diff --git a/README.md b/README.md
index 4464215..0645c19 100644
--- a/README.md
+++ b/README.md
@@ -635,10 +635,14 @@ gates.
 1. Encountering errors while executing EC2 userdata.
 
    This might be caused by using the untested AWS AMI.
-   The EC2 userdata is tested only with the following AMIs:
+   The EC2 userdata targets the following AMIs:
 
-   * Amazon Linux AMI 2018.03.0 (HVM), SSD Volume Type
-   * Amazon Linux 2 AMI (HVM), SSD Volume Type - This AMI is
-     **RECOMMENDED** for `aws-cfn-vpn`
+   * Amazon Linux 2023 AMI (HVM) - This AMI is **RECOMMENDED** for
+     `aws-cfn-vpn`
+
+   Amazon Linux 2 (end of support 2026-06-30) and Amazon Linux 2018.03
+   were supported up to the pre-AL2023 revisions of this template (the
+   userdata now relies on `yum install docker` from the AL2023 core
+   repos and IMDSv2 tokens).
 
    Feel free to open pull requests for the verified compatible AMIs.
diff --git a/stack.json b/stack.json
index 1a665f7..28014f3 100644
--- a/stack.json
+++ b/stack.json
@@ -251,7 +251,9 @@
                 " --region ", {"Ref": "AWS::Region"},
                 "' EXIT\n",
 
-                "yum update -y aws-cfn-bootstrap\n",
+                "# AL2023 may not preinstall the cfn helper scripts; install is a\n",
+                "# no-op/update when they are already present.\n",
+                "yum install -y aws-cfn-bootstrap\n",
                 "# Install the files and packages from the metadata\n",
                 "#/opt/aws/bin/cfn-init ",
                 "#         --stack ", {"Ref": "AWS::StackName"},
@@ -272,12 +274,15 @@
                 "export PATH=/usr/local/bin:$PATH\n",
                 "export HOME=~\n",
 
-                "amazon-linux-extras install -y docker\n",
+                "# AL2023: docker lives in the core repos (amazon-linux-extras is AL2-only)\n",
+                "yum install -y docker\n",
                 "systemctl start docker\n",
                 "systemctl enable docker\n",
 
-                "declare public_ip=$(curl http://169.254.169.254/latest/meta-data/public-ipv4)\n",
-                "declare private_ip=$(curl http://169.254.169.254/latest/meta-data/local-ipv4)\n",
+                "# AL2023 AMIs default to IMDSv2-required: fetch a session token first\n",
+                "declare imds_token=$(curl -sX PUT http://169.254.169.254/latest/api/token -H 'X-aws-ec2-metadata-token-ttl-seconds: 300')\n",
+                "declare public_ip=$(curl -s -H \"X-aws-ec2-metadata-token: $imds_token\" http://169.254.169.254/latest/meta-data/public-ipv4)\n",
+                "declare private_ip=$(curl -s -H \"X-aws-ec2-metadata-token: $imds_token\" http://169.254.169.254/latest/meta-data/local-ipv4)\n",
 
                 "declare ss_port_begin=", {"Ref": "SSPortBegin"}, "\n",
                 "declare ss_port_end=", {"Ref": "SSPortEnd"}, "\n",
@@ -374,19 +379,20 @@
                 ]]}, ""]},
 
                 {"Fn::If": ["EnableL2TP", {"Fn::Join": ["", [
-                  "git clone --depth 1 https://github.com/alexzhangs/aws-ec2-xl2tpd\n",
-                  "git clone --depth 1 https://github.com/alexzhangs/chap-manager\n",
-
-                  "bash aws-ec2-xl2tpd/install.sh",
-                  " -k '", {"Ref": "L2TPSharedKey"}, "'",
-                  " -p '", {"Ref": "L2TPPrimaryDNS"}, "'",
-                  " -s '", {"Ref": "L2TPSecondaryDNS"}, "'\n",
-
-                  "bash chap-manager/install.sh\n",
-
-                  "chap-manager.sh -a add",
-                  " -u '", {"Ref": "L2TPUsername"}, "'",
-                  " -p '", {"Ref": "L2TPPassword"}, "'\n"
+                  "# L2TP/IPsec runs containerized (libreswan + xl2tpd + bundled chap-manager);\n",
+                  "# the legacy host install needed EPEL packages that AL2023 does not ship.\n",
+                  "# --privileged + host network + /lib/modules: pppd needs /dev/ppp via the\n",
+                  "# host's kernel modules, IKE/NAT-T must terminate on the host's UDP 500/4500,\n",
+                  "# and the NAT rules for the client pool live in the host netns.\n",
+                  "docker run -d --name l2tpd --restart=always",
+                  " --privileged --network=host",
+                  " -v /lib/modules:/lib/modules:ro",
+                  " -e IPSEC_PSK='", {"Ref": "L2TPSharedKey"}, "'",
+                  " -e L2TP_USERNAME='", {"Ref": "L2TPUsername"}, "'",
+                  " -e L2TP_PASSWORD='", {"Ref": "L2TPPassword"}, "'",
+                  " -e PRIMARY_DNS='", {"Ref": "L2TPPrimaryDNS"}, "'",
+                  " -e SECONDARY_DNS='", {"Ref": "L2TPSecondaryDNS"}, "'",
+                  " alexzhangs/xl2tpd-libreswan:latest\n"
                 ]]}, ""]}
               ]
             ]
@@ -1239,139 +1245,139 @@
   "Mappings": {
     "RegionMap": {
       "ap-northeast-1": {
-        "nameAmd64": "amzn2-ami-hvm-2.0.20260526.0-x86_64-gp2",
-        "AMIAmd64": "ami-006364fbd0e812d5e",
-        "nameArm64": "amzn2-ami-hvm-2.0.20260526.0-arm64-gp2",
-        "AMIArm64": "ami-09be0d7ea855efaf9",
-        "created": "2026-05-21T18:12:45.000Z",
+        "nameAmd64": "al2023-ami-2023.12.20260608.0-kernel-6.1-x86_64",
+        "AMIAmd64": "ami-0c02cf818fceb9254",
+        "nameArm64": "al2023-ami-2023.12.20260608.0-kernel-6.1-arm64",
+        "AMIArm64": "ami-0c3f2b4be5dc82c2f",
+        "created": "2026-06-04T17:20:42.000Z",
         "location": "Asia Pacific (Tokyo)"
       },
       "ap-northeast-2": {
-        "nameAmd64": "amzn2-ami-hvm-2.0.20260526.0-x86_64-gp2",
-        "AMIAmd64": "ami-0f0ce59d54cc368b3",
-        "nameArm64": "amzn2-ami-hvm-2.0.20260526.0-arm64-gp2",
-        "AMIArm64": "ami-08a19a5bb68af2bf8",
-        "created": "2026-05-21T18:06:05.000Z",
+        "nameAmd64": "al2023-ami-2023.12.20260608.0-kernel-6.1-x86_64",
+        "AMIAmd64": "ami-00e1a894b4512388e",
+        "nameArm64": "al2023-ami-2023.12.20260608.0-kernel-6.1-arm64",
+        "AMIArm64": "ami-03dfdea4cb3d85628",
+        "created": "2026-06-04T17:20:42.000Z",
         "location": "Asia Pacific (Seoul)"
       },
       "ap-northeast-3": {
-        "nameAmd64": "amzn2-ami-hvm-2.0.20260526.0-x86_64-gp2",
-        "AMIAmd64": "ami-040ac1d7bbe22fd8e",
