diff --git a/fifa17-recon/docker/fifa17-python/client_arm.sh b/fifa17-recon/docker/fifa17-python/client_arm.sh
index 4b63525..565eb1e 100644
--- a/fifa17-recon/docker/fifa17-python/client_arm.sh
+++ b/fifa17-recon/docker/fifa17-python/client_arm.sh
@@ -27,6 +27,8 @@ set -euo pipefail
 
 SERVER="${OPENFUT_SERVER:?set OPENFUT_SERVER to the backend host IP, e.g. 203.0.113.10}"
 GOS_EA_IP="159.153.51.20"     # winter15.gosredirector.ea.com (hardcoded in FIFA17)
+UTAS_HOST="easw.easports.com" # dead UTAS host baked into CardsDLL
+UTAS_RE="${UTAS_HOST//./\\.}" # same, safe to embed in a regex
 
 if [ "$(id -u)" -ne 0 ]; then
   echo "!! must run as root (sudo). Re-run: sudo OPENFUT_SERVER=$SERVER $0" >&2
@@ -55,13 +57,46 @@ iptables -t nat -A POSTROUTING -p tcp -d "$SERVER" --dport 42127 -j MASQUERADE
 # 3) Point the dead hardcoded UTAS host at the server. The port (8099) is carried
 #    in the game's own URL, so only the name needs redirecting. Remove any prior
 #    OpenFUT-managed line (loopback or other server) and write the current one.
-sed -i '/[[:space:]]easw\.easports\.com\b.*# openfut$/d' /etc/hosts
-printf '%s\teasw.easports.com\t# openfut\n' "$SERVER" >> /etc/hosts
+sed -i "/[[:space:]]${UTAS_RE}\b.*# openfut\$/d" /etc/hosts
+printf '%s\t%s\t# openfut\n' "$SERVER" "$UTAS_HOST" >> /etc/hosts
 
 echo "[client_arm] --- armed ---"
 sysctl kernel.yama.ptrace_scope
 iptables -t nat -L OUTPUT -n | grep -i "$GOS_EA_IP" || echo "  (DNAT missing!)"
-grep 'easw.easports.com' /etc/hosts && echo "  /etc/hosts ok" || echo "  (/etc/hosts easw missing!)"
+
+# Verify the hosts entry by EFFECT, not by presence.
+#
+# glibc returns the FIRST match in /etc/hosts, so our line can be written
+# correctly and still lose to an earlier one -- and the sed above only removes
+# lines this script wrote (`# openfut`), so re-running never clears a foreign
+# one. The old check here was `grep easw /etc/hosts && echo ok`, which passed on
+# the shadowing line itself and reported success while resolution was wrong.
+#
+# Observed on 2026-08-11: a leftover `127.0.0.1 easw.easports.com` from the
+# single-machine era shadowed the OpenFUT line, and every re-run said "ok".
+resolved="$(getent ahosts "$UTAS_HOST" 2>/dev/null | awk '{print $1}' | sort -u | tr '\n' ' ')"
+# SERVER may be a hostname, so compare address-to-address rather than comparing
+# the literal string against resolved IPs (which would warn spuriously).
+server_ips="$(getent ahosts "$SERVER" 2>/dev/null | awk '{print $1}' | sort -u)"
+[ -n "$server_ips" ] || server_ips="$SERVER"
+match=0
+for ip in $server_ips; do
+  printf '%s' "$resolved" | grep -qw -- "$ip" && match=1
+done
+if [ "$match" -eq 1 ]; then
+  echo "  /etc/hosts ok ($UTAS_HOST -> $resolved)"
+else
+  echo
+  echo "  !! WARNING: $UTAS_HOST resolves to [$resolved], not $SERVER."
+  echo "     An earlier /etc/hosts line is shadowing the OpenFUT one:"
+  grep -nE "^[[:space:]]*[^#].*[[:space:]]${UTAS_RE}([[:space:]]|\$)" /etc/hosts \
+    | grep -v '# openfut$' | sed 's/^/       /' || true
+  echo
+  echo "     Not fatal: the responders advertise $SERVER, so the game stops using"
+  echo "     this name after the first hop. Worth removing the line above anyway."
+  echo "     Lines are listed rather than deleted -- this script will not remove"
+  echo "     /etc/hosts entries it did not write."
+fi
 echo
 echo "[client_arm] Next: start the LOCAL pieces (LSX + autopatch) with client_local.sh,"
 echo "             ensure the container is up on $SERVER, then launch FIFA 17."