diff --git a/modules/rke2/manifests/install.pp b/modules/rke2/manifests/install.pp
index f15764d..4b89c06 100644
--- a/modules/rke2/manifests/install.pp
+++ b/modules/rke2/manifests/install.pp
@@ -27,15 +27,18 @@ class rke2::install (
     before  => Service["rke2-${node_type}"],
   }
 
-  # download required archive of containers
-  archive { '/var/lib/rancher/rke2/agent/images/rke2-images.linux-amd64.tar.zst':
-    ensure  => present,
-    source  => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download/v${rke2_version}%2B${rke2_release}/rke2-images.linux-amd64.tar.zst",
-    require => [
-      Package["rke2-${node_type}"],
-      File['/var/lib/rancher/rke2/agent/images'],
-    ],
-    before  => Service["rke2-${node_type}"],
+  # preload airgap tarballs (incl. canal CNI) so flannel/calico start from disk, not the mirror VIP that needs flannel to be reachable
+  $image_archives = ['rke2-images.linux-amd64.tar.zst', 'rke2-images-canal.linux-amd64.tar.zst']
+  $image_archives.each |String $archive_file| {
+    archive { "/var/lib/rancher/rke2/agent/images/${archive_file}":
+      ensure  => present,
+      source  => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download/v${rke2_version}%2B${rke2_release}/${archive_file}",
+      require => [
+        Package["rke2-${node_type}"],
+        File['/var/lib/rancher/rke2/agent/images'],
+      ],
+      before  => Service["rke2-${node_type}"],
+    }
   }
 
   # ensure the images cache file exists
diff --git a/modules/rke2/manifests/params.pp b/modules/rke2/manifests/params.pp
index 4c110dc..9d5a443 100644
--- a/modules/rke2/manifests/params.pp
+++ b/modules/rke2/manifests/params.pp
@@ -1,7 +1,7 @@
 # rke2 params
 class rke2::params (
   Enum['server', 'agent'] $node_type = 'agent',
-  String                  $rke2_version = '1.33.4',
+  String                  $rke2_version = '1.33.11',
   String                  $rke2_release = 'rke2r1',
   Stdlib::Absolutepath    $config_file = '/etc/rancher/rke2/config.yaml',
   Hash                    $config_hash = {},