diff --git a/parts/linux/cloud-init/artifacts/cse_cmd.sh b/parts/linux/cloud-init/artifacts/cse_cmd.sh
index 2079e1f1664..8291358daea 100644
--- a/parts/linux/cloud-init/artifacts/cse_cmd.sh
+++ b/parts/linux/cloud-init/artifacts/cse_cmd.sh
@@ -18,7 +18,18 @@ fi;
 {{end}}
 INIT_AKS_CLOUD_FILEPATH="{{GetInitAKSCloudFilepath}}";
 if [ -f "${INIT_AKS_CLOUD_FILEPATH}" ]; then
-	REPO_DEPOT_ENDPOINT="{{AKSCustomCloudRepoDepotEndpoint}}" LOCATION={{GetVariable "location"}} "${INIT_AKS_CLOUD_FILEPATH}" >> /var/log/azure/cluster-provision.log 2>&1;
+	PRE_PROVISION_ONLY="{{GetPreProvisionOnly}}" REPO_DEPOT_ENDPOINT="{{AKSCustomCloudRepoDepotEndpoint}}" LOCATION={{GetVariable "location"}} "${INIT_AKS_CLOUD_FILEPATH}" >> /var/log/azure/cluster-provision.log 2>&1;
+	initAKSCloudExitCode=$?;
+	if [ "$initAKSCloudExitCode" -eq 246 ]; then
+		echo "Chrony configuration failed; init-aks-cloud failed with exit code ${initAKSCloudExitCode}" >> ${PROVISION_OUTPUT};
+		exit ${initAKSCloudExitCode};
+	elif [ "$initAKSCloudExitCode" -eq 245 ]; then
+		echo "NTP not reachable; init-aks-cloud failed with NTP synchronization error code ${initAKSCloudExitCode}" >> ${PROVISION_OUTPUT};
+		exit ${initAKSCloudExitCode};
+	elif [ "$initAKSCloudExitCode" -eq 244 ]; then
+		echo "Unable to determine confidential VM platform; init-aks-cloud failed with exit code ${initAKSCloudExitCode}" >> ${PROVISION_OUTPUT};
+		exit ${initAKSCloudExitCode};
+	fi;
 fi;
 {{/* Keep the environment assignments below contiguous through the nohup invocation at the end of this file. */ -}}
 {{/* The CSE command is flattened into one shell command, so all assignments below are passed to nohup. */ -}}
diff --git a/parts/linux/cloud-init/artifacts/cse_helpers.sh b/parts/linux/cloud-init/artifacts/cse_helpers.sh
index 8862606a704..7e45cd1f0e8 100755
--- a/parts/linux/cloud-init/artifacts/cse_helpers.sh
+++ b/parts/linux/cloud-init/artifacts/cse_helpers.sh
@@ -162,6 +162,7 @@ ERR_AKS_NODE_CONTROLLER_ERROR=240 # Generic error in AKS Node Controller
 ERR_AZNFS_RPM_DOWNLOAD_TIMEOUT=241 # Timeout downloading aznfs RPM from PMC
 ERR_AZNFS_INSTALL_FAIL=242 # Failed to install aznfs RPM package
 ERR_SECONDARY_NIC_CONFIG_FAIL=243 # Error configuring secondary NIC network interface
+# Exit codes 244-246 are reserved by init-aks-cloud.sh and propagated by cse_cmd.sh.
 # -----------------------------------------------------------------------------
 
 # This probably wasn't launched via a login shell, so ensure the PATH is correct.
diff --git a/parts/linux/cloud-init/artifacts/init-aks-cloud.sh b/parts/linux/cloud-init/artifacts/init-aks-cloud.sh
index bf38c0485e8..538598ddc13 100644
--- a/parts/linux/cloud-init/artifacts/init-aks-cloud.sh
+++ b/parts/linux/cloud-init/artifacts/init-aks-cloud.sh
@@ -103,6 +103,10 @@ IS_ACL=0
 IS_MARINER=0
 IS_AZURELINUX=0
 
+ERR_CVM_PLATFORM_DETECTION_FAIL=244 # Unable to distinguish SEV-SNP from TDX
+ERR_NTP_UNREACHABLE=245 # Chrony could not synchronize with the configured NTP pools
+ERR_CHRONY_CONFIG_FAIL=246 # Chrony could not be configured for the detected CVM platform
