diff --git a/test/resources/microshift-rpm.resource b/test/resources/microshift-rpm.resource
index 3335a64ca4..d1587b2e0f 100644
--- a/test/resources/microshift-rpm.resource
+++ b/test/resources/microshift-rpm.resource
@@ -14,13 +14,13 @@ ${REPO_FILE_NAME}       "/etc/yum.repos.d/microshift-local.repo"
 *** Keywords ***
 Install MicroShift RPM Packages From System Repo
     [Documentation]    Installs MicroShift RPM packages from a system repository
-    [Arguments]    ${version}    ${check_warnings}=True
+    [Arguments]    ${version}    ${check_warnings}=True    ${extra_args}=${EMPTY}
     # Allow erasing because update may require a new version of openvswitch
     # and major versions of openvswitch are separate packages that obsolete
     # each other. Override default timeout to 2 min (-R 2) because the transmission rate sometimes dips below the
     # minrate threshold. This is not a fatal error and should not fail the test, so raising the timeout only helps to
     # keep logs clean of flakey error messages.
-    ${stdout}=    Command Should Work    dnf install -q -R 2 -y --allowerasing 'microshift-${version}'
+    ${stdout}=    Command Should Work    dnf install -q -R 2 -y --allowerasing ${extra_args} 'microshift-${version}'
     IF    ${check_warnings}
         # Look for all warnings and errors before testing so that the log
         # shows the output for both.
@@ -32,11 +32,16 @@ Install MicroShift RPM Packages From System Repo
 
 Install MicroShift RPM Packages From Repo
     [Documentation]    Installs MicroShift RPM packages from the specified URL
-    [Arguments]    ${repo_url}    ${version}
+    [Arguments]    ${repo_url}    ${version}    ${extra_args}=${EMPTY}
     Configure MicroShift Repository    ${repo_url}
-    Install MicroShift RPM Packages From System Repo    ${version}
+    Install MicroShift RPM Packages From System Repo    ${version}    extra_args=${extra_args}
     Unconfigure MicroShift Repository
 
+Install Third Party Packages With Warnings
+    [Documentation]    Install these separately to avoid having warnings
+    ...    show up in the warning check when installing MicroShift.
+    Command Should Work    dnf install -y NetworkManager-ovs containers-common
+
 Configure MicroShift Repository
     [Documentation]    Sets up repository
     [Arguments]    ${repo_url}
diff --git a/test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh b/test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh
index 835e59f2dc..f420116ef3 100644
--- a/test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh
+++ b/test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh
@@ -11,92 +11,8 @@ TEST_EXECUTION_TIMEOUT=60m
 # for greenboot to finish when creating the VM.
 export SKIP_GREENBOOT=true
 
