diff --git a/terraform/templates/controlplane.tftpl b/terraform/templates/controlplane.tftpl
index 0d998fd..8669820 100644
--- a/terraform/templates/controlplane.tftpl
+++ b/terraform/templates/controlplane.tftpl
@@ -49,12 +49,15 @@ machine:
     image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:${talos_version}
     wipe: true
     grubUseUKICmdline: true
+%{ if length(longhorn_disks) > 0 ~}
   disks:
-%{ for disk in longhorn_disks ~}
+%{ for idx, disk in longhorn_disks ~}
+    # ${disk.kind} — ${disk.device}
     - device: ${disk.device}
       partitions:
-        - mountpoint: ${disk.mountpoint}
+        - mountpoint: ${coalesce(disk.mountpoint, format("/var/lib/longhorn-disk%d", idx + 1))}
 %{ endfor ~}
+%{ endif ~}
   features:
     diskQuotaSupport: true
     kubePrism:
@@ -172,10 +175,10 @@ cluster:
     # kubectl); moved here so LB-IPAM exists before any LoadBalancer Service syncs.
     - name: cilium-lb-ippool
       contents: |
-${indent(8, cilium_lb_ippool)}
+        ${indent(8, cilium_lb_ippool)}
     - name: cilium-l2-announcement
       contents: |
-${indent(8, cilium_l2_announcement)}
+        ${indent(8, cilium_l2_announcement)}
     # CoreDNS Corefile with homelab hostname rewrites (single source of truth in
     # terraform/files/coredns/Corefile). In-cluster pods resolve *.riotpiao.com to
     # the nginx ingress controller so OIDC auto-discovery against
diff --git a/terraform/variables.tf b/terraform/variables.tf
index fc40506..8693c03 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -107,10 +107,24 @@ variable "controlplane_configs" {
     lan_subnet   = string
     lan_gateway  = string
     install_disk = string
-    longhorn_disks = list(object({
+    # Longhorn data disks, in mountpoint order. `device` should be a stable
+    # /dev/disk/by-id/wwn-* path: this hardware enumerates /dev/sdX by discovery
+    # order, and `install.wipe: true` means a renumber can aim the installer at a
+    # data disk.
+    #
+    # `mountpoint` defaults to /var/lib/longhorn-disk<N> by position. Never
+    # renumber or reorder existing entries — Longhorn keys its disks off the
+    # mountpoint, so a rename orphans the replicas already on that disk. Append
+    # new disks to the end.
+    #
+    # `kind` ("ssd"/"hdd") is a declared label only. PERC RAID controllers report
+    # every disk as rotational, so it can't be autodetected, and it deliberately
+    # does not affect ordering or mountpoints.
+    longhorn_disks = optional(list(object({
       device     = string
-      mountpoint = string
-    }))
+      mountpoint = optional(string)
+      kind       = optional(string, "hdd")
+    })), [])
     zone             = string
     allow_scheduling = bool
     # Extra cert SANs for this node — e.g. Cloudflare Tunnel public hostnames so