+
 # http://168.63.129.16 is a constant for the host's wireserver endpoint.
 WIRESERVER_ENDPOINT="http://168.63.129.16"
 
@@ -538,9 +542,210 @@ function determine_cert_endpoint_mode {
     echo "$mode"
 }
 
+function is_ubuntu_2604_cvm {
+    [ "$IS_UBUNTU" -eq 1 ] || return 1
+    [ "${VERSION_ID:-}" = "26.04" ] || return 1
+
+    case "$(uname -r)" in
+        *-azure-fde*) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+
+function should_configure_ubuntu_2604_cvm_time_sync {
+    [ "${PRE_PROVISION_ONLY:-false}" != "true" ] || return 1
+    is_ubuntu_2604_cvm
+}
+
+function detect_confidential_vm_platform {
+    local platform
+
+    if ! platform="$(systemd-detect-virt --cvm 2>/dev/null)"; then
+        return 1
+    fi
+
+    case "$platform" in
+        sev-snp|tdx)
+            echo "$platform"
+            ;;
+        *)
+            return 1
+            ;;
+    esac
+}
+
+function ubuntu_ntp_pools {
+    cat <<'EOF'
+pool ntp.ubuntu.com        iburst maxsources 4
+pool 0.ubuntu.pool.ntp.org iburst maxsources 1
+pool 1.ubuntu.pool.ntp.org iburst maxsources 1
+pool 2.ubuntu.pool.ntp.org iburst maxsources 2
+EOF
+}
+
+function configure_chrony {
+    local time_sources="${1:-refclock PHC /dev/ptp0 poll 3 dpoll -2 offset 0}"
+    local chrony_conf="${CHRONY_CONF:-/etc/chrony/chrony.conf}"
+    local timesyncd_load_state
+    local chrony_failed=0
+
+    if [ "$IS_UBUNTU" -eq 1 ]; then
+        timesyncd_load_state="$(systemctl show -p LoadState --value systemd-timesyncd 2>/dev/null || true)"
+        if [ "$timesyncd_load_state" = "not-found" ]; then
+            echo "systemd-timesyncd is removed, no need to disable"
+        else
+            if ! systemctl stop systemd-timesyncd; then
+                echo "ERROR: failed to stop systemd-timesyncd" >&2
+                chrony_failed=1
+            fi
+            if ! systemctl disable systemd-timesyncd; then
+                echo "ERROR: failed to disable systemd-timesyncd" >&2
+                chrony_failed=1
+            fi
+        fi
+
+        if [ ! -e "$chrony_conf" ]; then
+            if ! apt-get update; then
+                echo "ERROR: failed to update package metadata before installing Chrony" >&2
+                chrony_failed=1
+            fi
+            if ! apt-get install chrony -y; then
+                echo "ERROR: failed to install Chrony" >&2
+                chrony_failed=1
+            fi
+        fi
+    elif [ "$IS_FLATCAR" -eq 1 ]; then
+        if ! rm -f "$chrony_conf"; then
+            echo "ERROR: failed to remove the existing Flatcar Chrony configuration" >&2
+            chrony_failed=1
+        fi
+    fi
+
+    if ! cat > "$chrony_conf" <<EOF
+# Welcome to the chrony configuration file. See chrony.conf(5) for more
+# information about usuable directives.
+
+# This will use (up to):
+# - 4 sources from ntp.ubuntu.com which some are ipv6 enabled
+# - 2 sources from 2.ubuntu.pool.ntp.org which is ipv6 enabled as well
+# - 1 source from [01].ubuntu.pool.ntp.org each (ipv4 only atm)
+# This means by default, up to 6 dual-stack and up to 2 additional IPv4-only
+# sources will be used.
+# At the same time it retains some protection against one of the entries being
+# down (compare to just using one of the lines). See (LP: #1754358) for the
+# discussion.
+#
+# About using servers from the NTP Pool Project in general see (LP: #104525).
+# Approved by Ubuntu Technical Board on 2011-02-08.
+# See http://www.pool.ntp.org/join.html for more information.
