diff --git a/documentation/command-log/2026-06-30_foundation-bootstrap.log b/documentation/command-log/2026-06-30_foundation-bootstrap.log
index e9ceb54..e6c5faf 100644
--- a/documentation/command-log/2026-06-30_foundation-bootstrap.log
+++ b/documentation/command-log/2026-06-30_foundation-bootstrap.log
@@ -28,3 +28,4 @@ EXIT: 0 — VM created (cx23, nbg1-dc3). publicIp in outputs. Docker installing
 EXIT: 0 — test VM foundation-test @ 91.98.117.152 (cx23, nbg1-dc3), SSH:222, Docker 29.6.1 verified.
 NOTE: docker-over-SSH provider path needs SSH_PRIVATE_KEY_PATH=~/.ssh/foundation-test_ed25519 + FOUNDATION_DOCKER_HOST=ssh://root@91.98.117.152:222. DESTROY: cd provision && pulumi destroy (stack foundation-test).
 ---
+--- 2026-06-30T18:13:36Z --- CMD: pulumi up (cx33/hel1-dc2 replace) EXIT: RUNNING
diff --git a/provision/index.ts b/provision/index.ts
index f9cac10..303acac 100644
--- a/provision/index.ts
+++ b/provision/index.ts
@@ -23,7 +23,7 @@ if (!token) {
 }
 
 const platformName = "foundation-test";
-const datacenter = "nbg1-dc3"; // matches existing cx22 servers (known-good)
+const datacenter = "hel1-dc2"; // cx33 only orderable in Helsinki (eu-central zone)
 // Dedicated throwaway key: the operator's id_rsa pubkey is already registered in
 // the project (olsicloud4-ssh-key) and Hetzner rejects duplicate key CONTENT, so
 // the test VM uses its own ed25519 key. SSH/Docker-over-SSH use the matching
@@ -53,7 +53,7 @@ const dep = new HetznerDeployment(platformName, {
     {
       name: "foundation-test",
       hostname: "foundation-test",
-      type: "cx23", // current-gen Intel shared (cx22 is legacy/unavailable for new servers); 2c/4G
+      type: "cx33", // 4c/8G/80GB (Helsinki); cx22 legacy, cx33 not in nbg1
       image: "debian-12",
       labels: { purpose: "foundation-test", ephemeral: "true" },
       cloudInitConfig: { lateCommands: dockerInstall },