diff --git a/scripts/verify-longhorn-migration-headroom/main.go b/scripts/verify-longhorn-migration-headroom/main.go
index e411aac2e2..9f7d66298d 100644
--- a/scripts/verify-longhorn-migration-headroom/main.go
+++ b/scripts/verify-longhorn-migration-headroom/main.go
@@ -136,7 +136,7 @@ func qualify(servers []server, nodes []node, requireV2 bool) error {
 		}
 		role, isStatic := static[name]
 		if controlPlaneName.MatchString(name) {
-			role, isStatic = "control-plane", true
+			role, isStatic = "controlplane", true
 		}
 		if isStatic {
 			if s.Labels["ksail.owned"] != "true" || s.Labels["ksail.cluster.name"] != "prod" || s.Labels["ksail.node.type"] != role || s.Labels["ksail.node.index"] != name[strings.LastIndex(name, "-")+1:] || s.Labels["hcloud/node-group"] != "" || n.Metadata.Labels["storage.platform.devantler.tech/migration-pool"] != "" {
@@ -155,7 +155,7 @@ func qualify(servers []server, nodes []node, requireV2 bool) error {
 		}
 		counts[match[1]]++
 	}
-	if counts["static"] != 6 || counts["control-plane"] != 3 || counts["worker"] != 3 || counts["v1"] != 2 || counts["v2"] > 1 || (requireV2 && counts["v2"] != 1) {
+	if counts["static"] != 6 || counts["controlplane"] != 3 || counts["worker"] != 3 || counts["v1"] != 2 || counts["v2"] > 1 || (requireV2 && counts["v2"] != 1) {
 		return errors.New("the required migration roster is incomplete")
 	}
 	return nil
diff --git a/scripts/verify-longhorn-migration-headroom/main_test.go b/scripts/verify-longhorn-migration-headroom/main_test.go
index 14392c36fd..ee4f829969 100644
--- a/scripts/verify-longhorn-migration-headroom/main_test.go
+++ b/scripts/verify-longhorn-migration-headroom/main_test.go
@@ -22,7 +22,7 @@ func roster(t *testing.T, v2 bool) ([]server, []node) {
 		id := int64(100 + i)
 		labels := map[string]string{"ksail.owned": "true", "ksail.cluster.name": "prod", "ksail.node.type": "worker"}
 		if i < 3 {
-			labels["ksail.node.type"] = "control-plane"
+			labels["ksail.node.type"] = "controlplane"
 		}
 		if i < 6 {
 			labels["ksail.node.index"] = name[strings.LastIndex(name, "-")+1:]
diff --git a/scripts/verify-longhorn-migration-headroom/ownership_contract_test.go b/scripts/verify-longhorn-migration-headroom/ownership_contract_test.go
new file mode 100644
index 0000000000..50997a5afe
--- /dev/null
+++ b/scripts/verify-longhorn-migration-headroom/ownership_contract_test.go
@@ -0,0 +1,29 @@
+package main
+
+import "testing"
+
+// KSail v7.210.0 NodeLabels and the Talos server-creation path use the
+// provider role "controlplane", independently of Kubernetes' role-label spelling.
+func TestPublishedProviderControlPlaneOwnership(t *testing.T) {
+	servers, nodes := roster(t, true)
+	if err := qualify(servers, nodes, true); err != nil {
+		t.Fatalf("the published provider ownership contract was refused: %v", err)
+	}
+}
+
+func TestProviderRoleAliasesDoNotEstablishOwnership(t *testing.T) {
+	for _, tc := range []struct{ name, role string }{
+		{"Kubernetes role spelling", "control-plane"},
+		{"different case", "controlPlane"},
+		{"worker role", "worker"},
+		{"missing role", ""},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			servers, nodes := roster(t, true)
+			servers[0].Labels["ksail.node.type"] = tc.role
+			if err := qualify(servers, nodes, true); err == nil {
+				t.Fatal("a role outside the published ownership contract qualified")
+			}
+		})
+	}
+}