d 2>/dev/null)