diff --git a/etc/kayobe/ansible/maintenance/cis.yml b/etc/kayobe/ansible/maintenance/cis.yml
index c14f0c1185..ffbe895432 100644
--- a/etc/kayobe/ansible/maintenance/cis.yml
+++ b/etc/kayobe/ansible/maintenance/cis.yml
@@ -12,7 +12,9 @@
         that:
           - ssh_key_type != 'ed25519'
         fail_msg: FIPS policy does not currently support ed25519 SSH keys on RHEL family systems
-      when: ansible_facts.os_family == 'RedHat' and rhel9cis_crypto_policy == 'FIPS'
+      when:
+        - ansible_facts.os_family == 'RedHat'
+        - (os_release | string == '9' and rhel9cis_crypto_policy == 'FIPS') or (os_release | string == '10' and rhel10cis_crypto_policy == 'FIPS')
 
     - name: Ensure the cron package is installed on ubuntu
       ansible.builtin.package:
diff --git a/etc/kayobe/ansible/requirements.yml b/etc/kayobe/ansible/requirements.yml
index 2690b17a37..dd5b61f1a2 100644
--- a/etc/kayobe/ansible/requirements.yml
+++ b/etc/kayobe/ansible/requirements.yml
@@ -21,7 +21,7 @@ roles:
     version: v1.3.4
   - name: ansible-lockdown.rhel10_cis
     src: https://github.com/ansible-lockdown/RHEL10-CIS
-    version: 1.0.2
+    version: 1.1.0
   - name: wazuh-ansible
     src: https://github.com/stackhpc/wazuh-ansible
     version: stackhpc-v4.10.0
diff --git a/etc/kayobe/inventory/group_vars/cis-hardening/cis b/etc/kayobe/inventory/group_vars/cis-hardening/cis
index 2226183669..25c9855e85 100644
--- a/etc/kayobe/inventory/group_vars/cis-hardening/cis
+++ b/etc/kayobe/inventory/group_vars/cis-hardening/cis
@@ -69,7 +69,7 @@ rhel9cis_auditd:
 # Max size of audit logs (MB)
 rhel9cis_max_log_file_size: 1024
 
-# Disable setting of boatloader password. This requires setting the variable
+# Disable setting of bootloader password. This requires setting the variable
 # `rhel9cis_bootloader_password_hash`
 rhel9cis_set_boot_pass: false
 
@@ -88,12 +88,16 @@ rhel10cis_auditd_max_log_file_size: 1024
 rhel10cis_auditd_max_log_file: 10
 rhel10cis_auditd_space_left_action: syslog
 
+# Prevent system from halting if disk is full
+rhel10cis_auditd_disk_full_action: suspend
+
 # Set an authselect profile name (required)
 rhel10cis_authselect_custom_profile_name: "stack"
 
 # Set crypto policy
+# NOTE: FIPS breaks ed25519 SSH keys
 # NOTE: FUTURE breaks wazuh agent repo metadata download
-rhel10cis_crypto_policy: FIPS
+rhel10cis_crypto_policy: DEFAULT
 
 # Skip configuration of the firewall
 rhel10cis_firewall: None
@@ -122,6 +126,9 @@ rhel10cis_rule_1_2_2_1: false
 rhel10cis_rule_2_3_1: false
 rhel10cis_rule_2_3_2: false
 
+# Avoid duplicate banner (already enabled by pam_motd)
+rhel10cis_rule_5_1_5: false
+
 # Disable requirement for password when using sudo
 rhel10cis_rule_5_2_4: false
 
diff --git a/releasenotes/notes/rhel10-cis-updates-f884f27770013f91.yaml b/releasenotes/notes/rhel10-cis-updates-f884f27770013f91.yaml
new file mode 100644
index 0000000000..929c689ffa
--- /dev/null
+++ b/releasenotes/notes/rhel10-cis-updates-f884f27770013f91.yaml
@@ -0,0 +1,22 @@
+---
+upgrade:
+  - |
+    Bumps the ``ansible-lockdown.rhel10_cis`` role to the 1.1.0 release.
+  - |
+    Switches default RHEL 10 crypto policy from ``FIPS`` to ``DEFAULT``
+    (``rhel10cis_crypto_policy: DEFAULT``). This only applies to the initial
+    CIS hardening execution because of `ansible-lockdown/RHEL10-CIS#111
+    <https://github.com/ansible-lockdown/RHEL10-CIS/issues/111>`__.
+fixes:
+  - |
+    Fixes compatibility with ed25519 SSH keys by changing the default RHEL 10
+    crypto policy from ``FIPS`` to ``DEFAULT``.
+  - |
+    Fixes assertion check for ed25519 SSH keys in CIS playbook to correctly
+    check ``rhel10cis_crypto_policy`` on Rocky Linux 10 hosts.
+  - |
+    Sets ``rhel10cis_auditd_disk_full_action: suspend`` to prevent hosts from
+    halting if audit log partitions become full.
+  - |
+    Disables CIS rule 5.1.5 (``rhel10cis_rule_5_1_5: false``) in SSH
+    configuration to avoid duplicate banners on interactive SSH login.