diff --git a/Makefile b/Makefile
index e6bbd42b06e..4999ee56399 100644
--- a/Makefile
+++ b/Makefile
@@ -212,7 +212,7 @@ whitespace:
 	@infra/scripts/whitespace-check.sh
 
 # exit 1 if golint complains about anything other than comments
-golintf = $(GOLINT) $(1) | sh -c "! grep -v 'lib/apiservers/portlayer/restapi/operations'" | sh -c "! grep -v 'lib/config/dynamic/admiral/client'" | sh -c "! grep -v 'should have comment'" | sh -c "! grep -v 'comment on exported'" | sh -c "! grep -v 'by other packages, and that stutters'" | sh -c "! grep -v 'error strings should not be capitalized'"
+golintf = $(GOLINT) $(1) | sh -c "! grep -v 'lib/apiservers/portlayer/restapi/operations'" | sh -c "! grep -v 'lib/apiservers/service/restapi/operations/not_yet_implemented'" | sh -c "! grep -v 'lib/config/dynamic/admiral/client'" | sh -c "! grep -v 'should have comment'" | sh -c "! grep -v 'comment on exported'" | sh -c "! grep -v 'by other packages, and that stutters'" | sh -c "! grep -v 'error strings should not be capitalized'"
 
 golint: $(GOLINT)
 	@echo checking go lint...
diff --git a/cmd/vic-machine/common/target.go b/cmd/vic-machine/common/target.go
index e96e5e5fe55..c4cbf5c7173 100644
--- a/cmd/vic-machine/common/target.go
+++ b/cmd/vic-machine/common/target.go
@@ -33,6 +33,8 @@ type Target struct {
 	Password    *string
 	CloneTicket string
 	Thumbprint  string `cmd:"thumbprint"`
+
+	MaxConcurrentConnections *int `cmd:"max-concurrent-connections"`
 }
 
 func NewTarget() *Target {
@@ -67,11 +69,20 @@ func (t *Target) TargetFlags() []cli.Flag {
 			Usage:       "ESX or vCenter host certificate thumbprint",
 			EnvVar:      "VIC_MACHINE_THUMBPRINT",
 		},
+		cli.GenericFlag{
+			Name:   "max-concurrent-connections, mcc",
+			Value:  flags.NewOptionalInt(&t.MaxConcurrentConnections),
+			Usage:  "Determines maximum number of connections (not sessions) to vCenter. Integer value, greater than 0",
+			EnvVar: "VIC_MACHINE_MAX_CONCURRENT_CONNECTIONS",
+			Hidden: true,
+		},
 	}
 }
 
 // HasCredentials check that the credentials have been supplied by any of the permitted mechanisms
 func (t *Target) HasCredentials(op trace.Operation) error {
+	defer trace.End(trace.Begin("", op))
+
 	if t.URL == nil {
 		return cli.NewExitError("--target argument must be specified", 1)
 	}
diff --git a/cmd/vic-machine/common/target_test.go b/cmd/vic-machine/common/target_test.go
index 58f83b6338d..e4fe99b462b 100644
--- a/cmd/vic-machine/common/target_test.go
+++ b/cmd/vic-machine/common/target_test.go
@@ -29,7 +29,7 @@ func TestFlags(t *testing.T) {
 	target := NewTarget()
 	flags := target.TargetFlags()
 
-	if len(flags) != 4 {
+	if len(flags) != 5 {
 		t.Errorf("Wrong flag numbers")
 	}
 }
@@ -50,6 +50,10 @@ func TestProcess(t *testing.T) {
 		User     string
 		Password *string
 
