diff --git a/ansible/roles/core-settings/templates/etc/apt/apt.conf.d/00proxy.j2 b/ansible/roles/core-settings/templates/etc/apt/apt.conf.d/00proxy.j2
index cc572c7..5fb05a9 100644
--- a/ansible/roles/core-settings/templates/etc/apt/apt.conf.d/00proxy.j2
+++ b/ansible/roles/core-settings/templates/etc/apt/apt.conf.d/00proxy.j2
@@ -1,10 +1,5 @@
-{% set adv = advanced | default([]) %}
-{% set proxy = adv | selectattr('label', 'equalto', 'apt.repository.proxy') 
-                   | map(attribute='value') 
-                   | first 
-                   | default('', true) 
-                   | string 
-                   | trim %}
+{% set adv = advanced | default({}) %}
+{% set proxy = adv.get('apt.repository.proxy', '') | string | trim %}
 
 {% if proxy | length > 1 %}
 Acquire::http { Proxy "{{ proxy }}"; }
diff --git a/ansible/roles/core-settings/templates/etc/apt/sources.list.d/edgestream.sources.j2 b/ansible/roles/core-settings/templates/etc/apt/sources.list.d/edgestream.sources.j2
index dc52101..5489ba2 100644
--- a/ansible/roles/core-settings/templates/etc/apt/sources.list.d/edgestream.sources.j2
+++ b/ansible/roles/core-settings/templates/etc/apt/sources.list.d/edgestream.sources.j2
@@ -1,42 +1,11 @@
 # EdgeStream Hub APT Repository (modern format)
 
-{# Ensure advanced is always a list #}
-{% set adv = advanced | default([]) %}
+{% set adv = advanced | default({}) %}
 
-{# ---- Defensive getters --------------------------------------------------- #}
-{# We check if the item is a dictionary (dict) before accessing 'label' #}
-{% set url_matches      = adv | selectattr('label', 'defined') | selectattr('label', 'equalto', 'apt.repository.url') | list %}
-{% set release_matches = adv | selectattr('label', 'defined') | selectattr('label', 'equalto', 'apt.repository.release') | list %}
-{% set branch_matches  = adv | selectattr('label', 'defined') | selectattr('label', 'equalto', 'apt.repository.branch') | list %}
-{% set key_matches     = adv | selectattr('label', 'defined') | selectattr('label', 'equalto', 'apt.repository.key') | list %}
-
-{% set apt_url_item     = url_matches[0]     if url_matches|length     > 0 else none %}
-{% set apt_release_item = release_matches[0] if release_matches|length > 0 else none %}
-{% set apt_branch_item  = branch_matches[0]  if branch_matches|length  > 0 else none %}
-{% set apt_key_item     = key_matches[0]     if key_matches|length     > 0 else none %}
-
-{# Helper: pick value -> default_value -> hard default #}
-{% macro pick(item, hard_default) -%}
-  {%- if item is mapping -%}
-    {%- set val = item.value | default('') | string | trim -%}
-    {%- set def = item.default_value | default('') | string | trim -%}
-    {%- if val -%}
-      {{ val }}
-    {%- elif def -%}
-      {{ def }}
-    {%- else -%}
-      {{ hard_default }}
-    {%- endif -%}
-  {%- else -%}
-    {{ hard_default }}
-  {%- endif -%}
-{%- endmacro %}
-
-{# Resolve fields - Pass empty strings as hard defaults to let the macro decide #}
-{% set apt_url     = pick(apt_url_item, 'https://apt.repo.hyperi.io/edgestream/testing') %}
-{% set apt_release = pick(apt_release_item, 'trixie') %}
-{% set apt_branch  = pick(apt_branch_item,  'main') %}
-{% set apt_key     = pick(apt_key_item,     '/etc/apt/keyrings/edgestream.gpg') %}
+{% set apt_url     = adv.get('apt.repository.url',     '') | string | trim or 'https://apt.repo.hyperi.io/edgestream/testing' %}
+{% set apt_release = adv.get('apt.repository.release', '') | string | trim or 'trixie' %}
+{% set apt_branch  = adv.get('apt.repository.branch',  '') | string | trim or 'main' %}
+{% set apt_key     = adv.get('apt.repository.key',     '') | string | trim or '/etc/apt/keyrings/edgestream.gpg' %}
 