-configure_microshift_mirror() {
-    local -r repo=$1
-
-    if [[ -z "${repo}" ]] ; then
-        return
-    fi
-
-    if [[ ! "${repo}" =~ ^http ]]; then
-        return
-    fi
-
-    local -r tmp_file=$(mktemp)
-    tee "${tmp_file}" >/dev/null <<EOF
-[microshift-mirror-rpms]
-name=MicroShift Mirror
-baseurl=${repo}
-enabled=1
-gpgcheck=0
-skip_if_unavailable=0
-EOF
-    copy_file_to_vm host1 "${tmp_file}" "${tmp_file}"
-    run_command_on_vm host1 "sudo cp ${tmp_file} /etc/yum.repos.d/microshift-mirror-rpms.repo"
-    rm -f "${tmp_file}"
-}
-
-# On RHEL 10, rhocp and fast-datapath repos are not available via
-# subscription-manager. Create repo files pointing to the RHEL 9 CDN
-# using entitlement certificates as a workaround.
-configure_cdn_repo() {
-    local -r repo_id=$1
-    local -r repo_name=$2
-    local -r baseurl=$3
-
-    local -r cert=$(run_command_on_vm host1 "ls /etc/pki/entitlement/[0-9]*.pem | grep -v '\-key.pem' | head -n1")
-    local -r key=$(run_command_on_vm host1 "ls /etc/pki/entitlement/[0-9]*-key.pem | head -n1")
-    local -r tmp_file=$(mktemp)
-
-    tee "${tmp_file}" >/dev/null <<EOF
-[${repo_id}]
-name=${repo_name}
-baseurl=${baseurl}
-enabled=1
-gpgcheck=1
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
-sslverify=1
-sslcacert=/etc/rhsm/ca/redhat-uep.pem
-sslclientcert=${cert}
-sslclientkey=${key}
-EOF
-    copy_file_to_vm host1 "${tmp_file}" "${tmp_file}"
-    run_command_on_vm host1 "sudo cp ${tmp_file} /etc/yum.repos.d/${repo_id}.repo"
-    rm -f "${tmp_file}"
-}
-
-configure_rhocp_repo() {
-    local -r rhocp=$1
-    local -r major=$2
-    local -r minor=$3
-    local -r arch=${4:-$(uname -m)}
-
-    if [[ -z "${rhocp}" ]] ; then
-        return
-    fi
-
-    if [[ "${rhocp}" =~ ^[0-9]{1,2}$ ]]; then
-        configure_cdn_repo \
-            "rhocp-${major}.${rhocp}" \
-            "Red Hat OpenShift ${major}.${rhocp} for RHEL 9" \
-            "https://cdn.redhat.com/content/dist/layered/rhel9/${arch}/rhocp/${major}.${rhocp}/os"
-    elif [[ "${rhocp}" =~ ^http ]]; then
-        local -r ocp_repo_name="rhocp-${major}.${minor}-for-rhel-9-mirrorbeta-rpms"
-        local -r tmp_file=$(mktemp)
-
-        tee "${tmp_file}" >/dev/null <<EOF
-[${ocp_repo_name}]
-name=Beta rhocp RPMs for RHEL 9
-baseurl=${rhocp}
-enabled=1
-gpgcheck=0
-skip_if_unavailable=0
-EOF
-        copy_file_to_vm host1 "${tmp_file}" "${tmp_file}"
-        run_command_on_vm host1 "sudo cp ${tmp_file} /etc/yum.repos.d/${ocp_repo_name}.repo"
-        rm -f "${tmp_file}"
-    fi
-}
+# CIS tests must run in order: harden, scan baseline, install, scan post.
+export TEST_RANDOMIZATION=none
 
 scenario_create_vms() {
     prepare_kickstart host1 kickstart-liveimg.ks.template ""
@@ -105,38 +21,17 @@ scenario_create_vms() {
     configure_vm_firewall host1
     subscription_manager_register host1
 
-    # Configure repositories for MicroShift and its dependencies.
-    # MicroShift is NOT installed here — the Robot suite installs it
-    # after CIS hardening so the scan reveals what MicroShift changes.
-    local -r source_reponame=$(basename "${LOCAL_REPO}")
-    local -r source_repo_url="${WEB_SERVER_URL}/rpm-repos/${source_reponame}"
-    local -r arch=$(run_command_on_vm host1 "uname -m")
-
-    configure_rhocp_repo "${RHOCP_MINOR_Y}"       "${MAJOR_VERSION}" "${MINOR_VERSION}" "${arch}"
-    configure_rhocp_repo "${RHOCP_MINOR_Y_BETA}"  "${MAJOR_VERSION}" "${MINOR_VERSION}" "${arch}"
-    configure_rhocp_repo "${RHOCP_MINOR_Y1}"      "${PREVIOUS_MAJOR_VERSION}" "${PREVIOUS_MINOR_VERSION}" "${arch}"
-    configure_rhocp_repo "${RHOCP_MINOR_Y1_BETA}" "${PREVIOUS_MAJOR_VERSION}" "${PREVIOUS_MINOR_VERSION}" "${arch}"
+    # Configure repositories for MicroShift dependencies.
+    # MicroShift itself is NOT installed here — the Robot suite configures
+    # the local source repo and installs MicroShift after CIS hardening
+    # so the scan reveals what MicroShift changes.
+    configure_rhocp_repo "${RHOCP_MINOR_Y}"       "${MAJOR_VERSION}" "${MINOR_VERSION}"
+    configure_rhocp_repo "${RHOCP_MINOR_Y_BETA}"  "${MAJOR_VERSION}" "${MINOR_VERSION}"
+    configure_rhocp_repo "${RHOCP_MINOR_Y1}"      "${PREVIOUS_MAJOR_VERSION}" "${PREVIOUS_MINOR_VERSION}"
+    configure_rhocp_repo "${RHOCP_MINOR_Y1_BETA}" "${PREVIOUS_MAJOR_VERSION}" "${PREVIOUS_MINOR_VERSION}"
     configure_microshift_mirror "${PREVIOUS_RELEASE_REPO}"
     run_command_on_vm host1 "sudo subscription-manager release --set 10.2"
-    configure_cdn_repo \
-        "fast-datapath" \
-        "Red Hat Fast Datapath for RHEL 9" \
-        "https://cdn.redhat.com/content/dist/layered/rhel9/${arch}/fast-datapath/os"
-
-    # Add the source RPM repo for locally-built MicroShift packages.
-    local -r tmp_file=$(mktemp)
-    tee "${tmp_file}" >/dev/null <<EOF
-[microshift-local]
-name=MicroShift Local
-baseurl=${source_repo_url}
-enabled=1
-gpgcheck=0
-skip_if_unavailable=0
-EOF
-    copy_file_to_vm host1 "${tmp_file}" "${tmp_file}"
-    run_command_on_vm host1 "sudo cp ${tmp_file} /etc/yum.repos.d/microshift-local.repo"
-    rm -f "${tmp_file}"
-
+    configure_fast_datapath_repo
 }
 
