diff --git a/observability/vector.yaml b/observability/vector.yaml
index 6ac059f..9667e6f 100644
--- a/observability/vector.yaml
+++ b/observability/vector.yaml
@@ -21,7 +21,9 @@ sources:
     exclude_containers: [vector]        # never ship our own output: it would feed itself
   units:
     type: journald
-    current_boot_only: false
+    # systemd 250-257 reject reading past boots through journalctl, so this stays true: only the current boot
+    # is shipped. Older entries are still on the host for `journalctl --boot=-1`.
+    current_boot_only: true
     journal_directory: /var/log/journal
     include_units: [dumpd, normalize-sweep, trash-purge, deploy-pending, vgdeband]
 
@@ -59,18 +61,18 @@ transforms:
       if starts_with(text, "{") {
         # caddy and authentik emit JSON
         fields, err = parse_json(text)
-        if err == null && is_object(fields) {
+        if err == null {
           .json = fields
-          .level = get(object!(fields), ["level"]) ?? get(object!(fields), ["severity"]) ?? null
-          .message = get(object!(fields), ["msg"]) ?? get(object!(fields), ["event"]) ?? text
+          .level = get(fields, ["level"]) ?? get(fields, ["severity"]) ?? null
+          .message = get(fields, ["msg"]) ?? get(fields, ["event"]) ?? text
         }
       } else if match(text, r'(^|\s)(ts|level|component|event)=') {
         # our own scripts, and syncthing's key=value tail
         fields, err = parse_logfmt(text)
         if err == null {
           .kv = fields
-          .level = get(object!(fields), ["level"]) ?? null
-          .event = get(object!(fields), ["event"]) ?? null
+          .level = get(fields, ["level"]) ?? null
+          .event = get(fields, ["event"]) ?? null
         }
       } else if match(text, r'^\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2} ') {
         # mediamtx: 2026/11/03 05:00:00 INF [component] message