 Types: deb
 URIs: {{ apt_url }}
diff --git a/ansible/roles/network-settings/tasks/nginx.yml b/ansible/roles/network-settings/tasks/nginx.yml
index db4cf04..337b9d4 100644
--- a/ansible/roles/network-settings/tasks/nginx.yml
+++ b/ansible/roles/network-settings/tasks/nginx.yml
@@ -56,25 +56,13 @@
   ansible.builtin.set_fact:
     dre_empty: >-
       {{
-        (
-          (advanced | default([]))
-            | selectattr('label','equalto','webui.enabled')
-            | map(attribute='value')
-            | first
-            | default(None, true)
-        ) is none
+        (advanced | default({})).get('webui.enabled') is none
       }}
 
     dre_truthy: >-
       {{
-        (
-          (advanced | default([]))
-            | selectattr('label','equalto','webui.enabled')
-            | map(attribute='value')
-            | first
-            | default('')
-        ) | string | lower
-        in ['1','true','yes','on']
+        ((advanced | default({})).get('webui.enabled', '') | string | lower)
+        in ['1', 'true', 'yes', 'on']
       }}
 
 - name: "[network-settings.nginx]: Permit access to webui"
diff --git a/ansible/roles/network-settings/templates/etc/nginx/sites-available/edgestream-revproxy.j2 b/ansible/roles/network-settings/templates/etc/nginx/sites-available/edgestream-revproxy.j2
index 1b6a416..f55b503 100644
--- a/ansible/roles/network-settings/templates/etc/nginx/sites-available/edgestream-revproxy.j2
+++ b/ansible/roles/network-settings/templates/etc/nginx/sites-available/edgestream-revproxy.j2
@@ -31,21 +31,8 @@ upstream edgestream-influx {
       keepalive 10;
 }
 
-{# --- Robust Advanced Settings Resolver --- #}
-{% set adv = advanced | default([]) %}
-
-{% macro get_adv(items, key, default_val) -%}
-  {%- set match = items | selectattr('label', 'defined') | selectattr('label', 'equalto', key) | list -%}
-  {%- if match | length > 0 and match[0].value | string | trim | length > 0 -%}
-    {{ match[0].value | string | trim }}
-  {%- elif match | length > 0 and match[0].default_value | string | trim | length > 0 -%}
-    {{ match[0].default_value | string | trim }}
-  {%- else -%}
-    {{ default_val }}
-  {%- endif -%}
-{%- endmacro %}
-
-{% set listen_port = get_adv(adv, 'webui.listen_port', '443') %}
+{# --- Advanced Settings Resolver --- #}
+{% set listen_port = (advanced | default({})).get('webui.listen_port', '443') | string | trim %}
 {% set ssl_crt = nginx_ssl_certificate | default('/etc/edgestream/ssl/nginx-server.crt', true) | string | trim %}
 {% set ssl_key = nginx_ssl_private_key | default('/etc/edgestream/ssl/nginx-server.key', true) | string | trim %}
 
@@ -144,4 +131,4 @@ server {
                 proxy_set_header X-Real-IP $remote_addr;
                 proxy_redirect off;
         }
-}
+}
\ No newline at end of file
diff --git a/ansible/roles/network-settings/templates/etc/pam.d/sshd.j2 b/ansible/roles/network-settings/templates/etc/pam.d/sshd.j2
index 0e6c40b..7e3fd1f 100644
--- a/ansible/roles/network-settings/templates/etc/pam.d/sshd.j2
+++ b/ansible/roles/network-settings/templates/etc/pam.d/sshd.j2
@@ -1,13 +1,13 @@
 # PAM configuration for the Secure Shell service
 
 {# --- safe locals & helpers --- #}
-{% set adv = advanced | default([]) %}
+{% set adv = advanced | default({}) %}
 {# pull flags once, tolerate strings like "true"/"1"/"yes" #}
-{% set pwd_auth_raw = adv | selectattr('label','equalto','ssh.password_authentication') | map(attribute='value') | first | default(False) %}
-{% set ga_raw       = adv | selectattr('label','equalto','ssh.google_auth')            | map(attribute='value') | first | default(False) %}
+{% set pwd_auth_raw = adv.get('ssh.password_authentication', False) %}
+{% set ga_raw       = adv.get('ssh.google_auth', False) %}
 
