diff --git a/.github/workflows/e2e-nightly.yml b/.github/workflows/e2e-nightly.yml
index 29bae74f6..08a4f7003 100644
--- a/.github/workflows/e2e-nightly.yml
+++ b/.github/workflows/e2e-nightly.yml
@@ -46,7 +46,7 @@ jobs:
           - { cell: 19, install: binary, topo: single,     net: nat,    host: debian-13,    arch: x86_64, runner: ci-single, extra: "nat-single" }
 
     runs-on: [ self-hosted, "${{ matrix.runner }}" ]
-    timeout-minutes: 35
+    timeout-minutes: ${{ matrix.extra == 'tofu-examples' && 45 || 35 }}
     env:
       TOFU_LOG: /tmp/e2e-nightly-cell-${{ matrix.cell }}-${{ github.run_id }}.log
       ARTIFACT_DIR: /tmp/spinifex-e2e-nightly-cell-${{ matrix.cell }}-${{ github.run_id }}
@@ -251,6 +251,18 @@ jobs:
                if [ \$rc -ne 0 ]; then echo \"\$SUITE: FAILED\" >> '${ARTIFACT_DIR}/suite-status.txt'; FAIL=1; fi; \
              done; exit \$FAIL"
 
+      - name: Import RDS PostgreSQL AMI
+        if: steps.gate.outputs.selected == 'true' && matrix.extra == 'tofu-examples'
+        working-directory: mulga/scripts/tofu-cluster
+        run: |
+          set -euo pipefail
+          INVENTORY=$(tofu output -json inventory)
+          WAN_IP=$(echo "$INVENTORY" | jq -r '.nodes[0].wan_ip')
+          SSH_KEY=$(echo "$INVENTORY" | jq -r '.ssh_key_path')
+          SSH_KEY="${SSH_KEY/#\~/$HOME}"
+          ssh -o StrictHostKeyChecking=no -i "$SSH_KEY" tf-user@${WAN_IP} \
+            "spx admin images import --name spinifex-rds-postgres"
+
       - name: Run Tofu Workbooks
         if: steps.gate.outputs.selected == 'true' && matrix.extra == 'tofu-examples'
         working-directory: mulga/scripts/tofu-cluster
diff --git a/docs/terraform-workbooks/rds-quickstart/README.md b/docs/terraform-workbooks/rds-quickstart/README.md
index e9975b19d..a5f89e495 100644
--- a/docs/terraform-workbooks/rds-quickstart/README.md
+++ b/docs/terraform-workbooks/rds-quickstart/README.md
@@ -52,11 +52,16 @@ The database security group admits `5432` from the client security group and not
 ## Prerequisites
 
 - **Spinifex running**, with the AWS CLI configured for the `spinifex` profile (see [Installing Spinifex](/docs/install)) and OpenTofu (or Terraform) installed.
-- **The `spinifex-rds-postgres` image registered.** DB instances boot from it; it is built at `spx admin init` time.
+- **The `spinifex-rds-postgres` image registered.** DB instances boot from this system image. Import it once per cluster, then verify that all tags used by the RDS engine resolver are present:
 
   ```bash
-  aws ec2 describe-images \
-    --filters 'Name=tag:spinifex:managed-by,Values=rds' \
+  spx admin images import --name spinifex-rds-postgres
+
+  AWS_PROFILE=spinifex aws ec2 describe-images \
+    --filters \
+      'Name=tag:spinifex:managed-by,Values=rds' \
+      'Name=tag:engine,Values=postgres' \
+      'Name=tag:engine-version,Values=18' \
     --query 'Images[].[ImageId,Name]' --output text
   ```
 
@@ -148,7 +153,7 @@ aws rds delete-db-instance --db-instance-identifier rds-quickstart \
 
 ## Troubleshooting
 
-**`apply` fails resolving the DB AMI.** The `spinifex-rds-postgres` image is not registered. Re-run the `describe-images` check in Prerequisites.
+**`apply` fails resolving the DB AMI.** The `spinifex-rds-postgres` image is not registered with the required engine tags. Run `spx admin images import --name spinifex-rds-postgres`, then repeat the tagged `describe-images` check in Prerequisites before applying again.
 
 **The apply sits on `aws_db_instance.main: Still creating...`.** Several minutes is normal — a VM boot plus `initdb` plus the first healthy heartbeat. Much longer is a bootstrap that did not finish:
 
diff --git a/tests/e2e/run-tofu-examples-e2e.sh b/tests/e2e/run-tofu-examples-e2e.sh
index 149773a9f..e16d994a7 100755
--- a/tests/e2e/run-tofu-examples-e2e.sh
+++ b/tests/e2e/run-tofu-examples-e2e.sh
@@ -354,6 +354,28 @@ assert_clean_plan() {
     return 1
 }
 
+# RDS resolves its database VM image from all three tags. Check this before
+# applying any workbook so a missing operator prerequisite does not surface as
+# provider retries during the final, most expensive example.
+require_rds_image() {
+    local image_ids
+    if ! image_ids=$(aws ec2 describe-images \
+        --filters \
+            'Name=tag:spinifex:managed-by,Values=rds' \
+            'Name=tag:engine,Values=postgres' \
+            'Name=tag:engine-version,Values=18' \
+        --query 'Images[].ImageId' --output text); then
+        log "RDS AMI preflight: describe-images failed"
+        return 1
+    fi
+    if [ -z "$image_ids" ] || [ "$image_ids" = "None" ]; then
+        log "RDS AMI preflight: spinifex-rds-postgres is not registered"
+        log "Run: spx admin images import --name spinifex-rds-postgres"
+        return 1
+    fi
+    log "RDS AMI preflight: found ${image_ids}"
+}
+
 # Pick an instance type available on this cluster. Workbooks default to
 # t3.small (Intel); on AMD-only hosts t3 isn't registered, so we query and
 # fall back to the smallest type with ≥2 vCPU / ≥1 GiB RAM (matches the
@@ -442,6 +464,7 @@ run_workbook() {
 # --- Main ---
 
 install_tofu || { log "tofu install failed"; exit 1; }
+require_rds_image || { log "required RDS AMI is unavailable"; exit 1; }
 
 INSTANCE_TYPE=$(detect_instance_type)
 if [ -z "$INSTANCE_TYPE" ] || [ "$INSTANCE_TYPE" = "None" ]; then