diff --git a/README.md b/README.md
index eec6b96e45..ad87d60f85 100644
--- a/README.md
+++ b/README.md
@@ -157,18 +157,6 @@ OVNKubernetes supports the following configuration options, all of which are opt
 * `egressIPConfig`: holds the configuration for EgressIP options.
   * `reachabilityTotalTimeoutSeconds`: Set EgressIP node reachability total timeout in seconds, 0 means disable reachability check and the default is 1 second.
 
-#### DPU Host Mode Support
-
-OVN-Kubernetes supports specialized hardware deployments such as DPU (Data Processing Unit) hosts through the `OVN_NODE_MODE` environment variable. In `dpu-host` mode, certain features are automatically disabled on those nodes regardless of cluster-wide configuration:
-
-- Egress IP and related features (egress firewall, egress QoS, egress service)
-- Multicast support
-- Multi-external gateway support
-- Multi-network policies and admin network policies
-- Network segmentation features
-
-This per-node feature enforcement is implemented through conditional logic in the startup scripts, allowing the same cluster configuration to work across heterogeneous node types. For detailed information about node modes and the technical implementation, see `docs/ovn_node_mode.md`.
-
 These configuration flags are only in the Operator configuration object.
 
 Example from the `manifests/cluster-network-03-config.yml` file:
diff --git a/bindata/network/ovn-kubernetes/common/008-script-lib.yaml b/bindata/network/ovn-kubernetes/common/008-script-lib.yaml
index 264f1f25df..4be80942b4 100644
--- a/bindata/network/ovn-kubernetes/common/008-script-lib.yaml
+++ b/bindata/network/ovn-kubernetes/common/008-script-lib.yaml
@@ -515,15 +515,9 @@ data:
 
       echo "I$(date "+%m%d %H:%M:%S.%N") - starting ovnkube-node"
 
-      # enable egress ip, egress firewall, egress qos, egress service
-      egress_features_enable_flag="--enable-egress-ip=true --enable-egress-firewall=true --enable-egress-qos=true --enable-egress-service=true"
       init_ovnkube_controller="--init-ovnkube-controller ${K8S_NODE}"
-      multi_external_gateway_enable_flag="--enable-multi-external-gateway=true"
       gateway_interface=br-ex
 
-      # enable multicast
-      enable_multicast_flag="--enable-multicast"
-
       # Use OVN_NODE_MODE environment variable, default to "full" if not set
       OVN_NODE_MODE=${OVN_NODE_MODE:-full}
       # We check only dpu-host mode and not smart-nic mode here as currently we do not support it yet
@@ -533,17 +527,9 @@ data:
         # https://github.com/ovn-kubernetes/ovn-kubernetes/pull/5327/files
         gateway_interface="derive-from-mgmt-port"
         ovnkube_node_mode="--ovnkube-node-mode dpu-host"
-        # disable egress ip for dpu-host mode as it is not supported
-        egress_features_enable_flag=""
-
-        # disable multicast for dpu-host mode as it is not supported
-        enable_multicast_flag=""
 
         # disable init-ovnkube-controller for dpu-host mode as it is not supported
         init_ovnkube_controller=""
-
-        # disable multi-external-gateway for dpu-host mode as it is not supported
-        multi_external_gateway_enable_flag=""
       fi
 
       if [ "{{.OVN_GATEWAY_MODE}}" == "shared" ]; then
@@ -589,12 +575,12 @@ data:
       fi
 
       multi_network_enabled_flag=
-      if [[ "{{.OVN_MULTI_NETWORK_ENABLE}}" == "true" && "${OVN_NODE_MODE}" != "dpu-host" ]]; then
+      if [[ "{{.OVN_MULTI_NETWORK_ENABLE}}" == "true" ]]; then
         multi_network_enabled_flag="--enable-multi-network"
       fi
 
       network_segmentation_enabled_flag=
-      if [[ "{{.OVN_NETWORK_SEGMENTATION_ENABLE}}" == "true" && "${OVN_NODE_MODE}" != "dpu-host" ]]; then
+      if [[ "{{.OVN_NETWORK_SEGMENTATION_ENABLE}}" == "true" ]]; then
         multi_network_enabled_flag="--enable-multi-network"
         network_segmentation_enabled_flag="--enable-network-segmentation"
       fi
@@ -615,12 +601,12 @@ data:
       fi
 
       multi_network_policy_enabled_flag=
-      if [[ "{{.OVN_MULTI_NETWORK_POLICY_ENABLE}}" == "true"&& "${OVN_NODE_MODE}" != "dpu-host" ]]; then
+      if [[ "{{.OVN_MULTI_NETWORK_POLICY_ENABLE}}" == "true" ]]; then
         multi_network_policy_enabled_flag="--enable-multi-networkpolicy"
       fi
 
       admin_network_policy_enabled_flag=
-      if [[ "{{.OVN_ADMIN_NETWORK_POLICY_ENABLE}}" == "true" && "${OVN_NODE_MODE}" != "dpu-host" ]]; then
+      if [[ "{{.OVN_ADMIN_NETWORK_POLICY_ENABLE}}" == "true" ]]; then
         admin_network_policy_enabled_flag="--enable-admin-network-policy"
       fi
 
@@ -629,6 +615,11 @@ data:
         dns_name_resolver_enabled_flag="--enable-dns-name-resolver"
       fi
 
