diff --git a/ansible/roles/network-nmstate/tasks/main.yml b/ansible/roles/network-nmstate/tasks/main.yml
index 4bff2ed9d..fdb326676 100644
--- a/ansible/roles/network-nmstate/tasks/main.yml
+++ b/ansible/roles/network-nmstate/tasks/main.yml
@@ -132,31 +132,72 @@
 
     # TODO(gkoper): replace temporary nmcli profile zone sync with native
     # zone handling in the nmstate filter/module path.
-    - name: Gather NetworkManager connection firewalld zones for nmstate interfaces
-      command:
-        argv:
-          - nmcli
-          - -g
-          - connection.zone
-          - connection
-          - show
-          - "{{ item.interface }}"
-      changed_when: false
-      loop: "{{ network_nmstate_zone_items }}"
-      register: network_nmstate_nm_zone_result
-
-    - name: Ensure NetworkManager connection firewalld zones are set for nmstate interfaces
-      command:
-        argv:
-          - nmcli
-          - connection
-          - modify
-          - "{{ item.item.interface }}"
-          - connection.zone
-          - "{{ item.item.zone }}"
-      loop: "{{ network_nmstate_nm_zone_result.results }}"
-      when:
-        - (item.stdout | default('') | trim) != item.item.zone
+    - name: Sync NetworkManager connection firewalld zones for nmstate interfaces
+      block:
+        # Cloud-init can create a profile whose ID is prefixed with
+        # "cloud-init", while its active device is still the nmstate interface.
+        # `nmcli connection show` accepts a profile UUID, so get the active
+        # profile UUID from the device before reading or updating its zone.
+        - name: Gather NetworkManager connection profiles for nmstate interfaces
+          command:
+            argv:
+              - nmcli
+              - -g
+              - GENERAL.CON-UUID
+              - device
+              - show
+              - "{{ zone_item.interface }}"
+          changed_when: false
+          loop: "{{ network_nmstate_zone_items }}"
+          loop_control:
+            loop_var: zone_item
+            label: "{{ zone_item.interface }}"
+          register: network_nmstate_nm_connection_result
+
+        - name: Validate NetworkManager connections for nmstate interfaces
+          ansible.builtin.assert:
+            that:
+              - (connection_item.stdout | trim) not in ['', '--']
+            fail_msg: >-
+              No active NetworkManager connection found for nmstate interface
+              {{ connection_item.zone_item.interface }}
+          loop: "{{ network_nmstate_nm_connection_result.results }}"
+          loop_control:
+            loop_var: connection_item
+            label: "{{ connection_item.zone_item.interface }}"
+
+        - name: Gather NetworkManager connection firewalld zones for nmstate interfaces
+          command:
+            argv:
+              - nmcli
+              - -g
+              - connection.zone
+              - connection
+              - show
+              - "{{ connection_item.stdout | trim }}"
+          changed_when: false
+          loop: "{{ network_nmstate_nm_connection_result.results }}"
+          loop_control:
+            loop_var: connection_item
+            label: "{{ connection_item.zone_item.interface }}"
+          register: network_nmstate_nm_zone_result
+
+        - name: Ensure NetworkManager connection firewalld zones are set for nmstate interfaces
+          command:
+            argv:
+              - nmcli
+              - connection
+              - modify
+              - "{{ zone_result.connection_item.stdout | trim }}"
+              - connection.zone
+              - "{{ zone_result.connection_item.zone_item.zone }}"
+          loop: "{{ network_nmstate_nm_zone_result.results }}"
+          loop_control:
+            loop_var: zone_result
+            label: "{{ zone_result.connection_item.zone_item.interface }}"
+          when:
+            - (zone_result.stdout | default('') | trim) != zone_result.connection_item.zone_item.zone
+      when: not ansible_check_mode
 
     # Keep permanent firewalld configuration in sync first. Runtime state is
     # refreshed separately below from permanent config.
diff --git a/playbooks/kayobe-infra-vm-base/overrides.yml.j2 b/playbooks/kayobe-infra-vm-base/overrides.yml.j2
index c6d5cc075..2df774af1 100644
--- a/playbooks/kayobe-infra-vm-base/overrides.yml.j2
+++ b/playbooks/kayobe-infra-vm-base/overrides.yml.j2
@@ -34,7 +34,7 @@ infra_vm_memory_mb: "{{ 1 * 1024 }}"
 {% if infra_vm_use_cirros | default(true) %}
 # Use cirros rather than distribution cloud image for the VM.
 infra_vm_bootstrap_user: cirros
-infra_vm_root_image: /opt/cache/files/cirros-0.5.3-x86_64-disk.img
+infra_vm_root_image: https://download.cirros-cloud.net/0.5.3/cirros-0.5.3-x86_64-disk.img
 
 # Cirros doesn't load cdom drivers by default.
 vm_configdrive_device: disk
diff --git a/playbooks/kayobe-seed-vm-base/overrides.yml.j2 b/playbooks/kayobe-seed-vm-base/overrides.yml.j2
index 83be19105..137370220 100644
--- a/playbooks/kayobe-seed-vm-base/overrides.yml.j2
+++ b/playbooks/kayobe-seed-vm-base/overrides.yml.j2
@@ -37,7 +37,7 @@ seed_vm_memory_mb: "{{ 1 * 1024 }}"
 {% if seed_vm_use_cirros | default(true) %}
 # Use cirros rather than distribution cloud image for the VM.
 seed_bootstrap_user: cirros
-seed_vm_root_image: /opt/cache/files/cirros-0.5.3-x86_64-disk.img
+seed_vm_root_image: https://download.cirros-cloud.net/0.5.3/cirros-0.5.3-x86_64-disk.img
 
 # Cirros doesn't load cdom drivers by default.
 seed_vm_configdrive_device: disk
diff --git a/releasenotes/notes/fix-nmstate-cloud-init-profile-3ea31ce33527ad63.yaml b/releasenotes/notes/fix-nmstate-cloud-init-profile-3ea31ce33527ad63.yaml
new file mode 100644
index 000000000..7ec31646a
--- /dev/null
+++ b/releasenotes/notes/fix-nmstate-cloud-init-profile-3ea31ce33527ad63.yaml
@@ -0,0 +1,8 @@
+---
+fixes:
+  - |
+    Fixes the nmstate network engine when cloud-init creates a
+    NetworkManager connection whose profile ID differs from the interface
+    name (`LP#2165006 <https://bugs.launchpad.net/kayobe/+bug/2165006>`__).
+    Firewalld zone synchronisation now resolves the active profile from the
+    interface before reading or updating its connection zone.