diff --git a/core/internal/cluster/manager.go b/core/internal/cluster/manager.go
index dfdab36..38c2945 100644
--- a/core/internal/cluster/manager.go
+++ b/core/internal/cluster/manager.go
@@ -294,6 +294,8 @@
 		return fmt.Errorf("joining a cluster without a golden ticket not yet implemented")
 	}
 
+	m.goldenTicket = enrolmentConfig.GoldenTicket
+
 	// Otherwise, we begin enrolling with the Golden Ticket.
 	m.next(ctx, StateCharlie)
 	return nil
diff --git a/core/internal/kubernetes/clusternet/clusternet.go b/core/internal/kubernetes/clusternet/clusternet.go
index e41ba8a..bb1f183 100644
--- a/core/internal/kubernetes/clusternet/clusternet.go
+++ b/core/internal/kubernetes/clusternet/clusternet.go
@@ -202,11 +202,17 @@
 // Run runs the ClusterNet service. See package description for what it does.
 func (s *Service) Run(ctx context.Context) error {
 	logger := supervisor.Logger(ctx)
+	s.logger = logger
 
 	wgClient, err := wgctrl.New()
 	if err != nil {
 		return fmt.Errorf("failed to connect to netlink's WireGuard config endpoint: %w", err)
 	}
+	s.wgClient = wgClient
+
+	if err := s.ensureOnDiskKey(); err != nil {
+		return fmt.Errorf("failed to ensure on-disk key: %w", err)
+	}
 
 	wgInterface := &Wireguard{LinkAttrs: netlink.LinkAttrs{Name: clusterNetDeviceName, Flags: net.FlagUp}}
 	if err := netlink.LinkAdd(wgInterface); err != nil {
diff --git a/core/internal/launch/launch.go b/core/internal/launch/launch.go
index 90eb00b..f20d721 100644
--- a/core/internal/launch/launch.go
+++ b/core/internal/launch/launch.go
@@ -235,7 +235,7 @@
 		return err
 	}
 
-	qemuArgs := []string{"-machine", "q35", "-accel", "kvm", "-nographic", "-nodefaults", "-m", "2048",
+	qemuArgs := []string{"-machine", "q35", "-accel", "kvm", "-nographic", "-nodefaults", "-m", "4096",
 		"-cpu", "host", "-smp", "sockets=1,cpus=1,cores=2,threads=2,maxcpus=4",
 		"-drive", "if=pflash,format=raw,readonly,file=external/edk2/OVMF_CODE.fd",
 		"-drive", "if=pflash,format=raw,snapshot=on,file=external/edk2/OVMF_VARS.fd",