diff --git a/all/099-ubuntu24-cis.yml b/all/099-ubuntu24-cis.yml
new file mode 100644
index 0000000..48a43ea
--- /dev/null
+++ b/all/099-ubuntu24-cis.yml
@@ -0,0 +1,133 @@
+---
+##########################
+# ubuntu24_cis
+#
+# Defaults for ansible-lockdown/UBUNTU24-CIS, run by `osism apply ubuntu24-cis`
+# and, with enable_cis_hardening: true, by bootstrap and maintenance. Level 1
+# server profile without the controls that break an OSISM node. Tighten in
+# environments/configuration.yml.
+
+# Firewalling is not managed on OSISM nodes. firewall_package: none alone
+# still runs 4.1.1.
+ubtu24cis_section4: false
+
+ubtu24cis_disruption_high: false
+
+# Time sync is osism.services.chrony's. 2.3.3.1 would add the NIST servers
+# and 2.3.3.2 a user line to chrony.conf, which that role rewrites again.
+ubtu24cis_rule_2_3_3_1: false
+ubtu24cis_rule_2_3_3_2: false
+
+# Login banners are osism.commons.motd's (motd, issue, issue.net).
+ubtu24cis_rule_1_6_1: false
+ubtu24cis_rule_1_6_2: false
+ubtu24cis_rule_1_6_3: false
+
+# 2.1.13 is about the rsync daemon. Mask it instead of removing the package,
+# which OSISM and its tooling use as a client.
+ubtu24cis_rsync_mask: true
+
+# Nodes forward for OVS/OVN and kolla: skips 3.3.1, 3.3.2 and 3.3.8.
+ubtu24cis_is_router: true
+# rp_filter is OSISM's (osism.services.frr sets 2). 3.3.7 would set 1 in
+# /etc/sysctl.conf, which loads after sysctl.d.
+ubtu24cis_rule_3_3_7: false
+# Router advertisements
+ubtu24cis_rule_3_3_11: false
+# osism.commons.sysctl sets tcp_syncookies=0 on the rabbitmq group.
+ubtu24cis_rule_3_3_10: false
+
+# Host logs go journald -> rsyslog -> fluentd (osism.services.rsyslog). The
+# journald default sets ForwardToSyslog=no and uploads to a placeholder host.
+ubtu24cis_syslog_service: rsyslog
+# Remote forwarding to ubtu24cis_remote_log_server
+ubtu24cis_rule_6_1_3_6: false
+# osism.services.journald and osism.services.rsyslog own journald.conf and
+# the rsyslog logrotate file. 6.1.1.3 would comment out OSISM's journald sizing
+# and override it with a drop-in; 6.1.3.3 and 6.1.3.8 edit what those roles
+# rewrite on every run.
+ubtu24cis_rule_6_1_1_3: false
+ubtu24cis_rule_6_1_3_3: false
+ubtu24cis_rule_6_1_3_8: false
+
+# AIDE would scan /var/lib/docker and Ceph hosts.
+ubtu24cis_config_aide: false
+
+# Docker volume and Ceph data is owned by container users without a host
+# account. Report instead of fixing: 7.1.12 would chown it to root, 7.1.11
+# would strip world-write from it, 7.1.13 SUID/SGID bits (sudo, ping) in
+# container layers.
+ubtu24cis_ownership_adjust: false
+ubtu24cis_no_world_write_adjust: false
+ubtu24cis_suid_sgid_adjust: false
+# The role's exclusions plus Docker and Ceph data, so the 7.1.12 report lists
+# host files rather than every container layer (some 380k files per node).
+# Re-check the role's own list on a version bump.
+ubtu24cis_exclude_unowned_search_path: '\( ! -path "/run/user/*" -a ! -path "/proc/*" -a ! -path "*/containerd/*" -a ! -path "*/kubelet/pods/*" -a ! -path "*/kubelet/plugins/*" -a ! -path "/sys/fs/cgroup/memory/*" -a ! -path "/var/*/private/*" -a ! -path "/snap/*" -a ! -path "/var/lib/docker/*" -a ! -path "/var/lib/ceph/*" -a ! -path "/var/log/ceph/*" \)'
+
+# Level 2 only. The role ignores ubtu24cis_level_2, so each rule is disabled
+# here. osism/release's ubuntu24_cis_level2 drift check compares this block
+# with the pinned role version.
+# BEGIN level2
+ubtu24cis_rule_1_1_1_6: false
+ubtu24cis_rule_1_1_1_7: false
+ubtu24cis_rule_1_1_1_8: false
+ubtu24cis_rule_1_1_2_3_1: false
+ubtu24cis_rule_1_1_2_4_1: false
+ubtu24cis_rule_1_1_2_5_1: false
+ubtu24cis_rule_1_1_2_6_1: false
+ubtu24cis_rule_1_1_2_7_1: false
+ubtu24cis_rule_1_3_1_4: false
+ubtu24cis_rule_1_7_1: false
+ubtu24cis_rule_2_1_20: false
+ubtu24cis_rule_3_2_1: false
+ubtu24cis_rule_3_2_2: false
+ubtu24cis_rule_3_2_3: false
+ubtu24cis_rule_3_2_4: false
+ubtu24cis_rule_5_1_8: false
+ubtu24cis_rule_5_1_9: false
+ubtu24cis_rule_5_2_4: false
+ubtu24cis_rule_5_3_3_1_3: false
+ubtu24cis_rule_5_4_1_2: false
+ubtu24cis_rule_5_4_3_1: false
+ubtu24cis_rule_6_2_1_1: false
+ubtu24cis_rule_6_2_1_2: false
+ubtu24cis_rule_6_2_1_3: false
+ubtu24cis_rule_6_2_1_4: false
+ubtu24cis_rule_6_2_2_1: false
+ubtu24cis_rule_6_2_2_2: false
+ubtu24cis_rule_6_2_2_3: false
+ubtu24cis_rule_6_2_2_4: false
+ubtu24cis_rule_6_2_3_1: false
+ubtu24cis_rule_6_2_3_2: false
+ubtu24cis_rule_6_2_3_3: false
+ubtu24cis_rule_6_2_3_4: false
+ubtu24cis_rule_6_2_3_5: false
+ubtu24cis_rule_6_2_3_6: false
+ubtu24cis_rule_6_2_3_7: false
+ubtu24cis_rule_6_2_3_8: false
+ubtu24cis_rule_6_2_3_9: false
+ubtu24cis_rule_6_2_3_10: false
+ubtu24cis_rule_6_2_3_11: false
+ubtu24cis_rule_6_2_3_12: false
+ubtu24cis_rule_6_2_3_13: false
+ubtu24cis_rule_6_2_3_14: false
+ubtu24cis_rule_6_2_3_15: false
+ubtu24cis_rule_6_2_3_16: false
+ubtu24cis_rule_6_2_3_17: false
+ubtu24cis_rule_6_2_3_18: false
+ubtu24cis_rule_6_2_3_19: false
+ubtu24cis_rule_6_2_3_20: false
+ubtu24cis_rule_6_2_3_21: false
+ubtu24cis_rule_6_2_4_1: false
+ubtu24cis_rule_6_2_4_2: false
+ubtu24cis_rule_6_2_4_3: false
+ubtu24cis_rule_6_2_4_4: false
+ubtu24cis_rule_6_2_4_5: false
+ubtu24cis_rule_6_2_4_6: false
+ubtu24cis_rule_6_2_4_7: false
+ubtu24cis_rule_6_2_4_8: false
+ubtu24cis_rule_6_2_4_9: false
+ubtu24cis_rule_6_2_4_10: false
+ubtu24cis_rule_6_3_3: false
+# END level2
diff --git a/all/README.md b/all/README.md
index 79d65dc..e1faa77 100644
--- a/all/README.md
+++ b/all/README.md
@@ -308,6 +308,10 @@ Three things to keep in mind about the result:
   ceph-ansible, k3s, playbooks).
 - **`099-generic.yml`** — host/OS-level config (docker, chrony, hardening, operator
   user); not kolla.
+- **`099-ubuntu24-cis.yml`** — OSISM-safe defaults for the UBUNTU24-CIS role
+  (`osism apply ubuntu24-cis`, `enable_cis_hardening`). The block between
+  `# BEGIN level2` and `# END level2` must match the pinned role; osism/release's
+  `ubuntu24_cis_level2` drift check reports the toggles to add or remove.
 - **`099-hosts.yml`** — OSISM playbook control vars.
 - **`099-infrastructure.yml`** — OSISM "infrastructure" services (cephclient,
   openstackclient, traefik, squid, …). An explicit exception — a version value