diff --git a/modules/rke2/manifests/install.pp b/modules/rke2/manifests/install.pp
index 4630f3c..e472eac 100644
--- a/modules/rke2/manifests/install.pp
+++ b/modules/rke2/manifests/install.pp
@@ -13,6 +13,12 @@ class rke2::install (
     before  => Package["rke2-${node_type}"],
   }
 
+  # lock rke2-common (a strict = version dep) so the rolling latest channel can't drift it ahead of the pinned server/agent
+  yum::versionlock{'rke2-common':
+    ensure  => present,
+    version => "${rke2_version}~${rke2_release}",
+  }
+
   # install rke2
   package {"rke2-${node_type}":
     ensure => "${rke2_version}~${rke2_release}",
diff --git a/modules/rke2/manifests/params.pp b/modules/rke2/manifests/params.pp
index 9d5a443..cf92de4 100644
--- a/modules/rke2/manifests/params.pp
+++ b/modules/rke2/manifests/params.pp
@@ -1,8 +1,8 @@
 # rke2 params
 class rke2::params (
   Enum['server', 'agent'] $node_type = 'agent',
-  String                  $rke2_version = '1.33.11',
-  String                  $rke2_release = 'rke2r1',
+  String                  $rke2_version = '1.33.13',
+  String                  $rke2_release = 'rke2r2',
   Stdlib::Absolutepath    $config_file = '/etc/rancher/rke2/config.yaml',
   Hash                    $config_hash = {},
   Stdlib::HTTPSUrl        $join_url = 'https://127.0.0.1:9345',