diff --git a/aks-node-controller/parser/helper.go b/aks-node-controller/parser/helper.go
index f5644dcda02..ab9e6210ccf 100644
--- a/aks-node-controller/parser/helper.go
+++ b/aks-node-controller/parser/helper.go
@@ -64,6 +64,7 @@ func getFuncMap() template.FuncMap {
 	return template.FuncMap{
 		"getInitAKSCustomCloudFilepath": getInitAKSCustomCloudFilepath,
 		"getIsAksCustomCloud":           getIsAksCustomCloud,
+		"getCloudLocation":              getCloudLocation,
 	}
 }
 
@@ -538,11 +539,15 @@ func getIsAksCustomCloud(customCloudConfig *aksnodeconfigv1.CustomCloudConfig) b
 	return strings.EqualFold(customCloudConfig.GetCustomCloudEnvName(), helpers.AksCustomCloudName)
 }
 
+func getCloudLocation(v *aksnodeconfigv1.Configuration) string {
+	return strings.ToLower(strings.Join(strings.Fields(v.GetClusterConfig().GetLocation()), ""))
+}
+
 /* GetCloudTargetEnv determines and returns whether the region is a sovereign cloud which
 have their own data compliance regulations (China/Germany/USGov) or standard.  */
 // Azure public cloud.
 func getCloudTargetEnv(v *aksnodeconfigv1.Configuration) string {
-	loc := strings.ToLower(strings.Join(strings.Fields(v.GetClusterConfig().GetLocation()), ""))
+	loc := getCloudLocation(v)
 	switch {
 	case strings.HasPrefix(loc, "china"):
 		return "AzureChinaCloud"
diff --git a/aks-node-controller/parser/templates/cse_cmd.sh.gtpl b/aks-node-controller/parser/templates/cse_cmd.sh.gtpl
index b1359b071d9..42376814388 100644
--- a/aks-node-controller/parser/templates/cse_cmd.sh.gtpl
+++ b/aks-node-controller/parser/templates/cse_cmd.sh.gtpl
@@ -1,6 +1,7 @@
 echo $(date),$(hostname) > ${PROVISION_OUTPUT};
 {{if getIsAksCustomCloud .CustomCloudConfig}}
 REPO_DEPOT_ENDPOINT="{{.CustomCloudConfig.RepoDepotEndpoint}}"
-{{getInitAKSCustomCloudFilepath}} >> /var/log/azure/cluster-provision.log 2>&1;
 {{end}}
+LOCATION="{{getCloudLocation .}}"
+{{getInitAKSCustomCloudFilepath}} >> /var/log/azure/cluster-provision.log 2>&1;
 /usr/bin/nohup /bin/bash -c "/bin/bash /opt/azure/containers/provision_start.sh"
diff --git a/parts/linux/cloud-init/artifacts/cse_cmd.sh b/parts/linux/cloud-init/artifacts/cse_cmd.sh
index bc48088a3b8..16650db92ae 100644
--- a/parts/linux/cloud-init/artifacts/cse_cmd.sh
+++ b/parts/linux/cloud-init/artifacts/cse_cmd.sh
@@ -18,8 +18,9 @@ fi;
 {{end}}
 {{if IsAKSCustomCloud}}
 REPO_DEPOT_ENDPOINT="{{AKSCustomCloudRepoDepotEndpoint}}"
-{{GetInitAKSCustomCloudFilepath}} >> /var/log/azure/cluster-provision.log 2>&1;
 {{end}}
+LOCATION={{GetVariable "location"}}
+{{GetInitAKSCustomCloudFilepath}} >> /var/log/azure/cluster-provision.log 2>&1;
 ADMINUSER={{GetParameter "linuxAdminUsername"}}
 MOBY_VERSION={{GetParameter "mobyVersion"}}
 TENANT_ID={{GetVariable "tenantID"}}
@@ -32,7 +33,6 @@ KUBEPROXY_URL={{GetParameter "kubeProxySpec"}}
 APISERVER_PUBLIC_KEY={{GetParameter "apiServerCertificate"}}
 SUBSCRIPTION_ID={{GetVariable "subscriptionId"}}
 RESOURCE_GROUP={{GetVariable "resourceGroup"}}
-LOCATION={{GetVariable "location"}}
 VM_TYPE={{GetVariable "vmType"}}
 SUBNET={{GetVariable "subnetName"}}
 NETWORK_SECURITY_GROUP={{GetVariable "nsgName"}}
diff --git a/parts/linux/cloud-init/artifacts/init-aks-custom-cloud-mariner.sh b/parts/linux/cloud-init/artifacts/init-aks-custom-cloud-mariner.sh
deleted file mode 100644
index 587da9ba270..00000000000
--- a/parts/linux/cloud-init/artifacts/init-aks-custom-cloud-mariner.sh
+++ /dev/null
@@ -1,186 +0,0 @@
-#!/bin/bash
-set -x
-mkdir -p /root/AzureCACertificates
-
-IS_MARINER=0
-IS_AZURELINUX=0
-# shellcheck disable=SC3010
-if [[ -f /etc/os-release ]]; then
-        . /etc/os-release
-    # shellcheck disable=SC3010
-    if [[ $NAME == *"Mariner"* ]]; then
-        IS_MARINER=1
-    elif [[ $NAME == *"Microsoft Azure Linux"* ]]; then
-        IS_AZURELINUX=1
-    else
-        echo "Unknown Linux distribution"
-        exit 1
-    fi
-else
-    echo "Unsupported operating system"
-    exit 1
-fi
-
-echo "distribution is $distribution"
-echo "Running on $NAME"
-
-# http://168.63.129.16 is a constant for the host's wireserver endpoint
-certs=$(curl "http://168.63.129.16/machine?comp=acmspackage&type=cacertificates&ext=json")
-IFS_backup=$IFS
-IFS=$'\r\n'
-certNames=($(echo $certs | grep -oP '(?<=Name\": \")[^\"]*'))
-certBodies=($(echo $certs | grep -oP '(?<=CertBody\": \")[^\"]*'))
-for i in ${!certBodies[@]}; do
-    echo ${certBodies[$i]}  | sed 's/\\r\\n/\n/g' | sed 's/\\//g' > "/root/AzureCACertificates/$(echo ${certNames[$i]} | sed 's/.cer/.crt/g')"
-done
-IFS=$IFS_backup
-
-cp /root/AzureCACertificates/*.crt /etc/pki/ca-trust/source/anchors/
-/usr/bin/update-ca-trust
-
-# This section creates a cron job to poll for refreshed CA certs daily
-# It can be removed if not needed or desired
-action=${1:-init}
-if [ "$action" = "ca-refresh" ]; then
-    exit
-fi
-
-scriptPath=$0
-# Determine an absolute, canonical path to this script for use in cron.
-if command -v readlink >/dev/null 2>&1; then
-    # Use readlink -f when available to resolve the canonical path; fall back to $0 on error.
-    scriptPath="$(readlink -f "$0" 2>/dev/null || printf '%s' "$0")"
-fi
-
-if ! crontab -l 2>/dev/null | grep -q "\"$scriptPath\" ca-refresh"; then
-    # Quote the script path in the cron entry to avoid issues with spaces or special characters.
-    if ! (crontab -l 2>/dev/null ; printf '%s\n' "0 19 * * * \"$scriptPath\" ca-refresh") | crontab -; then
-        echo "Failed to install ca-refresh cron job via crontab" >&2
-    fi
-fi
-
-cloud-init status --wait
-
-function init_mariner_repo_depot {
-    local repodepot_endpoint=$1
-    echo "Adding [extended] repo"
-    cp /etc/yum.repos.d/mariner-extras.repo /etc/yum.repos.d/mariner-extended.repo
-    sed -i -e "s|extras|extended|" /etc/yum.repos.d/mariner-extended.repo
-    sed -i -e "s|Extras|Extended|" /etc/yum.repos.d/mariner-extended.repo
-
-    echo "Adding [nvidia] repo"
-    cp /etc/yum.repos.d/mariner-extras.repo /etc/yum.repos.d/mariner-nvidia.repo
-    sed -i -e "s|extras|nvidia|" /etc/yum.repos.d/mariner-nvidia.repo
-    sed -i -e "s|Extras|Nvidia|" /etc/yum.repos.d/mariner-nvidia.repo
-
-    echo "Adding [cloud-native] repo"
-    cp /etc/yum.repos.d/mariner-extras.repo /etc/yum.repos.d/mariner-cloud-native.repo
-    sed -i -e "s|extras|cloud-native|" /etc/yum.repos.d/mariner-cloud-native.repo
-    sed -i -e "s|Extras|Cloud-Native|" /etc/yum.repos.d/mariner-cloud-native.repo
-
-    echo "Pointing Mariner repos at RepoDepot..."
-    for f in /etc/yum.repos.d/*.repo
-    do
-        sed -i -e "s|https://packages.microsoft.com|${repodepot_endpoint}/mariner/packages.microsoft.com|" $f
-        echo "$f modified."
-    done
-    echo "Mariner repo setup complete."
-}
-
-function init_azurelinux_repo_depot {
-    local repodepot_endpoint=$1
-    repos=("amd" "base" "cloud-native" "extended" "ms-non-oss" "ms-oss" "nvidia")
-
-    # tbd maybe we do this a bit nicer
-    rm -f /etc/yum.repos.d/azurelinux*
-
-    for repo in "${repos[@]}"; do
-        output_file="/etc/yum.repos.d/azurelinux-${repo}.repo"
-        repo_content=(
-            "[azurelinux-official-$repo]"
-            "name=Azure Linux Official $repo \$releasever \$basearch"
-            "baseurl=$repodepot_endpoint/azurelinux/\$releasever/prod/$repo/\$basearch"
-            "gpgkey=file:///etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY"
-            "gpgcheck=1"
-            "repo_gpgcheck=1"
-            "enabled=1"
-            "skip_if_unavailable=True"
-            "sslverify=1"
-        )
-
-        rm -f "$output_file"
-
-        for line in "${repo_content[@]}"; do
-            echo "$line" >> "$output_file"
-        done
-
-        echo "File '$output_file' has been created."
-    done
-    echo "Azure Linux repo setup complete."
-}
-
-dnf_makecache() {
-    local retries=10
-    local dnf_makecache_output=/tmp/dnf-makecache.out
-    local i
-    for i in $(seq 1 $retries); do
-        ! (dnf makecache -y 2>&1 | tee $dnf_makecache_output | grep -E "^([WE]:.*)|([eE]rr.*)$") && \
-        cat $dnf_makecache_output && break || \
-        cat $dnf_makecache_output
-        if [ $i -eq $retries ]; then
-            return 1
-        else sleep 5
-        fi
-    done
-    echo "Executed dnf makecache -y $i times"
-}
-
-marinerRepoDepotEndpoint="$(echo "${REPO_DEPOT_ENDPOINT}" | sed 's/\/ubuntu//')"
-if [ -z "$marinerRepoDepotEndpoint" ]; then
-  >&2 echo "repo depot endpoint empty while running custom-cloud init script"
-else
-  # logic taken from https://repodepot.azure.com/scripts/cloud-init/setup_repodepot.sh
-  if [ "$IS_MARINER" -eq 1 ]; then
-      echo "Initializing Mariner repo depot settings..."
-      init_mariner_repo_depot ${marinerRepoDepotEndpoint}
-      dnf_makecache || exit 1
-  elif [ "$IS_AZURELINUX" -eq 1 ]; then
-      echo "Initializing Azure Linux repo depot settings..."
-      init_azurelinux_repo_depot ${marinerRepoDepotEndpoint}
-      dnf_makecache || exit 1
-  else
-      echo "No customizations for distribution: $NAME"
-  fi
-fi
-
-# Set the chrony config to use the PHC /dev/ptp0 clock
-cat > /etc/chrony.conf <<EOF
-# This directive specify the location of the file containing ID/key pairs for
-# NTP authentication.
-keyfile /etc/chrony.keys
-
-# This directive specify the file into which chronyd will store the rate
-# information.
-driftfile /var/lib/chrony/drift
-
-# Uncomment the following line to turn logging on.
-#log tracking measurements statistics
-
-# Log files location.
-logdir /var/log/chrony
-
-# Stop bad estimates upsetting machine clock.
-maxupdateskew 100.0
-
-# This directive enables kernel synchronisation (every 11 minutes) of the
-# real-time clock. Note that it can’t be used along with the 'rtcfile' directive.
-rtcsync
-
-# Settings come from: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/time-sync
-refclock PHC /dev/ptp0 poll 3 dpoll -2 offset 0
-makestep 1.0 -1
-EOF
-
-systemctl restart chronyd
-
-#EOF
diff --git a/parts/linux/cloud-init/artifacts/init-aks-custom-cloud-operation-requests-mariner.sh b/parts/linux/cloud-init/artifacts/init-aks-custom-cloud-operation-requests-mariner.sh
deleted file mode 100644
index 4cd7ebe2689..00000000000
--- a/parts/linux/cloud-init/artifacts/init-aks-custom-cloud-operation-requests-mariner.sh
+++ /dev/null
@@ -1,236 +0,0 @@
-#!/bin/bash
-set -x
-mkdir -p /root/AzureCACertificates
-
-IS_MARINER=0
-IS_AZURELINUX=0
-# shellcheck disable=SC3010
-if [[ -f /etc/os-release ]]; then
-        . /etc/os-release
-    # shellcheck disable=SC3010
-    if [[ $NAME == *"Mariner"* ]]; then
-        IS_MARINER=1
-    elif [[ $NAME == *"Microsoft Azure Linux"* ]]; then
-        IS_AZURELINUX=1
-    else
-        echo "Unknown Linux distribution"
-        exit 1
-    fi
-else
-    echo "Unsupported operating system"
-    exit 1
-fi
-
-echo "distribution is $distribution"
-echo "Running on $NAME"
-
-# http://168.63.129.16 is a constant for the host's wireserver endpoint
-WIRESERVER_ENDPOINT="http://168.63.129.16"
-
-# Function to make HTTP request with retry logic for rate limiting
-make_request_with_retry() {
-    local url="$1"
-    local max_retries=10
-    local retry_delay=3
-    local attempt=1
-
-    local response
-    while [ $attempt -le $max_retries ]; do
-        response=$(curl -f --no-progress-meter "$url")
-        local request_status=$?
-
-        if echo "$response" | grep -q "RequestRateLimitExceeded"; then
-            sleep $retry_delay
-            retry_delay=$((retry_delay * 2))
-            attempt=$((attempt + 1))
-        elif [ $request_status -ne 0 ]; then
-            sleep $retry_delay
-            attempt=$((attempt + 1))
-        else
-            echo "$response"
-            return 0
-        fi
-    done
-
-    echo "exhausted all retries, last response: $response"
-    return 1
-}
-
-# Function to process certificate operations from a given endpoint
-process_cert_operations() {
-    local endpoint_type="$1"
-    local operation_response
-
-    echo "Retrieving certificate operations for type: $endpoint_type"
-    operation_response=$(make_request_with_retry "${WIRESERVER_ENDPOINT}/machine?comp=acmspackage&type=$endpoint_type&ext=json")
-    local request_status=$?
-    if [ -z "$operation_response" ] || [ $request_status -ne 0 ]; then
-        echo "Warning: No response received or request failed for: ${WIRESERVER_ENDPOINT}/machine?comp=acmspackage&type=$endpoint_type&ext=json"
-        return
-    fi
-
-    # Extract ResourceFileName values from the JSON response
-    local cert_filenames
-    mapfile -t cert_filenames < <(echo "$operation_response" | grep -oP '(?<="ResouceFileName": ")[^"]*')
-
-    if [ ${#cert_filenames[@]} -eq 0 ]; then
-        echo "No certificate filenames found in response for $endpoint_type"
-        return
-    fi
-
-    # Process each certificate file
-    for cert_filename in "${cert_filenames[@]}"; do
-        echo "Processing certificate file: $cert_filename"
-
-        # Extract filename and extension
-        local filename="${cert_filename%.*}"
-        local extension="${cert_filename##*.}"
-
-        echo "Downloading certificate: filename=$filename, extension=$extension"
-
-        # Retrieve the actual certificate content with retry logic
-        local cert_content
-        cert_content=$(make_request_with_retry "${WIRESERVER_ENDPOINT}/machine?comp=acmspackage&type=$filename&ext=$extension")
-        local request_status=$?
-        if [ -z "$cert_content" ] || [ $request_status -ne 0 ]; then
-            echo "Warning: No response received or request failed for: ${WIRESERVER_ENDPOINT}/machine?comp=acmspackage&type=$filename&ext=$extension"
-            continue
-        fi
-
-        if [ -n "$cert_content" ]; then
-            # Save the certificate to the appropriate location
-            echo "$cert_content" > "/root/AzureCACertificates/$cert_filename"
-            echo "Successfully saved certificate: $cert_filename"
-        else
-            echo "Warning: Failed to retrieve certificate content for $cert_filename"
-        fi
-    done
-}
-
-# Process root certificates
-process_cert_operations "operationrequestsroot"
-
-# Process intermediate certificates
-process_cert_operations "operationrequestsintermediate"
-
-# Copy all certificate files to the Mariner/AzureLinux system certificate directory
-cp /root/AzureCACertificates/*.crt /etc/pki/ca-trust/source/anchors/
-
-# Update the system certificate store using Mariner/AzureLinux command
-/usr/bin/update-ca-trust
-
-# This section creates a cron job to poll for refreshed CA certs daily
-# It can be removed if not needed or desired
-action=${1:-init}
-if [ "$action" = "ca-refresh" ]; then
-    exit
-fi
-
-scriptPath=$0
-# Determine an absolute, canonical path to this script for use in cron.
