diff --git a/bin/lib/onboard.js b/bin/lib/onboard.js
index e74d49921..955894113 100644
--- a/bin/lib/onboard.js
+++ b/bin/lib/onboard.js
@@ -1216,6 +1216,7 @@ function getNonInteractiveModel(providerKey) {
 
 // ── Step 1: Preflight ────────────────────────────────────────────
 
+// eslint-disable-next-line complexity
 async function preflight() {
   step(1, 7, "Preflight checks");
 
@@ -1592,6 +1593,7 @@ async function createSandbox(gpu, model, provider, preferredInferenceApi = null)
 
 // ── Step 4: NIM ──────────────────────────────────────────────────
 
+// eslint-disable-next-line complexity
 async function setupNim(gpu) {
   step(2, 7, "Configuring inference (NIM)");
 
@@ -1990,6 +1992,7 @@ async function setupNim(gpu) {
 
 // ── Step 5: Inference provider ───────────────────────────────────
 
+// eslint-disable-next-line complexity
 async function setupInference(sandboxName, model, provider, endpointUrl = null, credentialEnv = null) {
   step(4, 7, "Setting up inference provider");
   runOpenshell(["gateway", "select", GATEWAY_NAME], { ignoreError: true });
@@ -2073,6 +2076,7 @@ async function setupOpenclaw(sandboxName, model, provider) {
 
 // ── Step 7: Policy presets ───────────────────────────────────────
 
+// eslint-disable-next-line complexity
 async function setupPolicies(sandboxName) {
   step(7, 7, "Policy presets");
 
diff --git a/bin/lib/policies.js b/bin/lib/policies.js
index 75704a9a0..21b1f319d 100644
--- a/bin/lib/policies.js
+++ b/bin/lib/policies.js
@@ -93,6 +93,7 @@ function buildPolicyGetCommand(sandboxName) {
   return `${getOpenshellCommand()} policy get --full ${shellQuote(sandboxName)} 2>/dev/null`;
 }
 
+// eslint-disable-next-line complexity
 function applyPreset(sandboxName, presetName) {
   // Guard against truncated sandbox names — WSL can truncate hyphenated
   // names during argument parsing, e.g. "my-assistant" → "m"
diff --git a/bin/nemoclaw.js b/bin/nemoclaw.js
index 3d82ffa96..b070b7e9a 100755
--- a/bin/nemoclaw.js
+++ b/bin/nemoclaw.js
@@ -201,6 +201,7 @@ function printGatewayLifecycleHint(output = "", sandboxName = "", writer = conso
   }
 }
 
+// eslint-disable-next-line complexity
 async function getReconciledSandboxGatewayState(sandboxName) {
   let lookup = getSandboxGatewayState(sandboxName);
   if (lookup.state === "present") {
@@ -360,6 +361,7 @@ async function setupSpark() {
   run(`sudo bash "${SCRIPTS}/setup-spark.sh"`);
 }
 
+// eslint-disable-next-line complexity
 async function deploy(instanceName) {
   if (!instanceName) {
     console.error("  Usage: nemoclaw deploy <instance-name>");
@@ -569,6 +571,7 @@ async function sandboxConnect(sandboxName) {
   exitWithSpawnResult(result);
 }
 
+// eslint-disable-next-line complexity
 async function sandboxStatus(sandboxName) {
   const sb = registry.getSandbox(sandboxName);
   const live = parseGatewayInference(
@@ -757,6 +760,7 @@ function help() {
 
 const [cmd, ...args] = process.argv.slice(2);
 
+// eslint-disable-next-line complexity
 (async () => {
   // No command → help
   if (!cmd || cmd === "help" || cmd === "--help" || cmd === "-h") {
diff --git a/eslint.config.mjs b/eslint.config.mjs
index 4c2856dbc..b6b9b8aa5 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -39,6 +39,8 @@ export default [
     rules: {
       ...js.configs.recommended.rules,
       "no-unused-vars": ["error", { argsIgnorePattern: "^_", varsIgnorePattern: "^_", caughtErrorsIgnorePattern: "^_" }],
+      // Cyclomatic complexity — ratchet down to 15 as we refactor suppressed functions
+      "complexity": ["error", { max: 20 }],
     },
   },