diff --git a/scripts/dc-node-carve.sh b/scripts/dc-node-carve.sh
index d8df314..4b89580 100755
--- a/scripts/dc-node-carve.sh
+++ b/scripts/dc-node-carve.sh
@@ -375,9 +375,10 @@
 # hostname); machine identity is resolved separately by pinned boot MAC.
 is_juju_host(){ case "$1" in *"$JUJU_HOST_SUFFIX") return 0 ;; *) return 1 ;; esac; }
 is_tailscale_host(){ case "$1" in *"${TAILSCALE_HOST_SUFFIX:-tailscale-01}") return 0 ;; *) return 1 ;; esac; }
-# Two-plane hosts (juju controller, Tailscale router) carve metal-admin +
-# provider-public RAW with NO OVS br-ex -- only role nodes get br-ex.
-is_two_plane_host(){ is_juju_host "$1" || is_tailscale_host "$1"; }
+is_region_host(){ case "$1" in *"${REGION_HOST_SUFFIX:-maas-01}") return 0 ;; *) return 1 ;; esac; }
+# Two-plane hosts (juju controller, Tailscale router, MAAS region VM) carve
+# metal-admin + provider-public RAW with NO OVS br-ex -- only role nodes get br-ex.
+is_two_plane_host(){ is_juju_host "$1" || is_tailscale_host "$1" || is_region_host "$1"; }
 planes_for_host(){ if is_two_plane_host "$1"; then echo "$NODE_CARVE_JUJU_PLANES"; else echo "$NODE_CARVE_ROLE_PLANES"; fi; }
 
 # ===========================================================================
diff --git a/scripts/lib-hosts.sh b/scripts/lib-hosts.sh
index aa8a85d..179f732 100644
--- a/scripts/lib-hosts.sh
+++ b/scripts/lib-hosts.sh
@@ -92,6 +92,12 @@
 # (D-129(iii) amdt 2026-08-07; provider-public egress reaches Headscale).
 NODE_CARVE_TAILSCALE_PLANES=2
 TAILSCALE_HOST_SUFFIX="tailscale-01"  # how the aux Tailscale VM is identified
+# The per-DC MAAS region VM (.6) carves the SAME 2-plane shape (metal-admin +
+# provider-public, no br-ex) -- metal-admin is its service address (nodes reach
+# MAAS at :5240), provider-public is egress for image sync (D-134 octet .6). It
+# is bootstrapped BY Office1 (deployed there, then MAAS installed on it), so its
+# carve runs against --profile admin with all Office1 racks in --expect-rack.
+REGION_HOST_SUFFIX="maas-01"
 