-if command -v readlink >/dev/null 2>&1; then
-    # Use readlink -f when available to resolve the canonical path; fall back to $0 on error.
-    scriptPath="$(readlink -f "$0" 2>/dev/null || printf '%s' "$0")"
-fi
-
-if ! crontab -l 2>/dev/null | grep -q "\"$scriptPath\" ca-refresh"; then
-    # Quote the script path in the cron entry to avoid issues with spaces or special characters.
-    if ! (crontab -l 2>/dev/null ; printf '%s\n' "0 19 * * * \"$scriptPath\" ca-refresh") | crontab -; then
-        echo "Failed to install ca-refresh cron job via crontab" >&2
-    fi
-fi
-
-function init_mariner_repo_depot {
-    local repodepot_endpoint=$1
-    echo "Adding [extended] repo"
-    cp /etc/yum.repos.d/mariner-extras.repo /etc/yum.repos.d/mariner-extended.repo
-    sed -i -e "s|extras|extended|" /etc/yum.repos.d/mariner-extended.repo
-    sed -i -e "s|Extras|Extended|" /etc/yum.repos.d/mariner-extended.repo
-
-    echo "Adding [nvidia] repo"
-    cp /etc/yum.repos.d/mariner-extras.repo /etc/yum.repos.d/mariner-nvidia.repo
-    sed -i -e "s|extras|nvidia|" /etc/yum.repos.d/mariner-nvidia.repo
-    sed -i -e "s|Extras|Nvidia|" /etc/yum.repos.d/mariner-nvidia.repo
-
-    echo "Adding [cloud-native] repo"
-    cp /etc/yum.repos.d/mariner-extras.repo /etc/yum.repos.d/mariner-cloud-native.repo
-    sed -i -e "s|extras|cloud-native|" /etc/yum.repos.d/mariner-cloud-native.repo
-    sed -i -e "s|Extras|Cloud-Native|" /etc/yum.repos.d/mariner-cloud-native.repo
-
-    echo "Pointing Mariner repos at RepoDepot..."
-    for f in /etc/yum.repos.d/*.repo
-    do
-        sed -i -e "s|https://packages.microsoft.com|${repodepot_endpoint}/mariner/packages.microsoft.com|" $f
-        echo "$f modified."
-    done
-    echo "Mariner repo setup complete."
-}
-
-function init_azurelinux_repo_depot {
-    local repodepot_endpoint=$1
-    repos=("amd" "base" "cloud-native" "extended" "ms-non-oss" "ms-oss" "nvidia")
-
-    # tbd maybe we do this a bit nicer
-    rm -f /etc/yum.repos.d/azurelinux*
-
-    for repo in "${repos[@]}"; do
-        output_file="/etc/yum.repos.d/azurelinux-${repo}.repo"
-        repo_content=(
-            "[azurelinux-official-$repo]"
-            "name=Azure Linux Official $repo \$releasever \$basearch"
-            "baseurl=$repodepot_endpoint/azurelinux/\$releasever/prod/$repo/\$basearch"
-            "gpgkey=file:///etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY"
-            "gpgcheck=1"
-            "repo_gpgcheck=1"
-            "enabled=1"
-            "skip_if_unavailable=True"
-            "sslverify=1"
-        )
-
-        rm -f "$output_file"
-
-        for line in "${repo_content[@]}"; do
-            echo "$line" >> "$output_file"
-        done
-
-        echo "File '$output_file' has been created."
-    done
-}
-
-cloud-init status --wait
-
-dnf_makecache() {
-    local retries=10
-    local dnf_makecache_output=/tmp/dnf-makecache.out
-    local i
-    for i in $(seq 1 $retries); do
-        ! (dnf makecache -y 2>&1 | tee $dnf_makecache_output | grep -E "^([WE]:.*)|([eE]rr.*)$") && \
-        cat $dnf_makecache_output && break || \
-        cat $dnf_makecache_output
-        if [ $i -eq $retries ]; then
-            return 1
-        else sleep 5
-        fi
-    done
-    echo "Executed dnf makecache -y $i times"
-}
-
-marinerRepoDepotEndpoint="$(echo "${REPO_DEPOT_ENDPOINT}" | sed 's/\/ubuntu//')"
-if [ -z "$marinerRepoDepotEndpoint" ]; then
-  >&2 echo "repo depot endpoint empty while running custom-cloud init script"
-else
-  # logic taken from https://repodepot.azure.com/scripts/cloud-init/setup_repodepot.sh
-  if [ "$IS_MARINER" -eq 1 ]; then
-      echo "Initializing Mariner repo depot settings..."
-      init_mariner_repo_depot ${marinerRepoDepotEndpoint}
-      dnf_makecache || exit 1
-  elif [ "$IS_AZURELINUX" -eq 1 ]; then
-      echo "Initializing Azure Linux repo depot settings..."
-      init_azurelinux_repo_depot ${marinerRepoDepotEndpoint}
-      dnf_makecache || exit 1
-  else
-      echo "No customizations for distribution: $NAME"
-  fi
-fi
-
-#EOF
diff --git a/parts/linux/cloud-init/artifacts/init-aks-custom-cloud-operation-requests.sh b/parts/linux/cloud-init/artifacts/init-aks-custom-cloud-operation-requests.sh
deleted file mode 100644
index 99ae86d0242..00000000000
--- a/parts/linux/cloud-init/artifacts/init-aks-custom-cloud-operation-requests.sh
+++ /dev/null
@@ -1,346 +0,0 @@
-#!/bin/bash
-set -x
-mkdir -p /root/AzureCACertificates
-
-IS_FLATCAR=0
-IS_UBUNTU=0
-IS_ACL=0
-# shellcheck disable=SC3010
-if [[ -f /etc/os-release ]]; then
-    . /etc/os-release
-    # shellcheck disable=SC3010
-    if [[ $NAME == *"Ubuntu"* ]]; then
-        IS_UBUNTU=1
-    elif [[ $ID == *"flatcar"* ]]; then
-        IS_FLATCAR=1
-    elif [[ $ID == "azurecontainerlinux" ]] || { [[ $ID == "azurelinux" ]] && [[ ${VARIANT_ID:-} == "azurecontainerlinux" ]]; }; then
-        IS_ACL=1
-    else
-        echo "Unknown Linux distribution"
-        exit 1
-    fi
-else
-    echo "Unsupported operating system"
-    exit 1
-fi
-
-echo "distribution is $distribution"
-echo "Running on $NAME"
-
-# http://168.63.129.16 is a constant for the host's wireserver endpoint
-WIRESERVER_ENDPOINT="http://168.63.129.16"
-
-# Function to make HTTP request with retry logic for rate limiting
-make_request_with_retry() {
-    local url="$1"
-    local max_retries=10
-    local retry_delay=3
-    local attempt=1
-
-    local response
-    while [ $attempt -le $max_retries ]; do
-        response=$(curl -f --no-progress-meter "$url")
-        local request_status=$?
-
-        if echo "$response" | grep -q "RequestRateLimitExceeded"; then
-            sleep $retry_delay
-            retry_delay=$((retry_delay * 2))
-            attempt=$((attempt + 1))
-        elif [ $request_status -ne 0 ]; then
-            sleep $retry_delay
-            attempt=$((attempt + 1))
-        else
-            echo "$response"
-            return 0
-        fi
-    done
-
-    echo "exhausted all retries, last response: $response"
-    return 1
-}
-
-# Function to process certificate operations from a given endpoint
-process_cert_operations() {
-    local endpoint_type="$1"
-    local operation_response
-
-    echo "Retrieving certificate operations for type: $endpoint_type"
-    operation_response=$(make_request_with_retry "${WIRESERVER_ENDPOINT}/machine?comp=acmspackage&type=$endpoint_type&ext=json")
-    local request_status=$?
-    if [ -z "$operation_response" ] || [ $request_status -ne 0 ]; then
-        echo "Warning: No response received or request failed for: ${WIRESERVER_ENDPOINT}/machine?comp=acmspackage&type=$endpoint_type&ext=json"
-        return
-    fi
-
-    # Extract ResourceFileName values from the JSON response
-    local cert_filenames
-    mapfile -t cert_filenames < <(echo "$operation_response" | grep -oP '(?<="ResouceFileName": ")[^"]*')
-
-    if [ ${#cert_filenames[@]} -eq 0 ]; then
-        echo "No certificate filenames found in response for $endpoint_type"
-        return
-    fi
-
-    # Process each certificate file
-    for cert_filename in "${cert_filenames[@]}"; do
-        echo "Processing certificate file: $cert_filename"
-
-        # Extract filename and extension
-        local filename="${cert_filename%.*}"
-        local extension="${cert_filename##*.}"
-
-        echo "Downloading certificate: filename=$filename, extension=$extension"
-
-        # Retrieve the actual certificate content with retry logic
-        local cert_content
-        cert_content=$(make_request_with_retry "${WIRESERVER_ENDPOINT}/machine?comp=acmspackage&type=$filename&ext=$extension")
-        local request_status=$?
-        if [ -z "$cert_content" ] || [ $request_status -ne 0 ]; then
-            echo "Warning: No response received or request failed for: ${WIRESERVER_ENDPOINT}/machine?comp=acmspackage&type=$filename&ext=$extension"
-            continue
-        fi
-
-        if [ -n "$cert_content" ]; then
-            # Save the certificate to the appropriate location
-            echo "$cert_content" > "/root/AzureCACertificates/$cert_filename"
-            echo "Successfully saved certificate: $cert_filename"
-        else
-            echo "Warning: Failed to retrieve certificate content for $cert_filename"
-        fi
-    done
-}
-
-# Process root certificates
-process_cert_operations "operationrequestsroot"
-
-# Process intermediate certificates
-process_cert_operations "operationrequestsintermediate"
-
-if [ "$IS_ACL" -eq 1 ]; then
-    cp /root/AzureCACertificates/*.crt /etc/pki/ca-trust/source/anchors/
-    update-ca-trust
-elif [ "${IS_FLATCAR}" -eq 0 ]; then
-    # Copy all certificate files to the system certificate directory
-    cp /root/AzureCACertificates/*.crt /usr/local/share/ca-certificates/
-
-    # Update the system certificate store
-    update-ca-certificates
-
-    # This copies the updated bundle to the location used by OpenSSL which is commonly used
-    cp /etc/ssl/certs/ca-certificates.crt /usr/lib/ssl/cert.pem
-else
-    for cert in /root/AzureCACertificates/*.crt; do
-        destcert="${cert##*/}"
-        destcert="${destcert%.*}.pem"
-        cp "$cert" /etc/ssl/certs/"$destcert"
-    done
-    update-ca-certificates
-fi
-
-
-
-# This section creates a cron job to poll for refreshed CA certs daily
-# It can be removed if not needed or desired
-action=${1:-init}
-if [ "$action" = "ca-refresh" ]; then
-    exit
-fi
-
-function init_ubuntu_main_repo_depot {
-    local repodepot_endpoint="$1"
-    # Initialize directory for keys
-    mkdir -p /etc/apt/keyrings
-
-    # This copies the updated bundle to the location used by OpenSSL which is commonly used
-    echo "Copying updated bundle to OpenSSL .pem file..."
-    cp /etc/ssl/certs/ca-certificates.crt /usr/lib/ssl/cert.pem
-    echo "Updated bundle copied."
-
-    # Back up sources.list and sources.list.d contents
-    mkdir -p /etc/apt/backup/
-    if [ -f "/etc/apt/sources.list" ]; then
-        mv /etc/apt/sources.list /etc/apt/backup/
-    fi
-    for sources_file in /etc/apt/sources.list.d/*; do
-        if [ -f "$sources_file" ]; then
-            mv "$sources_file" /etc/apt/backup/
-        fi
-    done
-
-    # Set location of sources file
-    . /etc/os-release
-    aptSourceFile="/etc/apt/sources.list.d/ubuntu.sources"
-
-    # Create main sources file
-    cat <<EOF > /etc/apt/sources.list.d/ubuntu.sources
-
-Types: deb
-URIs: ${repodepot_endpoint}/ubuntu
-Suites: ${VERSION_CODENAME} ${VERSION_CODENAME}-updates ${VERSION_CODENAME}-backports ${VERSION_CODENAME}-security
-Components: main universe restricted multiverse
-Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
-EOF
-
-    # Update the apt sources file using the RepoDepot Ubuntu URL for this cloud. Update it by replacing
-    # all urls with the RepoDepot Ubuntu url
-    ubuntuUrl=${repodepot_endpoint}/ubuntu
-    echo "Converting URLs in $aptSourceFile to RepoDepot URLs..."
-    sed -i "s,https\?://.[^ ]*,$ubuntuUrl,g" $aptSourceFile
-    echo "apt source URLs converted, see new file below:"
-    echo ""
-    echo "-----"
-    cat $aptSourceFile
-    echo "-----"
-    echo ""
-}
-
-function check_url {
-    local url=$1
-    echo "Checking url: $url"
-
-    # Use curl to check the URL and capture both stdout and stderr
-    curl_exit_code=$(curl -s --head --request GET $url)
-    # Check the exit status of curl
-    # shellcheck disable=SC3010
-    if [[ $? -ne 0 ]] || echo "$curl_exit_code" | grep -E "404 Not Found" > /dev/null; then
-        echo "ERROR: $url is not available. Please manually check if the url is valid before re-running script"
-        exit 1
-    fi
-}
-
-function write_to_sources_file {
-    local sources_list_d_file=$1
-    local source_uri=$2
-    shift 2
-    local key_paths=("$@")
-
-    sources_file_path="/etc/apt/sources.list.d/${sources_list_d_file}.sources"
-    ubuntuDist=$(lsb_release -c | awk '{print $2}')
-
-    tee -a $sources_file_path <<EOF
-
-Types: deb
-URIs: $source_uri
-Suites: $ubuntuDist
-Components: main
-Arch: amd64
-Signed-By: ${key_paths[*]}
-EOF
-}
-
-function add_key_ubuntu {
-    local key_name=$1
-
-    key_url="${repodepot_endpoint}/keys/${key_name}"
-    check_url $key_url
-    echo "Adding $key_name key to keyring..."
-    key_data=$(wget -O - $key_url)
-    key_path=$(derive_key_paths $key_name)
-    echo "$key_data" | gpg --dearmor | tee $key_path > /dev/null
-    echo "$key_name key added to keyring."
-}
-
-function derive_key_paths {
-    local key_names=("$@")
-    local key_paths=()
-
-    for key_name in "${key_names[@]}"; do
-        key_paths+=("/etc/apt/keyrings/${key_name}.gpg")
-    done
-
-    echo "${key_paths[*]}"
-}
-
-function add_ms_keys {
-    # Add the Microsoft package server keys to keyring.
-    echo "Adding Microsoft keys to keyring..."
-
-    add_key_ubuntu microsoft.asc
-    add_key_ubuntu msopentech.asc
-}
-
-function aptget_update {
-    echo "apt-get updating..."
-    echo "note: depending on how many sources have been added this may take a couple minutes..."
-    if apt-get update | grep -q "404 Not Found"; then
-        echo "ERROR: apt-get update failed to find all sources. Please validate the sources or remove bad sources from your sources and try again."
-        exit 1
-    else
-        echo "apt-get update complete!"
-    fi
-}
-
-function init_ubuntu_pmc_repo_depot {
-    local repodepot_endpoint="$1"
-    # Add Microsoft packages source to the azure specific sources.list.
-    echo "Adding the packages.microsoft.com Ubuntu-$ubuntuRel repo..."
-
-    microsoftPackageSource="$repodepot_endpoint/microsoft/ubuntu/$ubuntuRel/prod"
-    check_url $microsoftPackageSource
-    write_to_sources_file microsoft-prod $microsoftPackageSource $(derive_key_paths microsoft.asc msopentech.asc)
-    write_to_sources_file microsoft-prod-testing $microsoftPackageSource $(derive_key_paths microsoft.asc msopentech.asc)
-    echo "Ubuntu ($ubuntuRel) repo added."
-    echo "Adding packages.microsoft.com keys"
-    add_ms_keys $repodepot_endpoint
-}
-
-if [ "$IS_UBUNTU" -eq 1 ]; then
-    scriptPath=$0
-    # Determine an absolute, canonical path to this script for use in cron.
-    if command -v readlink >/dev/null 2>&1; then
-        # Use readlink -f when available to resolve the canonical path; fall back to $0 on error.
-        scriptPath="$(readlink -f "$0" 2>/dev/null || printf '%s' "$0")"
-    fi
-
-    if ! crontab -l 2>/dev/null | grep -q "\"$scriptPath\" ca-refresh"; then
-        # Quote the script path in the cron entry to avoid issues with spaces or special characters.
-        if ! (crontab -l 2>/dev/null ; printf '%s\n' "0 19 * * * \"$scriptPath\" ca-refresh") | crontab -; then