+		// MaxConcurrentConnections is not tested here as there's no explicit validation at this stage
+		// Validation of input type is via flags package, and validation of values is via validator
+		/// mcc *int
+
 		err    error
 		result *url.URL
 	}{
diff --git a/cmd/vic-machine/configure/configure.go b/cmd/vic-machine/configure/configure.go
index 23f55ada2cb..18b73bc07a9 100644
--- a/cmd/vic-machine/configure/configure.go
+++ b/cmd/vic-machine/configure/configure.go
@@ -19,6 +19,7 @@ import (
 	"fmt"
 	"net"
 	"os"
+	"strconv"
 	"strings"
 	"time"
 
@@ -214,6 +215,11 @@ func (c *Configure) copyChangedConf(o *config.VirtualContainerHostConfigSpec, n
 		updateSessionEnv(portlayerSession, config.PortLayerDCPath, v.Session().Datacenter.Name())
 	}
 
+	// if mcc is explicitly set, apply it
+	if c.Data.MaxConcurrentConnections != nil {
+		updateSessionEnv(portlayerSession, config.PortLayerMaxConcurrentConnections, strconv.Itoa(*c.Data.MaxConcurrentConnections))
+	}
+
 	if c.Debug.Debug != nil {
 		o.SetDebug(n.Diagnostics.DebugLevel)
 	}
diff --git a/cmd/vic-machine/create/create.go b/cmd/vic-machine/create/create.go
index 03915f49689..df9e986fa70 100644
--- a/cmd/vic-machine/create/create.go
+++ b/cmd/vic-machine/create/create.go
@@ -719,6 +719,8 @@ func (c *Create) Run(clic *cli.Context) (err error) {
 
 	vConfig.Timeout = c.Data.Timeout
 
+	vConfig.MaxConcurrentConnections = c.MaxConcurrentConnections
+
 	// separate initial validation from dispatch of creation task
 	op.Info("")
 
diff --git a/cmd/vic-machine/create/create_test.go b/cmd/vic-machine/create/create_test.go
index e257db88ad5..91c93b454a9 100644
--- a/cmd/vic-machine/create/create_test.go
+++ b/cmd/vic-machine/create/create_test.go
@@ -72,7 +72,7 @@ func TestParseGatewaySpec(t *testing.T) {
 func TestFlags(t *testing.T) {
 	c := NewCreate()
 	flags := c.Flags()
-	numberOfFlags := 65
+	numberOfFlags := 66
 	assert.Equal(t, numberOfFlags, len(flags), "Missing flags during Create.")
 }
 
diff --git a/infra/scripts/bash-helpers.sh b/infra/scripts/bash-helpers.sh
index c3f86fdf6df..25c629b203d 100644
--- a/infra/scripts/bash-helpers.sh
+++ b/infra/scripts/bash-helpers.sh
@@ -30,7 +30,7 @@ fi
 # 1: release numnber, e.g. 1.4.1 or 1.4.1-rc2, or build id, e.g. 19653
 vic-set-version () {
     version="$1"
-    
+
     if [ "$1" == "" ]; then
         unset VIC_VERSION
         return
@@ -63,7 +63,7 @@ init-profile () {
 
 unset-vic () {
     unset TARGET_URL MAPPED_NETWORKS NETWORKS IMAGE_STORE DATASTORE COMPUTE VOLUME_STORES IPADDR TLS THUMBPRINT OPS_CREDS VIC_NAME PRESERVE_VOLUMES
-    unset GOVC_URL GOVC_INSECURE GOVC_DATACENTER GOVC_USERNAME GOVC_PASSWORD GOVC_DATASTORE GOVC_CERTIFICATE 
+    unset GOVC_URL GOVC_INSECURE GOVC_DATACENTER GOVC_USERNAME GOVC_PASSWORD GOVC_DATASTORE GOVC_CERTIFICATE
 