+#pool ntp.ubuntu.com        iburst maxsources 4
+#pool 0.ubuntu.pool.ntp.org iburst maxsources 1
+#pool 1.ubuntu.pool.ntp.org iburst maxsources 1
+#pool 2.ubuntu.pool.ntp.org iburst maxsources 2
+
+# This directive specify the location of the file containing ID/key pairs for
+# NTP authentication.
+keyfile /etc/chrony/chrony.keys
+
+# This directive specify the file into which chronyd will store the rate
+# information.
+driftfile /var/lib/chrony/chrony.drift
+
+# Uncomment the following line to turn logging on.
+#log tracking measurements statistics
+
+# Log files location.
+logdir /var/log/chrony
+
+# Stop bad estimates upsetting machine clock.
+maxupdateskew 100.0
+
+# This directive enables kernel synchronisation (every 11 minutes) of the
+# real-time clock. Note that it can’t be used along with the 'rtcfile' directive.
+rtcsync
+
+# Settings come from: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/time-sync
+${time_sources}
+makestep 1.0 -1
+EOF
+    then
+        echo "ERROR: failed to write Chrony configuration to ${chrony_conf}" >&2
+        chrony_failed=1
+    fi
+
+    if [ "$IS_UBUNTU" -eq 1 ]; then
+        if ! systemctl restart chrony; then
+            echo "ERROR: failed to restart Chrony" >&2
+            chrony_failed=1
+        fi
+    elif [ "$IS_FLATCAR" -eq 1 ]; then
+        if ! systemctl restart chronyd; then
+            echo "ERROR: failed to restart chronyd" >&2
+            chrony_failed=1
+        fi
+    fi
+
+    return "$chrony_failed"
+}
+
+function verify_chrony_ntp_sync {
+    local max_attempts=12
+    local retry_interval_seconds=5
+
+    if chronyc waitsync "$max_attempts" 0 0 "$retry_interval_seconds"; then
+        echo "NTP synchronization confirmed through the Ubuntu NTP pools"
+        emit_event "AKS.CSE.chrony.ntpSynchronized" "NTP synchronization confirmed through the Ubuntu NTP pools"
+        return 0
+    fi
+
+    echo "ERROR: NTP not reachable; Chrony did not synchronize" >&2
+    emit_event "AKS.CSE.chrony.ntpUnavailable" "NTP not reachable after ${max_attempts} synchronization checks; failing provisioning" "Error"
+    echo "Chrony source diagnostics:" >&2
+    chronyc sources -v >&2 || echo "ERROR: unable to retrieve Chrony source diagnostics" >&2
+    echo "Chrony tracking diagnostics:" >&2
+    chronyc tracking >&2 || echo "ERROR: unable to retrieve Chrony tracking diagnostics" >&2
+    return "$ERR_NTP_UNREACHABLE"
+}
+
+function configure_ubuntu_2604_cvm_time_sync {
+    local platform
+    local ntp_pools
+
+    if ! platform="$(detect_confidential_vm_platform)"; then
+        echo "ERROR: unable to determine Ubuntu 26.04 CVM platform with systemd-detect-virt --cvm" >&2
+        emit_event "AKS.CSE.chrony.platformDetectionFailed" "Unable to distinguish SEV-SNP from TDX using systemd-detect-virt --cvm" "Error"
+        return "$ERR_CVM_PLATFORM_DETECTION_FAIL"
+    fi
+
+    case "$platform" in
+        sev-snp)
+            echo "AMD SEV-SNP detected; preserving the existing Hyper-V PHC Chrony configuration"
+            emit_event "AKS.CSE.chrony.usingPHC" "AMD SEV-SNP detected; preserving the existing /dev/ptp0 PHC configuration"
+            if ! configure_chrony; then
+                echo "ERROR: failed to configure Chrony with the Hyper-V PHC source for AMD SEV-SNP" >&2
+                emit_event "AKS.CSE.chrony.configurationFailed" "Failed to configure Chrony with the Hyper-V PHC source for AMD SEV-SNP" "Error"
+                return "$ERR_CHRONY_CONFIG_FAIL"
+            fi
+            ;;
+        tdx)
+            echo "Intel TDX detected; configuring Chrony to use the Ubuntu NTP pools"
+            emit_event "AKS.CSE.chrony.usingNTP" "Intel TDX detected; using only the approved Ubuntu NTP pools"
+            ntp_pools="$(ubuntu_ntp_pools)"
+            if ! configure_chrony "$ntp_pools"; then
+                echo "ERROR: failed to configure Chrony with the Ubuntu NTP pools for Intel TDX" >&2
+                emit_event "AKS.CSE.chrony.configurationFailed" "Failed to configure Chrony with the Ubuntu NTP pools for Intel TDX" "Error"
+                return "$ERR_CHRONY_CONFIG_FAIL"
+            fi
+            verify_chrony_ntp_sync
+            ;;
+    esac
+}
+
 # shellcheck disable=SC2317
 ${__SOURCED__:+return}
 
+action=${1:-init}
+
 # shellcheck disable=SC3010
 if [[ -f /etc/os-release ]]; then
     . /etc/os-release
@@ -566,6 +771,16 @@ fi
 
 echo "Running on $NAME"
 
+ubuntu_2604_cvm_chrony_configured=0
+if [ "$action" = "init" ] && should_configure_ubuntu_2604_cvm_time_sync; then
+    configure_ubuntu_2604_cvm_time_sync
+    chrony_result=$?
