diff --git a/deployment/device-edge-vps-host-telemetry-v1.json b/deployment/device-edge-vps-host-telemetry-v1.json
index 024b5b1..3988bd4 100644
--- a/deployment/device-edge-vps-host-telemetry-v1.json
+++ b/deployment/device-edge-vps-host-telemetry-v1.json
@@ -7,7 +7,7 @@
   "phase": "host-telemetry",
   "runtimeHost": "koffyvngij",
   "predecessorPatch": "device-edge-vps-command-transport-20260812-013",
-  "predecessorArtifactSha256": "c7486ec879681ddd706f229628c8556ca8c9ccc4f152a85debb409c302759ef",
+  "predecessorArtifactSha256": "c7486ec879681ddd706f229b628c8556ca8c9ccc4f152a85debb409c302759ef",
   "agent": "telegraf",
   "agentVersion": "1.38.4",
   "agentRuntimeUser": "nodedc-telemetry",
diff --git a/infra/deploy-runner/build-device-edge-vps-artifact.mjs b/infra/deploy-runner/build-device-edge-vps-artifact.mjs
index da8a1bf..da5fdba 100644
--- a/infra/deploy-runner/build-device-edge-vps-artifact.mjs
+++ b/infra/deploy-runner/build-device-edge-vps-artifact.mjs
@@ -442,6 +442,9 @@ async function assertBoundary() {
     }
   }
   if (phase === "host-telemetry") {
+    if (!/^[0-9a-f]{64}$/.test(descriptor.predecessorArtifactSha256 || "")) {
+      throw new Error("host_telemetry_predecessor_sha256_invalid");
+    }
     for (const required of [
       '"predecessorPatch": "device-edge-vps-command-transport-20260812-013"',
       '"agent": "telegraf"',
diff --git a/infra/deploy-runner/nodedc-b2-vps-deploy b/infra/deploy-runner/nodedc-b2-vps-deploy
index 9dcc27f..9e7b0fa 100755
--- a/infra/deploy-runner/nodedc-b2-vps-deploy
+++ b/infra/deploy-runner/nodedc-b2-vps-deploy
@@ -135,7 +135,7 @@ COMMAND_TRANSPORT_ACCEPTED_PATCH = (
     "device-edge-vps-command-transport-20260812-013"
 )
 COMMAND_TRANSPORT_ACCEPTED_SHA256 = (
-    "c7486ec879681ddd706f229628c8556ca8c9ccc4f152a85debb409c302759ef"
+    "c7486ec879681ddd706f229b628c8556ca8c9ccc4f152a85debb409c302759ef"
 )
 
 FOUNDATION_ENTRIES = (
@@ -351,7 +351,7 @@ PHASE_FILE_SHA256 = {
     },
     "host-telemetry": {
         "deployment/device-edge-vps-host-telemetry-v1.json":
-            "69d4ed7c7462d982e53fa2f0688d7a129952811b96dcb1bf4ae3721f235fc406",
+            "c4dc60e68549c3c3844779091d5b767a2cb4152cd923433b488cb56e37717391",
         "packages/device-edge-channel-contract/package.json":
             "57d5349b5dcef2cacd4f3e4fad010359a65d59f5f903eff07d89f67c497f97c0",
         "packages/device-edge-channel-contract/src/index.mjs":
diff --git a/infra/deploy-runner/test_device_edge_vps_artifact.py b/infra/deploy-runner/test_device_edge_vps_artifact.py
index 1ab982c..26a55fa 100644
--- a/infra/deploy-runner/test_device_edge_vps_artifact.py
+++ b/infra/deploy-runner/test_device_edge_vps_artifact.py
@@ -462,6 +462,23 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
             self.assertIn("command_transport=typed-service-ping-v1", rendered)
             self.assertIn("gelios=untouched-legacy-only", rendered)
 
+    def test_host_telemetry_predecessor_is_exact_command_transport_artifact(self):
+        source_root = SCRIPT_DIR.parents[1]
+        descriptor = json.loads(
+            (
+                source_root
+                / "deployment/device-edge-vps-host-telemetry-v1.json"
+            ).read_text(encoding="utf-8")
+        )
+        predecessor_sha = descriptor["predecessorArtifactSha256"]
+
+        self.assertRegex(predecessor_sha, r"^[0-9a-f]{64}$")
+        self.assertEqual(predecessor_sha, RUNNER.COMMAND_TRANSPORT_ACCEPTED_SHA256)
+        self.assertEqual(
+            predecessor_sha,
+            "c7486ec879681ddd706f229b628c8556ca8c9ccc4f152a85debb409c302759ef",
+        )
+
     def test_publish_payload_preserves_unselected_executable_modes(self):
         with tempfile.TemporaryDirectory(prefix="nodedc-vps-publish-scope-") as directory:
             root = Path(directory)