     unset vsphere datacenter user password opsuser opspass opsgrant timeout compute datastore dns publicNet publicIP publicGW bridgeNet bridgeRange
     unset clientNet clientIP clientGW managementNet managementIP managementGW tls volumestores preserveVolumestores containernet
@@ -79,7 +79,7 @@ vic-create () {
     base=$(pwd)
     (
         cd "$(vic-path)"/bin || return
-        "$(vic-path)/bin/${VIC_VERSION}/vic-machine-$OS" create --target="$TARGET_URL" "${OPS_CREDS[@]}" --image-store="$IMAGE_STORE" --compute-resource="$COMPUTE" "${TLS[@]}" ${TLS_OPTS} --name="${VIC_NAME:-${USER}test}" "${MAPPED_NETWORKS[@]}" "${VOLUME_STORES[@]}" "${NETWORKS[@]}" ${IPADDR} ${TIMEOUT} --thumbprint="$THUMBPRINT" --ai="${VIC_VERSION}/appliance.iso" --bi="${VIC_VERSION}/bootstrap.iso" "$@"
+        "$(vic-path)/bin/${VIC_VERSION}/vic-machine-$OS" create --target="$TARGET_URL" "${OPS_CREDS[@]}" --image-store="$IMAGE_STORE" --compute-resource="$COMPUTE" "${TLS[@]}" ${TLS_OPTS} --name="${VIC_NAME:-${USER}test}" "${MAPPED_NETWORKS[@]}" "${VOLUME_STORES[@]}" "${NETWORKS[@]}" ${IPADDR} --timeout=${TIMEOUT} --thumbprint="$THUMBPRINT" --ai="${VIC_VERSION}/appliance.iso" --bi="${VIC_VERSION}/bootstrap.iso" "$@"
     )
 
     vic-select
diff --git a/infra/scripts/focused-test.sh b/infra/scripts/focused-test.sh
index 8b06879e783..de80e23fcb3 100755
--- a/infra/scripts/focused-test.sh
+++ b/infra/scripts/focused-test.sh
@@ -20,7 +20,7 @@
 #
 
 if [ -z "$1" ]; then
-    export REMOTE=$(git remote -v | grep "github.com.vmware/vic.git (fetch)" | awk '{print$1;exit}')/master
+    export REMOTE=$(git remote -v | grep "github.com.vmware/vic\(\.git\)* (fetch)" | awk '{print$1;exit}')/master
     echo "Using ${REMOTE} as default remote"
 else
     echo "Using ${REMOTE} as specified remote"
diff --git a/lib/config/executor/container_vm.go b/lib/config/executor/container_vm.go
index b616e08e66c..b9ed6ec6c52 100644
--- a/lib/config/executor/container_vm.go
+++ b/lib/config/executor/container_vm.go
@@ -119,7 +119,8 @@ type ExitLog struct {
 // MountSpec details a mount that must be executed within the executor
 // A mount is a URI -> path mapping with a credential of some kind
 // In the case of a labeled disk:
-// 	label://<label name> => </mnt/path>
+//
+//	label://<label name> => </mnt/path>
 type MountSpec struct {
 	// A URI->path mapping, e.g.
 	// May contain credentials
@@ -283,6 +284,40 @@ type SessionConfig struct {
 	Detail `vic:"0.1" scope:"read-write" key:"detail"`
 }
 
+// GetEnv returns
+// * the value of the specified environment variable if present
+// * nil if not present
+func (sc *SessionConfig) GetEnv(name string) *string {
+	if sc == nil {
+		return nil
+	}
+
+	for _, env := range sc.Cmd.Env {
+		if strings.HasPrefix(env, name+"=") {
+			val := strings.TrimPrefix(env, name+"=")
+			return &val
+		}
+	}
+
+	return nil
+}
+
+// SetEnv sets the value of the specified environment variable, returning:
+// * the old value if present
+// * nil if not present
+func (sc *SessionConfig) SetEnv(name, value string) *string {
+	for i, env := range sc.Cmd.Env {
+		if strings.HasPrefix(env, name+"=") {
+			sc.Cmd.Env[i] = name + "=" + value
+			val := strings.TrimPrefix(env, name+"=")
+			return &val
+		}
+	}
+
+	sc.Cmd.Env = append(sc.Cmd.Env, name+"="+value)
+	return nil
+}
+
 type Detail struct {
 
