diff --git a/cmd/agent/installer.go b/cmd/agent/installer.go
index c94f82f..21ec82a 100644
--- a/cmd/agent/installer.go
+++ b/cmd/agent/installer.go
@@ -69,9 +69,9 @@ func install(dir ...string) error {
 	// Reads config, and if present and offline is defined,
 	// runs the installation
 	cc, err := config.Scan(config.Directories(dir...), config.MergeBootLine)
-	if err == nil && cc.C3OS != nil && cc.C3OS.Offline {
+	if err == nil && cc.Install != nil && cc.Install.Auto {
 		r["cc"] = cc.String()
-		r["device"] = cc.C3OS.Device
+		r["device"] = cc.Install.Device
 		mergeOption(cc.String())
 
 		runInstall(r)
@@ -107,13 +107,28 @@ func install(dir ...string) error {
 		return errors.New("no configuration, stopping installation")
 	}
 
+	// we receive a cloud config at this point
 	cloudConfig, exists := r["cc"]
+
+	// merge any options defined in it
 	mergeOption(cloudConfig)
 
+	// now merge cloud config from system and the one received from the agent-provider
 	ccData := map[string]interface{}{}
+
+	// make sure the config we write has at least the #node-config header, if any other was defined beforeahead
+	header := "#node-config"
+	if hasHeader, head := config.HasHeader(cc.String(), ""); hasHeader {
+		header = head
+	}
+
+	// What we receive take precedence over the one in the system
 	yaml.Unmarshal([]byte(cc.String()), &ccData)
 	if exists {
 		yaml.Unmarshal([]byte(cloudConfig), &ccData)
+		if hasHeader, head := config.HasHeader(cloudConfig, ""); hasHeader {
+			header = head
+		}
 	}
 
 	out, err := yaml.Marshal(ccData)
@@ -121,7 +136,7 @@ func install(dir ...string) error {
 		return fmt.Errorf("failed marshalling cc: %w", err)
 	}
 
-	r["cc"] = string(out)
+	r["cc"] = config.AddHeader(header, string(out))
 
 	pterm.Info.Println("Starting installation")
 	utils.SH("elemental run-stage c3os-install.pre")
@@ -181,11 +196,11 @@ func runInstall(options map[string]string) error {
 	utils.SH("elemental run-stage c3os-install.after")
 	bus.RunHookScript("/usr/bin/c3os-agent.install.after.hook")
 
-	if reboot || c.C3OS != nil && c.C3OS.Reboot {
+	if reboot || c.Install != nil && c.Install.Reboot {
 		utils.Reboot()
 	}
 
-	if poweroff || c.C3OS != nil && c.C3OS.Poweroff {
+	if poweroff || c.Install != nil && c.Install.Poweroff {
 		utils.PowerOFF()
 	}
 	return nil
diff --git a/cmd/agent/main.go b/cmd/agent/main.go
index 87499fd..a495411 100644
--- a/cmd/agent/main.go
+++ b/cmd/agent/main.go
@@ -12,6 +12,7 @@ import (
 	"github.com/c3os-io/c3os/internal/bus"
 	cmd "github.com/c3os-io/c3os/internal/cmd"
 	machine "github.com/c3os-io/c3os/internal/machine"
+	providerConfig "github.com/c3os-io/c3os/internal/provider/config"
 
 	"github.com/c3os-io/c3os/internal/github"
 	config "github.com/c3os-io/c3os/pkg/config"
@@ -198,7 +199,14 @@ $ c3os rotate --network-token XXX
 			if err != nil {
 				return err
 			}
-			fmt.Print(cc.C3OS.NetworkToken)
+
+			providerCfg := &providerConfig.Config{}
+			err = cc.Unmarshal(providerCfg)
+			if err != nil {
+				return err
+			}
+
+			fmt.Print(providerCfg.C3OS.NetworkToken)
 			return nil
 		},
 	},
diff --git a/cmd/agent/manual_installer.go b/cmd/agent/manual_installer.go
index 656a1f8..ab3001f 100644
--- a/cmd/agent/manual_installer.go
+++ b/cmd/agent/manual_installer.go
@@ -5,6 +5,7 @@ import (
 	"strings"
 
 	"github.com/c3os-io/c3os/internal/cmd"
+	providerConfig "github.com/c3os-io/c3os/internal/provider/config"
 	"github.com/c3os-io/c3os/internal/utils"
 	config "github.com/c3os-io/c3os/pkg/config"
 	"github.com/erikgeiser/promptkit/textinput"
@@ -12,7 +13,6 @@ import (
 	"github.com/mudler/edgevpn/pkg/node"
 	"github.com/mudler/yip/pkg/schema"
 	"github.com/pterm/pterm"
-	"gopkg.in/yaml.v2"
 )
 
 const (
@@ -140,12 +140,16 @@ func interactiveInstall(spawnShell bool) error {
 	}
 
 	c := &config.Config{
-		C3OS: &config.C3OS{
-			NetworkToken: networkToken,
-			Device:       device,
+		Install: &config.Install{
+			Device: device,
 		},
+	}
 
-		K3s: config.K3s{
+	providerCfg := providerConfig.Config{
+		C3OS: &providerConfig.C3OS{
+			NetworkToken: networkToken,
+		},
+		K3s: providerConfig.K3s{
 			Enabled: isYes(k3sStandalone),
 		},
 	}
@@ -178,28 +182,7 @@ func interactiveInstall(spawnShell bool) error {
 			},
 		}}}
 
-	dat, err := yaml.Marshal(cloudConfig)
-	if err != nil {
-		return err
-	}
-	dat2, err := yaml.Marshal(c)
-	if err != nil {
-		return err
-	}
-
-	content1 := make(map[string]interface{})
-
-	err = yaml.Unmarshal(dat, &content1)
-	if err != nil {
-		return err
-	}
-
-	err = yaml.Unmarshal(dat2, &content1)
-	if err != nil {
-		return err
-	}
-
-	dat, err = yaml.Marshal(content1)
+	dat, err := config.MergeYAML(cloudConfig, c, providerCfg)
 	if err != nil {
 		return err
 	}
@@ -208,7 +191,7 @@ func interactiveInstall(spawnShell bool) error {
 
 	err = runInstall(map[string]string{
 		"device": device,
-		"cc":     string(dat),
+		"cc":     config.AddHeader("#node-config", string(dat)),
 	})
 	if err != nil {
 		pterm.Error.Println(err.Error())
diff --git a/cmd/agent/rotate.go b/cmd/agent/rotate.go
index 1d1112d..e3425d3 100644
--- a/cmd/agent/rotate.go
+++ b/cmd/agent/rotate.go
@@ -2,7 +2,8 @@ package main
 
 import (
 	machine "github.com/c3os-io/c3os/internal/machine"
-	"github.com/c3os-io/c3os/internal/vpn"
+	"github.com/c3os-io/c3os/internal/provider"
+	providerConfig "github.com/c3os-io/c3os/internal/provider/config"
 	config "github.com/c3os-io/c3os/pkg/config"
 )
 
@@ -16,7 +17,13 @@ func rotate(configDir []string, newToken, apiAddress, rootDir string, restart bo
 		return err
 	}
 
-	err = vpn.Setup(machine.EdgeVPNDefaultInstance, apiAddress, rootDir, false, c)
+	providerCfg := &providerConfig.Config{}
+	err = c.Unmarshal(providerCfg)
+	if err != nil {
+		return err
+	}
+
+	err = provider.SetupVPN(machine.EdgeVPNDefaultInstance, apiAddress, rootDir, false, providerCfg)
 	if err != nil {
 		return err
 	}