-{% set pwd_auth = (pwd_auth_raw|string|lower in ['1','true','yes','on']) or (pwd_auth_raw|bool) %}
-{% set google_2fa = (ga_raw|string|lower in ['1','true','yes','on']) or (ga_raw|bool) %}
+{% set pwd_auth = (pwd_auth_raw | string | lower in ['1', 'true', 'yes', 'on']) or (pwd_auth_raw | bool) %}
+{% set google_2fa = (ga_raw | string | lower in ['1', 'true', 'yes', 'on']) or (ga_raw | bool) %}
 
 # Standard Un*x authentication.
 {% if pwd_auth or not google_2fa %}
diff --git a/ansible/roles/network-settings/templates/etc/ssh/sshd_config.d/91-edgestream-settings.conf.j2 b/ansible/roles/network-settings/templates/etc/ssh/sshd_config.d/91-edgestream-settings.conf.j2
index 70e2551..912967e 100644
--- a/ansible/roles/network-settings/templates/etc/ssh/sshd_config.d/91-edgestream-settings.conf.j2
+++ b/ansible/roles/network-settings/templates/etc/ssh/sshd_config.d/91-edgestream-settings.conf.j2
@@ -1,19 +1,13 @@
-{% set adv = advanced | default([]) %}
+{% set adv = advanced | default({}) %}
 
 {# --- pull values safely --- #}
-{% set listen_port = (
-     adv | selectattr('label','equalto','ssh.listen_port')
-         | map(attribute='value')
-         | first
-         | default('') | string | trim
-) %}
-
-{% set pwd_auth_raw = adv | selectattr('label','equalto','ssh.password_authentication') | map(attribute='value') | first | default(true) %}
-{% set ga_raw       = adv | selectattr('label','equalto','ssh.google_auth')            | map(attribute='value') | first | default(false) %}
+{% set listen_port = adv.get('ssh.listen_port', '') | string | trim %}
+{% set pwd_auth_raw = adv.get('ssh.password_authentication', true) %}
+{% set ga_raw       = adv.get('ssh.google_auth', false) %}
 
 {# normalize truthy/falsey: accept 1/0, true/false, yes/no, on/off, strings #}
-{% set pwd_auth   = (pwd_auth_raw|string|lower in ['1','true','yes','on']) or (pwd_auth_raw|bool) %}
-{% set google_2fa = (ga_raw|string|lower in ['1','true','yes','on']) or (ga_raw|bool) %}
+{% set pwd_auth   = (pwd_auth_raw | string | lower in ['1', 'true', 'yes', 'on']) or (pwd_auth_raw | bool) %}
+{% set google_2fa = (ga_raw | string | lower in ['1', 'true', 'yes', 'on']) or (ga_raw | bool) %}
 
 {# Port: only emit if provided #}
 {% if listen_port %}
diff --git a/ansible/roles/network-settings/templates/etc/ufw/applications.d/edgestream-webui.j2 b/ansible/roles/network-settings/templates/etc/ufw/applications.d/edgestream-webui.j2
index 82a29ff..3edb9b4 100644
--- a/ansible/roles/network-settings/templates/etc/ufw/applications.d/edgestream-webui.j2
+++ b/ansible/roles/network-settings/templates/etc/ufw/applications.d/edgestream-webui.j2
@@ -1,17 +1,8 @@
-{% set adv = advanced | default([]) %}
+{% set adv = advanced | default({}) %}
 
-{# pull value and default_value, trimming whitespace #}
-{% set lp_value = (
-  adv | selectattr('label','equalto','webui.listen_port')
-      | map(attribute='value') | first | d('') | string | trim
-) %}
-{% set lp_default = (
-  adv | selectattr('label','equalto','webui.listen_port')
-      | map(attribute='default_value') | first | d('443') | string | trim
-) %}
-
-{# choose value if non-empty, else default_value, else hard fallback #}
-{% set listen_port = (lp_value if lp_value|length > 0 else (lp_default if lp_default|length > 0 else '443')) %}
+{# choose value if non-empty, else hard fallback to '443' #}
+{% set raw_port = adv.get('webui.listen_port', '') | string | trim %}
+{% set listen_port = raw_port if raw_port | length > 0 else '443' %}
 
 [edgestream-webui]
 title=EdgeStream Gateway webui
diff --git a/ansible/roles/network-settings/templates/etc/ufw/applications.d/openssh-server.j2 b/ansible/roles/network-settings/templates/etc/ufw/applications.d/openssh-server.j2
index e83ecfe..b20cacd 100644
--- a/ansible/roles/network-settings/templates/etc/ufw/applications.d/openssh-server.j2
+++ b/ansible/roles/network-settings/templates/etc/ufw/applications.d/openssh-server.j2
@@ -1,17 +1,8 @@
-{% set adv = advanced | default([]) %}
+{% set adv = advanced | default({}) %}
 