+    if [ "$chrony_result" -ne 0 ]; then
+        exit "$chrony_result"
+    fi
+    ubuntu_2604_cvm_chrony_configured=1
+fi
+
 
 # Certificate refresh behavior summary:
 # - legacy mode directly attempts certificate download from wireserver and only in ussec and usnat regions.
@@ -632,7 +847,6 @@ fi
 # Action values:
 # - init (default): full provisioning path
 # - ca-refresh <location>: periodic refresh path; location is passed as arg to avoid env dependency
-action=${1:-init}
 if [ "$action" = "ca-refresh" ] || [ "$install_ca_refresh_schedule" -eq 0 ]; then
     exit 0
 fi
@@ -755,71 +969,8 @@ EOF
 
     systemctl restart chronyd
 else
-    chrony_conf="/etc/chrony/chrony.conf"
-    if [ "$IS_UBUNTU" -eq 1 ]; then
-        systemctl stop systemd-timesyncd
-        systemctl disable systemd-timesyncd
-
-        if [ ! -e "$chrony_conf" ]; then
-            apt-get update
-            apt-get install chrony -y
-        fi
-    elif [ "$IS_FLATCAR" -eq 1 ]; then
-        rm -f ${chrony_conf}
-    fi
-
-    cat > $chrony_conf <<EOF
-# Welcome to the chrony configuration file. See chrony.conf(5) for more
-# information about usuable directives.
-
-# This will use (up to):
-# - 4 sources from ntp.ubuntu.com which some are ipv6 enabled
-# - 2 sources from 2.ubuntu.pool.ntp.org which is ipv6 enabled as well
-# - 1 source from [01].ubuntu.pool.ntp.org each (ipv4 only atm)
-# This means by default, up to 6 dual-stack and up to 2 additional IPv4-only
-# sources will be used.
-# At the same time it retains some protection against one of the entries being
-# down (compare to just using one of the lines). See (LP: #1754358) for the
-# discussion.
-#
-# About using servers from the NTP Pool Project in general see (LP: #104525).
-# Approved by Ubuntu Technical Board on 2011-02-08.
-# See http://www.pool.ntp.org/join.html for more information.
-#pool ntp.ubuntu.com        iburst maxsources 4
-#pool 0.ubuntu.pool.ntp.org iburst maxsources 1
-#pool 1.ubuntu.pool.ntp.org iburst maxsources 1
-#pool 2.ubuntu.pool.ntp.org iburst maxsources 2
-
-# This directive specify the location of the file containing ID/key pairs for
-# NTP authentication.
-keyfile /etc/chrony/chrony.keys
-
-# This directive specify the file into which chronyd will store the rate
-# information.
-driftfile /var/lib/chrony/chrony.drift
-
-# Uncomment the following line to turn logging on.
-#log tracking measurements statistics
-
-# Log files location.
-logdir /var/log/chrony
-
-# Stop bad estimates upsetting machine clock.
-maxupdateskew 100.0
-
-# This directive enables kernel synchronisation (every 11 minutes) of the
-# real-time clock. Note that it can’t be used along with the 'rtcfile' directive.
-rtcsync
-
-# Settings come from: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/time-sync
-refclock PHC /dev/ptp0 poll 3 dpoll -2 offset 0
-makestep 1.0 -1
-EOF
-
-    if [ "$IS_UBUNTU" -eq 1 ]; then
-        systemctl restart chrony
-    elif [ "$IS_FLATCAR" -eq 1 ]; then
-        systemctl restart chronyd
+    if [ "$ubuntu_2604_cvm_chrony_configured" -eq 0 ]; then
+        configure_chrony || true
     fi
 fi
 
diff --git a/pkg/agent/baker_test.go b/pkg/agent/baker_test.go
index 825817b1328..329f7e4f435 100644
--- a/pkg/agent/baker_test.go
+++ b/pkg/agent/baker_test.go
@@ -1368,6 +1368,23 @@ var _ = Describe("getLinuxNodeCSECommand", func() {
 		Expect(cseCmd).To(ContainSubstring("handleCloudInitStatus"))
 		Expect(cseCmd).To(ContainSubstring("cloud-init status --wait"))
 		Expect(cseCmd).To(ContainSubstring("cloudInitExitCode=$?"))
+		Expect(cseCmd).To(ContainSubstring("PRE_PROVISION_ONLY=\"false\" REPO_DEPOT_ENDPOINT="))
+		Expect(cseCmd).To(ContainSubstring("initAKSCloudExitCode=$?"))
+		Expect(cseCmd).To(ContainSubstring("if [ \"$initAKSCloudExitCode\" -eq 246 ]"))
+		Expect(cseCmd).To(ContainSubstring("Chrony configuration failed"))
+		Expect(cseCmd).To(ContainSubstring("elif [ \"$initAKSCloudExitCode\" -eq 245 ]"))
+		Expect(cseCmd).To(ContainSubstring("NTP not reachable"))
+		Expect(cseCmd).To(ContainSubstring("elif [ \"$initAKSCloudExitCode\" -eq 244 ]"))
+		Expect(cseCmd).To(ContainSubstring("Unable to determine confidential VM platform"))
+		Expect(cseCmd).To(ContainSubstring("exit ${initAKSCloudExitCode}"))
+	})
+
+	It("should pass pre-provision mode to init-aks-cloud", func() {
+		baseConfig.PreProvisionOnly = true
+
+		cseCmd := templateGenerator.getLinuxNodeCSECommand(baseConfig)
+
+		Expect(cseCmd).To(ContainSubstring("PRE_PROVISION_ONLY=\"true\" REPO_DEPOT_ENDPOINT="))
 	})
 
 	It("should handle configuration with custom kubelet config", func() {
diff --git a/spec/parts/linux/cloud-init/artifacts/init_aks_cloud_spec.sh b/spec/parts/linux/cloud-init/artifacts/init_aks_cloud_spec.sh
index 472f9b78de2..554929a6704 100644
--- a/spec/parts/linux/cloud-init/artifacts/init_aks_cloud_spec.sh
+++ b/spec/parts/linux/cloud-init/artifacts/init_aks_cloud_spec.sh
@@ -68,6 +68,28 @@ Describe 'init-aks-cloud.sh refresh mode wiring'
     End
 End
 
+Describe 'init-aks-cloud.sh Chrony distro routing'
+    script_path='./parts/linux/cloud-init/artifacts/init-aks-cloud.sh'
+
+    chrony_routing_block() {
+        sed -n '/^if \[ "\$IS_ACL" -eq 1 \]; then$/,/^#EOF$/p' "$script_path"
+    }
+
+    It 'keeps Azure Linux and Mariner on their native chronyd configuration path'
+        When call chrony_routing_block
+        The output should include 'elif [ "$IS_MARINER" -eq 1 ] || [ "$IS_AZURELINUX" -eq 1 ]; then'
+        The output should include 'cat > /etc/chrony.conf <<EOF'
+        The output should include 'refclock PHC /dev/ptp0 poll 3 dpoll -2 offset 0'
+        The output should include 'systemctl restart chronyd'
+    End
+
+    It 'keeps Ubuntu and Flatcar on configure_chrony unless the CVM path already configured it'
+        When call chrony_routing_block
+        The output should include 'if [ "$ubuntu_2604_cvm_chrony_configured" -eq 0 ]; then'
+        The output should include 'configure_chrony || true'
+    End
+End
+
 Describe 'init-aks-cloud.sh functional tests'
     setup() {
         TEST_DIR="$(mktemp -d)"
@@ -220,6 +242,355 @@ EOF
         End
     End
 
+    Describe 'Ubuntu 26.04 CVM Chrony configuration'
+        setup_chrony_test() {
+            export CHRONY_CONF="${TEST_DIR}/chrony.conf"
+            IS_UBUNTU=1
+            VERSION_ID="26.04"
+            touch "$CHRONY_CONF"
+        }
+
+        Mock systemctl
+            echo "systemctl $*"
+        End
+
+        It 'scopes the platform-specific behavior to Ubuntu 26.04 FDE images'
+            IS_UBUNTU=1
+            VERSION_ID="26.04"
+            Mock uname
+                echo "7.0.0-1011-azure-fde"
+            End
+
+            When call is_ubuntu_2604_cvm
