diff --git a/external/keyring-manager b/external/keyring-manager
index d475bd55..d35aec3a 160000
--- a/external/keyring-manager
+++ b/external/keyring-manager
@@ -1 +1 @@
-Subproject commit d475bd558872b6aa6c1b642899b7957e11734cdc
+Subproject commit d35aec3a4ea64bf21047d238b0c6c5a875903289
diff --git a/veilid-core/src/intf/native/network/mod.rs b/veilid-core/src/intf/native/network/mod.rs
index 97059d32..4ac4845c 100644
--- a/veilid-core/src/intf/native/network/mod.rs
+++ b/veilid-core/src/intf/native/network/mod.rs
@@ -454,6 +454,14 @@ impl Network {
         // that we have ports available to us
         self.free_bound_first_ports();
 
+        // If we have static public dialinfo, upgrade our network class
+        {
+            let mut inner = self.inner.lock();
+            if !inner.static_public_dialinfo.is_empty() {
+                inner.network_class = Some(NetworkClass::InboundCapable);
+            }
+        }
+
         info!("network started");
         self.inner.lock().network_started = true;
         Ok(())
diff --git a/veilid-core/src/intf/native/protected_store.rs b/veilid-core/src/intf/native/protected_store.rs
index 28b5b1d3..ac5cc992 100644
--- a/veilid-core/src/intf/native/protected_store.rs
+++ b/veilid-core/src/intf/native/protected_store.rs
@@ -62,9 +62,14 @@ impl ProtectedStore {
             {
                 let insecure_fallback_directory =
                     Path::new(&c.protected_store.insecure_fallback_directory);
-                let insecure_keyring_file = insecure_fallback_directory
-                    .to_owned()
-                    .join("insecure_keyring");
+                let insecure_keyring_file = insecure_fallback_directory.to_owned().join(format!(
+                    "insecure_keyring{}",
+                    if c.namespace.is_empty() {
+                        "".to_owned()
+                    } else {
+                        format!("_{}", c.namespace)
+                    }
+                ));
                 inner.keyring_manager = Some(
                     KeyringManager::new_insecure(&c.program_name, &insecure_keyring_file)
                         .map_err(map_to_string)
diff --git a/veilid-core/src/routing_table/bucket_entry.rs b/veilid-core/src/routing_table/bucket_entry.rs
index 1ead5705..8bce0ca4 100644
--- a/veilid-core/src/routing_table/bucket_entry.rs
+++ b/veilid-core/src/routing_table/bucket_entry.rs
@@ -215,19 +215,16 @@ impl BucketEntry {
     // Check if this node needs a ping right now to validate it is still reachable
     pub(super) fn needs_ping(
         &self,
-        routing_table: RoutingTable,
         node_id: &DHTKey,
         cur_ts: u64,
+        relay_node_id: Option<DHTKey>,
     ) -> bool {
-        let netman = routing_table.network_manager();
-        let relay_node = netman.relay_node();
-
         // See which ping pattern we are to use
         let state = self.state(cur_ts);
 
         // If this entry is our relay node, then we should ping it regularly to keep our association alive
-        if let Some(relay_node) = relay_node {
-            if relay_node.node_id() == *node_id {
+        if let Some(relay_node_id) = relay_node_id {
+            if relay_node_id == *node_id {
                 return self.needs_constant_ping(cur_ts, KEEPALIVE_PING_INTERVAL_SECS as u64);
             }
         }
diff --git a/veilid-core/src/routing_table/mod.rs b/veilid-core/src/routing_table/mod.rs
index bba8bc70..7219d93e 100644
--- a/veilid-core/src/routing_table/mod.rs
+++ b/veilid-core/src/routing_table/mod.rs
@@ -707,11 +707,15 @@ impl RoutingTable {
     // to determine their reliability
     async fn ping_validator_task_routine(self, _last_ts: u64, cur_ts: u64) -> Result<(), String> {
         log_rtab!("--- ping_validator task");
+
         let rpc = self.rpc_processor();
+        let netman = self.network_manager();
+        let relay_node_id = netman.relay_node().map(|nr| nr.node_id());
+
         let mut inner = self.inner.lock();
         for b in &mut inner.buckets {
             for (k, entry) in b.entries_mut() {
-                if entry.needs_ping(self.clone(), k, cur_ts) {
+                if entry.needs_ping(k, cur_ts, relay_node_id) {
                     let nr = NodeRef::new(self.clone(), *k, entry, None);
                     log_rtab!(
                         "    --- ping validating: {:?} ({})",