 scenario_remove_vms() {
@@ -144,9 +39,13 @@ scenario_remove_vms() {
 }
 
 scenario_run_tests() {
-    # shellcheck disable=SC2034  # used elsewhere
-    TEST_RANDOMIZATION=none
+    local -r source_reponame=$(basename "${LOCAL_REPO}")
+    local -r source_repo_url="${WEB_SERVER_URL}/rpm-repos/${source_reponame}"
+    local -r target_version=$(local_rpm_version)
+
     run_tests host1 \
+        --variable "SOURCE_REPO_URL:${source_repo_url}" \
+        --variable "TARGET_VERSION:${target_version}" \
         --variable "SCAP_DS_FILE:/usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml" \
         --variable "CIS_REQUIREMENTS_FILE:cis-requirements-el10.yml" \
         --variable "CIS_HARDEN_FILE:cis-harden-el10.yml" \
diff --git a/test/scenarios-bootc/el9/periodics/el98-src@cis-lvl2.sh b/test/scenarios-bootc/el9/periodics/el98-src@cis-lvl2.sh
index 3d78f03843..4d1f2fcc19 100644
--- a/test/scenarios-bootc/el9/periodics/el98-src@cis-lvl2.sh
+++ b/test/scenarios-bootc/el9/periodics/el98-src@cis-lvl2.sh
@@ -11,59 +11,8 @@ TEST_EXECUTION_TIMEOUT=60m
 # for greenboot to finish when creating the VM.
 export SKIP_GREENBOOT=true
 
-configure_microshift_mirror() {
-    local -r repo=$1
-
-    if [[ -z "${repo}" ]] ; then
-        return
-    fi
-
-    if [[ ! "${repo}" =~ ^http ]]; then
-        return
-    fi
-
-    local -r tmp_file=$(mktemp)
-    tee "${tmp_file}" >/dev/null <<EOF
-[microshift-mirror-rpms]
-name=MicroShift Mirror
-baseurl=${repo}
-enabled=1
-gpgcheck=0
-skip_if_unavailable=0
-EOF
-    copy_file_to_vm host1 "${tmp_file}" "${tmp_file}"
-    run_command_on_vm host1 "sudo cp ${tmp_file} /etc/yum.repos.d/microshift-mirror-rpms.repo"
-    rm -f "${tmp_file}"
-}
-
-configure_rhocp_repo() {
-    local -r rhocp=$1
-    local -r major=$2
-    local -r minor=$3
-
-    if [[ -z "${rhocp}" ]] ; then
-        return
-    fi
-
-    if [[ "${rhocp}" =~ ^[0-9]{1,2}$ ]]; then
-        run_command_on_vm host1 "sudo subscription-manager repos --enable rhocp-${major}.${rhocp}-for-rhel-9-\$(uname -m)-rpms"
-    elif [[ "${rhocp}" =~ ^http ]]; then
-        local -r ocp_repo_name="rhocp-${major}.${minor}-for-rhel-9-mirrorbeta-rpms"
-        local -r tmp_file=$(mktemp)
-
-        tee "${tmp_file}" >/dev/null <<EOF
-[${ocp_repo_name}]
-name=Beta rhocp RPMs for RHEL 9
-baseurl=${rhocp}
-enabled=1
-gpgcheck=0
-skip_if_unavailable=0
-EOF
-        copy_file_to_vm host1 "${tmp_file}" "${tmp_file}"
-        run_command_on_vm host1 "sudo cp ${tmp_file} /etc/yum.repos.d/${ocp_repo_name}.repo"
-        rm -f "${tmp_file}"
-    fi
-}
+# CIS tests must run in order: harden, scan baseline, install, scan post.
+export TEST_RANDOMIZATION=none
 
