diff --git a/device-plane/vps/systemd/nodedc-device-edge-channel.service b/device-plane/vps/systemd/nodedc-device-edge-channel.service
index 0e41d4e..a76f5fb 100644
--- a/device-plane/vps/systemd/nodedc-device-edge-channel.service
+++ b/device-plane/vps/systemd/nodedc-device-edge-channel.service
@@ -7,7 +7,7 @@ Wants=network-online.target
 Type=simple
 User=nodedc-channel
 Group=nodedc-channel
-ExecStart=/opt/nodedc-b2-vps/runtime/node/bin/node --jitless /opt/nodedc-b2-vps/services/device-edge-channel/src/server.mjs
+ExecStart=/opt/nodedc-b2-vps/runtime/node/bin/node /opt/nodedc-b2-vps/services/device-edge-channel/src/server.mjs
 Environment=DEVICE_EDGE_CHANNEL_HOST=0.0.0.0
 Environment=DEVICE_EDGE_CHANNEL_PORT=8443
 Environment=DEVICE_EDGE_CHANNEL_HEALTH_HOST=127.0.0.1
@@ -34,7 +34,7 @@ ProtectHostname=yes
 RestrictSUIDSGID=yes
 RestrictRealtime=yes
 LockPersonality=yes
-MemoryDenyWriteExecute=yes
+MemoryDenyWriteExecute=no
 SystemCallArchitectures=native
 RestrictAddressFamilies=AF_INET AF_INET6
 CapabilityBoundingSet=
diff --git a/infra/deploy-runner/build-device-edge-vps-artifact.mjs b/infra/deploy-runner/build-device-edge-vps-artifact.mjs
index 7a0009a..156cacb 100644
--- a/infra/deploy-runner/build-device-edge-vps-artifact.mjs
+++ b/infra/deploy-runner/build-device-edge-vps-artifact.mjs
@@ -262,7 +262,8 @@ async function assertBoundary() {
       "\"runtimeUser\": \"nodedc-channel\"",
       "\"trackerIngress\": \"disabled\"",
       "User=nodedc-channel",
-      "node --jitless",
+      "ExecStart=/opt/nodedc-b2-vps/runtime/node/bin/node /opt/nodedc-b2-vps/services/device-edge-channel/src/server.mjs",
+      "MemoryDenyWriteExecute=no",
       "tcp dport 8443",
       "MemoryMax=128M",
       "MemorySwapMax=0",
@@ -279,6 +280,7 @@ async function assertBoundary() {
       "LocalForward",
       "tailscale-userspace",
       "DEVICE_EDGE_RELAY_UPSTREAM",
+      "--jitless",
     ]) {
       if (combined.includes(forbidden)) {
         throw new Error(`core_channel_boundary_violation:${forbidden}`);
diff --git a/infra/deploy-runner/nodedc-b2-vps-deploy b/infra/deploy-runner/nodedc-b2-vps-deploy
index df65bfc..a47ac15 100755
--- a/infra/deploy-runner/nodedc-b2-vps-deploy
+++ b/infra/deploy-runner/nodedc-b2-vps-deploy
@@ -202,7 +202,7 @@ PHASE_FILE_SHA256 = {
         "vps/config/nftables-core-channel.conf":
             "1a04a5450042e80b8a20da3c6634dd6bc68693f191a463ba9a62984279d81d0c",
         "vps/systemd/nodedc-device-edge-channel.service":
-            "57c6c0c5eb952e1e196f50c410a8537468af145941b21dd4aad6ff0e8ca56249",
+            "afb2842db18d1863b2a089b4e89693f1ec17c78921457774ac9652f26b804856",
         "deployment/device-edge-vps-core-channel-v1.json":
             "938f6f7959b78e6be3a6e91a54dca2922fbd813f1a33dca5cebe0dc256a83a14",
     },
diff --git a/infra/deploy-runner/test_device_edge_vps_artifact.py b/infra/deploy-runner/test_device_edge_vps_artifact.py
index dc80a71..9f5cb6d 100644
--- a/infra/deploy-runner/test_device_edge_vps_artifact.py
+++ b/infra/deploy-runner/test_device_edge_vps_artifact.py
@@ -418,7 +418,13 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
         self.assertIn("DEVICE_EDGE_RELAY_SOURCE_POLICY=public-ipv4-only", relay_unit)
         self.assertIn("MemoryMax=192M", relay_unit)
         self.assertIn("User=nodedc-channel", channel_unit)
-        self.assertIn("node --jitless", channel_unit)
+        self.assertIn(
+            "ExecStart=/opt/nodedc-b2-vps/runtime/node/bin/node "
+            "/opt/nodedc-b2-vps/services/device-edge-channel/src/server.mjs",
+            channel_unit,
+        )
+        self.assertIn("MemoryDenyWriteExecute=no", channel_unit)
+        self.assertNotIn("--jitless", channel_unit)
         self.assertIn("MemoryMax=128M", channel_unit)
         self.assertIn("MemorySwapMax=0", channel_unit)
         self.assertIn("CPUQuota=50%", channel_unit)