 	// creation, started & stopped timestamps
diff --git a/lib/config/executor/container_vm_test.go b/lib/config/executor/container_vm_test.go
new file mode 100644
index 00000000000..1927eec68e2
--- /dev/null
+++ b/lib/config/executor/container_vm_test.go
@@ -0,0 +1,113 @@
+// Copyright 2016-2018 VMware, Inc. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package executor
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetEnv(t *testing.T) {
+	sess := SessionConfig{
+		Cmd: Cmd{
+			Env: []string{
+				"hello=world",
+				"goodbye=",
+			},
+		},
+	}
+
+	assert.Equal(t, "world", *sess.GetEnv("hello"), "Get on set variable should return set value")
+	assert.Equal(t, "", *sess.GetEnv("goodbye"), "Get on set variable with empty value should return empty string")
+	assert.Nil(t, sess.GetEnv("nope"), "Get on an unset variable should return nil")
+}
+
+func TestSetEnvUpdateValue(t *testing.T) {
+	sess := SessionConfig{
+		Cmd: Cmd{
+			Env: []string{
+				"hello=world",
+				"goodbye=",
+			},
+		},
+	}
+
+	require.Equal(t, "world", *sess.GetEnv("hello"), "Get on set variable should return set value")
+	require.Equal(t, "", *sess.GetEnv("goodbye"), "Get on set variable with empty value should return empty string")
+
+	newVal := "sapients"
+	old := *sess.SetEnv("hello", newVal)
+
+	assert.Equal(t, "world", old, "Expected old value to be return on update")
+	assert.Equal(t, newVal, *sess.GetEnv("hello"), "Expected new value to be updated value")
+
+	assert.Equal(t, "", *sess.GetEnv("goodbye"), "Expected unmodified value not to have changed")
+}
+
+func TestSetEnvEmptyValue(t *testing.T) {
+	sess := SessionConfig{
+		Cmd: Cmd{
+			Env: []string{
+				"hello=world",
+				"goodbye=",
+			},
+		},
+	}
+
+	require.Equal(t, "world", *sess.GetEnv("hello"), "Get on set variable should return set value")
+	require.Equal(t, "", *sess.GetEnv("goodbye"), "Get on set variable with empty value should return empty string")
+
+	newVal := "sapients"
+	old := *sess.SetEnv("goodbye", newVal)
+
+	assert.Equal(t, "", old, "Expected old value to be return on update")
+	assert.Equal(t, newVal, *sess.GetEnv("goodbye"), "Expected new value to be updated value")
+
+	assert.Equal(t, "world", *sess.GetEnv("hello"), "Expected unmodified value not to have changed")
+}
+
+func TestSetEnvNewEnv(t *testing.T) {
+	sess := SessionConfig{
+		Cmd: Cmd{
+			Env: []string{
+				"hello=world",
+				"goodbye=",
+			},
+		},
+	}
+
+	require.Equal(t, "world", *sess.GetEnv("hello"), "Get on set variable should return set value")
+	require.Equal(t, "", *sess.GetEnv("goodbye"), "Get on set variable with empty value should return empty string")
+
+	newKey := "solo"
+	require.Nil(t, sess.GetEnv(newKey), "Expected nil return for unset value")
+
+	// checking we can set a new env with value of empty string
+	newVal := ""
+	_ = sess.SetEnv(newKey, newVal)
+	assert.Equal(t, newVal, *sess.GetEnv(newKey), "Expected new value to be updated value")
+
+	// checking we can set a new env with value specified
+	newKey = "absence"
+	newVal = "fonder"
+
+	_ = sess.SetEnv(newKey, newVal)
+	assert.Equal(t, newVal, *sess.GetEnv(newKey), "Expected new value to be updated value")
+
+	assert.Equal(t, "world", *sess.GetEnv("hello"), "Expected unmodified value not to have changed")
+	assert.Equal(t, "", *sess.GetEnv("goodbye"), "Expected unmodified value not to have changed")
+}
diff --git a/lib/config/virtual_container_host.go b/lib/config/virtual_container_host.go
index 3933ba5446d..5eec3484418 100644
--- a/lib/config/virtual_container_host.go
+++ b/lib/config/virtual_container_host.go
@@ -54,18 +54,19 @@ const (
 	PortLayerService = "port-layer"
 	VicAdminService  = "vicadmin"
 
