From 8a320b997b9e69e8ae0d98f20d65be73b12bab01 Mon Sep 17 00:00:00 2001
From: Mayank Singh <mayansingh@microsoft.com>
Date: Mon, 17 Aug 2026 08:07:39 +0000
Subject: [PATCH 1/5] acl: add TPM libraries and fix decrypt-root ordering

---
 ...-decrypt-root-fix-firstboot-ordering.patch | 24 +++++++++++++++++++
 acl/SPECS/bootengine/bootengine.spec          |  8 ++++++-
 .../rpm/additional_files/99-acl.conf          |  5 ++++
 3 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 acl/SPECS/bootengine/0003-decrypt-root-fix-firstboot-ordering.patch

diff --git a/acl/SPECS/bootengine/0003-decrypt-root-fix-firstboot-ordering.patch b/acl/SPECS/bootengine/0003-decrypt-root-fix-firstboot-ordering.patch
new file mode 100644
index 00000000000..bb27fde9644
--- /dev/null
+++ b/acl/SPECS/bootengine/0003-decrypt-root-fix-firstboot-ordering.patch
@@ -0,0 +1,24 @@
+From b5153c74f62233438a72710673c0e53e3e1af7de Mon Sep 17 00:00:00 2001
+From: Mayank Singh <mayansingh@microsoft.com>
+Date: Mon, 17 Aug 2026 00:00:00 +0000
+Subject: [PATCH] decrypt-root: fix first-boot ordering race
+
+Decrypt ROOT before initramfs waits for or mounts it. Remove the
+ignition-disks ordering that creates a first-boot cycle and can drop the
+decryption job.
+---
+ dracut/31decrypt-root/decrypt-root.service | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/dracut/31decrypt-root/decrypt-root.service b/dracut/31decrypt-root/decrypt-root.service
+index 54f941a..7702f00 100644
+--- a/dracut/31decrypt-root/decrypt-root.service
++++ b/dracut/31decrypt-root/decrypt-root.service
+@@ -7 +7 @@
+-After=systemd-networkd.service dev-disk-by\x2dpartlabel-ROOT.device ignition-disks.service
++After=systemd-networkd.service dev-disk-by\x2dpartlabel-ROOT.device
+@@ -8,0 +9,3 @@
++# Decrypt ROOT before initramfs waits for or mounts it.
++Before=cryptsetup.target initrd-root-device.target sysroot.mount
++# Avoid ignition-disks.service here; it creates a first-boot ordering cycle.
+
diff --git a/acl/SPECS/bootengine/bootengine.spec b/acl/SPECS/bootengine/bootengine.spec
index 96b36ce0395..8d257133d60 100644
--- a/acl/SPECS/bootengine/bootengine.spec
+++ b/acl/SPECS/bootengine/bootengine.spec
@@ -2,7 +2,7 @@
 
 Name:           bootengine
 Version:        0.0.38
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        Flatcar bootengine dracut modules and helper utilities
 
 License:        BSD-2-Clause
@@ -12,6 +12,7 @@ URL:            https://github.com/flatcar/bootengine
 Source0:        https://github.com/flatcar/bootengine/archive/%{commit_hash}.tar.gz#/%{name}-%{version}.tar.gz
 Patch0:         0001-modify-tests.patch
 Patch1:         0002-delete-UKI-firstboot-addon-after-Ignition.patch
+Patch2:         0003-decrypt-root-fix-firstboot-ordering.patch
 BuildArch:      noarch
 BuildRequires:  dracut
 Requires:       util-linux
@@ -72,6 +73,11 @@ chmod +x \
 %{_sbindir}/update-bootengine
 
 %changelog
+* Mon Aug 17 2026 Mayank Singh <mayansingh@microsoft.com> - 0.0.38-3
+- decrypt-root: fix first-boot ordering race that dropped the decryption job
+  and fell through to the dracut emergency shell (Before= root-device/sysroot,
+  drop After=ignition-disks.service).
+
 * Tue May 06 2026 Lanze Liu <lanzeliu@microsoft.com> - 0.0.38-2
 - Update firstboot addon removal to use glob pattern for UAPI UKI naming
 
