diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index f05d601..f53a3ee 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -165,11 +165,15 @@ jobs:
 
       - name: Configure kernel
         run: |
-          # Unload AppArmor profiles — the host-loaded passt profile
-          # blocks passt's self-sandboxing inside bink node containers.
+          # Disable AppArmor service and unload all profiles.
+          # The host-loaded passt profile blocks passt's self-sandboxing
+          # inside bink node containers.
           # Must run AFTER installing podman, whose passt dependency
           # loads the profile during package installation.
+          sudo systemctl disable --now apparmor 2>/dev/null || true
           sudo aa-teardown 2>/dev/null || true
+          echo "AppArmor status after teardown:"
+          sudo aa-status 2>/dev/null || echo "(aa-status failed)"
           # Allow unprivileged user namespace creation (needed by passt
           # inside containers).
           sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
diff --git a/hack/gather-logs.sh b/hack/gather-logs.sh
index d6ef7cf..a84102d 100755
--- a/hack/gather-logs.sh
+++ b/hack/gather-logs.sh
@@ -32,6 +32,10 @@ run() {
     "$@" > "${output_dir}/${filename}" 2>&1 || true
 }
 
+# Host diagnostics
+run "host-journal.txt"            journalctl --no-pager
+run "host-dmesg.txt"              dmesg
+
 # Cluster-wide commands
 run "k-get-pods.txt"              kubectl get pods -n bootc-operator -o wide
 run "k-describe-pods.txt"         kubectl describe pods -n bootc-operator