diff --git a/bundles/admin/software.install.deployer_ui/README.md b/bundles/admin/software.install.deployer_ui/README.md
index 1c0c9e2..97baf05 100644
--- a/bundles/admin/software.install.deployer_ui/README.md
+++ b/bundles/admin/software.install.deployer_ui/README.md
@@ -28,7 +28,7 @@ The upstream repo ships a multi-stage Dockerfile :
 | `REMOTE_PROJECT_DIR` | `/var/www/range42_deployer_ui` |
 | `UI_PORT` | `3000` |
 | `BACKEND_API_URL` | *(unset)* — when set, rendered into `public/config.json` so the SPA pre-registers this backend |
-| `PROXMOX_NODE_NAME` | `pve` — paired with `BACKEND_API_URL` in `config.json` |
+| `PROXMOX_NODE_NAME` | `proxmox_node` from the workspace vault, else `pve` — paired with `BACKEND_API_URL` in `config.json` |
 
 ## Call-site example
 
diff --git a/bundles/admin/software.install.deployer_ui/bundle_parameters.json b/bundles/admin/software.install.deployer_ui/bundle_parameters.json
index 796e5a9..7bf98ab 100644
--- a/bundles/admin/software.install.deployer_ui/bundle_parameters.json
+++ b/bundles/admin/software.install.deployer_ui/bundle_parameters.json
@@ -57,8 +57,8 @@
       "type": "string",
       "required": false,
       "default_where": "bundle-inline",
-      "default": "pve",
-      "description": "Proxmox node the backend targets, paired with BACKEND_API_URL in config.json. Only consumed when BACKEND_API_URL is set."
+      "default": "proxmox_node from the workspace vault, else pve",
+      "description": "Proxmox node the backend targets, paired with BACKEND_API_URL in config.json. Defaults to the workspace vault's proxmox_node so a fresh lab seeds the node it actually deploys to; the literal \"pve\" is only the last-resort fallback. Only consumed when BACKEND_API_URL is set."
     },
     {
       "name": "INSTALL_TAILSCALE",
diff --git a/bundles/admin/software.install.deployer_ui/bundle_parameters.src.yml b/bundles/admin/software.install.deployer_ui/bundle_parameters.src.yml
index 77d3584..0f099d3 100644
--- a/bundles/admin/software.install.deployer_ui/bundle_parameters.src.yml
+++ b/bundles/admin/software.install.deployer_ui/bundle_parameters.src.yml
@@ -53,8 +53,8 @@ params:
     type: string
     required: false
     default_where: bundle-inline
-    default: "pve"
-    description: Proxmox node the backend targets, paired with BACKEND_API_URL in config.json. Only consumed when BACKEND_API_URL is set.
+    default: "proxmox_node from the workspace vault, else pve"
+    description: Proxmox node the backend targets, paired with BACKEND_API_URL in config.json. Defaults to the workspace vault's proxmox_node so a fresh lab seeds the node it actually deploys to; the literal "pve" is only the last-resort fallback. Only consumed when BACKEND_API_URL is set.
 
   - name: INSTALL_TAILSCALE
     type: bool
diff --git a/bundles/admin/software.install.deployer_ui/main.yml b/bundles/admin/software.install.deployer_ui/main.yml
index 4722f3c..4f7771d 100644
--- a/bundles/admin/software.install.deployer_ui/main.yml
+++ b/bundles/admin/software.install.deployer_ui/main.yml
@@ -37,7 +37,10 @@
 #                           Unset = no config.json rendered, operator configures
 #                           the backend by hand in the Settings modal.
 #   - PROXMOX_NODE_NAME   : Proxmox node that backend targets, paired with
-#                           BACKEND_API_URL in config.json (default "pve")
+#                           BACKEND_API_URL in config.json. Defaults to
+#                           `proxmox_node` from the workspace vault, so the
+#                           node is right without the call-site restating it ;
+#                           falls back to "pve" only when neither is set.
 #
 # Source provenance (this bundle deploys the controller's WORKING TREE) :
 #   The rsync below copies the controller's checkout as-is - branch, local
@@ -133,10 +136,17 @@
 - name: install deployer-ui - sync source + .env + docker compose up
   hosts: "{{ global_vm_ssh_name }}"
   become: true
+  vars_files:
+    # For `proxmox_node` — the node this workspace actually targets. Without it
+    # config.json would seed the literal "pve" on every deployment and the
+    # operator would still have to fix the node by hand in Settings, which is
+    # the exact retyping this file exists to remove.
+    - "{{ lookup('env', 'RANGE42_ACTIVE_CONFIG_DIR') }}/secrets/default_vault.yml"
   vars:
     LOCAL_CODE_PATH_RESOLVED: "{{ LOCAL_CODE_PATH | default(lookup('env', 'RANGE42_GITDIR__ROOT_DIR') + '/range42-deployer-ui/', true) }}"
     REMOTE_PROJECT_DIR_RESOLVED: "{{ REMOTE_PROJECT_DIR | default('/var/www/range42_deployer_ui') }}"
     UI_PORT_RESOLVED: "{{ UI_PORT | default('3000') }}"
+    PROXMOX_NODE_NAME_RESOLVED: "{{ PROXMOX_NODE_NAME | default(proxmox_node | default('pve', true), true) }}"
   tasks:
     - name: Install rsync on remote (required for synchronize)
       ansible.builtin.apt:
@@ -232,7 +242,7 @@
         content: |
           {
             "defaultBackendUrl": {{ BACKEND_API_URL | to_json }},
-            "defaultNodeName": {{ PROXMOX_NODE_NAME | default('pve') | to_json }}
+            "defaultNodeName": {{ PROXMOX_NODE_NAME_RESOLVED | to_json }}
           }
         owner: root
         group: root