diff --git a/build_library/rpm/additional_files/99-acl.conf b/build_library/rpm/additional_files/99-acl.conf
index 8720ba0f174..b40b74dedd5 100644
--- a/build_library/rpm/additional_files/99-acl.conf
+++ b/build_library/rpm/additional_files/99-acl.conf
@@ -34,6 +34,11 @@ install_items+=" /usr/sbin/dmsetup "
 # Cryptsetup libraries (required for veritysetup and crypt module)
 install_items+=" /usr/lib/libcryptsetup.so.12 /usr/lib64/libcryptsetup.so.12 "
 install_items+=" /usr/sbin/cryptsetup "
+# TPM2 libs for LUKS root auto-unlock. systemd-cryptsetup dlopen()s these at
+# runtime, so dracut's ldd scan misses them and so we are adding them.
+install_items+=" /usr/lib64/libtss2-esys.so.0 /usr/lib64/libtss2-sys.so.1 "
+install_items+=" /usr/lib64/libtss2-mu.so.0 /usr/lib64/libtss2-rc.so.0 "
+install_items+=" /usr/lib64/libtss2-tctildr.so.0 /usr/lib64/libtss2-tcti-device.so.0 "
 # dm-verity tool
 install_items+=" /usr/sbin/veritysetup "
 # systemd-veritysetup binary (dracut should include it via module, but be explicit)

From ec29d3c50898a402ea76e292371a218e3656a351 Mon Sep 17 00:00:00 2001
From: Mayank Singh <mayansingh@microsoft.com>
Date: Mon, 17 Aug 2026 18:31:32 +0000
Subject: [PATCH 2/5] oem-azure: make chrony Hyper-V PTP optional for CVMs

---
 .../coreos-base/oem-azure/files/chrony-azure-ptp | 16 ++++++++++++++++
 .../oem-azure/files/chrony-hyperv.conf           |  4 +++-
 .../coreos-base/oem-azure/files/chrony.conf      | 13 ++++++++-----
 .../coreos-base/oem-azure/files/manglefs_rpm.sh  | 16 ++++++++++++++--
 4 files changed, 41 insertions(+), 8 deletions(-)
 create mode 100755 sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-azure-ptp

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-azure-ptp b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-azure-ptp
new file mode 100755
index 00000000000..408ba461aaa
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-azure-ptp
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -euo pipefail
+
+config_dir="/run/chrony/conf.d"
+config_file="${config_dir}/azure-ptp.conf"
+
+install -d -m 0755 "${config_dir}"
+
+if [[ -e /dev/ptp_hyperv ]]; then
+    printf '%s\n' \
+        'refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 stratum 2 prefer' \
+        > "${config_file}"
+else
+    rm -f "${config_file}"
+fi
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-hyperv.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-hyperv.conf
index 9e2fd604a58..9d09ab15377 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-hyperv.conf
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-hyperv.conf
@@ -1,4 +1,6 @@
-# This should only be used when chronyd is configured to use the /dev/ptp_hyperv device
 [Unit]
 Wants=dev-ptp_hyperv.device
 After=dev-ptp_hyperv.device
+
+[Service]
+ExecStartPre=/usr/libexec/chrony-azure-ptp
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony.conf
index b5714071aff..306d1d4e01a 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony.conf
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony.conf
@@ -5,6 +5,9 @@
 # Include configuration files found in /etc/chrony/conf.d.
 confdir /etc/chrony/conf.d
 
+# Include runtime configuration generated for Azure platform devices.
+confdir /run/chrony/conf.d
+
 # This will use (up to):
 # - 2 sources from 2.ubuntu.pool.ntp.org which is ipv6 enabled as well
 # - 1 source from [013].ubuntu.pool.ntp.org each (ipv4 only atm)
@@ -25,6 +28,9 @@ sourcedir /run/chrony-dhcp
 # Use NTP sources found in /etc/chrony/sources.d.
 sourcedir /etc/chrony/sources.d
 
+# Match the Azure Linux 3.0 RPM fallback when Hyper-V PTP is unavailable.
+server time.windows.com iburst
+
 # This directive specify the location of the file containing ID/key pairs for
 # NTP authentication.
 #keyfile /etc/chrony/chrony.keys
@@ -58,8 +64,5 @@ makestep 1.0 -1
 # leap-smeared time.
 leapsectz right/UTC
 
-# Azure hosts are synchronized to internal Microsoft time servers
-# that take their time from Microsoft-owned Stratum 1 devices.
-# The Hyper-V drivers surface this time source as a PTP-based
-# time source in the guest. This configures chrony to use it.
-refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 stratum 2
+# /run/chrony/conf.d/azure-ptp.conf is generated before chronyd starts when
+# the Hyper-V PTP device is available.
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh
index c8c243fa20e..a0cc1238377 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh
@@ -55,18 +55,30 @@ if [[ -f "${rootfs}/usr/lib/systemd/system/chronyd.service" ]]; then
     sed -i \
         's|^ExecStart=/usr/sbin/chronyd $OPTIONS$|ExecStart=/usr/sbin/chronyd -f /usr/lib/chrony/chrony.conf $OPTIONS|' \
         "${rootfs}/usr/lib/systemd/system/chronyd.service"
+
+    # Azure Linux 3.0 adds remove-daemon-state, but its chrony-helper does not
+    # implement that command. Preserve update-daemon for DHCP-provided sources.
+    sed -i \
+        '\|^ExecStopPost=.*/chrony-helper remove-daemon-state$|d' \
+        "${rootfs}/usr/lib/systemd/system/chronyd.service"
 fi
 
 # Copy Azure-optimized chrony.conf from this directory.
 # Overwrites the RPM default that manglefs already moved from /etc.
-# Key differences: makestep 1.0 -1 (always-step), PTP refclock for Hyper-V clock.
+# Key differences: always-step, network fallback, and optional Hyper-V PTP.
 
 # Copy Azure-optimized chrony.conf to /usr/lib/chrony/chrony.conf
 if [[ -f "${script_dir}/chrony.conf" ]]; then
     cp "${script_dir}/chrony.conf" "${rootfs}/usr/lib/chrony/chrony.conf"
 fi
 
-# chronyd.service drop-in (Wants/After dev-ptp_hyperv.device)
+# Generate the optional Hyper-V PTP source before chronyd starts.
+if [[ -f "${script_dir}/chrony-azure-ptp" ]]; then
+    install -D -m 0755 "${script_dir}/chrony-azure-ptp" \
+        "${rootfs}/usr/libexec/chrony-azure-ptp"
+fi
+
+# chronyd.service drop-in for optional Hyper-V PTP configuration.
 if [[ -f "${script_dir}/chrony-hyperv.conf" ]]; then
     mkdir -p "${rootfs}/usr/lib/systemd/system/chronyd.service.d"
     cp "${script_dir}/chrony-hyperv.conf" \

From a17f8c12530521b33530db85a498393caa734c4d Mon Sep 17 00:00:00 2001
From: Mayank Singh <mayansingh@microsoft.com>
Date: Thu, 3 Sep 2026 06:22:48 +0000
Subject: [PATCH 3/5] incporporate review comments

---
 ...-decrypt-root-fix-firstboot-ordering.patch | 33 ++++++++++---------
 acl/SPECS/bootengine/bootengine.spec          |  7 ++--
 .../oem-azure/files/chrony-azure-ptp          |  2 +-
 .../oem-azure/files/chrony-hyperv.conf        |  4 +--
 .../coreos-base/oem-azure/files/chrony.conf   | 20 ++---------
 .../oem-azure/files/manglefs_rpm.sh           | 27 ++++++++++-----
 .../oem-azure/oem-azure-2.12.0.4-r2.ebuild    |  2 ++
 7 files changed, 46 insertions(+), 49 deletions(-)

diff --git a/acl/SPECS/bootengine/0003-decrypt-root-fix-firstboot-ordering.patch b/acl/SPECS/bootengine/0003-decrypt-root-fix-firstboot-ordering.patch
index bb27fde9644..b7f942f6940 100644
--- a/acl/SPECS/bootengine/0003-decrypt-root-fix-firstboot-ordering.patch
+++ b/acl/SPECS/bootengine/0003-decrypt-root-fix-firstboot-ordering.patch
@@ -1,24 +1,25 @@
 From b5153c74f62233438a72710673c0e53e3e1af7de Mon Sep 17 00:00:00 2001
 From: Mayank Singh <mayansingh@microsoft.com>
-Date: Mon, 17 Aug 2026 00:00:00 +0000
-Subject: [PATCH] decrypt-root: fix first-boot ordering race
+Date: Thu, 13 Aug 2026 00:00:00 +0000
+Subject: [PATCH] decrypt-root: order unlock before root-device wait
 
-Decrypt ROOT before initramfs waits for or mounts it. Remove the
-ignition-disks ordering that creates a first-boot cycle and can drop the
-decryption job.
+Keep Ignition's disks stage ahead of root decryption because it can provision
+LUKS volumes, then decrypt ROOT before initramfs waits for the root device.
 ---
- dracut/31decrypt-root/decrypt-root.service | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
+ dracut/31decrypt-root/decrypt-root.service | 2 ++
+ 1 file changed, 2 insertions(+)
 
 diff --git a/dracut/31decrypt-root/decrypt-root.service b/dracut/31decrypt-root/decrypt-root.service
-index 54f941a..7702f00 100644
+index 54f941a..226d3d3 100644
 --- a/dracut/31decrypt-root/decrypt-root.service
 +++ b/dracut/31decrypt-root/decrypt-root.service
-@@ -7 +7 @@
--After=systemd-networkd.service dev-disk-by\x2dpartlabel-ROOT.device ignition-disks.service
-+After=systemd-networkd.service dev-disk-by\x2dpartlabel-ROOT.device
-@@ -8,0 +9,3 @@
-+# Decrypt ROOT before initramfs waits for or mounts it.
-+Before=cryptsetup.target initrd-root-device.target sysroot.mount
-+# Avoid ignition-disks.service here; it creates a first-boot ordering cycle.
-
+@@ -4,5 +4,7 @@ Description=Generate and execute a systemd-cryptsetup service to decrypt the ROOT partition
+ DefaultDependencies=no
++# Decrypt ROOT before initramfs waits for it.
++Before=initrd-root-device.target
+ # If systemd-networkd.service is used in the initramfs, then we should run after it, since the ROOT partition
+ # might use network-bound encryption.
+ After=systemd-networkd.service dev-disk-by\x2dpartlabel-ROOT.device ignition-disks.service
+ Wants=dev-disk-by\x2dpartlabel-ROOT.device
+--
+2.43.0
diff --git a/acl/SPECS/bootengine/bootengine.spec b/acl/SPECS/bootengine/bootengine.spec
index 8d257133d60..90a943f7006 100644
--- a/acl/SPECS/bootengine/bootengine.spec
+++ b/acl/SPECS/bootengine/bootengine.spec
@@ -73,10 +73,9 @@ chmod +x \
 %{_sbindir}/update-bootengine
 
 %changelog
-* Mon Aug 17 2026 Mayank Singh <mayansingh@microsoft.com> - 0.0.38-3
-- decrypt-root: fix first-boot ordering race that dropped the decryption job
-  and fell through to the dracut emergency shell (Before= root-device/sysroot,
-  drop After=ignition-disks.service).
+* Thu Aug 13 2026 Mayank Singh <mayansingh@microsoft.com> - 0.0.38-3
+- decrypt-root: run after Ignition disk provisioning and before initramfs waits
+  for the encrypted root device.
 
 * Tue May 06 2026 Lanze Liu <lanzeliu@microsoft.com> - 0.0.38-2
 - Update firstboot addon removal to use glob pattern for UAPI UKI naming
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-azure-ptp b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-azure-ptp
index 408ba461aaa..8a72a102f4a 100755
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-azure-ptp
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-azure-ptp
@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-config_dir="/run/chrony/conf.d"
+config_dir="/run/chrony-azure/conf.d"
 config_file="${config_dir}/azure-ptp.conf"
 
 install -d -m 0755 "${config_dir}"
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-hyperv.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-hyperv.conf
index 9d09ab15377..8b9dbee05a3 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-hyperv.conf
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-hyperv.conf
@@ -1,6 +1,6 @@
 [Unit]
-Wants=dev-ptp_hyperv.device
+# Order after the PTP device if present without waiting for it when unavailable.
 After=dev-ptp_hyperv.device
 
 [Service]
-ExecStartPre=/usr/libexec/chrony-azure-ptp
+ExecStartPre=-/usr/libexec/chrony-azure-ptp
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony.conf
index 306d1d4e01a..c0aa93f1ca7 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony.conf
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony.conf
@@ -6,21 +6,7 @@
 confdir /etc/chrony/conf.d
 