+            The status should be success
+        End
+
+        It 'does not select an Ubuntu 26.04 non-FDE image'
+            IS_UBUNTU=1
+            VERSION_ID="26.04"
+            Mock uname
+                echo "7.0.0-1011-azure"
+            End
+
+            When call is_ubuntu_2604_cvm
+            The status should be failure
+        End
+
+        It 'does not select another Ubuntu release even when it has an FDE kernel'
+            IS_UBUNTU=1
+            VERSION_ID="24.04"
+            Mock uname
+                echo "6.8.0-1065-azure-fde"
+            End
+
+            When call is_ubuntu_2604_cvm
+            The status should be failure
+        End
+
+        It 'skips platform-specific time sync during pre-provision image preparation'
+            IS_UBUNTU=1
+            VERSION_ID="26.04"
+            PRE_PROVISION_ONLY="true"
+            Mock uname
+                echo "7.0.0-1011-azure-fde"
+            End
+
+            When call should_configure_ubuntu_2604_cvm_time_sync
+            The status should be failure
+        End
+
+        It 'selects platform-specific time sync when provisioning the real node'
+            IS_UBUNTU=1
+            VERSION_ID="26.04"
+            PRE_PROVISION_ONLY="false"
+            Mock uname
+                echo "7.0.0-1011-azure-fde"
+            End
+
+            When call should_configure_ubuntu_2604_cvm_time_sync
+            The status should be success
+        End
+
+        It 'preserves the PHC default for another Ubuntu release'
+            setup_chrony_test
+            VERSION_ID="24.04"
+
+            When call configure_chrony
+            The output should include "systemctl restart chrony"
+            The contents of file "$CHRONY_CONF" should include "refclock PHC /dev/ptp0 poll 3 dpoll -2 offset 0"
+            The status should be success
+        End
+
+        It 'detects AMD SEV-SNP with the systemd confidential VM signal'
+            Mock systemd-detect-virt
+                [ "$1" = "--cvm" ] || return 1
+                echo "sev-snp"
+            End
+
+            When call detect_confidential_vm_platform
+            The output should eq "sev-snp"
+            The status should be success
+        End
+
+        It 'detects Intel TDX with the systemd confidential VM signal'
+            Mock systemd-detect-virt
+                [ "$1" = "--cvm" ] || return 1
+                echo "tdx"
+            End
+
+            When call detect_confidential_vm_platform
+            The output should eq "tdx"
+            The status should be success
+        End
+
+        It 'rejects an unknown confidential VM platform'
+            Mock systemd-detect-virt
+                echo "none"
+            End
+
+            When call detect_confidential_vm_platform
+            The status should be failure
+        End
+
+        It 'fails provisioning when the confidential VM platform cannot be determined'
+            Mock detect_confidential_vm_platform
+                return 1
+            End
+            Mock emit_event
+                echo "event: $*" >&2
+            End
+
+            When call configure_ubuntu_2604_cvm_time_sync
+            The error should include "unable to determine Ubuntu 26.04 CVM platform"
+            The error should include "AKS.CSE.chrony.platformDetectionFailed"
+            The status should equal 244
+        End
+
+        It 'preserves the existing PHC configuration for SEV-SNP'
+            setup_chrony_test
+            Mock detect_confidential_vm_platform
+                echo "sev-snp"
+            End
+            Mock emit_event
+                echo "event: $*"
+            End
+
+            When call configure_ubuntu_2604_cvm_time_sync
+            The output should include "preserving the existing Hyper-V PHC Chrony configuration"
+            The output should include "AKS.CSE.chrony.usingPHC"
+            The contents of file "$CHRONY_CONF" should include "refclock PHC /dev/ptp0 poll 3 dpoll -2 offset 0"
+            The status should be success
+        End
+
+        It 'returns the Chrony configuration failure code when SEV-SNP PHC setup fails'
+            Mock detect_confidential_vm_platform
