diff --git a/dstack/crates/dstack-volume/src/bin/dstack-volume.rs b/dstack/crates/dstack-volume/src/bin/dstack-volume.rs
index 367fc33fc..0e370de45 100644
--- a/dstack/crates/dstack-volume/src/bin/dstack-volume.rs
+++ b/dstack/crates/dstack-volume/src/bin/dstack-volume.rs
@@ -80,8 +80,12 @@ fn read_compose(compose_path: &Path) -> Result<AppCompose> {
 }
 
 fn prepare_volumes() -> Result<Vec<VerityVolume>> {
-    let _ = run_cmd!(modprobe dm-verity);
-    let _ = run_cmd!(udevadm settle --timeout=5);
+    if let Err(err) = run_cmd!(modprobe dm-verity) {
+        warn!("could not load the dm-verity module, continuing: {err:#}");
+    }
+    if let Err(err) = run_cmd!(udevadm settle --timeout=5) {
+        warn!("udev did not settle, device nodes may be incomplete: {err:#}");
+    }
     discover_volumes()
 }
 
@@ -338,7 +342,13 @@ fn verify_first_block(path: &Path) -> Result<()> {
 }
 
 fn mount_volume(requested: &RequestedVolume, mapped: &Path) -> Result<()> {
-    let fs_type = run_fun!(blkid -o value -s TYPE $mapped).unwrap_or_default();
+    let fs_type = run_fun!(blkid -o value -s TYPE $mapped).unwrap_or_else(|err| {
+        warn!(
+            "blkid failed on {}, letting the kernel probe: {err:#}",
+            mapped.display()
+        );
+        String::new()
+    });
     let target = &requested.target;
     fs::create_dir_all(target)?;
     if is_mountpoint(target)? {
diff --git a/dstack/dstack-util/src/system_setup.rs b/dstack/dstack-util/src/system_setup.rs
index 66839b4fa..4b0de536b 100644
--- a/dstack/dstack-util/src/system_setup.rs
+++ b/dstack/dstack-util/src/system_setup.rs
@@ -396,8 +396,17 @@ impl GatewayKeyStore {
     }
 
     fn load_from(path: &Path) -> Option<Self> {
-        let content = fs::read_to_string(path).ok()?;
-        serde_json::from_str(&content).ok()
+        let content = match fs::read_to_string(path) {
+            Ok(content) => content,
+            Err(err) if err.kind() == std::io::ErrorKind::NotFound => return None,
+            Err(err) => {
+                warn!("failed to read the gateway cache, re-registering: {err}");
+                return None;
+            }
+        };
+        serde_json::from_str(&content)
+            .inspect_err(|err| warn!("malformed gateway cache, re-registering: {err}"))
+            .ok()
     }
 
     fn load_from_default() -> Option<Self> {
diff --git a/os/common/rootfs/app-compose.sh b/os/common/rootfs/app-compose.sh
index 4bd2dad79..7e61d99c8 100755
--- a/os/common/rootfs/app-compose.sh
+++ b/os/common/rootfs/app-compose.sh
@@ -16,7 +16,11 @@ NERDCTL_NAMESPACE="${NERDCTL_NAMESPACE:-dstack}"
 COMPOSE_RUNTIME_FILE="${COMPOSE_RUNTIME_FILE:-/run/dstack/app-compose-runtime.json}"
 ACTION="${1:-start}"
 
-CFG_PCCS_URL=$([ -f "$SYS_CONFIG_FILE" ] && jq -r '.pccs_url//""' "$SYS_CONFIG_FILE" || echo "")
+CFG_PCCS_URL=""
+if [ -f "$SYS_CONFIG_FILE" ]; then
+    CFG_PCCS_URL=$(jq -r '.pccs_url // ""' "$SYS_CONFIG_FILE") ||
+        echo "warning: failed to read pccs_url from $SYS_CONFIG_FILE, continuing without it" >&2
+fi
 export PCCS_URL=${PCCS_URL:-$CFG_PCCS_URL}
 
 runner=$(jq -r '.runner' "$APP_COMPOSE_FILE")