-	GeneralHTTPProxy   = "HTTP_PROXY"
-	GeneralHTTPSProxy  = "HTTPS_PROXY"
-	GeneralNoProxy     = "NO_PROXY"
-	VICAdminHTTPProxy  = "VICADMIN_HTTP_PROXY"
-	VICAdminHTTPSProxy = "VICADMIN_HTTPS_PROXY"
-	VICAdminNoProxy    = "NO_PROXY"
-	VICAdminCSPath     = "--cluster"
-	VICAdminPoolPath   = "--pool"
-	VICAdminDCPath     = "--dc"
-	PortLayerCSPath    = "CS_PATH"
-	PortLayerPoolPath  = "POOL_PATH"
-	PortLayerDCPath    = "DC_PATH"
+	GeneralHTTPProxy                  = "HTTP_PROXY"
+	GeneralHTTPSProxy                 = "HTTPS_PROXY"
+	GeneralNoProxy                    = "NO_PROXY"
+	VICAdminHTTPProxy                 = "VICADMIN_HTTP_PROXY"
+	VICAdminHTTPSProxy                = "VICADMIN_HTTPS_PROXY"
+	VICAdminNoProxy                   = "NO_PROXY"
+	VICAdminCSPath                    = "--cluster"
+	VICAdminPoolPath                  = "--pool"
+	VICAdminDCPath                    = "--dc"
+	PortLayerCSPath                   = "CS_PATH"
+	PortLayerPoolPath                 = "POOL_PATH"
+	PortLayerDCPath                   = "DC_PATH"
+	PortLayerMaxConcurrentConnections = "VIC_MAX_IN_FLIGHT"
 
 	AddPerms = "ADD"
 )
diff --git a/lib/constants/constants.go b/lib/constants/constants.go
index b050342f856..d95dc4fb17d 100644
--- a/lib/constants/constants.go
+++ b/lib/constants/constants.go
@@ -84,6 +84,15 @@ const (
 	TaskCreatedState = "created"
 	TaskFailedState  = "failed"
 	TaskUnknownState = "unknown"
+
+	// DefaultMaxConcurrentRequests limits the maximum number of SOAP operations in flight
+	// This has the effect of modifying the MaxIdleConnsPerHost field of the soap transport
+	DefaultMaxConcurrentRequests = 32
+	// MaximumMaxConcurrentRequests limits the upper bound that can be specified for concurrent connections
+	MaximumMaxConcurrentRequests = 255
+	// MinMaxConcurrentRequests is necessary because testing shows the port layer doesn't fully initialize if
+	// lower than this
+	MinMaxConcurrentRequests = 2
 )
 
 func DefaultAltVCHGuestName() string {
diff --git a/lib/install/data/data.go b/lib/install/data/data.go
index 57670a8062a..d3ecaa18cb3 100644
--- a/lib/install/data/data.go
+++ b/lib/install/data/data.go
@@ -127,6 +127,8 @@ type InstallerData struct {
 	ResourcePoolPath       string
 	ApplianceInventoryPath string
 
+	MaxConcurrentConnections *int
+
 	Datacenter types.ManagedObjectReference
 	Cluster    types.ManagedObjectReference
 
@@ -377,5 +379,7 @@ func (d *Data) CopyNonEmpty(src *Data) error {
 
 	d.ContainerConfig.ContainerNameConvention = src.ContainerConfig.ContainerNameConvention
 
