diff --git a/scripts/maas-role-tags.sh b/scripts/maas-role-tags.sh
index 231b63d..0e5e615 100755
--- a/scripts/maas-role-tags.sh
+++ b/scripts/maas-role-tags.sh
@@ -65,8 +65,9 @@
   done' 2>/dev/null)" || refuse "lib-hosts did not yield hosts for $SITE"
 [ -n "$EXPECT" ] || refuse "lib-hosts produced no hosts for $SITE"
 
-PLAN="$(printf '%s\n' "$EXPECT" | python3 -c '
-import sys
+PLAN="$(printf '%s\n' "$EXPECT" | SITE="$SITE" python3 -c '
+import sys, os
+SITE = os.environ["SITE"]
 BANDS = (("control", 100, 119), ("compute", 120, 149), ("storage", 150, 200))
 # D-134 AMENDMENT 2026-07-29: .4-.49 is the UTILITY band -- per-DC INFRASTRUCTURE the
 # OpenStack nodes consume (the artifact service at .4, the Juju controller at .5), NOT
@@ -85,8 +86,15 @@
     if UTILITY[0] <= o <= UTILITY[1]:
         if by_name is not None:
             print("REFUSE\t%s\t%s\tutility-band octet .%d but name says %s" % (host, mac, o, by_name)); rc = 1
+        elif "-juju-" in host:
+            # D-104 AMENDMENT: the per-DC Juju controller carries its OWN tag and NONE of
+            # the role tags, so a bootstrap constrained on tags=juju-controller-<dc> targets
+            # it deterministically and no OpenStack role constraint can cross-grab it.
+            # Emitting that tag as the host role lets every stage below -- existence check,
+            # NEED/HAS, apply, read-back -- handle it with no special case.
+            print("OK\t%s\t%s\tjuju-controller-%s" % (host, mac.lower(), SITE))
         else:
-            print("SKIP\t%s\t%s\tutility band .%d -- per-DC infrastructure, not an OpenStack role node" % (host, mac, o))
+            print("SKIP\t%s\t%s\tutility band .%d -- per-DC infrastructure, no ruled tag" % (host, mac, o))
         continue
     if by_band is None:
         print("REFUSE\t%s\t%s\toctet .%d is in NO ruled D-134 band" % (host, mac, o)); rc = 1
@@ -114,6 +122,7 @@
 try: print(" ".join(t.get("name","") for t in json.load(sys.stdin)))
 except Exception: print("")')"
 missing_tags=""
+ROLES+=("juju-controller-$SITE")   # D-104: the per-DC controller tag
 for r in "${ROLES[@]}"; do
   case " $TAGS " in *" $r "*) echo "  [ok]   tag '$r' exists" ;;
                     *) echo "  [MISS] tag '$r' does NOT exist -- every machine constraining on it would fail allocation"
diff --git a/tests/maas-role-tags/run-tests.sh b/tests/maas-role-tags/run-tests.sh
index 6b2c67c..f0941eb 100755
--- a/tests/maas-role-tags/run-tests.sh
+++ b/tests/maas-role-tags/run-tests.sh
@@ -48,7 +48,9 @@
 out = []
 for i, r in enumerate(rows):
     host, mac = r.split()
-    role = "control" if "-control-" in host else "compute" if "-compute-" in host else "storage"
+    role = ("juju-controller-vr1-dc0" if "-juju-" in host
+            else "control" if "-control-" in host
+            else "compute" if "-compute-" in host else "storage")
     out.append({"system_id": "sid%02d" % i, "hostname": "random-%02d" % i,
                 "boot_interface": {"mac_address": mac},
                 "tag_names": ["openstack-vr1-dc0"] + ([role] if sys.argv[2] == "all" else [])})
@@ -59,7 +61,7 @@
 
 mk_machines "$TMP/m-all.json"  all
 mk_machines "$TMP/m-none.json" none
-mk_tags control compute storage openstack-vr1-dc0 > "$TMP/t-all.json"
+mk_tags control compute storage juju-controller-vr1-dc0 openstack-vr1-dc0 > "$TMP/t-all.json"
 mk_tags openstack-vr1-dc0                          > "$TMP/t-none.json"
 
 run() { # run <label> <want_rc> <regex> <action> [env...]
@@ -124,8 +126,14 @@
 # <dc>-juju-01 sits at .5 and is NOT an OpenStack role node. It must be SKIPPED (reported,
 # never silent) rather than refused -- but the refusal must keep its teeth for a genuine
 # disagreement, which T11 proves.
-run "T10 a utility-band host is SKIPPED, not refused, and is REPORTED" 0 '\[skip\].*juju-01.*utility band' "check vr1-dc0" \
+# RE-POINTED 2026-07-29: juju-01 used to be SKIPPED as "not a role node". Since the script
+# learned the D-104 controller tag it is TAGGED instead, with its own tag and NO role tag --
+# which is the property that lets a constrained bootstrap target it deterministically.
+run "T10 the controller carries juju-controller-<dc>, not a role tag" 0 "tag 'juju-controller-vr1-dc0' exists" "check vr1-dc0" \
   SC_MACHINES="$TMP/m-all.json" SC_TAGS="$TMP/t-all.json"
+# ...and its ABSENCE is caught, so the new tag is gated like the three role tags.
+run "T10b a missing controller tag is REPORTED" 1 "tag 'juju-controller-vr1-dc0' does NOT exist" "check vr1-dc0" \
+  SC_MACHINES="$TMP/m-none.json" SC_TAGS="$TMP/t-none.json"
 
 mkdir -p "$TMP/fake2/scripts"; cp "$REPO"/scripts/*.sh "$TMP/fake2/scripts/" 2>/dev/null
 sed -i 's/\[vr1-dc0-storage-01\]=150/[vr1-dc0-storage-01]=7/' "$TMP/fake2/scripts/lib-hosts.sh"