diff --git a/traffic_core/src/firewall.rs b/traffic_core/src/firewall.rs
index 8a70b69..6c671c7 100644
--- a/traffic_core/src/firewall.rs
+++ b/traffic_core/src/firewall.rs
@@ -153,7 +153,7 @@ fn build_host_firewall_batch_script(cfg: &Config, policy: &str) -> String {
     let mut batch = String::new();
     batch.push_str(&format!("add table inet {HOST_FW_TABLE}\n"));
     batch.push_str(&format!(
-        "add chain inet {HOST_FW_TABLE} input {{ type filter hook input priority filter; policy accept; }}\n"
+        "add chain inet {HOST_FW_TABLE} input {{ type filter hook input priority filter; policy {policy}; }}\n"
     ));
     batch.push_str(&format!(
         "add rule inet {HOST_FW_TABLE} input iif \"lo\" accept\n"
@@ -180,9 +180,6 @@ fn build_host_firewall_batch_script(cfg: &Config, policy: &str) -> String {
             "add rule inet {HOST_FW_TABLE} input ip6 nexthdr icmpv6 accept\n"
         ));
     }
-    batch.push_str(&format!(
-        "set chain inet {HOST_FW_TABLE} input {{ policy {policy}; }}\n"
-    ));
     batch
 }
 
diff --git a/traffic_core/src/swap.rs b/traffic_core/src/swap.rs
index 7b597a4..a47b655 100644
--- a/traffic_core/src/swap.rs
+++ b/traffic_core/src/swap.rs
@@ -159,15 +159,27 @@ fn parse_swapon_output(raw: &str) -> anyhow::Result<Vec<ActiveSwap>> {
             continue;
         }
         let parts: Vec<&str> = t.split_whitespace().collect();
-        if parts.len() != 4 {
+        if parts.len() < 4 {
             anyhow::bail!("malformed swapon row: {t}");
         }
         let size_bytes = parts[2]
             .parse::<u64>()
             .map_err(|_| anyhow::anyhow!("malformed swapon size: {}", parts[2]))?;
-        let priority = parts[3]
+
+        // Debian 13/util-linux may include USED and UUID despite the requested
+        // output set. Accept both the old 4-column form:
+        //   NAME TYPE SIZE PRIO
+        // and the observed 5/6-column form:
+        //   NAME TYPE SIZE USED PRIO [UUID]
+        let priority_index = if parts.len() >= 5 && parts[4].parse::<i32>().is_ok() {
+            4
+        } else {
+            3
+        };
+
+        let priority = parts[priority_index]
             .parse::<i32>()
-            .map_err(|_| anyhow::anyhow!("malformed swapon priority: {}", parts[3]))?;
+            .map_err(|_| anyhow::anyhow!("malformed swapon priority: {}", parts[priority_index]))?;
         out.push(ActiveSwap {
             name: PathBuf::from(parts[0]),
             kind: parts[1].to_string(),
@@ -518,6 +530,18 @@ mod tests {
         assert_eq!(got.len(), 2);
     }
 
+    #[test]
+    fn parse_swapon_debian13_columns_with_used_prio_uuid() {
+        let got = parse_swapon_output(
+            "/swapfile file 2147479552 0 1 c8db470e-b8fb-414a-8537-8fa405ebeadf\n",
+        )
+        .expect("parse");
+        assert_eq!(got.len(), 1);
+        assert_eq!(got[0].name, PathBuf::from("/swapfile"));
+        assert_eq!(got[0].size_bytes, 2147479552);
+        assert_eq!(got[0].priority, 1);
+    }
+
     #[test]
     fn parse_swapon_rejects_malformed_size() {
         let err = parse_swapon_output("/swapfile file abc 1\n");