-            echo "Failed to install ca-refresh cron job via crontab" >&2
-        fi
-    fi
-
-    cloud-init status --wait
-    rootRepoDepotEndpoint="$(echo "${REPO_DEPOT_ENDPOINT}" | sed 's/\/ubuntu//')"
-    # logic taken from https://repodepot.azure.com/scripts/cloud-init/setup_repodepot.sh
-    ubuntuRel=$(lsb_release --release | awk '{print $2}')
-    ubuntuDist=$(lsb_release -c | awk '{print $2}')
-    # initialize archive.ubuntu.com repo
-    init_ubuntu_main_repo_depot ${rootRepoDepotEndpoint}
-    init_ubuntu_pmc_repo_depot ${rootRepoDepotEndpoint}
-    # update apt list
-    echo "Running apt-get update"
-    aptget_update
-elif [ "$IS_FLATCAR" -eq 1 ] || [ "$IS_ACL" -eq 1 ]; then
-    script_path="$(readlink -f "$0")"
-    svc="/etc/systemd/system/azure-ca-refresh.service"
-    tmr="/etc/systemd/system/azure-ca-refresh.timer"
-
-    cat >"$svc" <<EOF
-[Unit]
-Description=Refresh Azure Custom Cloud CA certificates
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=oneshot
-ExecStart=$script_path ca-refresh
-EOF
-
-    cat >"$tmr" <<EOF
-[Unit]
-Description=Daily refresh of Azure Custom Cloud CA certificates
-
-[Timer]
-OnCalendar=19:00
-Persistent=true
-RandomizedDelaySec=300
-
-[Install]
-WantedBy=timers.target
-EOF
-
-    systemctl daemon-reload
-    systemctl enable --now azure-ca-refresh.timer
-fi
-
-#EOF
diff --git a/parts/linux/cloud-init/artifacts/init-aks-custom-cloud-repos.sh b/parts/linux/cloud-init/artifacts/init-aks-custom-cloud-repos.sh
new file mode 100644
index 00000000000..0c68d513568
--- /dev/null
+++ b/parts/linux/cloud-init/artifacts/init-aks-custom-cloud-repos.sh
@@ -0,0 +1,358 @@
+#!/bin/bash
+# This script handles repo depot initialization and chrony configuration for
+# AKS custom cloud environments. It is sourced by init-aks-custom-cloud.sh and
+# inherits all variables from it (IS_UBUNTU, IS_MARINER, IS_AZURELINUX,
+# IS_FLATCAR, IS_ACL, REPO_DEPOT_ENDPOINT, etc.).
+#
+# This script is only included in custom cloud images to keep the base
+# customData size small for non-custom-cloud scenarios.
+
+set -x
+
+function init_ubuntu_main_repo_depot {
+    local repodepot_endpoint="$1"
+    # Initialize directory for keys
+    mkdir -p /etc/apt/keyrings
+
+    # This copies the updated bundle to the location used by OpenSSL which is commonly used
+    echo "Copying updated bundle to OpenSSL .pem file..."
+    cp /etc/ssl/certs/ca-certificates.crt /usr/lib/ssl/cert.pem
+    echo "Updated bundle copied."
+
+    # Back up sources.list and sources.list.d contents
+    mkdir -p /etc/apt/backup/
+    if [ -f "/etc/apt/sources.list" ]; then
+        mv /etc/apt/sources.list /etc/apt/backup/
+    fi
+    for sources_file in /etc/apt/sources.list.d/*; do
+        if [ -f "$sources_file" ]; then
+            mv "$sources_file" /etc/apt/backup/
+        fi
+    done
+
+    # Set location of sources file
+    . /etc/os-release
+    aptSourceFile="/etc/apt/sources.list.d/ubuntu.sources"
+
+    # Create main sources file
+    cat <<EOF > /etc/apt/sources.list.d/ubuntu.sources
+
+Types: deb
+URIs: ${repodepot_endpoint}/ubuntu
+Suites: ${VERSION_CODENAME} ${VERSION_CODENAME}-updates ${VERSION_CODENAME}-backports ${VERSION_CODENAME}-security
+Components: main universe restricted multiverse
+Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+EOF
+
+    # Update the apt sources file using the RepoDepot Ubuntu URL for this cloud. Update it by replacing
+    # all urls with the RepoDepot Ubuntu url
+    ubuntuUrl=${repodepot_endpoint}/ubuntu
+    echo "Converting URLs in $aptSourceFile to RepoDepot URLs..."
+    sed -i "s,https\?://.[^ ]*,$ubuntuUrl,g" $aptSourceFile
+    echo "apt source URLs converted, see new file below:"
+    echo ""
+    echo "-----"
+    cat $aptSourceFile
+    echo "-----"
+    echo ""
+}
+
+function check_url {
+    local url=$1
+    echo "Checking url: $url"
+
+    # Use curl to check the URL and capture both stdout and stderr
+    curl_exit_code=$(curl -s --head --request GET $url)
+    # Check the exit status of curl
+    # shellcheck disable=SC3010
+    if [[ $? -ne 0 ]] || echo "$curl_exit_code" | grep -E "404 Not Found" > /dev/null; then
+        echo "ERROR: $url is not available. Please manually check if the url is valid before re-running script"
+        exit 1
+    fi
+}
+
+function write_to_sources_file {
+    local sources_list_d_file=$1
+    local source_uri=$2
+    shift 2
+    local key_paths=("$@")
+
+    sources_file_path="/etc/apt/sources.list.d/${sources_list_d_file}.sources"
+    ubuntuDist=$(lsb_release -c | awk '{print $2}')
+
+    tee -a $sources_file_path <<EOF
+
+Types: deb
+URIs: $source_uri
+Suites: $ubuntuDist
+Components: main
+Arch: amd64
+Signed-By: ${key_paths[*]}
+EOF
+}
+
+function add_key_ubuntu {
+    local key_name=$1
+
+    key_url="${repodepot_endpoint}/keys/${key_name}"
+    check_url $key_url
+    echo "Adding $key_name key to keyring..."
+    key_data=$(wget -O - $key_url)
+    key_path=$(derive_key_paths $key_name)
+    echo "$key_data" | gpg --dearmor | tee $key_path > /dev/null
+    echo "$key_name key added to keyring."
+}
+
+function derive_key_paths {
+    local key_names=("$@")
+    local key_paths=()
+
+    for key_name in "${key_names[@]}"; do
+        key_paths+=("/etc/apt/keyrings/${key_name}.gpg")
+    done
+
+    echo "${key_paths[*]}"
+}
+
+function add_ms_keys {
+    # Add the Microsoft package server keys to keyring.
+    echo "Adding Microsoft keys to keyring..."
+
+    add_key_ubuntu microsoft.asc
+    add_key_ubuntu msopentech.asc
+}
+
+function aptget_update {
+    echo "apt-get updating..."
+    echo "note: depending on how many sources have been added this may take a couple minutes..."
+    if apt-get update | grep -q "404 Not Found"; then
+        echo "ERROR: apt-get update failed to find all sources. Please validate the sources or remove bad sources from your sources and try again."
+        exit 1
+    else
+        echo "apt-get update complete!"
+    fi
+}
+
+function init_ubuntu_pmc_repo_depot {
+    local repodepot_endpoint="$1"
+    # Add Microsoft packages source to the azure specific sources.list.
+    echo "Adding the packages.microsoft.com Ubuntu-$ubuntuRel repo..."
+
+    microsoftPackageSource="$repodepot_endpoint/microsoft/ubuntu/$ubuntuRel/prod"
+    check_url $microsoftPackageSource
+    write_to_sources_file microsoft-prod $microsoftPackageSource $(derive_key_paths microsoft.asc msopentech.asc)
+    write_to_sources_file microsoft-prod-testing $microsoftPackageSource $(derive_key_paths microsoft.asc msopentech.asc)
+    echo "Ubuntu ($ubuntuRel) repo added."
+    echo "Adding packages.microsoft.com keys"
+    add_ms_keys $repodepot_endpoint
+}
+
+function init_mariner_repo_depot {
+    local repodepot_endpoint=$1
+    echo "Adding [extended] repo"
+    cp /etc/yum.repos.d/mariner-extras.repo /etc/yum.repos.d/mariner-extended.repo
+    sed -i -e "s|extras|extended|" /etc/yum.repos.d/mariner-extended.repo
+    sed -i -e "s|Extras|Extended|" /etc/yum.repos.d/mariner-extended.repo
+
+    echo "Adding [nvidia] repo"
+    cp /etc/yum.repos.d/mariner-extras.repo /etc/yum.repos.d/mariner-nvidia.repo
+    sed -i -e "s|extras|nvidia|" /etc/yum.repos.d/mariner-nvidia.repo
+    sed -i -e "s|Extras|Nvidia|" /etc/yum.repos.d/mariner-nvidia.repo
+
+    echo "Adding [cloud-native] repo"
+    cp /etc/yum.repos.d/mariner-extras.repo /etc/yum.repos.d/mariner-cloud-native.repo
+    sed -i -e "s|extras|cloud-native|" /etc/yum.repos.d/mariner-cloud-native.repo
+    sed -i -e "s|Extras|Cloud-Native|" /etc/yum.repos.d/mariner-cloud-native.repo
+
+    echo "Pointing Mariner repos at RepoDepot..."
+    for f in /etc/yum.repos.d/*.repo; do
+        sed -i -e "s|https://packages.microsoft.com|${repodepot_endpoint}/mariner/packages.microsoft.com|" $f
+        echo "$f modified."
+    done
+    echo "Mariner repo setup complete."
+}
+
+function init_azurelinux_repo_depot {
+    local repodepot_endpoint=$1
+    local repos=("amd" "base" "cloud-native" "extended" "ms-non-oss" "ms-oss" "nvidia")
+
+    rm -f /etc/yum.repos.d/azurelinux*
+
+    for repo in "${repos[@]}"; do
+        output_file="/etc/yum.repos.d/azurelinux-${repo}.repo"
+        repo_content=(
+            "[azurelinux-official-$repo]"
+            "name=Azure Linux Official $repo \$releasever \$basearch"
+            "baseurl=$repodepot_endpoint/azurelinux/\$releasever/prod/$repo/\$basearch"
+            "gpgkey=file:///etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY"
+            "gpgcheck=1"
+            "repo_gpgcheck=1"
+            "enabled=1"
+            "skip_if_unavailable=True"
+            "sslverify=1"
+        )
+
+        rm -f "$output_file"
+
+        for line in "${repo_content[@]}"; do
+            echo "$line" >> "$output_file"
+        done
+
+        echo "File '$output_file' has been created."
+    done
+    echo "Azure Linux repo setup complete."
+}
+
+function dnf_makecache {
+    local retries=10
+    local dnf_makecache_output=/tmp/dnf-makecache.out
+    local i
+    for i in $(seq 1 $retries); do
+        ! (dnf makecache -y 2>&1 | tee $dnf_makecache_output | grep -E "^([WE]:.*)|([eE]rr.*)$") && \
+        cat $dnf_makecache_output && break || \
+        cat $dnf_makecache_output
+        if [ $i -eq $retries ]; then
+            return 1
+        else
+            sleep 5
+        fi
+    done
+    echo "Executed dnf makecache -y $i times"
+}
+
+if [ "$IS_UBUNTU" -eq 1 ]; then
+    rootRepoDepotEndpoint="$(echo "${REPO_DEPOT_ENDPOINT}" | sed 's/\/ubuntu//')"
+    if [ -n "$rootRepoDepotEndpoint" ]; then
+        cloud-init status --wait
+        ubuntuRel=$(lsb_release --release | awk '{print $2}')
+        ubuntuDist=$(lsb_release -c | awk '{print $2}')
+        init_ubuntu_main_repo_depot ${rootRepoDepotEndpoint}
+        init_ubuntu_pmc_repo_depot ${rootRepoDepotEndpoint}
+        echo "Running apt-get update"
+        aptget_update
+    else
+        echo "REPO_DEPOT_ENDPOINT empty, skipping Ubuntu RepoDepot initialization"
+    fi
+elif [ "$IS_MARINER" -eq 1 ] || [ "$IS_AZURELINUX" -eq 1 ]; then
+    cloud-init status --wait
+
+    marinerRepoDepotEndpoint="$(echo "${REPO_DEPOT_ENDPOINT}" | sed 's/\/ubuntu//')"
+    if [ -z "$marinerRepoDepotEndpoint" ]; then
+        >&2 echo "repo depot endpoint empty while running custom-cloud init script"
+    else
+        if [ "$IS_MARINER" -eq 1 ]; then
+            echo "Initializing Mariner repo depot settings..."
+            init_mariner_repo_depot ${marinerRepoDepotEndpoint}
+            dnf_makecache || exit 1
+        else
+            echo "Initializing Azure Linux repo depot settings..."
+            init_azurelinux_repo_depot ${marinerRepoDepotEndpoint}
+            dnf_makecache || exit 1
+        fi
+    fi
+fi
+
+# Disable systemd-timesyncd and install chrony and uses local time source
+# ACL has PTP clock config compiled into chronyd with no config file or sourcedir directives,
+# so it uses only the local PTP clock and has no DHCP-injectable NTP sources.
+if [ "$IS_ACL" -eq 1 ]; then
+    echo "Skipping chrony configuration for ACL (PTP clock baked into chronyd, no external NTP sources)"
+elif [ "$IS_MARINER" -eq 1 ] || [ "$IS_AZURELINUX" -eq 1 ]; then
+cat > /etc/chrony.conf <<EOF
+# This directive specify the location of the file containing ID/key pairs for
+# NTP authentication.
+keyfile /etc/chrony.keys
+
+# This directive specify the file into which chronyd will store the rate
+# information.
+driftfile /var/lib/chrony/drift
+
+# Uncomment the following line to turn logging on.
+#log tracking measurements statistics
+
+# Log files location.
+logdir /var/log/chrony
+
+# Stop bad estimates upsetting machine clock.
+maxupdateskew 100.0
+
+# This directive enables kernel synchronisation (every 11 minutes) of the
+# real-time clock. Note that it can't be used along with the 'rtcfile' directive.
+rtcsync
+
+# Settings come from: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/time-sync
+refclock PHC /dev/ptp0 poll 3 dpoll -2 offset 0
+makestep 1.0 -1
+EOF
+
+systemctl restart chronyd
+else
+chrony_conf="/etc/chrony/chrony.conf"
+if [ "$IS_UBUNTU" -eq 1 ]; then
+    systemctl stop systemd-timesyncd
+    systemctl disable systemd-timesyncd
+
+    if [ ! -e "$chrony_conf" ]; then
+        apt-get update
+        apt-get install chrony -y
+    fi
+elif [ "$IS_FLATCAR" -eq 1 ]; then
+    rm -f ${chrony_conf}
+fi
+
+cat > $chrony_conf <<EOF
+# Welcome to the chrony configuration file. See chrony.conf(5) for more
+# information about usuable directives.
+
+# This will use (up to):
+# - 4 sources from ntp.ubuntu.com which some are ipv6 enabled
+# - 2 sources from 2.ubuntu.pool.ntp.org which is ipv6 enabled as well
+# - 1 source from [01].ubuntu.pool.ntp.org each (ipv4 only atm)
+# This means by default, up to 6 dual-stack and up to 2 additional IPv4-only
+# sources will be used.
+# At the same time it retains some protection against one of the entries being
+# down (compare to just using one of the lines). See (LP: #1754358) for the
+# discussion.
+#
+# About using servers from the NTP Pool Project in general see (LP: #104525).
+# Approved by Ubuntu Technical Board on 2011-02-08.
+# See http://www.pool.ntp.org/join.html for more information.
+#pool ntp.ubuntu.com        iburst maxsources 4
+#pool 0.ubuntu.pool.ntp.org iburst maxsources 1
+#pool 1.ubuntu.pool.ntp.org iburst maxsources 1
+#pool 2.ubuntu.pool.ntp.org iburst maxsources 2
+
+# This directive specify the location of the file containing ID/key pairs for
+# NTP authentication.
+keyfile /etc/chrony/chrony.keys
+
+# This directive specify the file into which chronyd will store the rate
+# information.
+driftfile /var/lib/chrony/chrony.drift
+
+# Uncomment the following line to turn logging on.
+#log tracking measurements statistics
+
+# Log files location.
+logdir /var/log/chrony
+
+# Stop bad estimates upsetting machine clock.
+maxupdateskew 100.0
+
+# This directive enables kernel synchronisation (every 11 minutes) of the
+# real-time clock. Note that it can't be used along with the 'rtcfile' directive.
+rtcsync
+
+# Settings come from: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/time-sync
+refclock PHC /dev/ptp0 poll 3 dpoll -2 offset 0
+makestep 1.0 -1
+EOF
+
+if [ "$IS_UBUNTU" -eq 1 ]; then
+    systemctl restart chrony
+elif [ "$IS_FLATCAR" -eq 1 ]; then
+    systemctl restart chronyd
+fi
+fi
+
+#EOF
diff --git a/parts/linux/cloud-init/artifacts/init-aks-custom-cloud.sh b/parts/linux/cloud-init/artifacts/init-aks-custom-cloud.sh
index e7fc41e695d..2fd36c81434 100644
--- a/parts/linux/cloud-init/artifacts/init-aks-custom-cloud.sh
+++ b/parts/linux/cloud-init/artifacts/init-aks-custom-cloud.sh
@@ -1,10 +1,11 @@
 #!/bin/bash
 set -x
-mkdir -p /root/AzureCACertificates
 
