diff --git a/environments/site/tofu/additional.tf b/environments/site/tofu/additional.tf
index 20e363cf0..863e16040 100644
--- a/environments/site/tofu/additional.tf
+++ b/environments/site/tofu/additional.tf
@@ -33,6 +33,8 @@ module "additional" {
   availability_zone = lookup(each.value, "availability_zone", null)
   ip_addresses = lookup(each.value, "ip_addresses", null)
   security_group_ids = lookup(each.value, "security_group_ids", [for o in data.openstack_networking_secgroup_v2.nonlogin: o.id])
+  additional_cloud_config = lookup(each.value, "additional_cloud_config", var.additional_cloud_config)
+  additional_cloud_config_vars = lookup(each.value, "additional_cloud_config_vars", var.additional_cloud_config_vars)
 
   # can't be set for additional nodes
   compute_init_enable = []
@@ -65,5 +67,7 @@ module "additional" {
     "gateway_ip",
     "nodename_template",
     "security_group_ids",
+    "additional_cloud_config",
+    "additional_cloud_config_vars"
   ]
 }
diff --git a/environments/site/tofu/compute.tf b/environments/site/tofu/compute.tf
index a5b5d9010..9187f66bd 100644
--- a/environments/site/tofu/compute.tf
+++ b/environments/site/tofu/compute.tf
@@ -22,6 +22,8 @@ module "compute" {
   root_volume_type = lookup(each.value, "root_volume_type", var.root_volume_type)
   gateway_ip = lookup(each.value, "gateway_ip", var.gateway_ip)
   nodename_template = lookup(each.value, "nodename_template", var.cluster_nodename_template)
+  additional_cloud_config = lookup(each.value, "additional_cloud_config", var.additional_cloud_config)
+  additional_cloud_config_vars = lookup(each.value, "additional_cloud_config_vars", var.additional_cloud_config_vars)
 
   # optionally set for group:
   networks = concat(var.cluster_networks, lookup(each.value, "extra_networks", []))
@@ -60,6 +62,8 @@ module "compute" {
     "ip_addresses",
     "gateway_ip",
     "nodename_template",
+    "additional_cloud_config",
+    "additional_cloud_config_vars"
   ]
   
 }
diff --git a/environments/site/tofu/control.tf b/environments/site/tofu/control.tf
index 811e781b7..722e89d8b 100644
--- a/environments/site/tofu/control.tf
+++ b/environments/site/tofu/control.tf
@@ -92,6 +92,10 @@ resource "openstack_compute_instance_v2" "control" {
       %{if var.home_volume_provisioning != "none"}
       - [LABEL=home, /exports/home]
       %{endif}
+
+    %{if var.additional_cloud_config != ""}
+    ${templatestring(var.additional_cloud_config, var.additional_cloud_config_vars)}
+    %{endif}
   EOF
 
   config_drive = var.config_drive
diff --git a/environments/site/tofu/login.tf b/environments/site/tofu/login.tf
index 02a017227..7a5b3f847 100644
--- a/environments/site/tofu/login.tf
+++ b/environments/site/tofu/login.tf
@@ -22,6 +22,8 @@ module "login" {
   root_volume_type = lookup(each.value, "root_volume_type", var.root_volume_type)
   gateway_ip = lookup(each.value, "gateway_ip", var.gateway_ip)
   nodename_template = lookup(each.value, "nodename_template", var.cluster_nodename_template)
+  additional_cloud_config = lookup(each.value, "additional_cloud_config", var.additional_cloud_config)
+  additional_cloud_config_vars = lookup(each.value, "additional_cloud_config_vars", var.additional_cloud_config_vars)
   
   # optionally set for group:
   networks = concat(var.cluster_networks, lookup(each.value, "extra_networks", []))
@@ -64,6 +66,8 @@ module "login" {
     "ip_addresses",
     "gateway_ip",
     "nodename_template",
+    "additional_cloud_config",
+    "additional_cloud_config_vars",
     "security_group_ids"
   ]
   
diff --git a/environments/site/tofu/node_group/nodes.tf b/environments/site/tofu/node_group/nodes.tf
index 062d979c9..7c3fe218a 100644
--- a/environments/site/tofu/node_group/nodes.tf
+++ b/environments/site/tofu/node_group/nodes.tf
@@ -116,6 +116,10 @@ resource "openstack_compute_instance_v2" "compute_fixed_image" {
   user_data = <<-EOF
     #cloud-config
     fqdn: ${local.fqdns[each.key]}
+
+    %{if var.additional_cloud_config != ""}
+    ${templatestring(var.additional_cloud_config, var.additional_cloud_config_vars)}
+    %{endif}
   EOF
 
   availability_zone = var.match_ironic_node ? "${local.baremetal_az}::${var.baremetal_nodes[each.key]}" : var.availability_zone
@@ -173,6 +177,10 @@ resource "openstack_compute_instance_v2" "compute" {
   user_data = <<-EOF
     #cloud-config
     fqdn: ${local.fqdns[each.key]}
+
+    %{if var.additional_cloud_config != ""}
+    ${templatestring(var.additional_cloud_config, var.additional_cloud_config_vars)}
+    %{endif}
   EOF
 
   availability_zone = var.match_ironic_node ? "${local.baremetal_az}::${var.baremetal_nodes[each.key]}" : var.availability_zone
diff --git a/environments/site/tofu/node_group/variables.tf b/environments/site/tofu/node_group/variables.tf
index eed7238ad..35c1b6bac 100644
--- a/environments/site/tofu/node_group/variables.tf
+++ b/environments/site/tofu/node_group/variables.tf
@@ -196,3 +196,15 @@ variable "allowed_keys" {
 variable "config_drive" {
     type = bool
 }
+
+variable "additional_cloud_config" {
+    type = string
+    default = ""
+    nullable = false
+}
+
+variable "additional_cloud_config_vars" {
+    type = map(any)
+    default = {}
+    nullable = false
+}
diff --git a/environments/site/tofu/variables.tf b/environments/site/tofu/variables.tf
index 54d750f5d..f0451b38d 100644
--- a/environments/site/tofu/variables.tf
+++ b/environments/site/tofu/variables.tf
@@ -322,3 +322,21 @@ variable "config_drive" {
     type = bool
     default = null
 }
+
+variable "additional_cloud_config" {
+    description = <<-EOT
+        Multiline string to be appended to the node's cloud-init cloud-config user-data.
+        Must be in yaml format and not include the #cloud-config or any other user-data headers.
+        See https://cloudinit.readthedocs.io/en/latest/explanation/format.html#cloud-config-data.
+        Can be a templatestring parameterised by `additional_cloud_config_vars`.
+        The `boot-cmd`, `fqdn` and `mounts` modules must not be specified.
+    EOT
+    type = string
+    default = ""
+}
+
+variable "additional_cloud_config_vars" {
+    description = "Map of values passed to the `additional_cloud_config` templatestring"
+    type = map(any)
+    default = {}
+}