diff --git a/infrastructure/core/node-prefer-noschedule-cronjob.yaml b/infrastructure/core/node-prefer-noschedule-cronjob.yaml
index 3e6c092d..0ad10d95 100644
--- a/infrastructure/core/node-prefer-noschedule-cronjob.yaml
+++ b/infrastructure/core/node-prefer-noschedule-cronjob.yaml
@@ -59,6 +59,7 @@ spec:
                   clear_worker titan-14 rpi4
                   clear_worker titan-18 rpi4
                   clear_worker titan-22 amd64
+                  clear_worker titan-24 amd64
 
                   if k get node titan-22 >/dev/null 2>&1; then
                     k label node titan-22 \
@@ -69,6 +70,21 @@ spec:
                     k taint node titan-22 atlas.bstein.dev/media-primary=true:PreferNoSchedule --overwrite=true || true
                   fi
 
+                  if k get node titan-24 >/dev/null 2>&1; then
+                    # titan-24 (amd64, RTX 3080) co-hosts the out-of-cluster Sui
+                    # validator (docker-compose at /opt/sui-validator). It joins as a
+                    # worker so the native amd64 hermes-agent image leg can build here,
+                    # but a soft guard taint keeps routine pods from crowding the
+                    # validator. GPU workloads pinned to titan-24 by hostname are
+                    # unaffected (PreferNoSchedule never blocks a pinned pod); the
+                    # amd64 build pod tolerates this taint explicitly.
+                    k label node titan-24 \
+                      atlas.bstein.dev/general-compute=last-resort \
+                      atlas.bstein.dev/sui-validator=true \
+                      --overwrite=true || true
+                    k taint node titan-24 atlas.bstein.dev/sui-validator=true:PreferNoSchedule --overwrite=true || true
+                  fi
+
                   if k get node titan-23 >/dev/null 2>&1; then
                     k label node titan-23 \
                       veles.bstein.dev/simulation=true \