diff --git a/playbook/blancco-init.sh b/playbook/blancco-init.sh
index 90432e8..ec0f505 100644
--- a/playbook/blancco-init.sh
+++ b/playbook/blancco-init.sh
@@ -76,7 +76,38 @@ if [ -z "$IFACE" ]; then
     exec /bin/sh
 fi
 
-echo "  IFACE=$IFACE, bringing up..."
+# The first interface to appear is not necessarily the cabled one: a
+# second onboard port, a dock or a USB NIC can come first, and a static
+# IP on a dead port leaves wget at "Connecting" forever. Bring every
+# wired interface up and use the first with carrier.
+for n in /sys/class/net/*; do
+    name="${n##*/}"
+    case "$name" in lo|wl*) continue ;; esac
+    ip link set "$name" up 2>/dev/null || ifconfig "$name" up 2>/dev/null || true
+done
+echo "  Waiting up to 30s for a cabled interface..."
+CARRIER=""
+for i in $(seq 1 30); do
+    for n in /sys/class/net/*; do
+        name="${n##*/}"
+        case "$name" in lo|wl*) continue ;; esac
+        [ "$(cat "$n/carrier" 2>/dev/null)" = "1" ] && CARRIER="$name" && break 2
+    done
+    sleep 1
+    echo -n "."
+done
+echo ""
+if [ -z "$CARRIER" ]; then
+    echo "ERROR: no wired interface has link. Interfaces seen:"
+    for n in /sys/class/net/*; do
+        echo "  ${n##*/} carrier=$(cat "$n/carrier" 2>/dev/null)"
+    done
+    echo "Check the cable, then type 'exit' to reboot."
+    exec /bin/sh
+fi
+IFACE="$CARRIER"
+
+echo "  IFACE=$IFACE (has link), bringing up..."
 ip link set "$IFACE" up || ifconfig "$IFACE" up
 sleep 2
 
@@ -87,7 +118,7 @@ echo "  IP: 172.16.9.250  SERVER: $SERVER"
 ip addr
 
 echo "[3/5] Downloading airootfs.sfs (~756 MB)..."
-wget -O /tmp/airootfs.sfs http://$SERVER/blancco/arch/x86_64/airootfs.sfs 2>&1
+wget -T 30 -O /tmp/airootfs.sfs http://$SERVER/blancco/arch/x86_64/airootfs.sfs 2>&1
 [ -s /tmp/airootfs.sfs ] || { echo "ERROR: download failed"; exec /bin/sh; }
 
 echo "[4/5] Mounting rootfs + overlay..."
@@ -101,7 +132,7 @@ mkdir -p /run/upper/upper /run/upper/work
 mount -t overlay overlay -o lowerdir=/run/lower,upperdir=/run/upper/upper,workdir=/run/upper/work /run/newroot
 
 echo "[5/5] Fetching kmod tarball + config..."
-wget -O /tmp/kmod.tar.gz http://$SERVER/blancco/kmod.tar.gz 2>&1
+wget -T 30 -O /tmp/kmod.tar.gz http://$SERVER/blancco/kmod.tar.gz 2>&1
 [ -s /tmp/kmod.tar.gz ] && (cd /run/newroot && gunzip -c /tmp/kmod.tar.gz | tar xf - && rm -f /tmp/kmod.tar.gz)
 
 mkdir -p /run/newroot/albus
@@ -111,7 +142,7 @@ mkdir -p /run/newroot/albus
 # /albus/preferences.save (factory defaults, empty network_share) so
 # erasure reports never reach SMB. Fail loud here instead.
 PREFS=/run/newroot/albus/preferences.xml
-if ! wget -O "$PREFS" "http://$SERVER/blancco/preferences.xml"; then
+if ! wget -T 30 -O "$PREFS" "http://$SERVER/blancco/preferences.xml"; then
     echo "ERROR: preferences.xml download failed from http://$SERVER/blancco/preferences.xml"
     echo "Reports would fall back to factory defaults (no SMB target)."
     echo "Dropping to shell - check Apache + network."
@@ -132,7 +163,7 @@ fi
 # fires, we want the fallback to still have the right SMB target.
 cp -f "$PREFS" /run/newroot/albus/preferences.save
 
-if ! wget -O /run/newroot/albus/config.xml "http://$SERVER/blancco/config-clean.xml"; then
+if ! wget -T 30 -O /run/newroot/albus/config.xml "http://$SERVER/blancco/config-clean.xml"; then
     echo "ERROR: config.xml (license container) download failed."
     exec /bin/sh
 fi