diff --git a/hack/e2e-platform-packages.sh b/hack/e2e-platform-packages.sh
index 06a9f16db..302620f03 100755
--- a/hack/e2e-platform-packages.sh
+++ b/hack/e2e-platform-packages.sh
@@ -78,6 +78,19 @@ spec:
             - cozystack.external-dns-application
 EOF
 
+# gpu-operator is optional, so a closure that keeps it still has to list it.
+# Enabled, it turns on cozystack-controller's GPU paths, which the gpuclaim
+# suite drives with a fake extended resource; KubeVirt must permit that name
+# as an external provider, or a VM using a class on it is refused at
+# admission.
+gpu_operator=true
+case " $disabled " in
+  *" cozystack.gpu-operator "*) gpu_operator=false ;;
+esac
+if [ "$gpu_operator" = true ]; then
+  echo "            - cozystack.gpu-operator"
+fi
+
 if [ -n "$disabled" ]; then
   echo "          disabledPackages:"
   for pkg in $disabled; do
@@ -85,6 +98,17 @@ if [ -n "$disabled" ]; then
   done
 fi
 
+if [ "$gpu_operator" = true ]; then
+  cat <<'EOF'
+        gpu:
+          permittedHostDevices:
+            pciHostDevices:
+              - pciVendorSelector: "10DE:FFFF"
+                resourceName: nvidia.com/E2E_FAKE_GPU
+                externalResourceProvider: true
+EOF
+fi
+
 if [ "$linstor_drbd_enabled" = false ]; then
   cat <<'EOF'
 ---
diff --git a/hack/platform-packages_test.bats b/hack/platform-packages_test.bats
index 693f4d056..55b3af037 100644
--- a/hack/platform-packages_test.bats
+++ b/hack/platform-packages_test.bats
@@ -166,6 +166,29 @@ load test_helper
   done
 }
 
+@test "gpu-operator serves VMs and permits the fake GPU unless the selection drops it" {
+  manifest=$(hack/e2e-platform-packages.sh)
+  enabled=$(printf '%s\n' "$manifest" | yq '.spec.components.platform.values.bundles.enabledPackages | join(",")')
+  fake=$(printf '%s\n' "$manifest" | yq '.spec.components.platform.values.gpu.permittedHostDevices.pciHostDevices[] | select(.resourceName == "nvidia.com/E2E_FAKE_GPU") | .externalResourceProvider')
+
+  if [ "$enabled" != "cozystack.external-dns-application,cozystack.gpu-operator" ]; then
+    echo "an unscoped install does not enable gpu-operator: $enabled" >&2
+    return 1
+  fi
+  if [ "$fake" != "true" ]; then
+    echo "the fake GPU resource name is not permitted as an external provider: '$fake'" >&2
+    return 1
+  fi
+
+  manifest=$(COZY_DISABLED_PACKAGES="cozystack.gpu-operator" hack/e2e-platform-packages.sh)
+  enabled=$(printf '%s\n' "$manifest" | yq '.spec.components.platform.values.bundles.enabledPackages | join(",")')
+  gpu=$(printf '%s\n' "$manifest" | yq '.spec.components.platform.values | has("gpu")')
+  if [ "$enabled" != "cozystack.external-dns-application" ] || [ "$gpu" != "false" ]; then
+    echo "a selection without gpu-operator still enables it: enabled=$enabled gpu=$gpu" >&2
+    return 1
+  fi
+}
+
 @test "a malformed package name fails before emitting YAML" {
   for bad in "goldpinger" "cozystack." "cozystack.Gold" "cozystack.a;b"; do
     if manifest=$(COZY_DISABLED_PACKAGES="cozystack.keda $bad" hack/e2e-platform-packages.sh 2>/dev/null); then