 IS_FLATCAR=0
 IS_UBUNTU=0
 IS_ACL=0
+IS_MARINER=0
+IS_AZURELINUX=0
 # shellcheck disable=SC3010
 if [[ -f /etc/os-release ]]; then
     . /etc/os-release
@@ -15,6 +16,10 @@ if [[ -f /etc/os-release ]]; then
         IS_FLATCAR=1
     elif [[ $ID == "azurecontainerlinux" ]] || { [[ $ID == "azurelinux" ]] && [[ ${VARIANT_ID:-} == "azurecontainerlinux" ]]; }; then
         IS_ACL=1
+    elif [[ $NAME == *"Mariner"* ]]; then
+        IS_MARINER=1
+    elif [[ $NAME == *"Microsoft Azure Linux"* ]]; then
+        IS_AZURELINUX=1
     else
         echo "Unknown Linux distribution"
         exit 1
@@ -28,180 +33,216 @@ echo "distribution is $distribution"
 echo "Running on $NAME"
 
 # http://168.63.129.16 is a constant for the host's wireserver endpoint
-certs=$(curl "http://168.63.129.16/machine?comp=acmspackage&type=cacertificates&ext=json")
-IFS_backup=$IFS
-IFS=$'\r\n'
-certNames=($(echo $certs | grep -oP '(?<=Name\": \")[^\"]*'))
-certBodies=($(echo $certs | grep -oP '(?<=CertBody\": \")[^\"]*'))
-ext=".crt"
-if [ "$IS_FLATCAR" -eq 1 ]; then
-    ext=".pem"
-fi
-for i in ${!certBodies[@]}; do
-    echo ${certBodies[$i]}  | sed 's/\\r\\n/\n/g' | sed 's/\\//g' > "/root/AzureCACertificates/$(echo ${certNames[$i]} | sed "s/.cer/.${ext}/g")"
-done
-IFS=$IFS_backup
-
-if [ "$IS_ACL" -eq 1 ]; then
-    cp /root/AzureCACertificates/*.crt /etc/pki/ca-trust/source/anchors/
-    update-ca-trust
-elif [ "$IS_FLATCAR" -eq 1 ]; then
-    cp /root/AzureCACertificates/*.pem /etc/ssl/certs/
-    update-ca-certificates
-else
-    cp /root/AzureCACertificates/*.crt /usr/local/share/ca-certificates/
-    update-ca-certificates
-
-    # This copies the updated bundle to the location used by OpenSSL which is commonly used
-    cp /etc/ssl/certs/ca-certificates.crt /usr/lib/ssl/cert.pem
-fi
+WIRESERVER_ENDPOINT="http://168.63.129.16"
+
+function make_request_with_retry {
+    local url="$1"
+    local max_retries=10
+    local retry_delay=3
+    local attempt=1
+
+    local response
+    while [ $attempt -le $max_retries ]; do
+        response=$(curl -f --no-progress-meter "$url")
+        local request_status=$?
+
+        if echo "$response" | grep -q "RequestRateLimitExceeded"; then
+            sleep $retry_delay
+            retry_delay=$((retry_delay * 2))
+            attempt=$((attempt + 1))
+        elif [ $request_status -ne 0 ]; then
+            sleep $retry_delay
+            attempt=$((attempt + 1))
+        else
+            echo "$response"
+            return 0
+        fi
+    done
 
-# This section creates a cron job to poll for refreshed CA certs daily
-# It can be removed if not needed or desired
-action=${1:-init}
-if [ "$action" = "ca-refresh" ]; then
-    exit
-fi
+    echo "exhausted all retries, last response: $response"
+    return 1
+}
 
-function init_ubuntu_main_repo_depot {
-    local repodepot_endpoint="$1"
-    # Initialize directory for keys
-    mkdir -p /etc/apt/keyrings
+function is_opted_in_for_root_certs {
+    local opt_in_response
 
-    # This copies the updated bundle to the location used by OpenSSL which is commonly used
-    echo "Copying updated bundle to OpenSSL .pem file..."
-    cp /etc/ssl/certs/ca-certificates.crt /usr/lib/ssl/cert.pem
-    echo "Updated bundle copied."
+    opt_in_response=$(make_request_with_retry "${WIRESERVER_ENDPOINT}/acms/isOptedInForRootCerts")
+    local request_status=$?
+    if [ $request_status -ne 0 ] || [ -z "$opt_in_response" ]; then
+        echo "Warning: failed to determine IsOptedInForRootCerts state"
+        return 1
+    fi
 
-    # Back up sources.list and sources.list.d contents
-    mkdir -p /etc/apt/backup/
-    if [ -f "/etc/apt/sources.list" ]; then
-        mv /etc/apt/sources.list /etc/apt/backup/
+    if echo "$opt_in_response" | grep -q "IsOptedInForRootCerts=true"; then
+        echo "IsOptedInForRootCerts=true"
+        return 0
     fi
-    for sources_file in /etc/apt/sources.list.d/*; do
-        if [ -f "$sources_file" ]; then
-            mv "$sources_file" /etc/apt/backup/
-        fi
-    done
 
-    # Set location of sources file
-    . /etc/os-release
-    aptSourceFile="/etc/apt/sources.list.d/ubuntu.sources"
+    echo "Skipping custom cloud root cert installation because IsOptedInForRootCerts is not true"
+    return 1
+}
 
-    # Create main sources file
-    cat <<EOF > /etc/apt/sources.list.d/ubuntu.sources
+function get_trust_store_dir {
+    if [ "$IS_ACL" -eq 1 ] || [ "$IS_MARINER" -eq 1 ] || [ "$IS_AZURELINUX" -eq 1 ]; then
+        echo "/etc/pki/ca-trust/source/anchors"
+    elif [ "$IS_FLATCAR" -eq 1 ]; then
+        echo "/etc/ssl/certs"
+    else
+        echo "/usr/local/share/ca-certificates"
+    fi
+}
 
-Types: deb
-URIs: ${repodepot_endpoint}/ubuntu
-Suites: ${VERSION_CODENAME} ${VERSION_CODENAME}-updates ${VERSION_CODENAME}-backports ${VERSION_CODENAME}-security
-Components: main universe restricted multiverse
-Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
-EOF
+function debug_print_trust_store {
+    local stage="$1"
+    local trust_store_dir
 
-    # Update the apt sources file using the RepoDepot Ubuntu URL for this cloud. Update it by replacing
-    # all urls with the RepoDepot Ubuntu url
-    ubuntuUrl=${repodepot_endpoint}/ubuntu
-    echo "Converting URLs in $aptSourceFile to RepoDepot URLs..."
-    sed -i "s,https\?://.[^ ]*,$ubuntuUrl,g" $aptSourceFile
-    echo "apt source URLs converted, see new file below:"
-    echo ""
-    echo "-----"
-    cat $aptSourceFile
-    echo "-----"
-    echo ""
+    trust_store_dir=$(get_trust_store_dir)
+    echo "Trust store contents ${stage} cert copy: ${trust_store_dir}"
+    ls -al "$trust_store_dir" || true
 }
 
-function check_url {
-    local url=$1
-    echo "Checking url: $url"
+function retrieve_legacy_certs {
+    local certs
+    local cert_names
+    local cert_bodies
+    local i
 
-    # Use curl to check the URL and capture both stdout and stderr
-    curl_exit_code=$(curl -s --head --request GET $url)
-    # Check the exit status of curl
-    # shellcheck disable=SC3010
-    if [[ $? -ne 0 ]] || echo "$curl_exit_code" | grep -E "404 Not Found" > /dev/null; then
-        echo "ERROR: $url is not available. Please manually check if the url is valid before re-running script"
-        exit 1
+    certs=$(make_request_with_retry "${WIRESERVER_ENDPOINT}/machine?comp=acmspackage&type=cacertificates&ext=json")
+    if [ -z "$certs" ]; then
+        echo "Warning: failed to retrieve legacy custom cloud certificates"
+        return 1
     fi
+
+    IFS_backup=$IFS
+    IFS=$'\r\n'
+    cert_names=($(echo $certs | grep -oP '(?<=Name\": \")[^\"]*'))
+    cert_bodies=($(echo $certs | grep -oP '(?<=CertBody\": \")[^\"]*'))
+    for i in ${!cert_bodies[@]}; do
+        echo ${cert_bodies[$i]} | sed 's/\\r\\n/\n/g' | sed 's/\\//g' > "/root/AzureCACertificates/$(echo ${cert_names[$i]} | sed 's/.cer/.crt/g')"
+    done
+    IFS=$IFS_backup
 }
 
-function write_to_sources_file {
-    local sources_list_d_file=$1
-    local source_uri=$2
-    shift 2
-    local key_paths=("$@")
+function process_cert_operations {
+    local endpoint_type="$1"
+    local operation_response
 
-    sources_file_path="/etc/apt/sources.list.d/${sources_list_d_file}.sources"
-    ubuntuDist=$(lsb_release -c | awk '{print $2}')
+    echo "Retrieving certificate operations for type: $endpoint_type"
+    operation_response=$(make_request_with_retry "${WIRESERVER_ENDPOINT}/machine?comp=acmspackage&type=$endpoint_type&ext=json")
+    local request_status=$?
+    if [ -z "$operation_response" ] || [ $request_status -ne 0 ]; then
+        echo "Warning: No response received or request failed for: ${WIRESERVER_ENDPOINT}/machine?comp=acmspackage&type=$endpoint_type&ext=json"
+        return 1
+    fi
 
-    tee -a $sources_file_path <<EOF
+    local cert_filenames
+    mapfile -t cert_filenames < <(echo "$operation_response" | grep -oP '(?<="ResouceFileName": ")[^"]*')
 
-Types: deb
-URIs: $source_uri
-Suites: $ubuntuDist
-Components: main
-Arch: amd64
-Signed-By: ${key_paths[*]}
-EOF
-}
+    if [ ${#cert_filenames[@]} -eq 0 ]; then
+        echo "No certificate filenames found in response for $endpoint_type"
+        return 1
+    fi
 
-function add_key_ubuntu {
-    local key_name=$1
+    for cert_filename in "${cert_filenames[@]}"; do
+        echo "Processing certificate file: $cert_filename"
 
-    key_url="${repodepot_endpoint}/keys/${key_name}"
-    check_url $key_url
-    echo "Adding $key_name key to keyring..."
-    key_data=$(wget -O - $key_url)
-    key_path=$(derive_key_paths $key_name)
-    echo "$key_data" | gpg --dearmor | tee $key_path > /dev/null
-    echo "$key_name key added to keyring."
-}
+        local filename="${cert_filename%.*}"
+        local extension="${cert_filename##*.}"
+        local cert_content
 
-function derive_key_paths {
-    local key_names=("$@")
-    local key_paths=()
+        cert_content=$(make_request_with_retry "${WIRESERVER_ENDPOINT}/machine?comp=acmspackage&type=$filename&ext=$extension")
+        local request_status=$?
+        if [ -z "$cert_content" ] || [ $request_status -ne 0 ]; then
+            echo "Warning: No response received or request failed for: ${WIRESERVER_ENDPOINT}/machine?comp=acmspackage&type=$filename&ext=$extension"
+            continue
+        fi
 
-    for key_name in "${key_names[@]}"; do
-        key_paths+=("/etc/apt/keyrings/${key_name}.gpg")
+        echo "$cert_content" > "/root/AzureCACertificates/$cert_filename"
+        echo "Successfully saved certificate: $cert_filename"
     done
+}
 
-    echo "${key_paths[*]}"
+function retrieve_rcv1p_certs {
+    process_cert_operations "operationrequestsroot" || return 1
+    process_cert_operations "operationrequestsintermediate" || return 1
 }
 
-function add_ms_keys {
-    # Add the Microsoft package server keys to keyring.
-    echo "Adding Microsoft keys to keyring..."
+function install_certs_to_trust_store {
+    mkdir -p /root/AzureCACertificates
+
+    debug_print_trust_store "before"
+
+    if [ "$IS_ACL" -eq 1 ] || [ "$IS_MARINER" -eq 1 ] || [ "$IS_AZURELINUX" -eq 1 ]; then
+        cp /root/AzureCACertificates/*.crt /etc/pki/ca-trust/source/anchors/
+        update-ca-trust
+    elif [ "$IS_FLATCAR" -eq 1 ]; then
+        for cert in /root/AzureCACertificates/*.crt; do
+            destcert="${cert##*/}"
+            destcert="${destcert%.*}.pem"
+            cp "$cert" /etc/ssl/certs/"$destcert"
+        done
+        update-ca-certificates
+    else
+        cp /root/AzureCACertificates/*.crt /usr/local/share/ca-certificates/
+        update-ca-certificates
+
+        # This copies the updated bundle to the location used by OpenSSL which is commonly used
+        cp /etc/ssl/certs/ca-certificates.crt /usr/lib/ssl/cert.pem
+    fi
 
-    add_key_ubuntu microsoft.asc
-    add_key_ubuntu msopentech.asc
+    debug_print_trust_store "after"
 }
 
-function aptget_update {
-    echo "apt-get updating..."
-    echo "note: depending on how many sources have been added this may take a couple minutes..."
-    if apt-get update | grep -q "404 Not Found"; then
-        echo "ERROR: apt-get update failed to find all sources. Please validate the sources or remove bad sources from your sources and try again."
-        exit 1
+# Certificate refresh behavior summary:
+# - legacy mode directly attempts certificate download from wireserver and only in ussec and usnat regions.
+# - rcv1p mode first checks IsOptedInForRootCerts, then downloads only when opted in.
+# - Wireserver failures are treated as non-fatal, and cert trust-store updates are skipped gracefully.
+
+refresh_location="${2:-${LOCATION}}"
+
+location_normalized="${refresh_location,,}"
+location_normalized="${location_normalized//[[:space:]]/}"
+if [ -z "$location_normalized" ]; then
+    echo "Warning: LOCATION is empty; defaulting custom cloud certificate endpoint mode to rcv1p"
+fi
+
+cert_endpoint_mode="rcv1p"
+case "$location_normalized" in
+    ussec*|usnat*) cert_endpoint_mode="legacy" ;;
+esac
+
+echo "Using custom cloud certificate endpoint mode: ${cert_endpoint_mode}"
+install_ca_refresh_schedule=0
+rm -f /root/AzureCACertificates/*
+if [ "$cert_endpoint_mode" = "legacy" ]; then
+    install_ca_refresh_schedule=1
+    if retrieve_legacy_certs; then
+        install_certs_to_trust_store
     else
-        echo "apt-get update complete!"
+        echo "Warning: failed to retrieve legacy certificates from wireserver; continuing without trust store updates"
     fi
-}
+elif [ "$cert_endpoint_mode" = "rcv1p" ]; then
+    if is_opted_in_for_root_certs; then
+        install_ca_refresh_schedule=1
+        if retrieve_rcv1p_certs; then
+            install_certs_to_trust_store
+        else
+            echo "Warning: failed to retrieve rcv1p certificates from wireserver; continuing without trust store updates"
+        fi
+    fi
+fi
 