 # Include runtime configuration generated for Azure platform devices.
-confdir /run/chrony/conf.d
-
-# This will use (up to):
-# - 2 sources from 2.ubuntu.pool.ntp.org which is ipv6 enabled as well
-# - 1 source from [013].ubuntu.pool.ntp.org each (ipv4 only atm)
-# This means by default, up to 2 dual-stack and up to 3 additional IPv4-only
-# sources will be used.
-# At the same time it retains some protection against one of the entries being
-# down (compare to just using one of the lines).
-#
-# See http://www.pool.ntp.org/join.html for more information.
-#pool 0.flatcar.pool.ntp.org iburst maxsources 1
-#pool 1.flatcar.pool.ntp.org iburst maxsources 1
-#pool 2.flatcar.pool.ntp.org iburst maxsources 2
-#pool 3.flatcar.pool.ntp.org iburst maxsources 1
+confdir /run/chrony-azure/conf.d
 
 # Use time sources from DHCP.
 sourcedir /run/chrony-dhcp
@@ -28,7 +14,7 @@ sourcedir /run/chrony-dhcp
 # Use NTP sources found in /etc/chrony/sources.d.
 sourcedir /etc/chrony/sources.d
 
-# Match the Azure Linux 3.0 RPM fallback when Hyper-V PTP is unavailable.
+# Retain the Azure Linux 3.0 public fallback.
 server time.windows.com iburst
 
 # This directive specify the location of the file containing ID/key pairs for
@@ -64,5 +50,5 @@ makestep 1.0 -1
 # leap-smeared time.
 leapsectz right/UTC
 
-# /run/chrony/conf.d/azure-ptp.conf is generated before chronyd starts when
+# /run/chrony-azure/conf.d/azure-ptp.conf is generated before chronyd starts when
 # the Hyper-V PTP device is available.
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh
index a0cc1238377..529a6d071eb 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh
@@ -56,8 +56,13 @@ if [[ -f "${rootfs}/usr/lib/systemd/system/chronyd.service" ]]; then
         's|^ExecStart=/usr/sbin/chronyd $OPTIONS$|ExecStart=/usr/sbin/chronyd -f /usr/lib/chrony/chrony.conf $OPTIONS|' \
         "${rootfs}/usr/lib/systemd/system/chronyd.service"
 
-    # Azure Linux 3.0 adds remove-daemon-state, but its chrony-helper does not
-    # implement that command. Preserve update-daemon for DHCP-provided sources.
+    # Azure Linux adds this command, but its chrony-helper does not implement it,
+    # leaving chronyd failed after a clean stop.
+    if ! grep -qE '^ExecStopPost=.*/chrony-helper remove-daemon-state$' \
+        "${rootfs}/usr/lib/systemd/system/chronyd.service"; then
+        echo "ERROR: expected chrony-helper remove-daemon-state line not found" >&2
+        exit 1
+    fi
     sed -i \
         '\|^ExecStopPost=.*/chrony-helper remove-daemon-state$|d' \
         "${rootfs}/usr/lib/systemd/system/chronyd.service"
@@ -73,17 +78,21 @@ if [[ -f "${script_dir}/chrony.conf" ]]; then
 fi
 
 # Generate the optional Hyper-V PTP source before chronyd starts.
-if [[ -f "${script_dir}/chrony-azure-ptp" ]]; then
-    install -D -m 0755 "${script_dir}/chrony-azure-ptp" \
-        "${rootfs}/usr/libexec/chrony-azure-ptp"
+if [[ ! -f "${script_dir}/chrony-azure-ptp" ]]; then
+    echo "ERROR: missing ${script_dir}/chrony-azure-ptp" >&2
+    exit 1
 fi
+install -D -m 0755 "${script_dir}/chrony-azure-ptp" \
+    "${rootfs}/usr/libexec/chrony-azure-ptp"
 
