diff --git a/scripts/ha/cluster-init.sh b/scripts/ha/cluster-init.sh
index a2c7d2c..d2aa74b 100755
--- a/scripts/ha/cluster-init.sh
+++ b/scripts/ha/cluster-init.sh
@@ -72,6 +72,18 @@ if ! command -v mkfs.xfs &>/dev/null; then
     || die "mkfs.xfs not found — add xfsprogs to ha-server.nix environment.systemPackages and rebuild"
 fi
 
+# drbdmeta lives alongside drbdadm but may not be in PATH when run via sudo.
+if ! command -v drbdmeta &>/dev/null; then
+  _drbd_bin=$(dirname "$(command -v drbdadm)" 2>/dev/null || true)
+  [[ -n "$_drbd_bin" ]] && export PATH="$_drbd_bin:$PATH" \
+    || die "drbdmeta not found — is drbd-utils in ha-server environment.systemPackages?"
+fi
+
+# Portable 16-hex-char UUID generator (no openssl required).
+_rand_uuid() {
+  cat /proc/sys/kernel/random/uuid 2>/dev/null | tr -d '-' | cut -c1-16 | tr '[:lower:]' '[:upper:]'
+}
+
 # Inter-node SSH/SCP helpers — abstract over root-to-root vs nixos+sudo.
 _SSH_OPTS="-o StrictHostKeyChecking=no -o ConnectTimeout=10"
 [[ -n "$HA_KEY" ]] && _SSH_OPTS="-i $HA_KEY $_SSH_OPTS"
@@ -172,16 +184,17 @@ log "Initialising DRBD metadata on $NODE1..."
 # Calling drbdmeta --force directly bypasses the exclusive-open confirmation on
 # both steps without needing a TTY, regardless of whether the device is busy.
 if ! drbdadm dstate ha-data 2>/dev/null | grep -q "UpToDate"; then
-  UUID1=$(openssl rand -hex 8 2>/dev/null | tr '[:lower:]' '[:upper:]')
+  UUID1=$(_rand_uuid)
   drbdmeta --force 0 v08 /dev/sdb internal create-md
   drbdmeta --force 0 v08 /dev/sdb internal write-dev-uuid "$UUID1"
 fi
 
 log "Initialising DRBD metadata on $NODE2..."
 if ! n2_ssh "drbdadm dstate ha-data 2>/dev/null | grep -q UpToDate" 2>/dev/null; then
-  UUID2=$(openssl rand -hex 8 2>/dev/null | tr '[:lower:]' '[:upper:]')
-  n2_ssh "drbdmeta --force 0 v08 /dev/sdb internal create-md"
-  n2_ssh "drbdmeta --force 0 v08 /dev/sdb internal write-dev-uuid '${UUID2}'"
+  UUID2=$(n2_ssh "cat /proc/sys/kernel/random/uuid 2>/dev/null | tr -d '-' | cut -c1-16 | tr '[:lower:]' '[:upper:]'")
+  # PATH on NODE2 may not include drbdmeta when run via sudo; resolve via drbdadm's directory.
+  n2_ssh "bash -c 'export PATH=\"\$(dirname \"\$(command -v drbdadm)\"):\$PATH\"; drbdmeta --force 0 v08 /dev/sdb internal create-md'"
+  n2_ssh "bash -c 'export PATH=\"\$(dirname \"\$(command -v drbdadm)\"):\$PATH\"; drbdmeta --force 0 v08 /dev/sdb internal write-dev-uuid \"${UUID2}\"'"
 fi
 
 log "Bringing up DRBD on both nodes..."