-{# pull value and default_value, trimming whitespace #}
-{% set lp_value = (
-  adv | selectattr('label','equalto','ssh.listen_port')
-      | map(attribute='value') | first | d('') | string | trim
-) %}
-{% set lp_default = (
-  adv | selectattr('label','equalto','ssh.listen_port')
-      | map(attribute='default_value') | first | d('22') | string | trim
-) %}
-
-{# choose value if non-empty, else default_value, else hard fallback #}
-{% set listen_port = (lp_value if lp_value|length > 0 else (lp_default if lp_default|length > 0 else '22')) %}
+{# choose value if non-empty, else hard fallback to '22' #}
+{% set raw_port = adv.get('ssh.listen_port', '') | string | trim %}
+{% set listen_port = raw_port if raw_port | length > 0 else '22' %}
 
 [OpenSSH]
 title=Secure shell server, an rshd replacement
diff --git a/ansible/roles/o365audit-settings/templates/etc/office365-audit-log-collector/config.yml.j2 b/ansible/roles/o365audit-settings/templates/etc/office365-audit-log-collector/config.yml.j2
index 6abc416..6a4ba7f 100644
--- a/ansible/roles/o365audit-settings/templates/etc/office365-audit-log-collector/config.yml.j2
+++ b/ansible/roles/o365audit-settings/templates/etc/office365-audit-log-collector/config.yml.j2
@@ -1,7 +1,3 @@
-log:
-  path: ''
-  debug: {{ settings.debug | default(False) | bool }}
-
 {#--------- logic & safety checks ---------#}
 {% set s = source | default({}) %}
 
@@ -11,11 +7,15 @@ log:
 {% endif %}
 
 {% set settings = s.settings | default({}) %}
-{% set adv = advanced | default([]) %}
+{% set adv = advanced | default({}) %}
 
 {# Clean up the socket path: ensure no trailing slash #}
 {% set base_socket_path = (socketPath | default('/run/o365audit')).rstrip('/') %}
 
+log:
+  path: ''
+  debug: {{ settings.get('debug', False) | bool }}
+
 collect:
   workingDir: /var/cache/o365audit/{{ s.name }}/
   contentTypes:
@@ -25,11 +25,11 @@ collect:
     Audit.SharePoint: {{ settings.get('audit.sharepoint', '0') | bool }}
     DLP.All: {{ settings.get('dlp.all', '0') | bool }}
   cacheSize: 500000
-  maxThreads: {{ settings.maxthreads | default('40') | int }}
+  maxThreads: {{ settings.get('maxthreads', '40') | int }}
   globalTimeout: 1
   retries: 3
   skipKnownLogs: True
-  hoursToCollect: {{ settings.hourstocollect | default('24') | int }}
+  hoursToCollect: {{ settings.get('hourstocollect', '24') | int }}
   duplicate: 1
 
 output:
diff --git a/ansible/roles/vector-settings/tasks/render_system_templates.yml b/ansible/roles/vector-settings/tasks/render_system_templates.yml
index 0da42fa..7035686 100644
--- a/ansible/roles/vector-settings/tasks/render_system_templates.yml
+++ b/ansible/roles/vector-settings/tasks/render_system_templates.yml
@@ -10,7 +10,7 @@
           'transforms':   (transforms   | default([])),
           'sources':      (sources      | default([])),
           'destinations': (destinations | default([])),
-          'advanced':     (advanced     | default([])),
+          'advanced':     (advanced     | default({})),
         }
       }}
 
diff --git a/ansible/roles/vector-settings/tasks/vector_sinks.yml b/ansible/roles/vector-settings/tasks/vector_sinks.yml
index 440084b..ccb75b7 100644
--- a/ansible/roles/vector-settings/tasks/vector_sinks.yml
+++ b/ansible/roles/vector-settings/tasks/vector_sinks.yml
@@ -12,12 +12,8 @@
 - name: "[vector-settings.vector_sinks]: Determine default multiplex value (safe)"
   set_fact:
     multiplex_value: >-
-      {% set v = (advanced | default([]))
-                 | selectattr('label', 'equalto', 'destination.multiplex')
-                 | map(attribute='value')
-                 | first
-                 | default(1) | int %}
-      {{ [5, [1, v] | max] | min }}
+      {% set raw_v = (advanced | default({})).get('destination.multiplex', 1) | int %}
+      {{ [5, [1, raw_v] | max] | min }}
 