-        "nameArm64": "amzn2-ami-hvm-2.0.20260526.0-arm64-gp2",
-        "AMIArm64": "ami-06b4108cb2375daf3",
-        "created": "2026-05-21T18:06:19.000Z",
+        "nameAmd64": "al2023-ami-2023.12.20260608.0-kernel-6.1-x86_64",
+        "AMIAmd64": "ami-033d0123dabfebc0e",
+        "nameArm64": "al2023-ami-2023.12.20260608.0-kernel-6.1-arm64",
+        "AMIArm64": "ami-04e93af3f1333e805",
+        "created": "2026-06-04T17:20:42.000Z",
         "location": "Asia Pacific (Osaka)"
       },
       "ap-south-1": {
-        "nameAmd64": "amzn2-ami-hvm-2.0.20260526.0-x86_64-gp2",
-        "AMIAmd64": "ami-00c5d5e886a26d124",
-        "nameArm64": "amzn2-ami-hvm-2.0.20260526.0-arm64-gp2",
-        "AMIArm64": "ami-0d9a5630e9538b51f",
-        "created": "2026-05-21T18:06:14.000Z",
+        "nameAmd64": "al2023-ami-2023.12.20260608.0-kernel-6.1-x86_64",
+        "AMIAmd64": "ami-0db56f446d44f2f09",
+        "nameArm64": "al2023-ami-2023.12.20260608.0-kernel-6.1-arm64",
+        "AMIArm64": "ami-07c18f602ca3306b9",
+        "created": "2026-06-04T17:20:43.000Z",
         "location": "Asia Pacific (Mumbai)"
       },
       "ap-southeast-1": {
-        "nameAmd64": "amzn2-ami-hvm-2.0.20260526.0-x86_64-gp2",
-        "AMIAmd64": "ami-0e8bf7e1d1f339c74",
-        "nameArm64": "amzn2-ami-hvm-2.0.20260526.0-arm64-gp2",
-        "AMIArm64": "ami-05cf69f80c308c1f8",
-        "created": "2026-05-21T18:06:18.000Z",
+        "nameAmd64": "al2023-ami-2023.12.20260608.0-kernel-6.1-x86_64",
+        "AMIAmd64": "ami-0f79166d4c42e6c1e",
+        "nameArm64": "al2023-ami-2023.12.20260608.0-kernel-6.1-arm64",
+        "AMIArm64": "ami-073430a5057a25a87",
+        "created": "2026-06-04T17:20:43.000Z",
         "location": "Asia Pacific (Singapore)"
       },
       "ap-southeast-2": {
-        "nameAmd64": "amzn2-ami-hvm-2.0.20260526.0-x86_64-gp2",
-        "AMIAmd64": "ami-0c4ca191c5ba10793",
-        "nameArm64": "amzn2-ami-hvm-2.0.20260526.0-arm64-gp2",
-        "AMIArm64": "ami-0dce9d90dde833bac",
-        "created": "2026-05-21T18:06:17.000Z",
+        "nameAmd64": "al2023-ami-2023.12.20260608.0-kernel-6.1-x86_64",
+        "AMIAmd64": "ami-0e9310a659f5f62bf",
+        "nameArm64": "al2023-ami-2023.12.20260608.0-kernel-6.1-arm64",
+        "AMIArm64": "ami-07f95dfb1e3d841ce",
+        "created": "2026-06-04T17:20:38.000Z",
         "location": "Asia Pacific (Sydney)"
       },
       "ca-central-1": {
-        "nameAmd64": "amzn2-ami-hvm-2.0.20260526.0-x86_64-gp2",
-        "AMIAmd64": "ami-0000d5ca154ee91d4",
-        "nameArm64": "amzn2-ami-hvm-2.0.20260526.0-arm64-gp2",
-        "AMIArm64": "ami-053517da2230b7930",
-        "created": "2026-05-21T18:12:43.000Z",
+        "nameAmd64": "al2023-ami-2023.12.20260608.0-kernel-6.1-x86_64",
+        "AMIAmd64": "ami-0e80e7e160cbfbc53",
+        "nameArm64": "al2023-ami-2023.12.20260608.0-kernel-6.1-arm64",
+        "AMIArm64": "ami-089f8e99ee9a7cc1f",
+        "created": "2026-06-04T17:20:40.000Z",
         "location": "Canada (Central)"
       },
       "eu-central-1": {
-        "nameAmd64": "amzn2-ami-hvm-2.0.20260526.0-x86_64-gp2",
