diff --git a/environments/.stackhpc/tofu/ARCUS.tfvars b/environments/.stackhpc/tofu/ARCUS.tfvars
index 6aec599ef..40daa516b 100644
--- a/environments/.stackhpc/tofu/ARCUS.tfvars
+++ b/environments/.stackhpc/tofu/ARCUS.tfvars
@@ -1,4 +1,4 @@
-cluster_net = "portal-internal"
-cluster_subnet = "portal-internal"
+cluster_net         = "portal-internal"
+cluster_subnet      = "portal-internal"
 control_node_flavor = "vm.ska.cpu.general.eighth"
-other_node_flavor = "vm.ska.cpu.general.small"
+other_node_flavor   = "vm.ska.cpu.general.small"
diff --git a/environments/.stackhpc/tofu/LEAFCLOUD-dev.tfvars b/environments/.stackhpc/tofu/LEAFCLOUD-dev.tfvars
index 82e336dd8..b45a961a3 100644
--- a/environments/.stackhpc/tofu/LEAFCLOUD-dev.tfvars
+++ b/environments/.stackhpc/tofu/LEAFCLOUD-dev.tfvars
@@ -1,10 +1,10 @@
 cluster_networks = [
-    {
-        network = "stackhpc-dev"
-        subnet = "stackhpc-dev"
-    }
+  {
+    network = "stackhpc-dev"
+    subnet  = "stackhpc-dev"
+  }
 ]
 control_node_flavor = "ec1.medium" # small ran out of memory, medium gets down to ~100Mi mem free on deployment
-other_node_flavor = "en1.xsmall"
-state_volume_type = "unencrypted"
-home_volume_type = "unencrypted"
+other_node_flavor   = "en1.xsmall"
+state_volume_type   = "unencrypted"
+home_volume_type    = "unencrypted"
diff --git a/environments/.stackhpc/tofu/LEAFCLOUD.tfvars b/environments/.stackhpc/tofu/LEAFCLOUD.tfvars
index 135aadc64..601910aba 100644
--- a/environments/.stackhpc/tofu/LEAFCLOUD.tfvars
+++ b/environments/.stackhpc/tofu/LEAFCLOUD.tfvars
@@ -1,10 +1,10 @@
 cluster_networks = [
-    {
-        network = "slurmapp-ci"
-        subnet = "slurmapp-ci"
-    }
+  {
+    network = "slurmapp-ci"
+    subnet  = "slurmapp-ci"
+  }
 ]
 control_node_flavor = "ec1.medium" # small ran out of memory, medium gets down to ~100Mi mem free on deployment
-other_node_flavor = "en1.xsmall"
-state_volume_type = "unencrypted"
-home_volume_type = "unencrypted"
+other_node_flavor   = "en1.xsmall"
+state_volume_type   = "unencrypted"
+home_volume_type    = "unencrypted"
diff --git a/environments/.stackhpc/tofu/SMS.tfvars b/environments/.stackhpc/tofu/SMS.tfvars
index 808821bc0..6d14fc215 100644
--- a/environments/.stackhpc/tofu/SMS.tfvars
+++ b/environments/.stackhpc/tofu/SMS.tfvars
@@ -1,8 +1,8 @@
 cluster_networks = [
-    {
-        network = "stackhpc-ipv4-geneve"
-        subnet = "stackhpc-ipv4-geneve-subnet"
-    }
+  {
+    network = "stackhpc-ipv4-geneve"
+    subnet  = "stackhpc-ipv4-geneve-subnet"
+  }
 ]
 control_node_flavor = "general.v1.small"
-other_node_flavor = "general.v1.small"
\ No newline at end of file
+other_node_flavor   = "general.v1.small"
\ No newline at end of file
diff --git a/environments/.stackhpc/tofu/main.tf b/environments/.stackhpc/tofu/main.tf
index 22113cdb9..649f2f7cf 100644
--- a/environments/.stackhpc/tofu/main.tf
+++ b/environments/.stackhpc/tofu/main.tf
@@ -76,7 +76,7 @@ module "cluster" {
   control_node_flavor = var.control_node_flavor
 
   login = {
-    login = {
+    head = {
       nodes  = ["login-0"]
       flavor = var.other_node_flavor
     }
diff --git a/environments/site/tofu/variables.tf b/environments/site/tofu/variables.tf
index 98f364a9a..12a89e3f5 100644
--- a/environments/site/tofu/variables.tf
+++ b/environments/site/tofu/variables.tf
@@ -52,7 +52,7 @@ variable "login" {
     be useful for e.g. separating nodes for ssh and Open Ondemand usage, or
     to define login nodes with different capabilities such as high-memory.
 
-    Keys are names of groups.
+    Keys are names of groups. Keys cannot be 'login', 'compute', or 'control'.
     Values are a mapping as follows:
 
     Required:
@@ -88,6 +88,12 @@ variable "login" {
   EOF
 
   type = any
+  validation {
+    condition     = length(setintersection(keys(var.login), ["login", "compute", "control"])) == 0
+    error_message = <<-EOF
+      Login nodegroup names cannot be 'login', 'compute' or 'control'. Invalid var.login key(s): ${join(", ", setintersection(keys(var.login), ["login", "compute", "control"]))}.
+    EOF
+  }
 }
 
 variable "cluster_image_id" {
@@ -101,7 +107,8 @@ variable "compute" {
     Mapping defining homogenous groups of compute nodes. Groups are used
     in Slurm partition definitions.
 
-    Keys are names of groups.
+    Keys are names of groups. Keys cannot be 'compute', 'login', 'control' or 'default'
+    or be the same as keys in the login variable.
     Values are a mapping as follows:
 
     Required:
@@ -139,6 +146,18 @@ variable "compute" {
   EOF
 
   type = any # can't do any better; TF type constraints can't cope with heterogeneous inner mappings
+  validation {
+    condition     = length(setintersection(keys(var.compute), ["login", "compute", "control", "default"])) == 0
+    error_message = <<-EOF
+      Compute nodegroup names cannot be 'compute', 'default', 'login' or 'control'. Invalid var.compute key(s): ${join(", ", setintersection(keys(var.compute), ["login", "compute", "control", "default"]))}.
+    EOF
+  }
+  validation {
+    condition     = length(setintersection(keys(var.compute), keys(var.login))) == 0
+    error_message = <<-EOF
+      Compute and login nodegroups cannot have the same name. Invalid var.compute/var.login key(s): ${join(", ", setintersection(keys(var.compute), keys(var.login)))}
+    EOF
+  }
 }
 
 # tflint-ignore: terraform_typed_variables