diff --git a/etc/kayobe/ansible/maintenance/cis.yml b/etc/kayobe/ansible/maintenance/cis.yml
index c52918f55..0491cedbe 100644
--- a/etc/kayobe/ansible/maintenance/cis.yml
+++ b/etc/kayobe/ansible/maintenance/cis.yml
@@ -12,7 +12,7 @@
         that:
           - ssh_key_type != 'ed25519'
         fail_msg: FIPS policy does not currently support ed25519 SSH keys on RHEL family systems
-      when: ansible_facts.os_family == 'RedHat'
+      when: ansible_facts.os_family == 'RedHat' and rhel9cis_crypto_policy == 'FIPS'
 
     - name: Ensure the cron package is installed on ubuntu
       ansible.builtin.package:
diff --git a/etc/kayobe/inventory/group_vars/cis-hardening/cis b/etc/kayobe/inventory/group_vars/cis-hardening/cis
index e51625f96..3a5a46a3e 100644
--- a/etc/kayobe/inventory/group_vars/cis-hardening/cis
+++ b/etc/kayobe/inventory/group_vars/cis-hardening/cis
@@ -26,8 +26,9 @@ rhel9cis_rule_3_4_1_2: false
 # Don't configure selinux
 rhel9cis_selinux_disable: true
 
-# NOTE: FUTURE breaks wazuh agent repo metadata download
-rhel9cis_crypto_policy: FIPS
+# NOTE: Using DEFAULT crypto policy. FIPS breaks ed25519 SSH keys, and FUTURE
+# breaks wazuh agent repo metadata download.
+rhel9cis_crypto_policy: DEFAULT
 
 # Skip package updates
 rhel9cis_rule_1_9: false
diff --git a/releasenotes/notes/rhel9cis-crypto-policy-default-2de03e6a67a9efae.yaml b/releasenotes/notes/rhel9cis-crypto-policy-default-2de03e6a67a9efae.yaml
new file mode 100644
index 000000000..5470e3eee
--- /dev/null
+++ b/releasenotes/notes/rhel9cis-crypto-policy-default-2de03e6a67a9efae.yaml
@@ -0,0 +1,6 @@
+---
+security:
+  - |
+    Updates the default CIS hardening configuration to set
+    ``rhel9cis_crypto_policy`` to ``DEFAULT`` instead of ``FIPS``. This
+    resolves SSH issues with some modern key types such as ``ed25519``.