diff --git a/miners/macos/rustchain_mac_miner_v2.5.py b/miners/macos/rustchain_mac_miner_v2.5.py
index 68369000f..3a5817a5a 100644
--- a/miners/macos/rustchain_mac_miner_v2.5.py
+++ b/miners/macos/rustchain_mac_miner_v2.5.py
@@ -67,7 +67,16 @@ def error(msg): return msg
 
 MINER_VERSION = "2.5.0"
 NODE_URL = os.environ.get("RUSTCHAIN_NODE", "https://rustchain.org")
-PROXY_URL = os.environ.get("RUSTCHAIN_PROXY", "http://192.168.0.160:8089")
+# No default proxy. The previous default pointed at a private lab address
+# (192.168.0.160), which on anyone else's LAN is whatever machine happens to
+# hold that IP. The miner would hand its full attestation, including hardware
+# serial, MAC addresses, hostname and wallet, in cleartext to a stranger.
+PROXY_URL = os.environ.get("RUSTCHAIN_PROXY", "")
+
+# Verification is ON. Old PowerPC Macs genuinely cannot complete a modern
+# TLS handshake, and the escape hatch for them is an explicit opt-out that
+# the operator chooses, not a silent default that ships to everyone.
+TLS_VERIFY = os.environ.get("RUSTCHAIN_TLS_VERIFY", "1") not in ("0", "false", "False")
 BLOCK_TIME = 600  # 10 minutes
 LOTTERY_CHECK_INTERVAL = 10
 
@@ -199,7 +208,7 @@ def _probe_transport(self):
         try:
             r = requests.get(
                 self.node_url + "/health",
-                timeout=10, verify=False
+                timeout=10, verify=TLS_VERIFY
             )
             if r.status_code == 200:
                 print(success("[TRANSPORT] Direct HTTPS to node: OK"))
@@ -237,14 +246,14 @@ def base_url(self):
     def get(self, path, **kwargs):
         """GET request through whichever transport works."""
         kwargs.setdefault("timeout", 15)
-        kwargs.setdefault("verify", False)
+        kwargs.setdefault("verify", TLS_VERIFY)
         url = self.base_url + path
         return requests.get(url, **kwargs)
 
     def post(self, path, **kwargs):
         """POST request through whichever transport works."""
         kwargs.setdefault("timeout", 15)
-        kwargs.setdefault("verify", False)
+        kwargs.setdefault("verify", TLS_VERIFY)
         url = self.base_url + path
         return requests.post(url, **kwargs)
 
diff --git a/miners/pico_bridge/pico_bridge_miner.py b/miners/pico_bridge/pico_bridge_miner.py
index 2380785d7..0d6eb34ae 100644
--- a/miners/pico_bridge/pico_bridge_miner.py
+++ b/miners/pico_bridge/pico_bridge_miner.py
@@ -706,6 +706,17 @@ def main():
     config = load_config(args.config)
 
     # Override with CLI args
+    # --simulate fabricates hardware readings. Posting those to a node that
+    # pays real RTC is a fake-hardware faucet, so it is refused unless the
+    # operator has explicitly pointed the bridge at a local test node.
+    SIMULATE_LOCAL_ONLY = True
+    if args.simulate and SIMULATE_LOCAL_ONLY:
+        _n = config.get('node_url', '')
+        if not any(h in _n for h in ('localhost', '127.0.0.1', '0.0.0.0', '::1')):
+            print('refusing --simulate against a non-local node: ' + _n)
+            print('point RUSTCHAIN_NODE at a local test node to simulate')
+            return 2
+
     if args.simulate:
         config['simulation_mode'] = True
     if args.wallet: