diff --git a/docs/TODO.md b/docs/TODO.md
index 32b1cd6..9e5d22e 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -551,7 +551,29 @@ smoke test.
   trigger. Apply the same `-k 30 -l -1 -c 10` keep-alive/reconnect flags to the
   secure `nvme connect` as the test path has.
 - **Future hardening waived for now** (from the STIG register): FIPS, firewall,
-  remote audit offload, per-host/rotatable admin (SSH CA / config-agent).
+  per-host/rotatable admin (SSH CA / config-agent).
+- **TLS-encrypted audit/log offload (production).** The lab forwards logs to
+  `serving/audit-collector` in **plaintext**, and the STIG TLS-offload rules
+  (`rsyslog_encrypt_offload_defaultnetstreamdriver`,
+  `..._actionsendstreamdrivermode`, `..._actionsendstreamdriverauthmode`) are
+  **waived** in the tailoring because applying them forces `gtls` + x509 peer
+  auth + a CA file and breaks the plaintext `2f` forward. For production, do it
+  properly and DROP the waivers:
+  1. Stand up a CA (or reuse the boot-infra CA); issue the collector a server
+     cert (CN/SAN = `audit.fleet.lab`).
+  2. Configure the collector's rsyslog for TLS: `imtcp` with
+     `StreamDriver.Name="gtls"`, `StreamDriver.Mode="1"`, server cert/key + CA;
+     listen on the syslog-TLS port (6514) — add a TLS receiver to
+     `serving/audit-collector/rsyslog.conf` + compose.
+  3. Bundle the CA into the image (host-generic, no per-host state — same model
+     as the RADIUS CA) and point `$DefaultNetstreamDriverCAFile` at it.
+  4. Set the `2f` `omfwd` action to `StreamDriver="gtls" StreamDriverMode="1"
+     StreamDriverAuthMode="x509/name"` + the CA file, target port 6514.
+  5. Re-select the three `rsyslog_encrypt_offload_*` rules (remove from
+     `files/stig/diskless-tailoring.xml`) — they should then PASS, and update
+     `docs/stig-deviations.md` #6 to reflect encrypted offload.
+  (RELP+TLS via `omrelp`/`imrelp` is the alternative if guaranteed delivery is
+  wanted alongside encryption.)
 
 ## [ ] 9. (OPTIONAL / nice-to-have) Convert provisioning to Ansible where it pays off
 
diff --git a/docs/stig-deviations.md b/docs/stig-deviations.md
index c08443e..4f73b0a 100644
--- a/docs/stig-deviations.md
+++ b/docs/stig-deviations.md
@@ -26,7 +26,7 @@ Posture decisions (2026-06-18, lab phase):
 | 3 | **AIDE / file integrity** (`package_aide_installed`, `aide_build_database`, `aide_periodic_cron_checking`, `aide_scan_notification`, `aide_verify_*`) | The root is read-only and cryptographically verified; an on-disk AIDE db would also be non-deterministic and break the reproducible verity hash. | **dm-verity** verifies the whole root filesystem against a signed root hash on every read — continuous, hardware-backed integrity that supersedes AIDE's periodic scan. |
 | 4 | **Firewall** (`service_firewalld_enabled`, `package_firewalld_installed`, `set_firewalld_default_zone`) | Currently `firewall --disabled`; auto-enabling firewalld/nftables risks the NVMe/TCP (`:4420`) and NetworkManager paths during bring-up. | Isolated boot LAN; egress controlled at the serving-stack / network firewall layer. **Future hardening** — re-enable with explicit allow rules once the secure path is verified. |
 | 5 | **FIPS** (`enable_fips_mode`, `grub2_enable_fips_mode`, `package_dracut-fips_installed`) | Decision: off for the lab phase (interacts with the still-unsigned UKI / Secure Boot story). | Revisit with signing. No weakened crypto is configured in the meantime. |
-| 6 | **Remote audit offload** (`auditd_audispd_configure_remote_server`, `..._encrypt_sent_records`, `..._network_failure_action`, `rsyslog_remote_loghost`) | The SSG `audisp-remote` native-protocol rules stay waived; offload is done via **rsyslog over TCP** instead (simpler, container-friendly receiver). Lab uses **plaintext** (mirrors the HTTP-boot stack); encryption/failure-action rules remain deviated until TLS/RELP. | **Now wired both ends.** Sender (image, provisioner 2f, `audit_host` var): audisp-syslog → LOCAL6 + rsyslog `omfwd` (disk-assisted queue) to the host-generic `audit.fleet.lab`. Receiver: `serving/audit-collector/` (rsyslog TCP/514, per-source-host files). No per-host state. **Future**: TLS (`gtls`) or RELP+TLS + a real collector — then the encrypt/failure-action rules can pass. |
+| 6 | **Remote audit offload** (`auditd_audispd_configure_remote_server`, `..._encrypt_sent_records`, `..._network_failure_action`, `rsyslog_remote_loghost`) **+ rsyslog TLS offload** (`rsyslog_encrypt_offload_defaultnetstreamdriver`, `..._actionsendstreamdrivermode`, `..._actionsendstreamdriverauthmode`) | Offload is done via **rsyslog over TCP** (simpler, container-friendly receiver); the `audisp-remote` native-protocol rules stay waived. The **TLS-offload rules are waived** because the isolated lab boot LAN is plaintext (mirrors HTTP boot / no MACsec) and applying them forces `gtls` + x509 peer auth + a CA file, which **breaks** the plaintext `2f` forward (no CA, plaintext `:514`). | **Wired both ends, plaintext.** Sender (image, provisioner 2f, `audit_host`): audisp-syslog → LOCAL6 + rsyslog `omfwd` (disk-assisted queue) → host-generic `audit.fleet.lab`. Receiver: `serving/audit-collector/` (rsyslog TCP/514, per-source-host files). No per-host state; isolated LAN. **Production (tracked in docs/TODO.md #2):** issue the collector a TLS cert, bundle the CA in the image, switch `2f` + the collector to `gtls`/6514, then **re-select** the three `rsyslog_encrypt_offload_*` rules (drop the waivers) so they pass. |
 | 7 | **Smart card login** (`require_smart_card_login`, `sssd_enable_smartcard`, `install_smartcard_packages`) | Diskless hosts have no smartcard reader; admin access is SSH key-based. Enforcing smartcard login would lock the host out. | Admin auth is an SSH **key-only** account; root is locked; password auth disabled. |
 | 8 | **NOPASSWD sudo** (`sudo_remove_nopasswd`) | The baked admin is a **passwordless, key-only** account, so `sudo` cannot prompt for a password — NOPASSWD is required for it to function at all. | Single fleet-generic admin, key-only, `wheel`; no interactive password exists to protect. Tracked for the eventual per-host/rotatable access model (SSH CA / config-agent). |
 | 9 | **GUI / autologin / GDM** (gnome screensaver, GDM banner, automatic-login rules) | No GNOME/GDM is installed; the kiosk is an **intentional** autologin single-app (weston + Chromium) session on kiosk builds. | Kiosk user is unprivileged and passwordless; the session runs a single locked-down browser (no shell, no nav). Applies to kiosk builds only; non-kiosk builds don't install the GUI stack. |
diff --git a/files/stig/diskless-tailoring.xml b/files/stig/diskless-tailoring.xml
index 8911d7e..d38acc5 100644
--- a/files/stig/diskless-tailoring.xml
+++ b/files/stig/diskless-tailoring.xml
@@ -72,13 +72,23 @@
     <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_firewalld_installed" selected="false"/>
     <xccdf:select idref="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" selected="false"/>
 
-    <!-- Remote audit offload: LOCAL-only for now (decision). auditd runs and logs
-         to the overlay; audisp-remote/rsyslog remote loghost waived. -->
+    <!-- Remote audit offload: done via rsyslog (provisioner 2f) to the lab
+         collector. The audisp-remote native-protocol rules stay waived. -->
     <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_configure_remote_server" selected="false"/>
     <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_encrypt_sent_records" selected="false"/>
     <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_network_failure_action" selected="false"/>
     <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="false"/>
 
+    <!-- rsyslog TLS offload: these force gtls + x509 peer auth + a CA file for ALL
+         forwarding. The lab boot LAN is isolated and plaintext (HTTP boot, no
+         MACsec); applying them makes rsyslog require TLS and BREAKS the plaintext
+         2f forward to serving/audit-collector (no CA, plaintext :514). Waived for
+         the lab; TLS offload is tracked as production hardening (docs/TODO.md #2).
+         Re-select once the collector has a cert + the CA is bundled in the image. -->
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdrivermode" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdriverauthmode" selected="false"/>
+
     <!-- Smart card: diskless, key-based admin; no PKI/smartcard reader. Enabling
          smartcard-required login would lock the host out. -->
     <xccdf:select idref="xccdf_org.ssgproject.content_rule_require_smart_card_login" selected="false"/>