-function init_ubuntu_pmc_repo_depot {
-    local repodepot_endpoint="$1"
-    # Add Microsoft packages source to the azure specific sources.list.
-    echo "Adding the packages.microsoft.com Ubuntu-$ubuntuRel repo..."
-
-    microsoftPackageSource="$repodepot_endpoint/microsoft/ubuntu/$ubuntuRel/prod"
-    check_url $microsoftPackageSource
-    write_to_sources_file microsoft-prod $microsoftPackageSource $(derive_key_paths microsoft.asc msopentech.asc)
-    write_to_sources_file microsoft-prod-testing $microsoftPackageSource $(derive_key_paths microsoft.asc msopentech.asc)
-    echo "Ubuntu ($ubuntuRel) repo added."
-    echo "Adding packages.microsoft.com keys"
-    add_ms_keys $repodepot_endpoint
-}
+# In ca-refresh mode (invoked by the scheduled cron/systemd task with the location as arg),
+# only the cert refresh above is needed; exit before running the full init path.
+# Action values:
+# - init (default): full provisioning path
+# - ca-refresh <location>: periodic refresh path; location is passed as arg to avoid env dependency
+action=${1:-init}
+if [ "$action" = "ca-refresh" ]; then
+    exit
+fi
 
-if [ "$IS_UBUNTU" -eq 1 ]; then
+if [ "$IS_UBUNTU" -eq 1 ] || [ "$IS_MARINER" -eq 1 ] || [ "$IS_AZURELINUX" -eq 1 ]; then
     scriptPath=$0
     # Determine an absolute, canonical path to this script for use in cron.
     if command -v readlink >/dev/null 2>&1; then
@@ -209,30 +250,21 @@ if [ "$IS_UBUNTU" -eq 1 ]; then
         scriptPath="$(readlink -f "$0" 2>/dev/null || printf '%s' "$0")"
     fi
 
-    if ! crontab -l 2>/dev/null | grep -q "\"$scriptPath\" ca-refresh"; then
-        # Quote the script path in the cron entry to avoid issues with spaces or special characters.
-        if ! (crontab -l 2>/dev/null ; printf '%s\n' "0 19 * * * \"$scriptPath\" ca-refresh") | crontab -; then
-            echo "Failed to install ca-refresh cron job via crontab" >&2
+    if [ "$install_ca_refresh_schedule" -eq 1 ]; then
+        if ! crontab -l 2>/dev/null | grep -q "\"$scriptPath\" ca-refresh"; then
+            # Quote the script path in the cron entry to avoid issues with spaces or special characters.
+            if ! (crontab -l 2>/dev/null ; printf '%s\n' "0 19 * * * \"$scriptPath\" ca-refresh \"$LOCATION\"") | crontab -; then
+                echo "Failed to install ca-refresh cron job via crontab" >&2
+            fi
         fi
     fi
-
-    cloud-init status --wait
-    rootRepoDepotEndpoint="$(echo "${REPO_DEPOT_ENDPOINT}" | sed 's/\/ubuntu//')"
-    # logic taken from https://repodepot.azure.com/scripts/cloud-init/setup_repodepot.sh
-    ubuntuRel=$(lsb_release --release | awk '{print $2}')
-    ubuntuDist=$(lsb_release -c | awk '{print $2}')
-    # initialize archive.ubuntu.com repo
-    init_ubuntu_main_repo_depot ${rootRepoDepotEndpoint}
-    init_ubuntu_pmc_repo_depot ${rootRepoDepotEndpoint}
-    # update apt list
-    echo "Running apt-get update"
-    aptget_update
 elif [ "$IS_FLATCAR" -eq 1 ] || [ "$IS_ACL" -eq 1 ]; then
-    script_path="$(readlink -f "$0")"
-    svc="/etc/systemd/system/azure-ca-refresh.service"
-    tmr="/etc/systemd/system/azure-ca-refresh.timer"
+    if [ "$install_ca_refresh_schedule" -eq 1 ]; then
+        script_path="$(readlink -f "$0")"
+        svc="/etc/systemd/system/azure-ca-refresh.service"
+        tmr="/etc/systemd/system/azure-ca-refresh.timer"
 
-    cat >"$svc" <<EOF
+        cat >"$svc" <<EOF
 [Unit]
 Description=Refresh Azure Custom Cloud CA certificates
 After=network-online.target
@@ -240,10 +272,10 @@ Wants=network-online.target
 
 [Service]
 Type=oneshot
-ExecStart=$script_path ca-refresh
+ExecStart=$script_path ca-refresh $LOCATION
 EOF
 
-    cat >"$tmr" <<EOF
+        cat >"$tmr" <<EOF
 [Unit]
 Description=Daily refresh of Azure Custom Cloud CA certificates
 
@@ -256,82 +288,17 @@ RandomizedDelaySec=300
 WantedBy=timers.target
 EOF
 
-    systemctl daemon-reload
-    systemctl enable --now azure-ca-refresh.timer
-fi
-
-# Disable systemd-timesyncd and install chrony and uses local time source
-# ACL has PTP clock config compiled into chronyd with no config file or sourcedir directives,
-# so it uses only the local PTP clock and has no DHCP-injectable NTP sources.
-if [ "$IS_ACL" -eq 1 ]; then
-    echo "Skipping chrony configuration for ACL (PTP clock baked into chronyd, no external NTP sources)"
-else
-chrony_conf="/etc/chrony/chrony.conf"
-if [ "$IS_UBUNTU" -eq 1 ]; then
-    systemctl stop systemd-timesyncd
-    systemctl disable systemd-timesyncd
-
-    if [ ! -e "$chrony_conf" ]; then
-        apt-get update
-        apt-get install chrony -y
+        systemctl daemon-reload
+        systemctl enable --now azure-ca-refresh.timer
     fi
-elif [ "$IS_FLATCAR" -eq 1 ]; then
-    rm -f ${chrony_conf}
 fi
 
-cat > $chrony_conf <<EOF
-# Welcome to the chrony configuration file. See chrony.conf(5) for more
-# information about usuable directives.
-
-# This will use (up to):
-# - 4 sources from ntp.ubuntu.com which some are ipv6 enabled
-# - 2 sources from 2.ubuntu.pool.ntp.org which is ipv6 enabled as well
-# - 1 source from [01].ubuntu.pool.ntp.org each (ipv4 only atm)
-# This means by default, up to 6 dual-stack and up to 2 additional IPv4-only
-# sources will be used.
-# At the same time it retains some protection against one of the entries being
-# down (compare to just using one of the lines). See (LP: #1754358) for the
-# discussion.
-#
-# About using servers from the NTP Pool Project in general see (LP: #104525).
-# Approved by Ubuntu Technical Board on 2011-02-08.
-# See http://www.pool.ntp.org/join.html for more information.
-#pool ntp.ubuntu.com        iburst maxsources 4
-#pool 0.ubuntu.pool.ntp.org iburst maxsources 1
-#pool 1.ubuntu.pool.ntp.org iburst maxsources 1
-#pool 2.ubuntu.pool.ntp.org iburst maxsources 2
-
-# This directive specify the location of the file containing ID/key pairs for
-# NTP authentication.
-keyfile /etc/chrony/chrony.keys
-
-# This directive specify the file into which chronyd will store the rate
-# information.
-driftfile /var/lib/chrony/chrony.drift
-
-# Uncomment the following line to turn logging on.
-#log tracking measurements statistics
-
-# Log files location.
-logdir /var/log/chrony
-
-# Stop bad estimates upsetting machine clock.
-maxupdateskew 100.0
-
-# This directive enables kernel synchronisation (every 11 minutes) of the
-# real-time clock. Note that it can’t be used along with the 'rtcfile' directive.
-rtcsync
-
-# Settings come from: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/time-sync
-refclock PHC /dev/ptp0 poll 3 dpoll -2 offset 0
-makestep 1.0 -1
-EOF
-
-if [ "$IS_UBUNTU" -eq 1 ]; then
-    systemctl restart chrony
-elif [ "$IS_FLATCAR" -eq 1 ]; then
-    systemctl restart chronyd
+# Source the repo depot and chrony initialization script if present.
+# This script is only included in custom cloud images and handles repo depot
+# configuration and chrony setup. It inherits all variables from this script.
+REPOS_SCRIPT="$(dirname "$(readlink -f "$0")")/init-aks-custom-cloud-repos.sh"
+if [ -f "$REPOS_SCRIPT" ] && [ -s "$REPOS_SCRIPT" ]; then
+    source "$REPOS_SCRIPT"
 fi
-fi # end of IS_ACL skip block
 
 #EOF
diff --git a/parts/linux/cloud-init/nodecustomdata.yml b/parts/linux/cloud-init/nodecustomdata.yml
index b74cdeca6e9..18754fef3ee 100644
--- a/parts/linux/cloud-init/nodecustomdata.yml
+++ b/parts/linux/cloud-init/nodecustomdata.yml
@@ -168,6 +168,13 @@ write_files:
   content: !!binary |
     {{GetVariableProperty "cloudInitData" "initAKSCustomCloud"}}
 
+- path: {{GetInitAKSCustomCloudReposFilepath}}
+  permissions: "0744"
+  encoding: gzip
+  owner: root
+  content: !!binary |
+    {{GetVariableProperty "cloudInitData" "initAKSCustomCloudRepos"}}
+
 - path: /opt/azure/containers/reconcilePrivateHosts.sh
   permissions: "0744"
   encoding: gzip
diff --git a/parts/windows/kuberneteswindowssetup.ps1 b/parts/windows/kuberneteswindowssetup.ps1
index e5a76e37c10..3bf59f71b0b 100644
--- a/parts/windows/kuberneteswindowssetup.ps1
+++ b/parts/windows/kuberneteswindowssetup.ps1
@@ -431,9 +431,10 @@ function BasePrep {
     $envJSON = "{{ GetBase64EncodedEnvironmentJSON }}"
     [io.file]::WriteAllBytes($azureStackConfigFile, [System.Convert]::FromBase64String($envJSON))
 
-    Get-CACertificates
     {{end}}
 
+    Get-CACertificates -Location $Location
+
     Write-CACert -CACertificate $global:CACertificate `
         -KubeDir $global:KubeDir
 
@@ -474,6 +475,16 @@ function BasePrep {
     Adjust-DynamicPortRange
     Register-LogsCleanupScriptTask
     Register-NodeResetScriptTask
+    # Guard against older CSE packages that do not yet export Should-InstallCACertificatesRefreshTask.
+    # If the function is absent (old package), fall back to the previous unconditional behaviour so
+    # that legacy/ussec/usnat clusters continue to register the refresh task.
+    if (Get-Command -Name Should-InstallCACertificatesRefreshTask -ErrorAction Ignore) {
+        if (Should-InstallCACertificatesRefreshTask -Location $Location) {
+            Register-CACertificatesRefreshTask -Location $Location
+        }
+    } elseif (Get-Command -Name Register-CACertificatesRefreshTask -ErrorAction Ignore) {
+        Register-CACertificatesRefreshTask -Location $Location
+    }
 
     Update-DefenderPreferences
 
diff --git a/pkg/agent/baker.go b/pkg/agent/baker.go
index 4f3d0e6364c..da8ecff5f96 100644
--- a/pkg/agent/baker.go
+++ b/pkg/agent/baker.go
@@ -936,6 +936,9 @@ func getContainerServiceFuncMap(config *datamodel.NodeBootstrappingConfiguration
 		"GetInitAKSCustomCloudFilepath": func() string {
 			return initAKSCustomCloudFilepath
 		},
+		"GetInitAKSCustomCloudReposFilepath": func() string {
+			return initAKSCustomCloudReposFilepath
+		},
 		"AKSCustomCloudRepoDepotEndpoint": func() string {
 			return cs.Properties.CustomCloudEnv.RepoDepotEndpoint
 		},
diff --git a/pkg/agent/const.go b/pkg/agent/const.go
index 3dc02012d54..bacc68bfe17 100644
--- a/pkg/agent/const.go
+++ b/pkg/agent/const.go
@@ -89,13 +89,10 @@ const (
 	dhcpv6SystemdService      = "linux/cloud-init/artifacts/dhcpv6.service"
 	dhcpv6ConfigurationScript = "linux/cloud-init/artifacts/enable-dhcpv6.sh"
 