+	d.MaxConcurrentConnections = src.MaxConcurrentConnections
+
 	return nil
 }
diff --git a/lib/install/management/appliance.go b/lib/install/management/appliance.go
index bec409b888f..57230881bfb 100644
--- a/lib/install/management/appliance.go
+++ b/lib/install/management/appliance.go
@@ -693,6 +693,11 @@ func (d *Dispatcher) createAppliance(conf *config.VirtualContainerHostConfigSpec
 		Active:  true,
 	}
 
+	if settings.MaxConcurrentConnections != nil {
+		d.op.Debugf("Setting max concurrent connections in portlayer environment to %d", *settings.MaxConcurrentConnections)
+		cfg.Cmd.Env = append(cfg.Cmd.Env, fmt.Sprintf("%s=%s", config.PortLayerMaxConcurrentConnections, strconv.Itoa(*settings.MaxConcurrentConnections)))
+	}
+
 	conf.AddComponent(config.PortLayerService, cfg)
 
 	// fix up those parts of the config that depend on the final applianceVM folder name
diff --git a/lib/install/validate/config_to_data.go b/lib/install/validate/config_to_data.go
index 814faa64689..35fa6e38f20 100644
--- a/lib/install/validate/config_to_data.go
+++ b/lib/install/validate/config_to_data.go
@@ -19,6 +19,7 @@ import (
 	"fmt"
 	"net/url"
 	"path"
+	"strconv"
 	"strings"
 
 	"github.com/docker/go-units"
@@ -162,6 +163,16 @@ func NewDataFromConfig(ctx context.Context, finder Finder, conf *config.VirtualC
 	d.OpsCredentials.OpsPassword = &conf.Connection.Token
 	d.Thumbprint = conf.Connection.TargetThumbprint
 
+	maxConcurrent := conf.ExecutorConfig.Sessions[config.PortLayerService].GetEnv(config.PortLayerMaxConcurrentConnections)
+	if maxConcurrent != nil {
+		var max int
+		max, err = strconv.Atoi(*maxConcurrent)
+		if err != nil {
+			return
+		}
+		d.MaxConcurrentConnections = &max
+	}
+
 	d.AsymmetricRouting = conf.AsymmetricRouting
 
 	if err = setBridgeNetwork(op, finder, d, conf); err != nil {
diff --git a/lib/install/validate/validator.go b/lib/install/validate/validator.go
index 7d56006fb3c..ec8babdb93e 100644
--- a/lib/install/validate/validator.go
+++ b/lib/install/validate/validator.go
@@ -490,22 +490,25 @@ func (v *Validator) sessionValid(op trace.Operation, errMsg string) bool {
 		v.NoteIssue(errors.New(errMsg))
 		return false
 	}
+
 	return true
 }
 
 func (v *Validator) target(op trace.Operation, input *data.Data, conf *config.VirtualContainerHostConfigSpec) {
 	defer trace.End(trace.Begin("", op))
 
-	// check if host is managed by VC
 	v.managedbyVC(op)
+	v.connectionManagement(op, input, conf)
 }
 
+// managedbyVC checks if host is managed by VC and is blocked from direct interaction
 func (v *Validator) managedbyVC(op trace.Operation) {
 	defer trace.End(trace.Begin("", op))
 