 # The per-region forms exist only for the VR1 DCs (D-132 q1). Declared EMPTY at
 # the flat/VR0 layer so a shell that never selects a VR1 DC cannot pick up a
@@ -190,7 +196,7 @@
                    [vr1-dc0-compute-01]=120 [vr1-dc0-compute-02]=121
                    [vr1-dc0-storage-01]=150 [vr1-dc0-storage-02]=151
                    [vr1-dc0-storage-03]=152 [vr1-dc0-storage-04]=153
-                   [vr1-dc0-juju-01]=5 [vr1-dc0-tailscale-01]=7 )
+                   [vr1-dc0-juju-01]=5 [vr1-dc0-tailscale-01]=7 [vr1-dc0-maas-01]=6 )
       HOST_BOOT_MAC=( [vr1-dc0-control-01]=52:54:00:be:69:c5
                       [vr1-dc0-control-02]=52:54:00:02:ff:57
                       [vr1-dc0-control-03]=52:54:00:4f:de:a9
@@ -201,7 +207,8 @@
                       [vr1-dc0-storage-03]=52:54:00:b1:94:d1
                       [vr1-dc0-storage-04]=52:54:00:2b:ed:ab
                       [vr1-dc0-juju-01]=52:54:00:48:e7:1e
-                      [vr1-dc0-tailscale-01]=52:54:00:54:d5:5e )
+                      [vr1-dc0-tailscale-01]=52:54:00:54:d5:5e
+                      [vr1-dc0-maas-01]=52:54:00:dc:5c:0b )
       VIRSH_POWER_ADDRESS_FROM_OFFICE1="qemu+ssh://jessea123@172.31.0.2/system"
       VIRSH_POWER_ADDRESS_FROM_DCREGION="qemu+ssh://jessea123@10.12.8.2/system"
       VIRSH_POWER_ADDRESS="$VIRSH_POWER_ADDRESS_FROM_OFFICE1"
@@ -209,7 +216,7 @@
       # The per-DC Tailscale subnet router (.7): an AUX carve target reached via
       # --host, NOT an OpenStack role node (stays out of HOSTS). Boot MAC + octet
       # above pin its identity; the substrate pins the domain (main.tf:243).
-      CARVE_AUX_HOSTS=( vr1-dc0-tailscale-01 )
+      CARVE_AUX_HOSTS=( vr1-dc0-tailscale-01 vr1-dc0-maas-01 )
       ;;
     vr1-dc1)
       # MEASURED 2026-07-23 (Stage 4): 9/9 Ready; MACs are the config pins
@@ -223,7 +230,7 @@
                    [vr1-dc1-compute-01]=120 [vr1-dc1-compute-02]=121
                    [vr1-dc1-storage-01]=150 [vr1-dc1-storage-02]=151
                    [vr1-dc1-storage-03]=152 [vr1-dc1-storage-04]=153
-                   [vr1-dc1-juju-01]=5 [vr1-dc1-tailscale-01]=7 )
+                   [vr1-dc1-juju-01]=5 [vr1-dc1-tailscale-01]=7 [vr1-dc1-maas-01]=6 )
       HOST_BOOT_MAC=( [vr1-dc1-control-01]=52:54:01:d1:01:01
                       [vr1-dc1-control-02]=52:54:01:d1:02:01
                       [vr1-dc1-control-03]=52:54:01:d1:03:01
@@ -234,7 +241,8 @@
                       [vr1-dc1-storage-03]=52:54:01:d1:08:01
                       [vr1-dc1-storage-04]=52:54:01:d1:09:01
                       [vr1-dc1-juju-01]=52:54:00:53:12:70
-                      [vr1-dc1-tailscale-01]=52:54:00:f9:d6:df )
+                      [vr1-dc1-tailscale-01]=52:54:00:f9:d6:df
+                      [vr1-dc1-maas-01]=52:54:00:ff:5c:02 )
       VIRSH_POWER_ADDRESS_FROM_OFFICE1="qemu+ssh://jessea123@172.31.0.6/system"
       # 10.12.68.2 MEASURED on the dc1 rack 2026-07-30 (`ip -4 -o addr`: virbr6
       # inet 10.12.68.2/22), corroborated by dc-rack-net.sh's dc1 LEGS block.
@@ -246,7 +254,7 @@
       # --host, NOT an OpenStack role node (stays out of HOSTS). MAC pinned from
       # opentofu/vr1-dc1-substrate/main.tf:207. dc1 carve is gated on the
       # dedicated vr1-dc1 region being built first (operator ruling 2026-08-07).
-      CARVE_AUX_HOSTS=( vr1-dc1-tailscale-01 )
+      CARVE_AUX_HOSTS=( vr1-dc1-tailscale-01 vr1-dc1-maas-01 )
       ;;
     dc0|dc1|dc2)
       echo "FAIL: bare '$dc' is RETIRED (D-119). It was AMBIGUOUS ACROSS REGIONS: 'dc0' meant VR0's live DC0 here, but VR1's FIRST DC in the NetBox importer. Use the region-qualified selector: vr0-dc0 | vr1-dc0 | vr1-dc1" >&2
diff --git a/tests/dc-node-carve/run-tests.sh b/tests/dc-node-carve/run-tests.sh
index 42971a6..208ff19 100755
--- a/tests/dc-node-carve/run-tests.sh
+++ b/tests/dc-node-carve/run-tests.sh
@@ -71,7 +71,8 @@
  {"system_id":"s03","hostname":"loyal-oyster","status_name":"Ready","boot_interface":{"mac_address":"52:54:00:b1:94:d1"}},
  {"system_id":"s04","hostname":"civil-bug","status_name":"${STUB_S04_STATUS:-Ready}","boot_interface":{"mac_address":"52:54:00:2b:ed:ab"}},
  {"system_id":"j01","hostname":"subtle-grouse","status_name":"Ready","boot_interface":{"mac_address":"52:54:00:48:e7:1e"}},
- {"system_id":"t01","hostname":"known-marten","status_name":"${STUB_T01_STATUS:-Ready}","boot_interface":{"mac_address":"52:54:00:54:d5:5e"}}]
+ {"system_id":"t01","hostname":"known-marten","status_name":"${STUB_T01_STATUS:-Ready}","boot_interface":{"mac_address":"52:54:00:54:d5:5e"}},
+ {"system_id":"r01","hostname":"brave-otter","status_name":"Ready","boot_interface":{"mac_address":"52:54:00:dc:5c:0b"}}]
 M
 }
 
