diff --git a/hieradata/cluster/lukay.yaml b/hieradata/cluster/lukay.yaml
index 5d0e5830e5..39be5bb9a5 100644
--- a/hieradata/cluster/lukay.yaml
+++ b/hieradata/cluster/lukay.yaml
@@ -2,3 +2,7 @@
 clustershell::groupmembers:
   lukay: {group: "lukay", member: "lukay[01-04]"}
 tuned::active_profile: "latency-performance"
+nm::conf:
+  device:
+    keep-configuration: "no"
+    allowed-connections: "except:origin:nm-initrd-generator"
diff --git a/hieradata/cluster/lukay/role/rke2agent.yaml b/hieradata/cluster/lukay/role/rke2agent.yaml
new file mode 100644
index 0000000000..904d9d872c
--- /dev/null
+++ b/hieradata/cluster/lukay/role/rke2agent.yaml
@@ -0,0 +1,7 @@
+---
+classes:
+  - "profile::core::sysctl::rp_filter"
+profile::core::sysctl::rp_filter::enable: false
+rke2::config:
+  node-label:
+    - "role=storage-node"
diff --git a/hieradata/cluster/lukay/role/rke2server.yaml b/hieradata/cluster/lukay/role/rke2server.yaml
new file mode 100644
index 0000000000..904d9d872c
--- /dev/null
+++ b/hieradata/cluster/lukay/role/rke2server.yaml
@@ -0,0 +1,7 @@
+---
+classes:
+  - "profile::core::sysctl::rp_filter"
+profile::core::sysctl::rp_filter::enable: false
+rke2::config:
+  node-label:
+    - "role=storage-node"
diff --git a/spec/hosts/nodes/lukay01.cp.lsst.org_spec.rb b/spec/hosts/nodes/lukay01.cp.lsst.org_spec.rb
index 449b4ff8b8..e8664d623f 100644
--- a/spec/hosts/nodes/lukay01.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/lukay01.cp.lsst.org_spec.rb
@@ -22,7 +22,7 @@
       end
       let(:node_params) do
         {
-          role: 'rke',
+          role: 'rke2server',
           site: 'cp',
           cluster: 'lukay',
         }
@@ -30,7 +30,6 @@
 
       it { is_expected.to compile.with_all_deps }
 
-      include_examples 'docker', docker_version: '25.0.3'
       include_examples 'baremetal'
       include_examples 'ceph cluster'
       include_context 'with nm interface'
@@ -47,9 +46,19 @@
       end
 
       it do
-        is_expected.to contain_class('rke').with(
-          version: '1.7.8',
-          checksum: '9494448f684ab0f3f79c62aa9736cd718743ad94e78a291f49eafec8bc71abde'
+        is_expected.to contain_class('rke2').with(
+          node_type: 'server',
+          release_series: '1.31',
+          version: '1.31.9~rke2r1'
+        )
+      end
+
+      it do
+        expect(catalogue.resource('class', 'nm')[:conf]).to include(
+          'device' => {
+            'keep-configuration' => 'no',
+            'allowed-connections' => 'except:origin:nm-initrd-generator',
+          }
         )
       end
 
diff --git a/spec/hosts/nodes/lukay04.cp.lsst.org_spec.rb b/spec/hosts/nodes/lukay04.cp.lsst.org_spec.rb
new file mode 100644
index 0000000000..c2af5658ed
--- /dev/null
+++ b/spec/hosts/nodes/lukay04.cp.lsst.org_spec.rb
@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'lukay04.cp.lsst.org', :sitepp do
+  on_supported_os.each do |os, os_facts|
+    next unless os =~ %r{almalinux-9-x86_64}
+
+    context "on #{os}" do
+      let(:facts) do
+        lsst_override_facts(os_facts,
+                            is_virtual: false,
+                            virtual: 'physical',
+                            dmi: {
+                              'product' => {
+                                'name' => 'Super Server',
+                              },
+                              'board' => {
+                                'product' => 'H12SSL-NT',
+                              },
+                            })
+      end
+      let(:node_params) do
+        {
+          role: 'rke2agent',
+          site: 'cp',
+          cluster: 'lukay',
+        }
+      end
+
+      it { is_expected.to compile.with_all_deps }
+
+      include_examples 'baremetal'
+      include_examples 'ceph cluster'
+      include_context 'with nm interface'
+
+      it do
+        is_expected.to contain_class('clustershell').with(
+          groupmembers: {
+            'lukay' => {
+              'group' => 'lukay',
+              'member' => 'lukay[01-04]',
+            },
+          }
+        )
+      end
+
+      it do
+        is_expected.to contain_class('rke2').with(
+          node_type: 'agent',
+          release_series: '1.31',
+          version: '1.31.9~rke2r1'
+        )
+      end
+
+      it do
+        expect(catalogue.resource('class', 'nm')[:conf]).to include(
+          'device' => {
+            'keep-configuration' => 'no',
+            'allowed-connections' => 'except:origin:nm-initrd-generator',
+          }
+        )
+      end
+
+      it { is_expected.to have_nm__connection_resource_count(0) }
+    end # on os
+  end # on_supported_os
+end