diff --git a/.github/workflows/integration_test.yaml b/.github/workflows/integration_test.yaml
index dcabfdec74f..9e729a9d247 100644
--- a/.github/workflows/integration_test.yaml
+++ b/.github/workflows/integration_test.yaml
@@ -106,6 +106,33 @@ jobs:
       name: integration-test
       deployment: false
     steps:
+      - name: Purge Docker
+        # GitHub-hosted Azure runners ship Docker pre-installed and active.
+        # Canonical K8s requires "A system with no previous installations
+        # of containerd/docker as this may cause conflicts"
+        # (see https://documentation.ubuntu.com/canonical-kubernetes
+        # /release-1.32/snap/tutorial/getting-started/).
+        # Completely purging Docker requires also
+        # deleting the Docker-specific `iptables-nft` rulesets
+        # created on installation.
+        timeout-minutes: 5
+        run: |
+          sudo apt-get remove --purge -y docker-ce docker-ce-cli containerd.io docker.io containerd 2>/dev/null || true
+          sudo nft flush ruleset
+          sudo ip link delete docker0 2>/dev/null || true
+      - name: Remove podman CNI bridge config
+        # Ubuntu 24.04 runners ship podman with a CNI bridge config
+        # (/etc/cni/net.d/87-podman-bridge.conflist) that sorts
+        # lexicographically before Cilium's config (05-cilium.conflist).
+        # When that file is present, containerd picks the podman bridge
+        # as the active CNI before Cilium is ready, bypassing the
+        # node.kubernetes.io/network-unavailable taint and scheduling
+        # pods onto the 10.88.0.0/16 bridge instead of the Cilium pod
+        # CIDR. Removing the file ensures Cilium is the only CNI plugin
+        # from the start.
+        timeout-minutes: 1
+        run: |
+          sudo rm -f /etc/cni/net.d/87-podman-bridge.conflist
       - name: Checkout
         timeout-minutes: 3
         uses: actions/checkout@v6
diff --git a/concierge.yaml b/concierge.yaml
index 0d2bbc8c7a1..b1f472d412b 100644
--- a/concierge.yaml
+++ b/concierge.yaml
@@ -2,13 +2,12 @@ juju:
   model-defaults:
     logging-config: <root>=INFO; unit=DEBUG
 providers:
-  microk8s:
+  k8s:
     enable: true
     bootstrap: true
-    addons:
-      - dns
-      - hostpath-storage
-      - rbac
+    channel: 1.32-classic/stable
+    bootstrap-constraints:
+      root-disk: 5G
 host:
   snaps:
     jhack:
diff --git a/spread.yaml b/spread.yaml
index deca84c7ed0..37a6275db19 100644
--- a/spread.yaml
+++ b/spread.yaml
@@ -60,7 +60,7 @@ backends:
       # For example, with microk8s, using `concierge restore` takes twice as long as this (e.g. 6
       # min instead of 3 min between every spread job)
       juju destroy-model --force --no-wait --destroy-storage --no-prompt testing
-      juju kill-controller --no-prompt concierge-microk8s
+      juju kill-controller --no-prompt concierge-k8s
     restore: |
       rm -rf "$SPREAD_PATH"
 
@@ -82,9 +82,6 @@ backends:
       sudo passwd -d runner
 
       ADDRESS localhost
-
-      sudo mkdir -p /var/snap/microk8s/common/default-storage
-      sudo mount --bind /mnt /var/snap/microk8s/common/default-storage
     # HACK: spread does not pass environment variables set on runner
     # Manually pass specific environment variables
     environment:
@@ -136,4 +133,19 @@ prepare-each: |
   # Unable to set constraint on all models because of Juju bug:
   # https://bugs.launchpad.net/juju/+bug/2065050
   juju set-model-constraints arch="$(dpkg --print-architecture)"
-# Only restore on lxd backend—no need to restore on CI
+
+  # k8s status --wait-ready returns as soon as 1 node is ready
+  # (see https://github.com/canonical/k8s-snap/issues/1789)
+  # but Cilium, CoreDNS, and storage may still be initialising
+  for res in deployment/cilium-operator deployment/coredns deployment/metrics-server daemonset/cilium daemonset/ck-storage-rawfile-csi-node statefulset/ck-storage-rawfile-csi-controller; do
+      if k8s kubectl -n kube-system get "$res" >/dev/null 2>&1; then
+          k8s kubectl -n kube-system rollout status "$res" --timeout=5m
+      else
+          echo "Skipping rollout status for missing $res"
+      fi
+  done
+
+  # Validate k8s DNS / API access
+  sudo k8s kubectl get nodes
+  sudo k8s kubectl get svc -A
+  sudo k8s kubectl get pods -A
diff --git a/tests/integration/helpers.py b/tests/integration/helpers.py
index 70ac890727f..b230f6c0b27 100644
--- a/tests/integration/helpers.py
+++ b/tests/integration/helpers.py
@@ -45,7 +45,7 @@
     check_call(["kubectl", "version", "--client=true"])
     KUBECTL = "kubectl"
 except FileNotFoundError:
-    KUBECTL = "microk8s kubectl"
+    KUBECTL = "sudo k8s kubectl"
 
 logger = logging.getLogger(__name__)