diff --git a/.github/workflows/cl2-image.yml b/.github/workflows/cl2-image.yml
new file mode 100644
index 0000000000..9d6deafb75
--- /dev/null
+++ b/.github/workflows/cl2-image.yml
@@ -0,0 +1,93 @@
+name: Build ClusterLoader2 Image
+
+on:
+  push:
+    branches:
+      - main
+      - vitto/cl2_image
+  schedule:
+    # Every 2 weeks at 03:00 UTC (Sunday).
+    - cron: "0 3 */14 * 0"
+  workflow_dispatch:
+    inputs:
+      upstream_ref:
+        description: "Upstream kubernetes/perf-tests ref (branch/tag/SHA)"
+        required: false
+        default: "master"
+      push_target:
+        description: "Where to push the built image"
+        required: false
+        default: "telescope"
+        type: choice
+        options:
+          - telescope
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  # GitHub Packages target for Azure/telescope.
+  TELESCOPE_IMAGE: ghcr.io/azure/clusterloader2-upstream
+
+jobs:
+  build:
+    name: Build and Push
+    runs-on: ubuntu-latest
+    outputs:
+      image_tag: ${{ steps.meta.outputs.image_tag }}
+      upstream_ref: ${{ steps.meta.outputs.upstream_ref }}
+      push_target: ${{ steps.meta.outputs.push_target }}
+      telescope_image: ${{ steps.meta.outputs.telescope_image }}
+    steps:
+      - name: Set workflow metadata
+        id: meta
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          IMAGE_TAG="v$(date -u +%Y%m%d)"
+          UPSTREAM_REF="${{ github.event_name == 'workflow_dispatch' && inputs.upstream_ref || 'master' }}"
+          PUSH_TARGET="${{ github.event_name == 'workflow_dispatch' && inputs.push_target || 'telescope' }}"
+          TELESCOPE_IMAGE="${TELESCOPE_IMAGE}"
+
+          echo "image_tag=${IMAGE_TAG}" >> "$GITHUB_OUTPUT"
+          echo "upstream_ref=${UPSTREAM_REF}" >> "$GITHUB_OUTPUT"
+          echo "push_target=${PUSH_TARGET}" >> "$GITHUB_OUTPUT"
+          echo "telescope_image=${TELESCOPE_IMAGE}" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout upstream perf-tests
+        uses: actions/checkout@v4
+        with:
+          repository: kubernetes/perf-tests
+          ref: ${{ steps.meta.outputs.upstream_ref }}
+          path: perf-tests
+          fetch-depth: 1
+      - name: Build local clusterloader2 image
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker build \
+            -f perf-tests/clusterloader2/Dockerfile \
+            -t local/clusterloader2:${{ steps.meta.outputs.image_tag }} \
+            perf-tests
+          docker image inspect local/clusterloader2:${{ steps.meta.outputs.image_tag }} > /dev/null
+
+      - name: Log in to GHCR for Telescope image
+        if: ${{ steps.meta.outputs.push_target == 'telescope' }}
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Push image to Telescope (date + latest)
+        if: ${{ steps.meta.outputs.push_target == 'telescope' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker tag local/clusterloader2:${{ steps.meta.outputs.image_tag }} ${{ steps.meta.outputs.telescope_image }}:${{ steps.meta.outputs.image_tag }}
+          docker tag local/clusterloader2:${{ steps.meta.outputs.image_tag }} ${{ steps.meta.outputs.telescope_image }}:latest
+          docker push ${{ steps.meta.outputs.telescope_image }}:${{ steps.meta.outputs.image_tag }}
+          docker push ${{ steps.meta.outputs.telescope_image }}:latest
+
diff --git a/pipelines/perf-eval/Autoscale Benchmark/node-auto-provisioning-benchmark.yml b/pipelines/perf-eval/Autoscale Benchmark/node-auto-provisioning-benchmark.yml
index fb5808d876..5b74bddae6 100644
--- a/pipelines/perf-eval/Autoscale Benchmark/node-auto-provisioning-benchmark.yml	
+++ b/pipelines/perf-eval/Autoscale Benchmark/node-auto-provisioning-benchmark.yml	
@@ -128,7 +128,7 @@ stages:
           credential_type: service_connection
           ssh_key_enabled: false
 
-  - stage: azure_australiaeast_small_scale