-	// scripts for initializing specifically within AKS stack cloud environments (AGC).
-	initAKSCustomCloudScript        = "linux/cloud-init/artifacts/init-aks-custom-cloud.sh"
-	initAKSCustomCloudMarinerScript = "linux/cloud-init/artifacts/init-aks-custom-cloud-mariner.sh"
-
-	// scripts for initializing specifically within AKS custom cloud environments other than stack cloud (e.g. Bleu).
-	initAKSCustomCloudOperationRequestsScript        = "linux/cloud-init/artifacts/init-aks-custom-cloud-operation-requests.sh"
-	initAKSCustomCloudOperationRequestsMarinerScript = "linux/cloud-init/artifacts/init-aks-custom-cloud-operation-requests-mariner.sh"
+	// script for initializing AKS custom cloud environment (cert refresh + scheduling).
+	initAKSCustomCloudScript = "linux/cloud-init/artifacts/init-aks-custom-cloud.sh"
+	// script for repo depot initialization and chrony configuration (custom cloud only).
+	initAKSCustomCloudReposScript = "linux/cloud-init/artifacts/init-aks-custom-cloud-repos.sh"
 
 	ensureNoDupEbtablesScript  = "linux/cloud-init/artifacts/ensure-no-dup.sh"
 	ensureNoDupEbtablesService = "linux/cloud-init/artifacts/ensure-no-dup.service"
@@ -118,6 +115,7 @@ const (
 	dhcpV6ServiceCSEScriptFilepath       = "/etc/systemd/system/dhcpv6.service"
 	dhcpV6ConfigCSEScriptFilepath        = "/opt/azure/containers/enable-dhcpv6.sh"
 	initAKSCustomCloudFilepath           = "/opt/azure/containers/init-aks-custom-cloud.sh"
+	initAKSCustomCloudReposFilepath      = "/opt/azure/containers/init-aks-custom-cloud-repos.sh"
 )
 
 const (
diff --git a/pkg/agent/variables.go b/pkg/agent/variables.go
index 35b9f944e98..4389b314d14 100644
--- a/pkg/agent/variables.go
+++ b/pkg/agent/variables.go
@@ -64,23 +64,9 @@ func getCustomDataVariables(config *datamodel.NodeBootstrappingConfiguration) pa
 	}
 
 	cloudInitData := cloudInitFiles["cloudInitData"].(paramsMap) //nolint:errcheck // no error is actually here
+	cloudInitData["initAKSCustomCloud"] = getBase64EncodedGzippedCustomScript(initAKSCustomCloudScript, config)
 	if cs.IsAKSCustomCloud() {
-		switch {
-		// AGC still uses the old initAKSCustomCloudScript logic to grab certificates from WireServer
-		// TODO: align initializtion script logic for all clouds (such as Bleu) when able
-		case datamodel.GetCloudTargetEnv(cs.Location) == datamodel.USSecCloud || datamodel.GetCloudTargetEnv(cs.Location) == datamodel.USNatCloud:
-			if config.AgentPoolProfile.Distro.IsAzureLinuxDistro() || isMariner(config.OSSKU) {
-				cloudInitData["initAKSCustomCloud"] = getBase64EncodedGzippedCustomScript(initAKSCustomCloudMarinerScript, config)
-			} else {
-				cloudInitData["initAKSCustomCloud"] = getBase64EncodedGzippedCustomScript(initAKSCustomCloudScript, config)
-			}
-		default: // covers all custom clouds other than USSecCloud and USNatCloud, such as Bleu
-			if config.AgentPoolProfile.Distro.IsAzureLinuxDistro() || isMariner(config.OSSKU) {
-				cloudInitData["initAKSCustomCloud"] = getBase64EncodedGzippedCustomScript(initAKSCustomCloudOperationRequestsMarinerScript, config)
-			} else {
-				cloudInitData["initAKSCustomCloud"] = getBase64EncodedGzippedCustomScript(initAKSCustomCloudOperationRequestsScript, config)
-			}
-		}
+		cloudInitData["initAKSCustomCloudRepos"] = getBase64EncodedGzippedCustomScript(initAKSCustomCloudReposScript, config)
 	}
 
 	if config.IsFlatcar() || config.IsACL() {
diff --git a/spec/parts/linux/cloud-init/artifacts/init_aks_custom_cloud_spec.sh b/spec/parts/linux/cloud-init/artifacts/init_aks_custom_cloud_spec.sh
new file mode 100644
index 00000000000..58812659856
--- /dev/null
+++ b/spec/parts/linux/cloud-init/artifacts/init_aks_custom_cloud_spec.sh
@@ -0,0 +1,61 @@
+#!/bin/bash
+
+Describe 'init-aks-custom-cloud.sh refresh mode wiring'
+    script_path='./parts/linux/cloud-init/artifacts/init-aks-custom-cloud.sh'
+
+    It 'parses action argument after deriving location, with init default'
+        When run grep -Eq '^action=\$\{1:-init\}$' "$script_path"
+        The status should eq 0
+    End
+
+    It 'uses arg2 as location fallback when invoked as ca-refresh'
+        # refresh_location falls back to LOCATION env var when arg2 is absent
+        When run grep -Eq '^refresh_location="\$\{2:-\$\{LOCATION\}\}"$' "$script_path"
+        The status should eq 0
+    End
+
+    It 'always derives cert endpoint mode from refresh_location'
+        When run grep -Eq '^location_normalized="\$\{refresh_location,,\}"$' "$script_path"
+        The status should eq 0
+    End
+
+    It 'maps ussec/usnat locations to legacy cert endpoint mode'
+        When run grep -Eq 'ussec\*|usnat\*\) cert_endpoint_mode="legacy"' "$script_path"
+        The status should eq 0
+    End
+
+    It 'initializes refresh schedule installation as disabled'
+        When run grep -Eq '^install_ca_refresh_schedule=0$' "$script_path"
+        The status should eq 0
+    End
+
+    It 'enables refresh schedule installation for eligible certificate modes'
+        When run grep -Eq '^[[:space:]]*install_ca_refresh_schedule=1$' "$script_path"
+        The status should eq 0
+    End
+
+    It 'gates refresh schedule installation on install_ca_refresh_schedule'
+        When run grep -Eq '^[[:space:]]*if \[ "\$install_ca_refresh_schedule" -eq 1 \]; then$' "$script_path"
+        The status should eq 0
+    End
+
+    It 'checks for ca-refresh mode after certificate refresh logic'
+        When run grep -Eq '^if \[ "\$action" = "ca-refresh" \]; then$' "$script_path"
+        The status should eq 0
+    End
+
+    It 'exits early in ca-refresh mode after certificate refresh logic'
+        When run grep -Eq '^[[:space:]]*exit$' "$script_path"
+        The status should eq 0
+    End
+
+    It 'passes LOCATION directly into cron refresh command'
+        When run grep -Eq 'ca-refresh \\"\$LOCATION\\"' "$script_path"
+        The status should eq 0
+    End
+
+    It 'passes LOCATION directly into systemd refresh command'
+        When run grep -Eq '^ExecStart=\$script_path ca-refresh \$LOCATION$' "$script_path"
+        The status should eq 0
+    End
+End
diff --git a/staging/cse/windows/kubernetesfunc.ps1 b/staging/cse/windows/kubernetesfunc.ps1
index 2a019424ba8..5918e37e57b 100644
--- a/staging/cse/windows/kubernetesfunc.ps1
+++ b/staging/cse/windows/kubernetesfunc.ps1
@@ -69,6 +69,35 @@ function Register-NodeResetScriptTask {
     Register-ScheduledTask -TaskName "k8s-restart-job" -InputObject $definition
 }
 
+function Register-CACertificatesRefreshTask {
+    Param(
+        [Parameter(Mandatory = $false)][string]
+        $Location = ""
+    )
+
+    Logs-To-Event -TaskName "AKS.WindowsCSE.RegisterCACertificatesRefreshTask" -TaskMessage "Start to register CA certificates refresh task"
+    Write-Log "Creating a scheduled task to refresh custom cloud CA certificates"
+
+    $taskName = "aks-ca-certs-refresh-task"
+    if (Get-ScheduledTask -TaskName $taskName -ErrorAction Ignore) {
+        Write-Log "Scheduled task $taskName already exists, skipping registration"
+        return
+    }
+
+    # Include -Location only when it was provided, so older VHDs whose Get-CACertificates
+    # does not accept -Location can still execute the scheduled task successfully.
+    if ([string]::IsNullOrEmpty($Location)) {
+        $refreshCommand = "& { . 'C:\AzureData\windows\windowscsehelper.ps1'; . 'C:\AzureData\windows\kubernetesfunc.ps1'; Get-CACertificates | Out-Null }"
+    } else {
+        $refreshCommand = "& { . 'C:\AzureData\windows\windowscsehelper.ps1'; . 'C:\AzureData\windows\kubernetesfunc.ps1'; Get-CACertificates -Location '$Location' | Out-Null }"
+    }
+    $action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -NonInteractive -ExecutionPolicy Bypass -Command `"$refreshCommand`""
+    $principal = New-ScheduledTaskPrincipal -UserId SYSTEM -LogonType ServiceAccount -RunLevel Highest
+    $trigger = New-JobTrigger -Daily -At "19:00" -DaysInterval 1
+    $definition = New-ScheduledTask -Action $action -Principal $principal -Trigger $trigger -Description "aks-ca-certs-refresh-task"
+    Register-ScheduledTask -TaskName $taskName -InputObject $definition
+}
+
 # TODO ksubrmnn parameterize this fully
 function Write-KubeClusterConfig {
     param(
@@ -220,38 +249,137 @@ function Check-APIServerConnectivity {
     Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_CHECK_API_SERVER_CONNECTIVITY -ErrorMessage "Failed to connect to API server $MasterIP after $retryCount retries. Last exception: $lastExceptionMessage"
 }
 
-function Get-CACertificates {
+function Get-CustomCloudCertEndpointModeFromLocation {
+    Param(
+        [Parameter(Mandatory = $true)][string]
+        $Location
+    )
+
+    # ussec/usnat regions still use the legacy certificate endpoint contract.
+    $normalizedLocation = $Location.ToLowerInvariant()
+    if ($normalizedLocation.StartsWith("ussec") -or $normalizedLocation.StartsWith("usnat")) {
+        return "legacy"
+    }
+
+    # All other regions use the rcv1p endpoint mode with opt-in gating.
+    return "rcv1p"
+}
+
+function Should-InstallCACertificatesRefreshTask {
+    Param(
+        [Parameter(Mandatory = $false)][string]
+        $Location = ""
+    )
+
+    # When Location is not supplied (older callers), default to legacy mode.
+    if ([string]::IsNullOrEmpty($Location)) {
+        return $true
+    }
+    $certEndpointMode = Get-CustomCloudCertEndpointModeFromLocation -Location $Location
+    if ($certEndpointMode -eq "legacy") {
+        return $true
+    }
+
     try {
-        Write-Log "Get CA certificates"
-        $caFolder = "C:\ca"
-        $uri = 'http://168.63.129.16/machine?comp=acmspackage&type=cacertificates&ext=json'
+        $optInUri = 'http://168.63.129.16/acms/isOptedInForRootCerts'
+        $optInResponse = Retry-Command -Command 'Invoke-WebRequest' -Args @{Uri=$optInUri; UseBasicParsing=$true} -Retries 5 -RetryDelaySeconds 10
+        return ($optInResponse.Content -match 'IsOptedInForRootCerts=true')
+    } catch {
+        Write-Log "Skipping CA refresh task registration because IsOptedInForRootCerts could not be determined: $_"
+        return $false
+    }
+}
+
+function Get-CACertificates {
+    Param(
+        [Parameter(Mandatory = $false)][string]
+        $Location = ""
+    )
 
-        Create-Directory -FullPath $caFolder -DirectoryUsage "storing CA certificates"
+    $caFolder = "C:\ca"
+    Create-Directory -FullPath $caFolder -DirectoryUsage "storing CA certificates"
+
+    # When Location is not supplied (older callers), fall back to the legacy endpoint
+    # which was the original behavior before the rcv1p changes.
+    if ([string]::IsNullOrEmpty($Location)) {
+        $certEndpointMode = "legacy"
+        Write-Log "Get CA certificates. Location not provided, defaulting to legacy endpoint mode"
+    } else {
+        $certEndpointMode = Get-CustomCloudCertEndpointModeFromLocation -Location $Location
+        Write-Log "Get CA certificates. Location: $Location. EndpointMode: $certEndpointMode"
+    }
 
-        Write-Log "Download CA certificates rawdata"
-        # This is required when the root CA certs are different for some clouds.
-        try {
+    try {
+        if ($certEndpointMode -eq "legacy") {
+            $uri = 'http://168.63.129.16/machine?comp=acmspackage&type=cacertificates&ext=json'
             $rawData = Retry-Command -Command 'Invoke-WebRequest' -Args @{Uri=$uri; UseBasicParsing=$true} -Retries 5 -RetryDelaySeconds 10
-        } catch {
-            Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_DOWNLOAD_CA_CERTIFICATES -ErrorMessage "Failed to download CA certificates rawdata. Error: $_"
+            $caCerts = ($rawData.Content) | ConvertFrom-Json
+            if ($null -eq $caCerts -or $null -eq $caCerts.Certificates -or $caCerts.Certificates.Length -eq 0) {
+                Write-Log "Warning: CA certificates rawdata is empty for legacy endpoint"
+                return $false
+            }
+
+            foreach ($certificate in $caCerts.Certificates) {
+                $name = $certificate.Name
+                $certFilePath = Join-Path $caFolder $name
+                Write-Log "Write certificate $name to $certFilePath"
+                $certificate.CertBody > $certFilePath
+            }
+
+            return $true
         }
 
