diff --git a/nautobot/gc-configplan.py b/nautobot/gc-configplan.py
index 55722fd..e6fa435 100644
--- a/nautobot/gc-configplan.py
+++ b/nautobot/gc-configplan.py
@@ -398,12 +398,16 @@ def job_tp38_oob():
         ' . " fw=" . [:tostr [:len [/ip firewall filter find where comment~"TP38"]]] . "/8")',
     ])
 
+    # ⚠️ `add ... place-before=[find ...]` wird ueber Netmiko IGNORIERT (Regel landet am
+    # Ketten-Ende, also HINTER dem finalen drop = wirkungslos; beim Deploy 2026-09-15 so
+    # aufgeschlagen). Deshalb: erst add (appends), dann `move` vor die Log-Regel.
     core_set = "\n".join([
         bridge_set,
         vlan_set,
         '/ip firewall filter add action=accept chain=input comment="TP38: OOB->core mgmt" '
-        'dst-port=22,80,8291,8728 in-interface=vlan99 protocol=tcp '
-        'place-before=[find where log-prefix=TP5-INPUT-WOULD-DROP]',
+        'dst-port=22,80,8291,8728 in-interface=vlan99 protocol=tcp',
+        '/ip firewall filter move [find where comment="TP38: OOB->core mgmt"] '
+        'destination=[find where comment="TP5: input log-only"]',
         ':log info ("tp38: core pvid=" . [:tostr [/interface bridge port get [find interface=ether23] pvid]]'
         ' . " oob=" . [:tostr [:len [/ip firewall filter find where comment="TP38: OOB->core mgmt"]]])',
     ])
diff --git a/nautobot/mikrotik_routeros.j2 b/nautobot/mikrotik_routeros.j2
index bfa6ece..594c346 100644
--- a/nautobot/mikrotik_routeros.j2
+++ b/nautobot/mikrotik_routeros.j2
@@ -76,7 +76,7 @@
 {% for n in range(17, 23) %}
 /interface bridge port add bridge=bridge comment=defconf interface=ether{{ n }}
 {% endfor %}
-/interface bridge port add bridge=bridge comment="TP38-OOB-MGMT" frame-types=admit-only-untagged-and-priority-tagged interface=ether23 pvid=99
+/interface bridge port add bridge=bridge comment=TP38-OOB-MGMT frame-types=admit-only-untagged-and-priority-tagged interface=ether23 pvid=99
 /interface bridge port add bridge=bridge comment=defconf interface=ether24
 /interface bridge port add bridge=bridge comment=defconf interface=sfp-sfpplus1
 /interface bridge port add bridge=bridge comment=defconf interface=sfp-sfpplus2
@@ -449,7 +449,7 @@
 {% for n in range(9, 23) %}
 /interface bridge port add bridge=bridge comment=defconf interface=ether{{ n }} pvid=20
 {% endfor %}
-/interface bridge port add bridge=bridge comment="TP38-OOB-MGMT" frame-types=admit-only-untagged-and-priority-tagged interface=ether23 pvid=99
+/interface bridge port add bridge=bridge comment=TP38-OOB-MGMT frame-types=admit-only-untagged-and-priority-tagged interface=ether23 pvid=99
 /interface bridge port add bridge=bridge comment=defconf interface=ether24
 /interface bridge port add bridge=bridge comment=defconf disabled=yes interface=sfp-sfpplus1
 /interface bridge port add bridge=bridge comment=defconf disabled=yes interface=sfp-sfpplus2