@@ -0,0 +1,28 @@
+//go:build linux
+
+package main
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCPUTemplateOverride(t *testing.T) {
+	t.Parallel()
+
+	for raw, want := range map[string]string{
+		`{"kvm_capabilities":["!122"]}`: `{"template":{"kvm_capabilities":["!122"]}}`,
+		`{}`:                            `{"template":{}}`,
+		"null\n":                        `{"template":{}}`,
+		"":                              `{"template":{}}`,
+	} {
+		got, err := cpuTemplateOverride([]byte(raw))
+		require.NoError(t, err, raw)
+		assert.JSONEq(t, want, got.JSONString(), raw)
+	}
+
+	_, err := cpuTemplateOverride([]byte(`{"kvm_capabilities":`))
+	require.Error(t, err)
+}
@@ -3,7 +3,9 @@
 package main
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
 	"errors"
 	"flag"
 	"fmt"
@@ -50,6 +52,23 @@ import (
 	"github.com/e2b-dev/infra/packages/shared/pkg/utils"
 )
 
+// cpuTemplateOverride wraps a -cpu-template document as the reboot-cpu-template-override
+// value. Empty and null documents mean no template, so they wrap as {} rather than as null,
+// which the flag reads as no override.
+func cpuTemplateOverride(raw []byte) (ldvalue.Value, error) {
+	tmpl := ldvalue.ObjectBuild().Build()
+	if raw = bytes.TrimSpace(raw); len(raw) > 0 {
+		if !json.Valid(raw) {
+			return ldvalue.Null(), errors.New("not valid JSON")
+		}
+		if parsed := ldvalue.Parse(raw); !parsed.IsNull() {
+			tmpl = parsed
+		}
+	}
+
+	return ldvalue.ObjectBuild().Set("template", tmpl).Build(), nil
+}
+
 func main() {
 	fromBuild := flag.String("from-build", "", "build ID (UUID) to resume from (required)")
 	toBuild := flag.String("to-build", "", "output build ID (UUID) for pause snapshot (auto-generated if not specified)")
@@ -171,7 +190,11 @@ func main() {
 				log.Fatalf("read -cpu-template: %v", err)
 			}
 		}
-		featureflags.OverrideJSONFlag(featureflags.RebootCPUTemplateOverride, ldvalue.Parse(raw))
+		override, err := cpuTemplateOverride(raw)
+		if err != nil {
+			log.Fatalf("-cpu-template: %v", err)
+		}
+		featureflags.OverrideJSONFlag(featureflags.RebootCPUTemplateOverride, override)
 	}
 
 	if *fromBuild == "" {
 
@@ -4,8 +4,10 @@ package sandbox
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
+	"strings"
 	"sync"
 	"time"
 
@@ -85,11 +87,19 @@ func checkRebootCPUTemplate(tmpl *cputemplate.Template, fcVersion string) error
 // boot ran, unless override (the reboot-cpu-template-override flag) replaces it. An invalid
 // override is returned as an error alongside the build's template.
 func rebootCPUTemplate(meta metadata.Template, override ldvalue.Value) (*cputemplate.Template, bool, error) {
-	if override.IsNull() {
+	var o struct {
+		Template *json.RawMessage `json:"template"`
+	}
+	dec := json.NewDecoder(strings.NewReader(override.JSONString()))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&o); err != nil {
+		return meta.BuildCPUTemplate, false, fmt.Errorf("invalid CPU template override: %w", err)
+	}
+	if o.Template == nil {
 		return meta.BuildCPUTemplate, false, nil
 	}
 
-	tmpl, err := cputemplate.Parse([]byte(override.JSONString()))
+	tmpl, err := cputemplate.Parse(*o.Template)
 	if err != nil {
 		return meta.BuildCPUTemplate, false, err
 	}
 
@@ -52,18 +52,27 @@ func TestRebootCPUTemplate(t *testing.T) {
 	assert.False(t, overridden)
 	assert.Equal(t, a, got, "with no override the build's template returns")
 
-	got, overridden, err = rebootCPUTemplate(meta, ldvalue.Parse([]byte(`{"kvm_capabilities":["!122"]}`)))
+	for _, none := range []string{`{}`, `{"template":null}`} {
+		got, overridden, err = rebootCPUTemplate(meta, ldvalue.Parse([]byte(none)))
+		require.NoError(t, err)
+		assert.False(t, overridden)
+		assert.Equal(t, a, got, "%s is no override", none)
+	}
+
+	got, overridden, err = rebootCPUTemplate(meta, ldvalue.Parse([]byte(`{"template":{"kvm_capabilities":["!122"]}}`)))
 	require.NoError(t, err)
 	assert.True(t, overridden)
 	assert.Equal(t, b, got)
 
-	got, overridden, err = rebootCPUTemplate(meta, ldvalue.Parse([]byte(`{}`)))
+	got, overridden, err = rebootCPUTemplate(meta, ldvalue.Parse([]byte(`{"template":{}}`)))
 	require.NoError(t, err)
 	assert.True(t, overridden)
-	assert.Nil(t, got, "{} boots with no template")
+	assert.Nil(t, got, `{"template":{}} boots with no template`)
 
-	got, overridden, err = rebootCPUTemplate(meta, ldvalue.Parse([]byte(`{"bogus":1}`)))
-	require.Error(t, err)
-	assert.False(t, overridden)
-	assert.Equal(t, a, got, "an invalid override falls back to the build's template")
+	for _, invalid := range []string{`{"template":{"bogus":1}}`, `{"kvm_capabilities":["!122"]}`, `{"template":{},"x":1}`, `[]`} {
+		got, overridden, err = rebootCPUTemplate(meta, ldvalue.Parse([]byte(invalid)))
+		require.Error(t, err, invalid)
+		assert.False(t, overridden)
+		assert.Equal(t, a, got, "an invalid override falls back to the build's template")
+	}
 }
@@ -1046,9 +1046,10 @@ var (
 	BuildCPUTemplate = NewJSONFlag("build-cpu-template", ldvalue.Null())
 
 	// RebootCPUTemplateOverride replaces the build's CPU template on a filesystem-only cold
-	// boot, as the PUT /cpu-config body; {} boots with none. Null (the default) boots the
-	// build's template. The applied template is recorded as the running one, so the next
-	// pause stores it, while the build's template is kept and returns once the flag clears.
+	// boot: {"template": <PUT /cpu-config body>}; {"template": {}} boots with none. {} or null
+	// (the default) boots the build's template. The applied template is recorded as the
+	// running one, so the next pause stores it, while the build's template is kept and
+	// returns once the flag clears.
 	// A value that does not parse is logged and ignored; one the resolved Firecracker version
 	// or host cannot apply fails the boot, like a stored template would.
 	RebootCPUTemplateOverride = NewJSONFlag("reboot-cpu-template-override", ldvalue.Null())