diff --git a/admin/hooks-1.32.sh b/admin/hooks-1.32.sh
index bb6470b2..01a35cc0 100644
--- a/admin/hooks-1.32.sh
+++ b/admin/hooks-1.32.sh
@@ -5,7 +5,7 @@ pre_control_plane_upgrade_cluster() {
   if [ "$PLATFORM" != "gke" ];then
     # patch multus DS to ONLY run pods on 1.31 controllers
     kubectl patch ds kube-multus-ds -n kube-system -p '{"spec": {"template": {"spec": {"nodeSelector": {"node.kubernetes.io/kubezero.version": "v1.31.6"}}}}}' || true
-  }
+  fi
 }
 
 
diff --git a/admin/libhelm.sh b/admin/libhelm.sh
index 57e89f90..2b42355b 100644
--- a/admin/libhelm.sh
+++ b/admin/libhelm.sh
@@ -88,7 +88,7 @@ function ensure_kubezero_secret_key() {
   local val
 
   for key in $1; do
-    val=$(echo $secret | yq ".data.\"$key\""
+    val=$(echo $secret | yq ".data.\"$key\"")
     if [ "$val" == "null" ]; then
       set_kubezero_secret $key ""
     fi
diff --git a/charts/kubezero-network/values.yaml b/charts/kubezero-network/values.yaml
index 11d24f43..64f7a681 100644
--- a/charts/kubezero-network/values.yaml
+++ b/charts/kubezero-network/values.yaml
@@ -44,6 +44,7 @@ cilium:
     logFile: /var/log/cilium-cni.log
     #-- Ensure this is false if multus is enabled
     exclusive: true
+    iptablesRemoveAWSRules: false
 
   cluster:
     # This should match the second octet of clusterPoolIPv4PodCIDRList