diff --git a/01-proxmox-infra/index.ts b/01-proxmox-infra/index.ts
index d346fd8..fc7e301 100644
--- a/01-proxmox-infra/index.ts
+++ b/01-proxmox-infra/index.ts
@@ -6,9 +6,12 @@ import * as pfsense from "@pulumi/pfsense";
 const config = new pulumi.Config();
 
 const pve1Endpoint = config.requireSecret("pve1Endpoint");
-const pve1ApiToken = config.requireSecret("pve1ApiToken");
 const pve2Endpoint = config.requireSecret("pve2Endpoint");
+const pve3Endpoint = config.requireSecret("pve3Endpoint");
+
+const pve1ApiToken = config.requireSecret("pve1ApiToken");
 const pve2ApiToken = config.requireSecret("pve2ApiToken");
+const pve3ApiToken = config.requireSecret("pve3ApiToken");
 
 const pfSenseUrl = config.requireSecret("pfSenseUrl");
 const pfSenseUser = config.requireSecret("pfSenseUser");
@@ -16,9 +19,11 @@ const pfSensePassword = config.requireSecret("pfSensePassword");
 
 const master1Ip = config.requireSecret("master1Ip");
 const master2Ip = config.requireSecret("master2Ip");
-const worker1Ip = config.requireSecret("worker1Ip");
 const master3Ip = config.requireSecret("master3Ip");
+
+const worker1Ip = config.requireSecret("worker1Ip");
 const worker2Ip = config.requireSecret("worker2Ip");
+const worker3Ip = config.requireSecret("worker3Ip");
 
 // ---------------------------------------------------------------------------
 // Providers — one per standalone Proxmox machine
@@ -36,6 +41,12 @@ const pveBckpProvider = new proxmox.Provider("pve-bckp", {
   insecure: true,
 });
 
+const pveEsprimoProvider = new proxmox.Provider("pve-esprimo", {
+  endpoint: pve3Endpoint,
+  apiToken: pve3ApiToken,
+  insecure: true,
+});
+
 // ---------------------------------------------------------------------------
 // Providers — PfSense
 // ---------------------------------------------------------------------------
@@ -91,6 +102,20 @@ const ubuntuImagePveBckp = new proxmox.download.File(
   { provider: pveBckpProvider },
 );
 
+const ubuntuImagePveEsprimo = new proxmox.download.File(
+  "ubuntu-noble-pve-esprimo",
+  {
+    nodeName: "pve-esprimo",
+    datastoreId: "local",
+    contentType: "import",
+    fileName: "noble-server-cloudimg-amd64.qcow2",
+    url: ubuntuNobleUrl,
+    overwrite: false,
+    overwriteUnmanaged: true,
+  },
+  { provider: pveEsprimoProvider },
+);
+
 // ---------------------------------------------------------------------------
 // VM templates — one per node, cloned from the downloaded cloud image.
 // Templates are not started and have no cloud-init config; that is applied
@@ -158,6 +183,26 @@ const pveBckpTemplate = new proxmox.VmLegacy(
   { provider: pveBckpProvider, ignoreChanges: ["disks"] },
 );
 
+const pveEsprimoTemplate = new proxmox.VmLegacy(
+  "k3s-template-pve-esprimo",
+  {
+    ...templateSettings,
+    nodeName: "pve-esprimo",
+    name: "k3s-ubuntu-noble-template",
+    disks: [
+      {
+        interface: "scsi0",
+        datastoreId: "local",
+        importFrom: pulumi.interpolate`${ubuntuImagePveEsprimo.datastoreId}:import/${ubuntuImagePveEsprimo.fileName}`,
+        size: 10,
+        ssd: true,
+        discard: "on",
+      },
+    ],
+  },
+  { provider: pveEsprimoProvider, ignoreChanges: ["disks"] },
+);
+
 // ---------------------------------------------------------------------------
 // k3s nodes — full clones of their respective templates
 // ---------------------------------------------------------------------------
@@ -190,7 +235,7 @@ const nodeConfigs: NodeConfig[] = [
     name: "k3s-master-2",
     role: "master",
     nodeName: "pve",
-    provider: pveProvider,
+    provider: pveEsprimoProvider,
     template: pveTemplate,
     diskDatastore: "local-lvm",
     ip: master2Ip,
@@ -224,6 +269,16 @@ const nodeConfigs: NodeConfig[] = [
     ip: worker2Ip,
     longhornDiskSize: 50,
   },
+  {
+    name: "k3s-worker-3",
+    role: "worker",
+    nodeName: "pve-esprimo",
+    provider: pveEsprimoProvider,
+    template: pveEsprimoTemplate,
+    diskDatastore: "local",
+    ip: worker3Ip,
+    longhornDiskSize: 50,
+  },
 ];
 
 const k3sVms = nodeConfigs.map(
@@ -321,11 +376,19 @@ export const vmIds = {
   worker1: k3sVms[2].vmId,
   master3: k3sVms[3].vmId,
   worker2: k3sVms[4].vmId,
+  worker3: k3sVms[5].vmId,
 };
 
 // CI runner SSH private key — consumed by k8s-bootstrap via StackReference.
 export const ciRunnerPrivateKey = pulumi.secret(ciRunnerKey.privateKeyOpenssh);
 
-export { pve1Endpoint, pve1ApiToken, pve2Endpoint, pve2ApiToken };
+export {
+  pve1Endpoint,
+  pve1ApiToken,
+  pve2Endpoint,
+  pve2ApiToken,
+  pve3Endpoint,
+  pve3ApiToken,
+};
 
-export { master1Ip, master2Ip, worker1Ip, master3Ip, worker2Ip };
+export { master1Ip, master2Ip, worker1Ip, master3Ip, worker2Ip, worker3Ip };