diff --git a/modules/build-types/ha-server.nix b/modules/build-types/ha-server.nix
index c4490a2..0307dfe 100644
--- a/modules/build-types/ha-server.nix
+++ b/modules/build-types/ha-server.nix
@@ -14,7 +14,7 @@
 #   the Beszel hub) is not set yet — add it to hosts/ha-server-{1,2}/host.nix
 #   under services.beszel.agent.environment.KEY once the hub accepts the
 #   new agents, following the pattern in hosts/server/host.nix.
-{ lib, vars, ... }:
+{ lib, pkgs, vars, ... }:
 
 let
   # Generates /etc/exports lines for all nfsShares data entries. Shared
@@ -33,6 +33,10 @@ in
     ../beszel/enable-agent.nix
   ];
 
+  # xfsprogs must be in systemPackages so mkfs.xfs/xfs_info are on PATH
+  # for cluster-init.sh (which runs as root via sudo during initial cluster setup).
+  environment.systemPackages = [ pkgs.xfsprogs ];
+
   services.nfs.server = {
     enable = true;
     exports = mkNfsExports vars.haStorageRoot;
diff --git a/modules/ha/cluster-config.nix b/modules/ha/cluster-config.nix
index 3271ef7..deb07e7 100644
--- a/modules/ha/cluster-config.nix
+++ b/modules/ha/cluster-config.nix
@@ -30,6 +30,9 @@
   # cluster management commands (drbdadm, crm*, pcs, etc.)
   security.sudo.wheelNeedsPassword = lib.mkForce false;
 
+  # DRBD lock-file directory (drbd-utils checks for it; missing → harmless but noisy warnings).
+  systemd.tmpfiles.rules = [ "d /var/lib/drbd 0750 root root -" ];
+
   services.drbd = {
     enable = true;
     config = ''
diff --git a/scripts/ha/cluster-init.sh b/scripts/ha/cluster-init.sh
index 2864b0c..59335a7 100755
--- a/scripts/ha/cluster-init.sh
+++ b/scripts/ha/cluster-init.sh
@@ -64,6 +64,14 @@ warn() { echo "[cluster-init] WARNING: $*" >&2; }
 [[ $(id -u) -eq 0 ]] || die "must run as root"
 [[ "$(hostname)" == "$NODE1" ]] || die "must run on $NODE1"
 
+# NixOS may not include xfsprogs in root's PATH even when it's in the store.
+# If mkfs.xfs is missing, search the Nix store for it.
+if ! command -v mkfs.xfs &>/dev/null; then
+  _xfs_bin=$(find /nix/store -maxdepth 3 -name mkfs.xfs 2>/dev/null | head -1 | xargs dirname 2>/dev/null || true)
+  [[ -n "$_xfs_bin" ]] && export PATH="$_xfs_bin:$PATH" \
+    || die "mkfs.xfs not found — add xfsprogs to ha-server.nix environment.systemPackages and rebuild"
+fi
+
 # Inter-node SSH/SCP helpers — abstract over root-to-root vs nixos+sudo.
 _SSH_OPTS="-o StrictHostKeyChecking=no -o ConnectTimeout=10"
 [[ -n "$HA_KEY" ]] && _SSH_OPTS="-i $HA_KEY $_SSH_OPTS"
@@ -128,7 +136,8 @@ if ! drbdadm dstate ha-data 2>/dev/null | grep -q "UpToDate\|Inconsistent\|Diskl
 fi
 
 log "Initialising DRBD metadata on $NODE2..."
-n2_ssh "bash -c 'if ! drbdadm dstate ha-data 2>/dev/null | grep -q UpToDate.Inconsistent.Diskless; then drbdadm create-md ha-data --force; fi'"
+# Use grep -E for ERE alternation inside the remote bash -c string (avoids \| quoting issues).
+n2_ssh "bash -c 'drbdadm dstate ha-data 2>/dev/null | grep -qE \"UpToDate|Inconsistent|Diskless\" || drbdadm create-md ha-data --force'"
 
 log "Bringing up DRBD on both nodes..."
 drbdadm up ha-data 2>/dev/null || true