diff --git a/scenarios/m03_ghost_in_the_machine/scenario.json.erb b/scenarios/m03_ghost_in_the_machine/scenario.json.erb
index 463aa05..8955be4 100644
--- a/scenarios/m03_ghost_in_the_machine/scenario.json.erb
+++ b/scenarios/m03_ghost_in_the_machine/scenario.json.erb
@@ -221,6 +221,24 @@ operational_log_content = "TRANSACTION LOG - Q3 2024\n\n[2024-09-15 14:32:11] Pr
         }
       ],
       "npcs": [
+        {
+          "id": "briefing_cutscene",
+          "displayName": "Agent 0x99",
+          "npcType": "person",
+          "position": {"x": 500, "y": 500},
+          "spriteSheet": "hacker",
+          "spriteConfig": {
+            "idleFrameStart": 20,
+            "idleFrameEnd": 23
+          },
+          "storyPath": "scenarios/m03_ghost_in_the_machine/ink/m03_opening_briefing.json",
+          "currentKnot": "start",
+          "timedConversation": {
+            "delay": 0,
+            "targetKnot": "start",
+            "background": "assets/backgrounds/hq1.png"
+          }
+        },
         {
           "id": "receptionist_npc",
           "displayName": "Receptionist",
@@ -365,9 +383,12 @@ operational_log_content = "TRANSACTION LOG - Q3 2024\n\n[2024-09-15 14:32:11] Pr
         },
         {
           "type": "vm-launcher",
+          "id": "vm_launcher_zero_day",
           "name": "VM Access Terminal",
           "takeable": false,
-          "observations": "Terminal for accessing Zero Day training network VMs"
+          "observations": "Terminal for accessing Zero Day training network VMs",
+          "hacktivityMode": <%= vm_context && vm_context['hacktivity_mode'] ? 'true' : 'false' %>,
+          "vm": <%= vm_object('ghost_in_machine_vm_network', {"id":1,"title":"Zero Day Training Network","ip":"192.168.100.0/24","enable_console":true}) %>
         },
         {
           "type": "workstation",
@@ -377,9 +398,34 @@ operational_log_content = "TRANSACTION LOG - Q3 2024\n\n[2024-09-15 14:32:11] Pr
         },
         {
           "type": "flag-station",
+          "id": "flag_station_dropsite",
           "name": "Drop-Site Terminal",
           "takeable": false,
-          "observations": "Terminal for submitting VM flags"
+          "observations": "Terminal for submitting VM flags from Zero Day training network",
+          "acceptsVms": ["ghost_in_machine_vm_network"],
+          "flags": <%= flags_for_vm('ghost_in_machine_vm_network', ['flag{network_scan_complete}', 'flag{ftp_intel_gathered}', 'flag{pricing_intel_decoded}', 'flag{distcc_legacy_compromised}']) %>,
+          "flagRewards": [
+            {
+              "type": "emit_event",
+              "event_name": "network_scan_flag_submitted",
+              "description": "Network scanning flag submitted"
+            },
+            {
+              "type": "emit_event",
+              "event_name": "ftp_intel_flag_submitted",
+              "description": "FTP intelligence flag submitted"
+            },
+            {
+              "type": "emit_event",
+              "event_name": "pricing_intel_flag_submitted",
+              "description": "Pricing intelligence flag submitted"
+            },
+            {
+              "type": "emit_event",
+              "event_name": "distcc_exploit_flag_submitted",
+              "description": "distcc exploitation flag submitted - triggers M2 revelation"
+            }
+          ]
         }
       ],
       "npcs": []