+  - stage: azure_canadacentral_small_scale
     condition: |
         or(
           eq(variables['Build.CronSchedule.DisplayName'], '3:00 AM Daily'),
@@ -140,7 +140,7 @@ stages:
         parameters:
           cloud: azure
           regions:
-            - australiaeast
+            - canadacentral
           engine: clusterloader2
           engine_input:
             image: "ghcr.io/azure/clusterloader2:v20250423"
diff --git a/test-nap.sh b/test-nap.sh
new file mode 100644
index 0000000000..860fca62c4
--- /dev/null
+++ b/test-nap.sh
@@ -0,0 +1,154 @@
+# =========================================
+# VARIABLES
+# =========================================
+
+RG=nap-test
+LOCATION=australiaeast
+
+CLUSTER=nap
+
+VNET=nap-vnet
+VNET_CIDR=10.192.0.0/10
+
+SUBNET=nap-subnet
+SUBNET_CIDR=10.192.0.0/16
+
+IDENTITY=nap-identity
+
+NODEPOOL=system
+NODECOUNT=5
+VMSIZE=Standard_D4_v5
+
+
+
+# =========================================
+# CREATE VNET
+# =========================================
+
+az network vnet create \
+  -g $RG \
+  -n $VNET \
+  --address-prefixes $VNET_CIDR \
+  --subnet-name $SUBNET \
+  --subnet-prefixes $SUBNET_CIDR
+
+
+# =========================================
+# GET SUBNET ID (IMPORTANT)
+# =========================================
+
+SUBNET_ID=$(az network vnet subnet show \
+  -g $RG \
+  --vnet-name $VNET \
+  -n $SUBNET \
+  --query id -o tsv)
+
+echo $SUBNET_ID
+
+
+# =========================================
+# CREATE MANAGED IDENTITY
+# =========================================
+
+az identity create \
+  -g $RG \
+  -n $IDENTITY
+
+
+# =========================================
+# GET IDENTITY RESOURCE ID
+# =========================================
+
+IDENTITY_ID=$(az identity show \
+  -g $RG \
+  -n $IDENTITY \
+  --query id -o tsv)
+
+echo $IDENTITY_ID
+
+
+# =========================================
+# GET IDENTITY PRINCIPAL ID
+# =========================================
+
+PRINCIPAL_ID=$(az identity show \
+  -g $RG \
+  -n $IDENTITY \
+  --query principalId -o tsv)
+
+echo $PRINCIPAL_ID
+
+
+# =========================================
+# ASSIGN NETWORK CONTRIBUTOR
+# =========================================
+
+az role assignment create \
+  --assignee-object-id $PRINCIPAL_ID \
+  --role "Network Contributor" \
+  --scope /subscriptions/$(az account show --query id -o tsv)/resourceGroups/$RG
+
+
+# =========================================
+# CREATE AKS CLUSTER
+# CRITICAL:
+# USE FULL SUBNET ID
+# =========================================
+
+az aks create \
+  -g $RG \
+  -n $CLUSTER \
+  --location $LOCATION \
+  --sku-tier standard \
+  --enable-managed-identity \
+  --assign-identity $IDENTITY_ID \
+  --network-plugin azure \
+  --vnet-subnet-id $SUBNET_ID \
+  --node-count $NODECOUNT \
+  --nodepool-name $NODEPOOL \
+  --node-vm-size $VMSIZE \
+  --node-init-taints CriticalAddonsOnly=true:NoSchedule \
+  --node-provisioning-mode Auto \
+  --enable-oidc-issuer \
+  --generate-ssh-keys
+
+
+# =========================================
+# GET KUBECONFIG
+# =========================================
+
+az aks get-credentials \
+  -g $RG \
+  -n $CLUSTER \
+  --overwrite-existing
+
+
+# =========================================
+# VERIFY CLUSTER SUBNET BINDING
+# MUST POINT TO 66998-3093b6fc
+# NOT MC_*
+# =========================================
+
+az aks show \
+  -g $RG \
+  -n $CLUSTER \
+  --query agentPoolProfiles[0].vnetSubnetId -o tsv
+
+
+# =========================================
+# VERIFY KARPENTER NODECLASS
+# =========================================
+
+kubectl get aksnodeclass -o yaml
+
+
+# =========================================
+# EXPECTED RESULT
+# =========================================
+#
+# status:
+#   conditions:
+#   - type: SubnetsReady
+#     status: "True"
+#
+# =========================================