diff --git a/scripts/pre-flight-checks.sh b/scripts/pre-flight-checks.sh
index 6155242..dd84c45 100644
--- a/scripts/pre-flight-checks.sh
+++ b/scripts/pre-flight-checks.sh
@@ -199,6 +199,10 @@
   VIPOUT="$(awk -v pp="$VIP_PREFIX_PROVIDER" -v pa="$VIP_PREFIX_ADMIN" -v pi="$VIP_PREFIX_INTERNAL" \
                 -v lo="$VIP_OCTET_MIN" -v hi="$VIP_OCTET_MAX" '
     BEGIN{ok=0;bad=0;name=""}
+    # Reset on each applications: block so a 2-space key from bundle.yaml (VIP-free today,
+    # ruling 3) can never survive stale into the first overlay vip: line and grade it under
+    # the wrong app. Cheap insurance if bundle.yaml ever regains a vip.
+    /^applications:[[:space:]]*$/{name=""}
     /^  [A-Za-z0-9_-]+:[[:space:]]*$/{name=$1; sub(/:.*/,"",name)}
     /^[[:space:]]+vip:/{
       v=$0; sub(/^[^"]*"/,"",v); sub(/".*/,"",v); n=split(v,a," ");