 scenario_create_vms() {
     prepare_kickstart host1 kickstart-liveimg.ks.template ""
@@ -72,32 +21,17 @@ scenario_create_vms() {
     configure_vm_firewall host1
     subscription_manager_register host1
 
-    # Configure repositories for MicroShift and its dependencies.
-    # MicroShift is NOT installed here — the Robot suite installs it
-    # after CIS hardening so the scan reveals what MicroShift changes.
-    local -r source_reponame=$(basename "${LOCAL_REPO}")
-    local -r source_repo_url="${WEB_SERVER_URL}/rpm-repos/${source_reponame}"
-
+    # Configure repositories for MicroShift dependencies.
+    # MicroShift itself is NOT installed here — the Robot suite configures
+    # the local source repo and installs MicroShift after CIS hardening
+    # so the scan reveals what MicroShift changes.
     configure_rhocp_repo "${RHOCP_MINOR_Y}"       "${MAJOR_VERSION}" "${MINOR_VERSION}"
     configure_rhocp_repo "${RHOCP_MINOR_Y_BETA}"  "${MAJOR_VERSION}" "${MINOR_VERSION}"
     configure_rhocp_repo "${RHOCP_MINOR_Y1}"      "${PREVIOUS_MAJOR_VERSION}" "${PREVIOUS_MINOR_VERSION}"
     configure_rhocp_repo "${RHOCP_MINOR_Y1_BETA}" "${PREVIOUS_MAJOR_VERSION}" "${PREVIOUS_MINOR_VERSION}"
     configure_microshift_mirror "${PREVIOUS_RELEASE_REPO}"
     run_command_on_vm host1 "sudo subscription-manager release --set 9.8"
-    run_command_on_vm host1 "sudo subscription-manager repos --enable fast-datapath-for-rhel-9-\$(uname -m)-rpms"
-
-    local -r tmp_file=$(mktemp)
-    tee "${tmp_file}" >/dev/null <<EOF
-[microshift-local]
-name=MicroShift Local
-baseurl=${source_repo_url}
-enabled=1
-gpgcheck=0
-skip_if_unavailable=0
-EOF
-    copy_file_to_vm host1 "${tmp_file}" "${tmp_file}"
-    run_command_on_vm host1 "sudo cp ${tmp_file} /etc/yum.repos.d/microshift-local.repo"
-    rm -f "${tmp_file}"
+    configure_fast_datapath_repo
 }
 
 scenario_remove_vms() {
@@ -105,8 +39,15 @@ scenario_remove_vms() {
 }
 
 scenario_run_tests() {
-    # shellcheck disable=SC2034  # used elsewhere
-    TEST_RANDOMIZATION=none
+    local -r source_reponame=$(basename "${LOCAL_REPO}")
+    local -r source_repo_url="${WEB_SERVER_URL}/rpm-repos/${source_reponame}"
+    local -r target_version=$(local_rpm_version)
+
     run_tests host1 \
+        --variable "SOURCE_REPO_URL:${source_repo_url}" \
+        --variable "TARGET_VERSION:${target_version}" \
+        --variable "SCAP_DS_FILE:/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml" \
+        --variable "CIS_REQUIREMENTS_FILE:cis-requirements-el9.yml" \
+        --variable "CIS_HARDEN_FILE:cis-harden-el9.yml" \
         suites/cis/
 }
diff --git a/test/suites/cis/validate-cis-lvl2.robot b/test/suites/cis/validate-cis-lvl2.robot
index 5d1c294a74..6ce2b2213a 100644
--- a/test/suites/cis/validate-cis-lvl2.robot
+++ b/test/suites/cis/validate-cis-lvl2.robot
@@ -11,6 +11,7 @@ Resource            ../../resources/ostree-health.resource
 Resource            ../../resources/microshift-host.resource
 Resource            ../../resources/microshift-process.resource
 Resource            ../../resources/microshift-network.resource
+Resource            ../../resources/microshift-rpm.resource
 