@@ -94,7 +95,7 @@
     c01) echo 100 ;; c02) echo 101 ;; c03) echo 102 ;;
     m01) echo 120 ;; m02) echo 121 ;;
     s01) echo 150 ;; s02) echo 151 ;; s03) echo 152 ;; s04) echo 153 ;;
-    j01) echo 5 ;; t01) echo 7 ;;
+    j01) echo 5 ;; t01) echo 7 ;; r01) echo 6 ;;
   esac
 }
 
@@ -180,6 +181,19 @@
 TS
 }
 
+# the MAAS REGION VM (.6): identical 2-plane no-br-ex shape as the tailscale
+# router, at octet 6. Proves is_region_host routes to the two-plane path.
+emit_region() {
+  cat <<RG
+[{"id":1,"name":"enp1s0","type":"physical","vlan":{"id":5001},"parents":[],"links":[{"id":1,"mode":"static","ip_address":"10.12.8.6","subnet":{"cidr":"10.12.8.0/22"}}]},
+ {"id":2,"name":"enp2s0","type":"physical","vlan":{"id":5002},"parents":[],"links":[{"id":2,"mode":"static","ip_address":"10.12.4.6","subnet":{"cidr":"10.12.4.0/22"}}]},
+ {"id":3,"name":"enp3s0","type":"physical","vlan":{"id":5301},"parents":[],"links":[{"id":3,"mode":"link_up","ip_address":null,"subnet":null}]},
+ {"id":4,"name":"enp4s0","type":"physical","vlan":{"id":5302},"parents":[],"links":[{"id":4,"mode":"link_up","ip_address":null,"subnet":null}]},
+ {"id":5,"name":"enp5s0","type":"physical","vlan":{"id":5303},"parents":[],"links":[{"id":5,"mode":"link_up","ip_address":null,"subnet":null}]},
+ {"id":6,"name":"enp6s0","type":"physical","vlan":{"id":5304},"parents":[],"links":[{"id":6,"mode":"link_up","ip_address":null,"subnet":null}]}]
+RG
+}
+
 case "$sub" in
   rack-controllers)
       case "${STUB_RACK:-hot-kid}" in
@@ -197,6 +211,7 @@
       case "$sid" in
         j01) emit_juju ;;
         t01) emit_tailscale ;;
+        r01) emit_region ;;
         *)   emit_role "$(octet_of "$sid")" ;;
       esac ;;
   interface)  echo '{}' ;;
@@ -307,6 +322,15 @@
 chk "T33 tailscale spare NIC carved onto a plane FAILS rc=1" "$rc" "1"
 
 echo
+echo "== T34..T35 the MAAS region VM (.6): -maas-01 routes to the 2-plane path, octet 6 =="
+out="$(R carved check vr1-dc0 "${GATE[@]}" --host vr1-dc0-maas-01)"; rc=$?
+chk "T34 region VM alone passes rc=0" "$rc" "0"
+has "T34b carved on 2 planes" "$out" "2 plane(s)"
+has "T35 enp1s0 is metal-admin .6" "$out" "enp1s0 STATIC 10.12.8.6 on metal-admin"
+has "T35b enp2s0 is provider-public .6 (raw, no br-ex)" "$out" "enp2s0 STATIC 10.12.4.6 on provider-public"
+has "T35c asserts the region VM has NO br-ex" "$out" "has NO br-ex"
+
+echo
 echo "== T21..T24 apply is DRY-RUN without --commit =="
 out="$(R raw apply vr1-dc0 "${GATE[@]}" --host vr1-dc0-storage-04)"; rc=$?
 has "T21 plan-only banner" "$out" "PLAN ONLY -- nothing was changed"