 - name: "[vector-settings.vector_sinks]: Ensure multiplex_value is an integer"
   set_fact:
@@ -30,11 +26,6 @@
          | selectattr('enabled', 'equalto', true)
          | list }}
 
-#- debug:
-#    var: multiplex_destinations
-#- debug:
-#    var: multiplex_value
-
 - name: "[vector-settings.vector_sinks]: Generate per-sink multiplexed sink config files"
   template:
     src: "etc/vector/edgestream/sinks/{{ destination.type | default('') }}.yaml.j2"
@@ -72,7 +63,6 @@
     - (system_sink_templates.files | default([])) | length > 0
     - vector_settings_system_sinks is not defined or vector_settings_system_sinks | bool
 
-
 - name: "[vector-settings.vector_sinks]: Calculate enabled sources"
   set_fact:
     enabled_sources_count: "{{ sources | default([]) | selectattr('enabled', 'equalto', true) | list | length }}"
@@ -85,7 +75,7 @@
     group: vector
     mode: "0640"
   when: enabled_sources_count | int > 0
-  
+
 - name: "[vector-settings.vector_sinks]: Remove 10_sink_blackhole.yaml if no sources are enabled"
   file:
     path: "/etc/vector/edgestream/sinks/10_sink_blackhole.yaml"
diff --git a/ansible/roles/vector-settings/tasks/vector_transforms.yml b/ansible/roles/vector-settings/tasks/vector_transforms.yml
index a7b352b..0be22a1 100644
--- a/ansible/roles/vector-settings/tasks/vector_transforms.yml
+++ b/ansible/roles/vector-settings/tasks/vector_transforms.yml
@@ -9,16 +9,11 @@
     group: vector
     mode: "0750"
 
-# Multiplex value (safe if 'advanced' is undefined/missing)
-- name: "[vector-settings.vector_transforms]: Determine default multiplex value"
+- name: "[vector-settings.vector_sinks]: Determine default multiplex value (safe)"
   set_fact:
     multiplex_value: >-
-      {% set v = (advanced | default([]))
-                   | selectattr('label', 'equalto', 'destination.multiplex')
-                   | map(attribute='value')
-                   | first
-                   | default(1) | int %}
-      {{ [5, [1, v] | max] | min }}
+      {% set raw_v = (advanced | default({}))['destination.multiplex'] | default(1) | int %}
+      {{ [5, [1, raw_v] | max] | min }}
 
 - name: "[vector-settings.vector_transforms]: Ensure multiplex_value is an integer"
   set_fact:
diff --git a/ansible/roles/vector-settings/templates/etc/cron.d/influx-clean.j2 b/ansible/roles/vector-settings/templates/etc/cron.d/influx-clean.j2
index eb483bc..38ef5a1 100644
--- a/ansible/roles/vector-settings/templates/etc/cron.d/influx-clean.j2
+++ b/ansible/roles/vector-settings/templates/etc/cron.d/influx-clean.j2
@@ -4,21 +4,8 @@
 # ----------------------------- #}
 
 {# ---------- Advanced Settings Resolver ---------- #}
-{% set adv = advanced | default([]) %}
-
-{# Safe lookup macro for advanced settings #}
-{% macro get_adv(items, key, default_val) -%}
-  {%- set match = items | selectattr('label', 'defined') | selectattr('label', 'equalto', key) | list -%}
-  {%- if match | length > 0 and match[0].value | string | trim | length > 0 -%}
-    {{ match[0].value | string | trim }}
-  {%- elif match | length > 0 and match[0].default_value | string | trim | length > 0 -%}
-    {{ match[0].default_value | string | trim }}
-  {%- else -%}
-    {{ default_val }}
-  {%- endif -%}
-{%- endmacro %}
-
-{% set threshold = get_adv(adv, 'webui.chart.threshold', '2G') %}
+{% set adv = advanced | default({}) %}
+{% set threshold = adv.get('webui.chart.threshold', '') | string | trim or '2G' %}
 
 # Managed by Ansible – DO NOT EDIT
 SHELL=/bin/bash