-        Write-Log "Convert CA certificates rawdata"
-        $caCerts=($rawData.Content) | ConvertFrom-Json
-        if ([string]::IsNullOrEmpty($caCerts)) {
-            Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_EMPTY_CA_CERTIFICATES -ErrorMessage "CA certificates rawdata is empty"
+        $optInUri = 'http://168.63.129.16/acms/isOptedInForRootCerts'
+        $optInResponse = Retry-Command -Command 'Invoke-WebRequest' -Args @{Uri=$optInUri; UseBasicParsing=$true} -Retries 5 -RetryDelaySeconds 10
+        if (($optInResponse.Content -notmatch 'IsOptedInForRootCerts=true')) {
+            Write-Log "Skipping custom cloud root cert installation because IsOptedInForRootCerts is not true"
+            return $false
         }
 
-        $certificates = $caCerts.Certificates
-        for ($index = 0; $index -lt $certificates.Length ; $index++) {
-            $name=$certificates[$index].Name
-            $certFilePath = Join-Path $caFolder $name
-            Write-Log "Write certificate $name to $certFilePath"
-            $certificates[$index].CertBody > $certFilePath
+        $operationRequestTypes = @("operationrequestsroot", "operationrequestsintermediate")
+        $downloadedAny = $false
+
+        foreach ($requestType in $operationRequestTypes) {
+            $operationRequestUri = "http://168.63.129.16/machine?comp=acmspackage&type=$requestType&ext=json"
+            $operationResponse = Retry-Command -Command 'Invoke-WebRequest' -Args @{Uri=$operationRequestUri; UseBasicParsing=$true} -Retries 5 -RetryDelaySeconds 10
+            $operationJson = ($operationResponse.Content) | ConvertFrom-Json
+
+            if ($null -eq $operationJson -or $null -eq $operationJson.OperationRequests) {
+                Write-Log "Warning: no operation requests found for $requestType"
+                continue
+            }
+
+            foreach ($operation in $operationJson.OperationRequests) {
+                $resourceFileName = $operation.ResouceFileName
+                if ([string]::IsNullOrEmpty($resourceFileName)) {
+                    continue
+                }
+
+                $resourceType = [IO.Path]::GetFileNameWithoutExtension($resourceFileName)
+                $resourceExt = [IO.Path]::GetExtension($resourceFileName).TrimStart('.')
+                $resourceUri = "http://168.63.129.16/machine?comp=acmspackage&type=$resourceType&ext=$resourceExt"
+
+                $certContentResponse = Retry-Command -Command 'Invoke-WebRequest' -Args @{Uri=$resourceUri; UseBasicParsing=$true} -Retries 5 -RetryDelaySeconds 10
+                if ([string]::IsNullOrEmpty($certContentResponse.Content)) {
+                    Write-Log "Warning: empty certificate content for $resourceFileName"
+                    continue
+                }
+
+                $certFilePath = Join-Path $caFolder $resourceFileName
+                Write-Log "Write certificate $resourceFileName to $certFilePath"
+                $certContentResponse.Content > $certFilePath
+                $downloadedAny = $true
+            }
         }
+
+        if (-not $downloadedAny) {
+            Write-Log "Warning: no CA certificates were downloaded in rcv1p mode"
+        }
+
+        return $downloadedAny
     }
     catch {
-        # Catch all exceptions in this function. NOTE: exit cannot be caught.
-        Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_GET_CA_CERTIFICATES -ErrorMessage $_
+        Write-Log "Warning: failed to retrieve CA certificates. Error: $_"
+        return $false
     }
 }
diff --git a/staging/cse/windows/kubernetesfunc.tests.ps1 b/staging/cse/windows/kubernetesfunc.tests.ps1
new file mode 100644
index 00000000000..8ada13ee440
--- /dev/null
+++ b/staging/cse/windows/kubernetesfunc.tests.ps1
@@ -0,0 +1,242 @@
+BeforeAll {
+    if (-not (Get-PSDrive -Name C -ErrorAction SilentlyContinue)) {
+        New-PSDrive -Name C -PSProvider FileSystem -Root ([System.IO.Path]::GetTempPath()) | Out-Null
+    }
+
+    function Write-Log {
+        param($Message)
+        Write-Host "$Message"
+    }
+
+    function Logs-To-Event {
+        param($TaskName, $TaskMessage)
+        Write-Host "$TaskName $TaskMessage"
+    }
+
+    function Set-ExitCode {
+        param($ExitCode, $ErrorMessage)
+        throw "Unexpected Set-ExitCode: $ExitCode $ErrorMessage"
+    }
+
+    function Create-Directory {
+        param($FullPath, $DirectoryUsage)
+        if (-not (Test-Path $FullPath)) {
+            New-Item -Path $FullPath -ItemType Directory -Force | Out-Null
+        }
+    }
+
+    function Get-ScheduledTask {
+        param($TaskName, $ErrorAction)
+    }
+
+    function New-ScheduledTaskAction {
+        param($Execute, $Argument)
+    }
+
+    function New-ScheduledTaskPrincipal {
+        param($UserId, $LogonType, $RunLevel)
+    }
+
+    function New-JobTrigger {
+        param([switch]$Daily, $At, $DaysInterval)
+    }
+
+    function New-ScheduledTask {
+        param($Action, $Principal, $Trigger, $Description)
+    }
+
+    function Register-ScheduledTask {
+        param($TaskName, $InputObject)
+    }
+
+    function Retry-Command {
+        param($Command, $Args, $Retries, $RetryDelaySeconds)
+    }
+
+    $helperScriptPath = Join-Path $PSScriptRoot '..\..\..\parts\windows\windowscsehelper.ps1'
+    $scriptUnderTestPath = Join-Path $PSScriptRoot 'kubernetesfunc.ps1'
+
+    . $helperScriptPath
+    . $scriptUnderTestPath
+}
+
+Describe 'Get-CustomCloudCertEndpointModeFromLocation' {
+    It 'returns legacy for ussec regions' {
+        Get-CustomCloudCertEndpointModeFromLocation -Location 'ussecwest' | Should -Be 'legacy'
+    }
+
+    It 'returns legacy for usnat regions' {
+        Get-CustomCloudCertEndpointModeFromLocation -Location 'usnatcentral' | Should -Be 'legacy'
+    }
+
+    It 'returns rcv1p for public regions' {
+        Get-CustomCloudCertEndpointModeFromLocation -Location 'southcentralus' | Should -Be 'rcv1p'
+    }
+
+    It 'handles mixed-case input' {
+        Get-CustomCloudCertEndpointModeFromLocation -Location 'UsSeCeast' | Should -Be 'legacy'
+    }
+}
+
+Describe 'Register-CACertificatesRefreshTask' {
+    BeforeEach {
+        $script:lastScheduledTaskArgument = $null
+
+        Mock Logs-To-Event -MockWith { }
+        Mock New-ScheduledTaskPrincipal -MockWith { return @{ Kind = 'principal' } }
+        Mock New-JobTrigger -MockWith { return @{ Kind = 'trigger' } }
+        Mock New-ScheduledTask -MockWith { return @{ Kind = 'definition' } }
+        Mock Register-ScheduledTask -MockWith { }
+        Mock New-ScheduledTaskAction -MockWith {
+            param($Execute, $Argument)
+            $script:lastScheduledTaskArgument = $Argument
+            return @{ Execute = $Execute; Argument = $Argument }
+        }
+    }
+
+    It 'skips registration when the task already exists' {
+        Mock Get-ScheduledTask -MockWith { return @{ TaskName = 'aks-ca-certs-refresh-task' } }
+
+        Register-CACertificatesRefreshTask -Location 'southcentralus'
+
+        Assert-MockCalled -CommandName Register-ScheduledTask -Exactly -Times 0
+        Assert-MockCalled -CommandName New-ScheduledTaskAction -Exactly -Times 0
+    }
+
+    It 'creates a scheduled task that passes location for cert endpoint mode derivation' {
+        Mock Get-ScheduledTask -MockWith { return $null }
+
+        Register-CACertificatesRefreshTask -Location 'southcentralus'
+
+        Assert-MockCalled -CommandName Register-ScheduledTask -Exactly -Times 1
+        $script:lastScheduledTaskArgument | Should -Match ([regex]::Escape("Get-CACertificates -Location 'southcentralus'"))
+    }
+}
+
+Describe 'Should-InstallCACertificatesRefreshTask' {
+    BeforeEach {
+        Mock Retry-Command -MockWith { }
+    }
+
+    It 'returns true for legacy regions without calling the opt-in endpoint' {
+        Mock Retry-Command
+
+        $result = Should-InstallCACertificatesRefreshTask -Location 'ussecwest'
+
+        $result | Should -Be $true
+        Assert-MockCalled -CommandName Retry-Command -Exactly -Times 0
+    }
+
+    It 'returns true for rcv1p regions when opt-in is enabled' {
+        $script:lastRetryUri = $null
+        Mock Retry-Command -MockWith {
+            param($Command, $Args, $Retries, $RetryDelaySeconds)
+            $script:lastRetryUri = $PSBoundParameters['Args'].Uri
+            return [PSCustomObject]@{ Content = 'IsOptedInForRootCerts=true' }
+        }
+
+        $result = Should-InstallCACertificatesRefreshTask -Location 'southcentralus'
+
+        $result | Should -Be $true
+        Assert-MockCalled -CommandName Retry-Command -Exactly -Times 1
+        $script:lastRetryUri | Should -Be 'http://168.63.129.16/acms/isOptedInForRootCerts'
+    }
+
+    It 'returns false for rcv1p regions when opt-in is disabled' {
+        Mock Retry-Command -MockWith {
+            return [PSCustomObject]@{ Content = 'IsOptedInForRootCerts=false' }
+        }
+
+        $result = Should-InstallCACertificatesRefreshTask -Location 'southcentralus'
+
+        $result | Should -Be $false
+    }
+}
+
+Describe 'Get-CACertificates' {
+    BeforeEach {
+        if (Test-Path 'C:\ca') {
+            Remove-Item -Path 'C:\ca' -Recurse -Force
+        }
+    }
+
+    It 'uses the legacy endpoint when location is a ussec/usnat region' {
+        $script:retryUris = @()
+        Mock Retry-Command -MockWith {
+            param($Command, $Args, $Retries, $RetryDelaySeconds)
+            $script:retryUris += $PSBoundParameters['Args'].Uri
+            return [PSCustomObject]@{
+                Content = '{"Certificates":[{"Name":"legacy.crt","CertBody":"legacy-body"}]}'
+            }
+        }
+
+        $result = Get-CACertificates -Location 'ussecwest'
+
+        $result | Should -Be $true
+        Assert-MockCalled -CommandName Retry-Command -Exactly -Times 1
+        $script:retryUris | Should -Contain 'http://168.63.129.16/machine?comp=acmspackage&type=cacertificates&ext=json'
+        $script:retryUris | Should -Not -Contain 'http://168.63.129.16/acms/isOptedInForRootCerts'
+    }
+
+    It 'returns false when certificate retrieval throws' {
+        Mock Retry-Command -MockWith {
+            throw 'simulated retrieval failure'
+        }
+
+        $result = Get-CACertificates -Location 'southcentralus'
+
+        $result | Should -Be $false
+    }
+
+    It 'falls back to legacy endpoint when called without -Location (backward compat)' {
+        $script:retryUris = @()
+        Mock Retry-Command -MockWith {
+            param($Command, $Args, $Retries, $RetryDelaySeconds)
+            $script:retryUris += $PSBoundParameters['Args'].Uri
+            return [PSCustomObject]@{
+                Content = '{"Certificates":[{"Name":"compat.crt","CertBody":"compat-body"}]}'
+            }
+        }
+
+        $result = Get-CACertificates
+
+        $result | Should -Be $true
+        Assert-MockCalled -CommandName Retry-Command -Exactly -Times 1
+        $script:retryUris | Should -Contain 'http://168.63.129.16/machine?comp=acmspackage&type=cacertificates&ext=json'
+    }
+}
+
+Describe 'Should-InstallCACertificatesRefreshTask - backward compat' {
+    It 'returns true when called without -Location (backward compat)' {
+        $result = Should-InstallCACertificatesRefreshTask
+
+        $result | Should -Be $true
+    }
+}
+
+Describe 'Register-CACertificatesRefreshTask - backward compat' {
+    BeforeEach {
+        $script:lastScheduledTaskArgument = $null
+
+        Mock Logs-To-Event -MockWith { }
+        Mock New-ScheduledTaskPrincipal -MockWith { return @{ Kind = 'principal' } }
+        Mock New-JobTrigger -MockWith { return @{ Kind = 'trigger' } }
+        Mock New-ScheduledTask -MockWith { return @{ Kind = 'definition' } }
+        Mock Register-ScheduledTask -MockWith { }
+        Mock New-ScheduledTaskAction -MockWith {
+            param($Execute, $Argument)
+            $script:lastScheduledTaskArgument = $Argument
+            return @{ Execute = $Execute; Argument = $Argument }
+        }
+    }
+
+    It 'creates a scheduled task without -Location when called without it (backward compat)' {
+        Mock Get-ScheduledTask -MockWith { return $null }
+
+        Register-CACertificatesRefreshTask
+
+        Assert-MockCalled -CommandName Register-ScheduledTask -Exactly -Times 1
+        $script:lastScheduledTaskArgument | Should -Match ([regex]::Escape("Get-CACertificates |"))
+        $script:lastScheduledTaskArgument | Should -Not -Match "Location"
+    }
+}