 # chronyd.service drop-in for optional Hyper-V PTP configuration.
-if [[ -f "${script_dir}/chrony-hyperv.conf" ]]; then
-    mkdir -p "${rootfs}/usr/lib/systemd/system/chronyd.service.d"
-    cp "${script_dir}/chrony-hyperv.conf" \
-       "${rootfs}/usr/lib/systemd/system/chronyd.service.d/"
+if [[ ! -f "${script_dir}/chrony-hyperv.conf" ]]; then
+    echo "ERROR: missing ${script_dir}/chrony-hyperv.conf" >&2
+    exit 1
 fi
+mkdir -p "${rootfs}/usr/lib/systemd/system/chronyd.service.d"
+cp "${script_dir}/chrony-hyperv.conf" \
+   "${rootfs}/usr/lib/systemd/system/chronyd.service.d/"
 
 # Chrony tmpfiles: /var/lib/chrony dir + /etc/chrony.keys copy-on-boot
 if [[ -f "${script_dir}/var-chrony.conf" ]]; then
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/oem-azure-2.12.0.4-r2.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/oem-azure-2.12.0.4-r2.ebuild
index d32ccde9450..6f431e3871c 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/oem-azure-2.12.0.4-r2.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/oem-azure-2.12.0.4-r2.ebuild
@@ -31,6 +31,8 @@ src_install() {
 	systemd_enable_service multi-user.target chronyd.service
 	insinto "$(systemd_get_systemunitdir)"/chronyd.service.d
 	doins "${FILESDIR}"/chrony-hyperv.conf
+	exeinto /usr/libexec
+	doexe "${FILESDIR}"/chrony-azure-ptp
 	dotmpfiles "${FILESDIR}"/var-chrony.conf
 	dotmpfiles "${FILESDIR}"/etc-chrony.conf
 	insinto /usr/share/${PN}

From eb40735b20995a4c900fea1b0f6fb3fa74359978 Mon Sep 17 00:00:00 2001
From: Mayank Singh <mayansingh@microsoft.com>
Date: Wed, 7 Oct 2026 15:25:30 +0000
Subject: [PATCH 4/5] trust the PHC

---
 ...-decrypt-root-fix-firstboot-ordering.patch | 25 -------------------
 .../oem-azure/files/chrony-azure-ptp          |  4 ++-
 .../oem-azure/files/chrony-hyperv.conf        |  2 ++
 .../coreos-base/oem-azure/files/chrony.conf   |  8 +++---
 4 files changed, 9 insertions(+), 30 deletions(-)
 delete mode 100644 acl/SPECS/bootengine/0003-decrypt-root-fix-firstboot-ordering.patch

diff --git a/acl/SPECS/bootengine/0003-decrypt-root-fix-firstboot-ordering.patch b/acl/SPECS/bootengine/0003-decrypt-root-fix-firstboot-ordering.patch
deleted file mode 100644
index b7f942f6940..00000000000
--- a/acl/SPECS/bootengine/0003-decrypt-root-fix-firstboot-ordering.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From b5153c74f62233438a72710673c0e53e3e1af7de Mon Sep 17 00:00:00 2001
-From: Mayank Singh <mayansingh@microsoft.com>
-Date: Thu, 13 Aug 2026 00:00:00 +0000
-Subject: [PATCH] decrypt-root: order unlock before root-device wait
-
-Keep Ignition's disks stage ahead of root decryption because it can provision
-LUKS volumes, then decrypt ROOT before initramfs waits for the root device.
----
- dracut/31decrypt-root/decrypt-root.service | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/dracut/31decrypt-root/decrypt-root.service b/dracut/31decrypt-root/decrypt-root.service
-index 54f941a..226d3d3 100644
---- a/dracut/31decrypt-root/decrypt-root.service
-+++ b/dracut/31decrypt-root/decrypt-root.service
-@@ -4,5 +4,7 @@ Description=Generate and execute a systemd-cryptsetup service to decrypt the ROOT partition
- DefaultDependencies=no
-+# Decrypt ROOT before initramfs waits for it.
-+Before=initrd-root-device.target
- # If systemd-networkd.service is used in the initramfs, then we should run after it, since the ROOT partition
- # might use network-bound encryption.
- After=systemd-networkd.service dev-disk-by\x2dpartlabel-ROOT.device ignition-disks.service
- Wants=dev-disk-by\x2dpartlabel-ROOT.device
---
-2.43.0
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-azure-ptp b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-azure-ptp
index 8a72a102f4a..030c2a550b9 100755
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-azure-ptp
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-azure-ptp
@@ -8,8 +8,10 @@ config_file="${config_dir}/azure-ptp.conf"
 install -d -m 0755 "${config_dir}"
 
 if [[ -e /dev/ptp_hyperv ]]; then
+    # trust keeps the host clock authoritative: without it a disagreement with the
+    # public NTP fallback marks both sources falsetickers and chronyd loses sync.
     printf '%s\n' \
-        'refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 stratum 2 prefer' \
+        'refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 stratum 2 prefer trust' \
         > "${config_file}"
 else
     rm -f "${config_file}"
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-hyperv.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-hyperv.conf
index 8b9dbee05a3..b398d6a7154 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-hyperv.conf
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony-hyperv.conf
@@ -1,5 +1,7 @@
 [Unit]
 # Order after the PTP device if present without waiting for it when unavailable.
+# No Wants= on purpose: CVMs never get this device, so it would stall chronyd every
+# boot. Cost is that a late device waits for the next chronyd restart.
 After=dev-ptp_hyperv.device
 
 [Service]
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony.conf
index c0aa93f1ca7..80c541f2abe 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony.conf
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/chrony.conf
@@ -6,6 +6,8 @@
 confdir /etc/chrony/conf.d
 
 # Include runtime configuration generated for Azure platform devices.
+# azure-ptp.conf is generated here before chronyd starts when the Hyper-V PTP
+# device is available.
 confdir /run/chrony-azure/conf.d
 
 # Use time sources from DHCP.
@@ -42,13 +44,11 @@ maxupdateskew 100.0
 rtcsync
 
 # Step the system clock instead of slewing it if the adjustment is larger than
-# one second, but only in the first three clock updates.
+# one second. Unbounded on purpose: the AKS VHD test jumps the clock years back
+# long after boot and expects chrony to step it, which a bounded limit can't do.
 makestep 1.0 -1
 
 # Get TAI-UTC offset and leap seconds from the system tz database.
 # This directive must be commented out when using time sources serving
 # leap-smeared time.
 leapsectz right/UTC
-
-# /run/chrony-azure/conf.d/azure-ptp.conf is generated before chronyd starts when
-# the Hyper-V PTP device is available.

From 8fe04298cdd699be4bdc50f95eeb27bd62343f07 Mon Sep 17 00:00:00 2001
From: Mayank Singh <mayansingh@microsoft.com>
Date: Wed, 7 Oct 2026 15:25:30 +0000
Subject: [PATCH 5/5] use a drop-in for decrypt-root ordering

---
 acl/SPECS/bootengine/bootengine.spec                   |  7 +------
 build_library/rpm/additional_files/99-acl.conf         |  7 ++-----
 build_library/rpm/dracut_install.sh                    | 10 ++++++++++
 .../coreos-base/oem-azure/files/manglefs_rpm.sh        |  6 ++++--
 4 files changed, 17 insertions(+), 13 deletions(-)

diff --git a/acl/SPECS/bootengine/bootengine.spec b/acl/SPECS/bootengine/bootengine.spec
index 90a943f7006..96b36ce0395 100644
--- a/acl/SPECS/bootengine/bootengine.spec
+++ b/acl/SPECS/bootengine/bootengine.spec
@@ -2,7 +2,7 @@
 
 Name:           bootengine
 Version:        0.0.38
-Release:        3%{?dist}
+Release:        2%{?dist}
 Summary:        Flatcar bootengine dracut modules and helper utilities
 
 License:        BSD-2-Clause
@@ -12,7 +12,6 @@ URL:            https://github.com/flatcar/bootengine
 Source0:        https://github.com/flatcar/bootengine/archive/%{commit_hash}.tar.gz#/%{name}-%{version}.tar.gz
 Patch0:         0001-modify-tests.patch
 Patch1:         0002-delete-UKI-firstboot-addon-after-Ignition.patch
-Patch2:         0003-decrypt-root-fix-firstboot-ordering.patch
 BuildArch:      noarch
 BuildRequires:  dracut
 Requires:       util-linux
@@ -73,10 +72,6 @@ chmod +x \
 %{_sbindir}/update-bootengine
 