+                echo "sev-snp"
+            End
+            Mock configure_chrony
+                return 1
+            End
+            Mock emit_event
+                echo "event: $*" >&2
+            End
+
+            When call configure_ubuntu_2604_cvm_time_sync
+            The output should include "AMD SEV-SNP detected"
+            The error should include "failed to configure Chrony with the Hyper-V PHC source"
+            The error should include "AKS.CSE.chrony.configurationFailed"
+            The status should equal 246
+        End
+
+        It 'defines exactly the four approved Ubuntu NTP pools'
+            When call ubuntu_ntp_pools
+            The lines of output should eq 4
+            The line 1 of output should eq "pool ntp.ubuntu.com        iburst maxsources 4"
+            The line 2 of output should eq "pool 0.ubuntu.pool.ntp.org iburst maxsources 1"
+            The line 3 of output should eq "pool 1.ubuntu.pool.ntp.org iburst maxsources 1"
+            The line 4 of output should eq "pool 2.ubuntu.pool.ntp.org iburst maxsources 2"
+            The status should be success
+        End
+
+        It 'configures TDX with only the fixed Ubuntu NTP pools'
+            setup_chrony_test
+            Mock detect_confidential_vm_platform
+                echo "tdx"
+            End
+            Mock verify_chrony_ntp_sync
+                echo "verified NTP synchronization"
+            End
+            Mock emit_event
+                echo "event: $*"
+            End
+
+            When call configure_ubuntu_2604_cvm_time_sync
+            The output should include "Intel TDX detected"
+            The output should include "verified NTP synchronization"
+            The contents of file "$CHRONY_CONF" should include "pool ntp.ubuntu.com        iburst maxsources 4"
+            The contents of file "$CHRONY_CONF" should include "pool 0.ubuntu.pool.ntp.org iburst maxsources 1"
+            The contents of file "$CHRONY_CONF" should include "pool 1.ubuntu.pool.ntp.org iburst maxsources 1"
+            The contents of file "$CHRONY_CONF" should include "pool 2.ubuntu.pool.ntp.org iburst maxsources 2"
+            The contents of file "$CHRONY_CONF" should not include "refclock PHC"
+            The status should be success
+        End
+
+        It 'returns failure when the Chrony service cannot restart'
+            setup_chrony_test
+            Mock systemctl
+                if [ "$1" = "restart" ]; then
+                    return 1
+                fi
+            End
+
+            When call configure_chrony
+            The error should include "failed to restart Chrony"
+            The status should equal 1
+        End
+
+        It 'skips stopping and disabling systemd-timesyncd when the unit is removed'
+            setup_chrony_test
+            Mock systemctl
+                if [ "$1" = "show" ]; then
+                    echo "not-found"
+                    return 1
+                fi
+                if [ "$1" = "stop" ] || [ "$1" = "disable" ]; then
+                    echo "unexpected systemd-timesyncd operation"
+                    return 1
+                fi
+            End
+
+            When call configure_chrony
+            The output should include "systemd-timesyncd is removed, no need to disable"
+            The output should not include "unexpected systemd-timesyncd operation"
+            The contents of file "$CHRONY_CONF" should include "refclock PHC /dev/ptp0 poll 3 dpoll -2 offset 0"
+            The status should be success
+        End
+
+        It 'stops and disables systemd-timesyncd when the unit is loaded but inactive'
+            setup_chrony_test
+            Mock systemctl
+                if [ "$1" = "show" ]; then
+                    echo "loaded"
+                elif [ "$1" = "stop" ] || [ "$1" = "disable" ]; then
+                    echo "systemctl $*"
+                fi
+            End
+
+            When call configure_chrony
+            The output should include "systemctl stop systemd-timesyncd"
+            The output should include "systemctl disable systemd-timesyncd"
+            The contents of file "$CHRONY_CONF" should include "refclock PHC /dev/ptp0 poll 3 dpoll -2 offset 0"