 	if v.isVC() {
 		return
 	}
+
 	host, err := v.session.Finder.DefaultHostSystem(op)
 	if err != nil {
 		v.NoteIssue(fmt.Errorf("Failed to get host system: %s", err))
@@ -522,6 +525,26 @@ func (v *Validator) managedbyVC(op trace.Operation) {
 	if ip := mh.Summary.ManagementServerIp; ip != "" {
 		v.NoteIssue(fmt.Errorf("Target is managed by vCenter server %q, please change --target to vCenter server address or select a standalone ESXi", ip))
 	}
+
+	return
+}
+
+func (v *Validator) connectionManagement(op trace.Operation, input *data.Data, conf *config.VirtualContainerHostConfigSpec) {
+	defer trace.End(trace.Begin("", op))
+
+	if input.MaxConcurrentConnections == nil {
+		return
+	}
+
+	// unsure if we need to set a maximum bound as well. Adding something sane, but above the
+	// default that's been in force since 2017
+	if *input.MaxConcurrentConnections < constants.MinMaxConcurrentRequests || *input.MaxConcurrentConnections > constants.MaximumMaxConcurrentRequests {
+		op.Debugf("Validating max connection failed")
+
+		v.NoteIssue(fmt.Errorf("Maximum concurrent connections must be between %d - %d inclusive", constants.MinMaxConcurrentRequests, constants.MaximumMaxConcurrentRequests))
+		return
+	}
+
 	return
 }
 
diff --git a/pkg/vsphere/session/session.go b/pkg/vsphere/session/session.go
index 9f3107f7597..e4cfe2f4a42 100644
--- a/pkg/vsphere/session/session.go
+++ b/pkg/vsphere/session/session.go
@@ -21,7 +21,6 @@
 // each corresponding value in Config. The Session is returned and
 // the user can use the cached govmomi objects in the exported fields of
 // Session instead of directly using a govmomi Client.
-//
 package session
 
 import (
@@ -45,13 +44,13 @@ import (
 	"github.com/vmware/govmomi/vim25/soap"
 	"github.com/vmware/govmomi/vim25/types"
 	"github.com/vmware/vic/lib/config"
+	"github.com/vmware/vic/lib/constants"
 	"github.com/vmware/vic/pkg/errors"
 	"github.com/vmware/vic/pkg/trace"
 	"github.com/vmware/vic/pkg/vsphere/extraconfig"
 )
 
 const (
-	defaultMaxInFlight  = 32
 	tlsHandshakeTimeout = 30 * time.Second
 )
 
@@ -69,6 +68,7 @@ type Config struct {
 	Thumbprint string
 	// Keep alive duration
 	Keepalive time.Duration
+	// Maximum
 	// User-Agent to identify login sessions (see: govc session.ls)
 	UserAgent string
 
@@ -232,9 +232,9 @@ func (s *Session) Connect(ctx context.Context) (*Session, error) {
 
 	soapClient.SetThumbprint(soapURL.Host, s.Thumbprint)
 
-	maxInFlight := defaultMaxInFlight
+	maxInFlight := constants.DefaultMaxConcurrentRequests
 	if e := os.Getenv("VIC_MAX_IN_FLIGHT"); e != "" {
-		if i, err := strconv.Atoi(e); err == nil {
+		if i, err := strconv.Atoi(e); err == nil && i > 0 {
 			maxInFlight = i
 		}
 	}
diff --git a/tests/check-org-membership.sh b/tests/check-org-membership.sh
index a948d6ec143..fda7c9e508c 100755
--- a/tests/check-org-membership.sh
+++ b/tests/check-org-membership.sh
@@ -24,7 +24,11 @@ if [ "$SKIP_CHECK_MEMBERSHIP" == "true" ]; then
   exit 0
 fi
 
-if [ ! $(curl --silent -H "Authorization: token $GITHUB_AUTOMATION_API_KEY" "https://api.github.com/orgs/vmware/members/${DRONE_COMMIT_AUTHOR}") ]; then
+# assuming that the logic here is both a successful curl AND no output.
+# testing with a bad auth token shows a 0 return code for curl, but json blob with error
+# good auth token is just empty response
+result=$(curl --silent -H "Authorization: token $GITHUB_AUTOMATION_API_KEY" "https://api.github.com/orgs/vmware/members/${DRONE_COMMIT_AUTHOR}")
+if [ "$?" -eq 0 -o -n "$result" ]; then
   echo "checked origin membership successfully"
 else
   echo "failed to check origin membership"