diff --git a/.buildkite/run-kb-tests.sh b/.buildkite/run-kb-tests.sh
index b9da071f..1ba16f39 100755
--- a/.buildkite/run-kb-tests.sh
+++ b/.buildkite/run-kb-tests.sh
@@ -31,13 +31,19 @@ NODE_RUNNER_IMAGE="node:${NODE_VERSION}-bookworm-slim"
 
 cleanup() {
   echo "--- ES logs (last 50 lines)"
-  docker logs "$ES_CONTAINER_NAME" 2>&1 | tail -50 || true
+  if docker inspect "$ES_CONTAINER_NAME" >/dev/null 2>&1; then
+    docker logs "$ES_CONTAINER_NAME" 2>&1 | tail -50 || true
+  else
+    echo "(container never started)"
+  fi
   echo "--- Kibana logs (last 50 lines)"
-  docker logs "$KB_CONTAINER_NAME" 2>&1 | tail -50 || true
+  if docker inspect "$KB_CONTAINER_NAME" >/dev/null 2>&1; then
+    docker logs "$KB_CONTAINER_NAME" 2>&1 | tail -50 || true
+  else
+    echo "(container never started)"
+  fi
   echo "--- Cleaning up"
-  docker rm -f "$TEST_RUNNER_NAME" 2>/dev/null || true
-  docker rm -f "$KB_CONTAINER_NAME" 2>/dev/null || true
-  docker rm -f "$ES_CONTAINER_NAME" 2>/dev/null || true
+  docker rm -f "$TEST_RUNNER_NAME" "$KB_CONTAINER_NAME" "$ES_CONTAINER_NAME" 2>/dev/null || true
   docker network rm "$NETWORK_NAME" 2>/dev/null || true
 }
 trap cleanup EXIT
@@ -62,7 +68,8 @@ echo "--- Loading Elasticsearch image"
 ES_CACHE_DIR="${ES_CACHE_DIR:-}"
 if [[ -n "$ES_CACHE_DIR" ]] && compgen -G "$ES_CACHE_DIR/elasticsearch-$STACK_VERSION*.tar.gz" > /dev/null 2>&1; then
   echo "  Loading from agent cache: $ES_CACHE_DIR"
-  docker load < "$(ls "$ES_CACHE_DIR/elasticsearch-$STACK_VERSION"*.tar.gz | head -1)"
+  ES_TARBALLS=("$ES_CACHE_DIR/elasticsearch-$STACK_VERSION"*.tar.gz)
+  docker load < "${ES_TARBALLS[0]}"
 else
   docker pull "$ES_IMAGE"
 fi
@@ -78,6 +85,7 @@ docker run \
   --env "ELASTIC_PASSWORD=${ES_PASSWORD}" \
   --env "xpack.security.http.ssl.enabled=false" \
   --env "xpack.security.transport.ssl.enabled=false" \
+  --env "cluster.routing.allocation.disk.threshold_enabled=false" \
   --env "ES_JAVA_OPTS=-Xms512m -Xmx512m" \
   --detach \
   --rm \
diff --git a/.buildkite/setup-kibana.cjs b/.buildkite/setup-kibana.cjs
index 7b1aadf6..9f063afe 100644
--- a/.buildkite/setup-kibana.cjs
+++ b/.buildkite/setup-kibana.cjs
@@ -42,30 +42,39 @@ function request(method, path, body) {
 
 function delay(ms) { return new Promise(r => setTimeout(r, ms)); }
 
+function summarize(body) {
+  const s = typeof body === 'string' ? body : JSON.stringify(body);
+  return s.length > 200 ? `${s.slice(0, 200)}...` : s;
+}
+
 async function retry(fn, label, maxRetries = 180, intervalMs = 2000) {
+  let lastReason = '(no response observed)';
   for (let i = 0; i < maxRetries; i++) {
     try {
-      const ok = await fn();
-      if (ok) return;
-    } catch { /* not ready yet */ }
-    if (i > 0 && i % 15 === 0) console.log(`  still waiting for ${label}... (${i}/${maxRetries})`);
+      await fn();
+      return;
+    } catch (e) {
+      lastReason = e.message;
+    }
+    if (i > 0 && i % 15 === 0) console.log(`  still waiting for ${label}... (${i}/${maxRetries}) — last: ${lastReason}`);
     await delay(intervalMs);
   }
-  throw new Error(`${label} did not become ready in time`);
+  throw new Error(`${label} did not become ready in time. Last seen: ${lastReason}`);
 }
 
 async function main() {
   console.log('Waiting for Elasticsearch cluster health...');
   await retry(async () => {
-    const { body } = await request('GET', '/_cluster/health');
-    return ['green', 'yellow'].includes(body.status);
+    const { status, body } = await request('GET', '/_cluster/health');
+    if (status < 200 || status >= 300) throw new Error(`HTTP ${status}: ${summarize(body)}`);
+    if (!['green', 'yellow'].includes(body.status)) throw new Error(`cluster status=${body.status || 'unknown'}`);
   }, 'ES cluster health');
   console.log('ES cluster is up');
 
   console.log('Waiting for ES security index...');
   await retry(async () => {
-    const { status } = await request('POST', '/_security/api_key', { name: 'setup-check', expiration: '1m' });
-    return status >= 200 && status < 300;
+    const { status, body } = await request('POST', '/_security/api_key', { name: 'setup-check', expiration: '1m' });
+    if (status < 200 || status >= 300) throw new Error(`HTTP ${status}: ${summarize(body)}`);
   }, 'ES security index', 60);
   console.log('ES security index is ready');
 
diff --git a/NOTICE.txt b/NOTICE.txt
index adf8baa9..11184980 100644
--- a/NOTICE.txt
+++ b/NOTICE.txt
@@ -377,7 +377,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 
 ------------------------------------------------------------------------
-commander@14.0.3
+commander@15.0.0
 License: MIT
 Repository: https://github.com/tj/commander.js
 Publisher: TJ Holowaychuk <tj@vision-media.ca>