-        "AMIAmd64": "ami-0af964531014e9a60",
-        "nameArm64": "amzn2-ami-hvm-2.0.20260526.0-arm64-gp2",
-        "AMIArm64": "ami-01ae2826e5a255590",
-        "created": "2026-05-21T18:12:55.000Z",
+        "nameAmd64": "al2023-ami-2023.12.20260608.0-kernel-6.1-x86_64",
+        "AMIAmd64": "ami-0c8ab82f51d47e1be",
+        "nameArm64": "al2023-ami-2023.12.20260608.0-kernel-6.1-arm64",
+        "AMIArm64": "ami-0441bebc50ee115c5",
+        "created": "2026-06-04T17:20:37.000Z",
         "location": "Europe (Frankfurt)"
       },
       "eu-north-1": {
-        "nameAmd64": "amzn2-ami-hvm-2.0.20260526.0-x86_64-gp2",
-        "AMIAmd64": "ami-0d25d4b80a73a8948",
-        "nameArm64": "amzn2-ami-hvm-2.0.20260526.0-arm64-gp2",
-        "AMIArm64": "ami-0b32a3aa8fac8994f",
-        "created": "2026-05-21T18:06:19.000Z",
+        "nameAmd64": "al2023-ami-2023.12.20260608.0-kernel-6.1-x86_64",
+        "AMIAmd64": "ami-05ec2ffaee0a0e6d4",
+        "nameArm64": "al2023-ami-2023.12.20260608.0-kernel-6.1-arm64",
+        "AMIArm64": "ami-02dfded7ef8caafd0",
+        "created": "2026-06-04T17:20:43.000Z",
         "location": "Europe (Stockholm)"
       },
       "eu-west-1": {
-        "nameAmd64": "amzn2-ami-hvm-2.0.20260526.0-x86_64-gp2",
-        "AMIAmd64": "ami-0e59c64f4e013cb5f",
-        "nameArm64": "amzn2-ami-hvm-2.0.20260526.0-arm64-gp2",
-        "AMIArm64": "ami-04c19fc5e06cfc88e",
-        "created": "2026-05-21T18:12:47.000Z",
+        "nameAmd64": "al2023-ami-2023.12.20260608.0-kernel-6.1-x86_64",
+        "AMIAmd64": "ami-06c66eb06932cda07",
+        "nameArm64": "al2023-ami-2023.12.20260608.0-kernel-6.1-arm64",
+        "AMIArm64": "ami-0ca80f80bf97f59cb",
+        "created": "2026-06-04T17:20:42.000Z",
         "location": "Europe (Ireland)"
       },
       "eu-west-2": {
-        "nameAmd64": "amzn2-ami-hvm-2.0.20260526.0-x86_64-gp2",
-        "AMIAmd64": "ami-0ec7d503f466ab809",
-        "nameArm64": "amzn2-ami-hvm-2.0.20260526.0-arm64-gp2",
-        "AMIArm64": "ami-019fccdbc86099c98",
-        "created": "2026-05-21T18:12:49.000Z",
+        "nameAmd64": "al2023-ami-2023.12.20260608.0-kernel-6.1-x86_64",
+        "AMIAmd64": "ami-0725c3768a7eb0fd5",
+        "nameArm64": "al2023-ami-2023.12.20260608.0-kernel-6.1-arm64",
+        "AMIArm64": "ami-07771450d3d98ed88",
+        "created": "2026-06-04T17:20:37.000Z",
         "location": "Europe (London)"
       },
       "eu-west-3": {
-        "nameAmd64": "amzn2-ami-hvm-2.0.20260526.0-x86_64-gp2",
-        "AMIAmd64": "ami-06cf836a152a19276",
-        "nameArm64": "amzn2-ami-hvm-2.0.20260526.0-arm64-gp2",
-        "AMIArm64": "ami-05ba889900ecb6b48",
-        "created": "2026-05-21T18:06:18.000Z",
+        "nameAmd64": "al2023-ami-2023.12.20260608.0-kernel-6.1-x86_64",
+        "AMIAmd64": "ami-024dc9662d095682b",
+        "nameArm64": "al2023-ami-2023.12.20260608.0-kernel-6.1-arm64",
+        "AMIArm64": "ami-0c296368c2460e564",
+        "created": "2026-06-04T17:20:42.000Z",
         "location": "Europe (Paris)"
       },
       "sa-east-1": {
