diff --git a/scripts/integration-vm.py b/scripts/integration-vm.py
index 02c655c..c51f9f7 100644
--- a/scripts/integration-vm.py
+++ b/scripts/integration-vm.py
@@ -106,6 +106,12 @@ def render_run_hosts(name, ip, ansible_user, groups):
             f"        {name}:",
             f"          ansible_host: {ip}",
             f"          ansible_user: {ansible_user}",
+            # Integration VMs reuse IPs; bypass host-key caching so stale
+            # known_hosts entries (from prior runs with a different VM at
+            # the same IP) do not block the Ansible apply step.
+            "          ansible_ssh_common_args: >-",
+            "            -o StrictHostKeyChecking=no",
+            "            -o UserKnownHostsFile=/dev/null",
         ]
     return "\n".join(lines) + "\n"
 
@@ -188,15 +194,22 @@ def up(host, name=None, mem_mib=DEFAULT_MEM_MIB, vcpus=DEFAULT_VCPUS):
     overlay = CACHE_DIR / f"{name}.qcow2"
     sh(["qemu-img", "create", "-f", "qcow2", "-F", "qcow2", "-b", str(img), str(overlay)])
     (RUN_DIR / "user-data").write_text(render_user_data(_ssh_pubkey(), "ansible"))
-    (RUN_DIR / "meta-data").write_text(render_meta_data(f"iid-{name}", name))
+    # cloud-init rejects underscores in local-hostname (causes init-local to skip
+    # writing the network config → VM never gets a DHCP lease). Sanitize VM name
+    # for use as hostname without affecting disk paths or virsh domain names.
+    (RUN_DIR / "meta-data").write_text(render_meta_data(f"iid-{name}", name.replace("_", "-")))
     seed = CACHE_DIR / f"{name}-seed.img"
     # Force DHCP on the VM NIC — don't rely on the genericcloud image's network fallback.
+    # Use explicit renderer + interface name to avoid a netplan 1.1.2 generation issue:
+    # `match.name: en*` with a named key (e.g. `primary`) produces a .network file that
+    # networkd loads but never DHCPs (no DHCP4 messages, just IPv6LL). Using the real
+    # interface name `enp1s0` (all virtio NICs in these KVM VMs are named enp1s0) and
+    # `renderer: networkd` bypasses the bug.
     (RUN_DIR / "network-config").write_text(
         'version: 2\n'
+        'renderer: networkd\n'
         'ethernets:\n'
-        '  primary:\n'
-        '    match:\n'
-        '      name: "en*"\n'
+        '  enp1s0:\n'
         '    dhcp4: true\n')
     sh(["cloud-localds", "--network-config", str(RUN_DIR / "network-config"),
         str(seed), str(RUN_DIR / "user-data"), str(RUN_DIR / "meta-data")])