diff --git a/cleanup_amis.sh b/cleanup_amis.sh
index f74c347..b03ff62 100755
--- a/cleanup_amis.sh
+++ b/cleanup_amis.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 # set -x
 
-TAG_FILTER="Name=tag:Name,Values=zdt-alpine-3.18*dev*" #-dev" #kubezero*"
+TAG_FILTER="Name=tag:Name,Values=zdt-alpine-3.18*" #-dev" #kubezero*"
 #TAG_FILTER="Name=tag:Name,Values=zdt-alpine-*kubezero*1.28*"
 
 echo "Are you really sure to delete AMIs matching \"$TAG_FILTER\" ?"
diff --git a/overlay/zdt/configs/access.conf.age b/overlay/zdt/configs/access.conf.age
deleted file mode 100644
index 0b310c3..0000000
Binary files a/overlay/zdt/configs/access.conf.age and /dev/null differ
diff --git a/overlay/zdt/configs/edition/kubezero.conf b/overlay/zdt/configs/edition/kubezero.conf
index 1d808bf..0b28a93 100644
--- a/overlay/zdt/configs/edition/kubezero.conf
+++ b/overlay/zdt/configs/edition/kubezero.conf
@@ -1,6 +1,6 @@
 # vim: ts=2 et:
 
-kubezero-version = "1.28.8"
+kubezero-version = "1.28.9"
 
 include required("common.conf")
 
@@ -15,7 +15,7 @@ services { include required("kubezero-services.conf") }
 WHEN {
   aws {
     packages {
-      #aws-neuron-driver = kubezero
+      aws-neuron-driver = kubezero
       nvidia-open-gpu   = kubezero
     }
   }
diff --git a/scan_image.sh b/scan_image.sh
index 5baf088..1c97c3d 100755
--- a/scan_image.sh
+++ b/scan_image.sh
@@ -5,7 +5,7 @@ IMAGE=$1
 
 modprobe nbd
 qemu-nbd -c /dev/nbd0 --read-only $IMAGE
-mount /dev/nbd0p2 /mnt/temp/
-trivy rootfs /mnt/temp
+mount -o ro /dev/nbd0p2 /mnt/temp/
+trivy rootfs -d /mnt/temp
 umount /mnt/temp
 qemu-nbd -d /dev/nbd0