-        "nameAmd64": "amzn2-ami-hvm-2.0.20260526.0-x86_64-gp2",
-        "AMIAmd64": "ami-0e8494bdfecb07069",
-        "nameArm64": "amzn2-ami-hvm-2.0.20260526.0-arm64-gp2",
-        "AMIArm64": "ami-011ace3574ac85ef7",
-        "created": "2026-05-21T18:06:16.000Z",
+        "nameAmd64": "al2023-ami-2023.12.20260608.0-kernel-6.1-x86_64",
+        "AMIAmd64": "ami-0b8be106964beb076",
+        "nameArm64": "al2023-ami-2023.12.20260608.0-kernel-6.1-arm64",
+        "AMIArm64": "ami-044b2685557233d78",
+        "created": "2026-06-04T17:20:44.000Z",
         "location": "South America (Sao Paulo)"
       },
       "us-east-1": {
-        "nameAmd64": "amzn2-ami-hvm-2.0.20260526.0-x86_64-gp2",
-        "AMIAmd64": "ami-046b36f55e189564a",
-        "nameArm64": "amzn2-ami-hvm-2.0.20260526.0-arm64-gp2",
-        "AMIArm64": "ami-0537561b54bdeb5bc",
-        "created": "2026-05-21T18:12:49.000Z",
+        "nameAmd64": "al2023-ami-2023.12.20260608.0-kernel-6.1-x86_64",
+        "AMIAmd64": "ami-0152204c1a187337c",
+        "nameArm64": "al2023-ami-2023.12.20260608.0-kernel-6.1-arm64",
+        "AMIArm64": "ami-02c114835b4e7739f",
+        "created": "2026-06-04T17:20:42.000Z",
         "location": "US East (N. Virginia)"
       },
       "us-east-2": {
-        "nameAmd64": "amzn2-ami-hvm-2.0.20260526.0-x86_64-gp2",
-        "AMIAmd64": "ami-0ae3c5abab3d5cb90",
-        "nameArm64": "amzn2-ami-hvm-2.0.20260526.0-arm64-gp2",
-        "AMIArm64": "ami-0a71fc9a8ab5be978",
-        "created": "2026-05-21T18:12:43.000Z",
+        "nameAmd64": "al2023-ami-2023.12.20260608.0-kernel-6.1-x86_64",
+        "AMIAmd64": "ami-0c6ac5f2fed2981b0",
+        "nameArm64": "al2023-ami-2023.12.20260608.0-kernel-6.1-arm64",
+        "AMIArm64": "ami-096f34d377a72cea5",
+        "created": "2026-06-04T17:20:40.000Z",
         "location": "US East (Ohio)"
       },
       "us-west-1": {
-        "nameAmd64": "amzn2-ami-hvm-2.0.20260526.0-x86_64-gp2",
-        "AMIAmd64": "ami-0679b96f0452f05e1",
-        "nameArm64": "amzn2-ami-hvm-2.0.20260526.0-arm64-gp2",
-        "AMIArm64": "ami-03be23223285bb7aa",
-        "created": "2026-05-21T18:06:12.000Z",
+        "nameAmd64": "al2023-ami-2023.12.20260608.0-kernel-6.1-x86_64",
+        "AMIAmd64": "ami-0e564a15089b1ff77",
+        "nameArm64": "al2023-ami-2023.12.20260608.0-kernel-6.1-arm64",
+        "AMIArm64": "ami-0df7dcf0a242fece4",
+        "created": "2026-06-04T17:20:37.000Z",
         "location": "US West (N. California)"
       },
       "us-west-2": {
-        "nameAmd64": "amzn2-ami-hvm-2.0.20260526.0-x86_64-gp2",
-        "AMIAmd64": "ami-08812a845130824aa",
-        "nameArm64": "amzn2-ami-hvm-2.0.20260526.0-arm64-gp2",
-        "AMIArm64": "ami-0730d412cb3cb28cb",
-        "created": "2026-05-21T18:00:03.000Z",
+        "nameAmd64": "al2023-ami-2023.12.20260608.0-kernel-6.1-x86_64",
+        "AMIAmd64": "ami-09e69ca1171857250",
+        "nameArm64": "al2023-ami-2023.12.20260608.0-kernel-6.1-arm64",
+        "AMIArm64": "ami-0d66fdbe267edd3b1",
+        "created": "2026-06-04T17:09:33.000Z",
         "location": "US West (Oregon)"
       }
     }