diff --git a/infra/ansible/roles/k3s_server/tasks/main.yml b/infra/ansible/roles/k3s_server/tasks/main.yml
index 8b13afd..c280031 100644
--- a/infra/ansible/roles/k3s_server/tasks/main.yml
+++ b/infra/ansible/roles/k3s_server/tasks/main.yml
@@ -30,6 +30,14 @@
 # its containerd config.toml (so nonroot-devices takes effect). Apply the restart
 # ROLLING, one node at a time (kube-vip keeps the API reachable; etcd quorum holds
 # at 2/3). See playbooks note: run with `serial: 1`.
+- name: Ensure /etc/rancher/k3s exists (a freshly re-provisioned node has no k3s dir until install)
+  ansible.builtin.file:
+    path: /etc/rancher/k3s
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
 - name: Write /etc/rancher/k3s/config.yaml (tls-san + nonroot-devices + oidc)
   ansible.builtin.copy:
     dest: /etc/rancher/k3s/config.yaml
diff --git a/infra/tofu/variables.tf b/infra/tofu/variables.tf
index 88dbfe4..4b967da 100644
--- a/infra/tofu/variables.tf
+++ b/infra/tofu/variables.tf
@@ -182,7 +182,7 @@ variable "image_source" {
     import + disk-resize under bpg (bpg issue #1639).
   EOT
   type        = string
-  default     = "https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-generic-amd64.qcow2"
+  default     = "https://cloud.debian.org/images/cloud/trixie/latest/debian-13-generic-amd64.qcow2"
 }
 
 variable "image_file_name" {
@@ -194,7 +194,7 @@ variable "image_file_name" {
     panics with "Attempted to kill init" on import + disk-resize (bpg issue #1639).
   EOT
   type        = string
-  default     = "debian-12-generic-amd64.qcow2"
+  default     = "debian-13-generic-amd64.qcow2"
 }
 
 # --- cloud-init identity ----------------------------------------------------