diff --git a/CHANGELOG.md b/CHANGELOG.md
index e26464ea8..0e9d386bf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 
+## Unreleased
+
+### Added
+* Public API: add `NestedVirtualizationEnabled` stack parameter for `c8i`, `m8i`, `r8i`, and their flex variants
+
 ## [v6.65.0](https://github.com/buildkite/elastic-ci-stack-for-aws/compare/v6.64.0...v6.65.0) (2026-05-08)
 
 ### Changed
diff --git a/templates/aws-stack.yml b/templates/aws-stack.yml
index bc1336d27..246bbdd5e 100644
--- a/templates/aws-stack.yml
+++ b/templates/aws-stack.yml
@@ -88,6 +88,7 @@ Metadata:
         - InstanceOperatingSystem
         - InstanceTypes
         - CpuCredits
+        - NestedVirtualizationEnabled
         - EnableInstanceStorage
         - MountTmpfsAtTmp
         - AgentsPerInstance
@@ -657,6 +658,18 @@ Parameters:
       - unlimited
     Default: "unlimited"
 
+  NestedVirtualizationEnabled:
+    Description: >
+        Enable nested virtualization on supported EC2 instance types. Sets
+        CpuOptions.NestedVirtualization=enabled on the agent launch template.
+        Supported on c8i, m8i, r8i, and their flex variants. If enabled, all
+        values in InstanceTypes must be from supported families or launches fail.
+    Type: String
+    AllowedValues:
+      - "true"
+      - "false"
+    Default: "false"
+
   MaxSize:
     Description: Maximum number of instances. Controls cost ceiling and prevents runaway scaling.
     Type: Number
@@ -1532,6 +1545,9 @@ Conditions:
         - !Equals [ !Select [ 0, !Split [ ".", !Ref InstanceTypes ] ], "t3a" ]
         - !Equals [ !Select [ 0, !Split [ ".", !Ref InstanceTypes ] ], "t4g" ]
 
+    UseNestedVirtualization:
+      !Equals [ !Ref NestedVirtualizationEnabled, "true" ]
+
     UseStackNameForInstanceName:
       !Equals [ !Ref InstanceName, "" ]
 
@@ -2254,6 +2270,10 @@ Resources:
             - UsingBurstableInstances
             - CpuCredits: !Ref CpuCredits
             - !Ref "AWS::NoValue"
+          CpuOptions: !If
+            - UseNestedVirtualization
+            - NestedVirtualization: enabled
+            - !Ref "AWS::NoValue"
           TagSpecifications:
             - ResourceType: instance
               Tags: