diff --git a/hieradata/roles/infra/k8s.yaml b/hieradata/roles/infra/k8s.yaml
index d8c9bcb..b91b86a 100644
--- a/hieradata/roles/infra/k8s.yaml
+++ b/hieradata/roles/infra/k8s.yaml
@@ -11,6 +11,8 @@ hiera_include:
 # manage rke2
 rke2::bootstrap_node: prodnxsr0001.main.unkin.net
 rke2::join_url: https://join-k8s.service.consul:9345
+# pull the airgap image bundle via artifactapi (host-reachable pre-CNI), not github directly
+rke2::container_archive_source: 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download'
 rke2::manage_registries: true
 rke2::registries:
   docker.io:
diff --git a/modules/rke2/manifests/params.pp b/modules/rke2/manifests/params.pp
index a8ab75e..9d5a443 100644
--- a/modules/rke2/manifests/params.pp
+++ b/modules/rke2/manifests/params.pp
@@ -11,7 +11,7 @@ class rke2::params (
   Boolean                 $helm_install = false,
   Hash                    $helm_repos = {},
   Array[String[1]]        $extra_config_files = [],
-  Stdlib::HTTPUrl         $container_archive_source = 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download',
+  Stdlib::HTTPUrl         $container_archive_source = 'https://github.com/rancher/rke2/releases/download',
   Boolean                 $manage_registries = false,
   Hash                    $registries = {},
 ) {}