+            The status should be success
+        End
+
+        It 'continues Chrony setup and returns failure when systemd-timesyncd cannot be stopped'
+            setup_chrony_test
+            Mock systemctl
+                if [ "$1" = "show" ]; then
+                    echo "loaded"
+                elif [ "$1" = "stop" ]; then
+                    return 1
+                elif [ "$1" = "disable" ] || [ "$1" = "restart" ]; then
+                    echo "systemctl $*"
+                fi
+            End
+
+            When call configure_chrony
+            The error should include "failed to stop systemd-timesyncd"
+            The output should include "systemctl disable systemd-timesyncd"
+            The output should include "systemctl restart chrony"
+            The contents of file "$CHRONY_CONF" should include "refclock PHC /dev/ptp0 poll 3 dpoll -2 offset 0"
+            The status should equal 1
+        End
+
+        It 'returns the Chrony configuration failure code without checking NTP when TDX setup fails'
+            Mock detect_confidential_vm_platform
+                echo "tdx"
+            End
+            Mock ubuntu_ntp_pools
+                echo "fixed pools"
+            End
+            Mock configure_chrony
+                return 1
+            End
+            Mock verify_chrony_ntp_sync
+                echo "unexpected NTP verification"
+            End
+            Mock emit_event
+                echo "event: $*" >&2
+            End
+
+            When call configure_ubuntu_2604_cvm_time_sync
+            The output should not include "unexpected NTP verification"
+            The error should include "failed to configure Chrony with the Ubuntu NTP pools"
+            The error should include "AKS.CSE.chrony.configurationFailed"
+            The status should equal 246
+        End
+
+        It 'waits for Chrony to synchronize successfully'
+            Mock chronyc
+                echo "$*"
+            End
+            Mock emit_event
+                echo "event: $*"
+            End
+
+            When call verify_chrony_ntp_sync
+            The output should include "waitsync 12 0 0 5"
+            The output should include "NTP synchronization confirmed through the Ubuntu NTP pools"
+            The output should include "AKS.CSE.chrony.ntpSynchronized"
+            The status should be success
+        End
+
+        It 'returns the NTP-unreachable code with Chrony diagnostics when NTP is not reachable'
+            Mock chronyc
+                case "$1" in
+                    waitsync)
+                        return 1
+                        ;;
+                    sources)
+                        echo "mock Chrony sources"
+                        ;;
+                    tracking)
+                        echo "mock Chrony tracking"
+                        ;;
+                esac
+            End
+            Mock emit_event
+                echo "event: $*" >&2
+            End
+
+            When call verify_chrony_ntp_sync
+            The error should include "NTP not reachable"
+            The error should include "AKS.CSE.chrony.ntpUnavailable"
+            The error should include "mock Chrony sources"
+            The error should include "mock Chrony tracking"
+            The status should equal 245
+        End
+
+        It 'propagates failed TDX NTP synchronization'
+            Mock detect_confidential_vm_platform
+                echo "tdx"
+            End
+            Mock ubuntu_ntp_pools
+                echo "fixed pools"
+            End
+            Mock configure_chrony
+                :
+            End
+            Mock verify_chrony_ntp_sync
+                exit 245
+            End
+            Mock emit_event
+                :
+            End
+
+            When call configure_ubuntu_2604_cvm_time_sync
+            The output should include "Intel TDX detected"
+            The status should equal 245
+        End
+    End
+
     Describe 'init_mariner_repo_depot'
         It 'creates extended, nvidia, and cloud-native repos and points all at RepoDepot'
             export YUM_REPOS_DIR="${TEST_DIR}/yum.repos.d"