diff --git a/apparmor.d/profiles-m-r/motd b/apparmor.d/profiles-m-r/motd
index fe684f671..67f216212 100644
--- a/apparmor.d/profiles-m-r/motd
+++ b/apparmor.d/profiles-m-r/motd
@@ -9,16 +9,11 @@ include <tunables/global>
 @{exec_path} = /etc/update-motd.d/*
 profile motd @{exec_path} {
   include <abstractions/base>
-  include <abstractions/nameservice-strict>
-  include <abstractions/ssl_certs>
 
-  network inet dgram,
-  network inet stream,
-  network inet6 dgram,
-  network inet6 stream,
-  network netlink raw,
+  capability net_admin,
 
   @{exec_path} mr,
+  @{bin}/ r,
 
   @{sh_path}         rix,
   @{coreutils_path}  rix,
@@ -28,7 +23,7 @@ profile motd @{exec_path} {
   @{bin}/snap        rPx,
   @{bin}/dpkg        rPx -> child-dpkg,
   @{bin}/systemd-detect-virt rPx,
-  @{bin}/wget        rix,
+  @{bin}/wget        rCx -> wget,
 
   @{lib}/ubuntu-release-upgrader/release-upgrade-motd            rPx,
   @{lib}/update-notifier/update-motd-fsck-at-reboot              rPx,
@@ -37,26 +32,49 @@ profile motd @{exec_path} {
   /usr/share/update-notifier/notify-updates-outdated             rPx,
 
   / r,
+  /etc/cloud/cloud.cfg r,
+  /etc/cloud/cloud.cfg.d/{,*} r,
   /etc/default/motd-news r,
   /etc/lsb-release r,
   /etc/update-motd.d/* r,
-  /etc/cloud/cloud.cfg r,
-  /etc/cloud/cloud.cfg.d/{,*} r,
+  /etc/wgetrc r,
 
   /var/cache/motd-news rw,
   /var/lib/update-notifier/updates-available r,
   /var/lib/ubuntu-advantage/messages/motd-esm-announce r,
+  /var/lib/cloud/instances/nocloud/cloud-config.txt r,
 
-  /tmp/tmp.@{rand10} rw,
+  # /tmp/tmp.@{rand10} rw,
 
+  @{run}/cloud-init/cloud.cfg r,
   @{run}/motd.d/{,*} r,
   @{run}/motd.dynamic.new rw,
   @{run}/reboot-required r,
 
   @{PROC}/@{pids}/mounts r,
+  @{PROC}/1/environ r,
+  @{PROC}/cmdline r,
 
   /dev/tty@{int} rw,
 
+  profile wget {
+    include <abstractions/base>
+    include <abstractions/nameservice-strict>
+    include <abstractions/ssl_certs>
+
+    network inet dgram,
+    network inet stream,
+    network inet6 dgram,
+    network inet6 stream,
+    network netlink raw,
+
+    @{bin}/wget mr,
+
+    /tmp/tmp.@{rand10} rw,
+
+    include if exists <local/motd_wget>
+  }
+
   profile systemctl {
     include <abstractions/base>
     include <abstractions/app/systemctl>