 Suite Setup         Setup
 Suite Teardown      Teardown
@@ -21,14 +22,16 @@ Test Tags           slow
 *** Variables ***
 ${USHIFT_HOST}                  ${EMPTY}
 ${USHIFT_USER}                  ${EMPTY}
+${SOURCE_REPO_URL}              ${EMPTY}
+${TARGET_VERSION}               ${EMPTY}
 ${API_PORT}                     6443
 ${OSCAP_BASELINE_FILE}          /tmp/cis-baseline-results.xml
 ${OSCAP_POST_FILE}              /tmp/cis-post-results.xml
 ${OSCAP_REPORT_FILE}            /tmp/cis-post-report.html
 ${OSCAP_PROFILE}                xccdf_org.ssgproject.content_profile_cis
-${SCAP_DS_FILE}                 /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
-${CIS_REQUIREMENTS_FILE}        cis-requirements-el9.yml
-${CIS_HARDEN_FILE}              cis-harden-el9.yml
+${SCAP_DS_FILE}                 ${EMPTY}
+${CIS_REQUIREMENTS_FILE}        ${EMPTY}
+${CIS_HARDEN_FILE}              ${EMPTY}
 
 # Rules that MicroShift is known to cause. Any new failure outside this
 # set means MicroShift introduced an unexpected CIS regression.
@@ -75,7 +78,7 @@ Smoke Test With Route
 Setup
     [Documentation]    Harden the system, run a baseline scan, install MicroShift,
     ...    run a post-install scan, and prepare for functional tests.
-    Check Required Env Variables
+    Validate Required Variables
     Login MicroShift Host
     Harden And Scan Baseline
     Install And Enable MicroShift
@@ -85,6 +88,15 @@ Setup
     Run CIS Scan    ${OSCAP_POST_FILE}    oscap_report=${OSCAP_REPORT_FILE}
     Setup Kubeconfig
 
+Validate Required Variables
+    [Documentation]    Fail fast if any required variable is missing.
+    Check Required Env Variables
+    Should Not Be Empty    ${SOURCE_REPO_URL}    SOURCE_REPO_URL variable is required
+    Should Not Be Empty    ${TARGET_VERSION}    TARGET_VERSION variable is required
+    Should Not Be Empty    ${SCAP_DS_FILE}    SCAP_DS_FILE variable is required
+    Should Not Be Empty    ${CIS_REQUIREMENTS_FILE}    CIS_REQUIREMENTS_FILE variable is required
+    Should Not Be Empty    ${CIS_HARDEN_FILE}    CIS_HARDEN_FILE variable is required
+
 Teardown
     [Documentation]    Archive scan artifacts and close SSH
     Run Keyword And Ignore Error
@@ -126,9 +138,10 @@ Reboot And Reconnect
 Install And Enable MicroShift
     [Documentation]    Install MicroShift after CIS hardening so the scan
     ...    reveals what MicroShift changes to CIS compliance.
-    ...    Uses --nogpgcheck because locally-built nightly RPMs are
-    ...    unsigned and CIS hardening enforces gpgcheck=1 globally.
-    Command Should Work    dnf install -y --nogpgcheck microshift
+    ...    Uses --nogpgcheck because CIS hardening forces gpgcheck=1
+    ...    on dependency repos that contain unsigned beta RPMs.
+    Install Third Party Packages With Warnings
+    Install MicroShift RPM Packages From Repo    ${SOURCE_REPO_URL}    ${TARGET_VERSION}    extra_args=--nogpgcheck
     Command Should Work    systemctl enable microshift
 
 Run Hardening Playbook
diff --git a/test/suites/rpm/install.robot b/test/suites/rpm/install.robot
index 8eb93793be..805d8fd3d1 100644
--- a/test/suites/rpm/install.robot
+++ b/test/suites/rpm/install.robot
@@ -58,8 +58,3 @@ Setup
 Teardown
     [Documentation]    Test suite teardown
     Logout MicroShift Host
-
-Install Third Party Packages With Warnings
-    [Documentation]    Install these separately to avoid having warnings
-    ...    show up in the warning check when installing MicroShift.
-    Command Should Work    dnf install -y NetworkManager-ovs containers-common