 %changelog
-* Thu Aug 13 2026 Mayank Singh <mayansingh@microsoft.com> - 0.0.38-3
-- decrypt-root: run after Ignition disk provisioning and before initramfs waits
-  for the encrypted root device.
-
 * Tue May 06 2026 Lanze Liu <lanzeliu@microsoft.com> - 0.0.38-2
 - Update firstboot addon removal to use glob pattern for UAPI UKI naming
 
diff --git a/build_library/rpm/additional_files/99-acl.conf b/build_library/rpm/additional_files/99-acl.conf
index b40b74dedd5..5dc73798aff 100644
--- a/build_library/rpm/additional_files/99-acl.conf
+++ b/build_library/rpm/additional_files/99-acl.conf
@@ -34,11 +34,6 @@ install_items+=" /usr/sbin/dmsetup "
 # Cryptsetup libraries (required for veritysetup and crypt module)
 install_items+=" /usr/lib/libcryptsetup.so.12 /usr/lib64/libcryptsetup.so.12 "
 install_items+=" /usr/sbin/cryptsetup "
-# TPM2 libs for LUKS root auto-unlock. systemd-cryptsetup dlopen()s these at
-# runtime, so dracut's ldd scan misses them and so we are adding them.
-install_items+=" /usr/lib64/libtss2-esys.so.0 /usr/lib64/libtss2-sys.so.1 "
-install_items+=" /usr/lib64/libtss2-mu.so.0 /usr/lib64/libtss2-rc.so.0 "
-install_items+=" /usr/lib64/libtss2-tctildr.so.0 /usr/lib64/libtss2-tcti-device.so.0 "
 # dm-verity tool
 install_items+=" /usr/sbin/veritysetup "
 # systemd-veritysetup binary (dracut should include it via module, but be explicit)
@@ -46,6 +41,8 @@ install_items+=" /usr/lib/systemd/systemd-veritysetup "
 # Include verity device timing drop-ins in initramfs
 # These ensure udev has finished device enumeration before verity setup runs
 install_items+=" /usr/lib/systemd/system/dev-mapper-usr.device.d/no-job-timeout.conf "
+# Ordering drop-in for bootengine's decrypt-root.service (CVM LUKS root)
+install_items+=" /usr/lib/systemd/system/decrypt-root.service.d/10-acl-ordering.conf "
 # Include flatcar-tmpfiles stub needed by bootengine's initrd-setup-root
 install_items+=" /usr/sbin/flatcar-tmpfiles "
 # Include setfiles stub for SELinux-disabled systems
diff --git a/build_library/rpm/dracut_install.sh b/build_library/rpm/dracut_install.sh
index a38301b8fd1..fdda82dde6f 100644
--- a/build_library/rpm/dracut_install.sh
+++ b/build_library/rpm/dracut_install.sh
@@ -397,6 +397,16 @@ EOF
 [Unit]
 # Disable job timeout to allow verity setup to wait for slow device enumeration
 JobRunningTimeoutSec=infinity
+EOF
+
+    # Drop-in for bootengine's decrypt-root.service (31decrypt-root dracut module).
+    # Kept here rather than as a bootengine patch to avoid rebasing with bootengine updates.
+    info "RPM mode: Creating drop-in for decrypt-root.service (ordering before root device wait)"
+    sudo mkdir -p "${systemd_dropin_dir}/decrypt-root.service.d"
+    cat <<'EOF' | sudo tee "${systemd_dropin_dir}/decrypt-root.service.d/10-acl-ordering.conf" > /dev/null
+[Unit]
+# Decrypt ROOT before initramfs waits for it.
+Before=initrd-root-device.target
 EOF
 }
 
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh
index 529a6d071eb..43ec815eca4 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh
@@ -73,9 +73,11 @@ fi
 # Key differences: always-step, network fallback, and optional Hyper-V PTP.
 
 # Copy Azure-optimized chrony.conf to /usr/lib/chrony/chrony.conf
-if [[ -f "${script_dir}/chrony.conf" ]]; then
-    cp "${script_dir}/chrony.conf" "${rootfs}/usr/lib/chrony/chrony.conf"
+if [[ ! -f "${script_dir}/chrony.conf" ]]; then
+    echo "ERROR: missing ${script_dir}/chrony.conf" >&2
+    exit 1
 fi
+cp "${script_dir}/chrony.conf" "${rootfs}/usr/lib/chrony/chrony.conf"
 
 # Generate the optional Hyper-V PTP source before chronyd starts.
 if [[ ! -f "${script_dir}/chrony-azure-ptp" ]]; then