+      enable_multicast_flag=""
+      if [[ "{{.OVN_MULTICAST_ENABLE}}" == "true" ]]; then
+        enable_multicast_flag="--enable-multicast"
+      fi
+
       # If IP Forwarding mode is global set it in the host here. IPv6 IP Forwarding shuld be
       # enabled for all interfaces at all times if cluster is configured as single stack IPv6
       # or dual stack. This will be taken care by ovn-kubernetes(ovn-org/ovn-kubernetes#4376).
@@ -693,7 +684,9 @@ data:
         --inactivity-probe="${OVN_CONTROLLER_INACTIVITY_PROBE}" \
         ${gateway_mode_flags} \
         ${node_mgmt_port_netdev_flags} \
-        ${ovnkube_node_mode} \
+{{- if eq .OVN_NODE_MODE "dpu-host" }}
+        --ovnkube-node-mode dpu-host \
+{{- end }}
         --metrics-bind-address "127.0.0.1:${metrics_port}" \
         --ovn-metrics-bind-address "127.0.0.1:${ovn_metrics_port}" \
         --metrics-enable-pprof \
@@ -722,7 +715,5 @@ data:
         ${ovn_v4_masquerade_subnet_opt} \
         ${ovn_v6_masquerade_subnet_opt} \
         ${ovn_v4_transit_switch_subnet_opt} \
-        ${ovn_v6_transit_switch_subnet_opt} \
-        ${egress_features_enable_flag} \
-        ${multi_external_gateway_enable_flag}
+        ${ovn_v6_transit_switch_subnet_opt}
     }
diff --git a/bindata/network/ovn-kubernetes/managed/004-config.yaml b/bindata/network/ovn-kubernetes/managed/004-config.yaml
index ae43238950..291efe1f96 100644
--- a/bindata/network/ovn-kubernetes/managed/004-config.yaml
+++ b/bindata/network/ovn-kubernetes/managed/004-config.yaml
@@ -33,9 +33,19 @@ data:
     dns-service-name="dns-default"
  
     [ovnkubernetesfeature]
+{{- if not .DPU_HOST_MODE_ENABLED }}
+    enable-egress-ip=false
+    enable-egress-firewall=false
+    enable-egress-qos=false
+    enable-egress-service=false
+    enable-multi-external-gateway=false
+{{- end }}
 {{- if .ReachabilityNodePort }}
     egressip-node-healthcheck-port={{.ReachabilityNodePort}}
 {{- end }}
+{{- if .OVN_MULTI_NETWORK_ENABLE }}
+    enable-multi-network=true
+{{- end }}
 {{- if .OVN_NETWORK_SEGMENTATION_ENABLE }}
     {{- if not .OVN_MULTI_NETWORK_ENABLE }}
     enable-multi-network=true
@@ -45,6 +55,12 @@ data:
 {{- if .OVN_PRE_CONF_UDN_ADDR_ENABLE }}
     enable-preconfigured-udn-addresses=true
 {{- end }}
+{{- if .OVN_MULTI_NETWORK_POLICY_ENABLE }}
+    enable-multi-networkpolicy=true
+{{- end }}
+{{- if .OVN_ADMIN_NETWORK_POLICY_ENABLE }}
+    enable-admin-network-policy=true
+{{- end }}
 {{- if .DNS_NAME_RESOLVER_ENABLE }}
     enable-dns-name-resolver=true
 {{- end }}
@@ -114,10 +130,13 @@ data:
     dns-service-name="dns-default"
 
     [ovnkubernetesfeature]
+{{- if not .DPU_HOST_MODE_ENABLED }}
     enable-egress-ip=true
     enable-egress-firewall=true
     enable-egress-qos=true
     enable-egress-service=true
+    enable-multi-external-gateway=true
+{{- end }}
 {{- if .ReachabilityNodePort }}
     egressip-node-healthcheck-port={{.ReachabilityNodePort}}
 {{- end }}
@@ -129,9 +148,21 @@ data:
     enable-multi-network=true
     {{- end }}
     enable-network-segmentation=true
+{{- end }}
 {{- if .OVN_PRE_CONF_UDN_ADDR_ENABLE }}
     enable-preconfigured-udn-addresses=true
 {{- end }}
+{{- if .OVN_MULTI_NETWORK_POLICY_ENABLE }}
+    enable-multi-networkpolicy=true
+{{- end }}
+{{- if .OVN_ADMIN_NETWORK_POLICY_ENABLE }}
+    enable-admin-network-policy=true
+{{- end }}
+{{- if .OVN_MULTI_NETWORK_POLICY_ENABLE }}
+    enable-multi-networkpolicy=true
+{{- end }}
+{{- if .OVN_ADMIN_NETWORK_POLICY_ENABLE }}
+    enable-admin-network-policy=true
 {{- end }}
 {{- if .DNS_NAME_RESOLVER_ENABLE }}
     enable-dns-name-resolver=true
@@ -141,7 +172,6 @@ data:
     mode={{.OVN_GATEWAY_MODE}}
     nodeport=true
 
-
     [logging]
     libovsdblogfile=/var/log/ovnkube/libovsdb.log
     logfile-maxsize=100
diff --git a/bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml b/bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml
index 5a4c72d1ff..1bacebd715 100644
--- a/bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml
+++ b/bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml
@@ -184,13 +184,8 @@ spec:
           # will rollout control plane pods as well
           network_segmentation_enabled_flag=
           multi_network_enabled_flag=
-          if [[ "{{.OVN_MULTI_NETWORK_ENABLE}}" == "true" ]]; then
-            multi_network_enabled_flag="--enable-multi-network"
-          fi
           if [[ "{{.OVN_NETWORK_SEGMENTATION_ENABLE}}" == "true" ]]; then
-            if [[ "{{.OVN_MULTI_NETWORK_ENABLE}}" != "true" ]]; then
-              multi_network_enabled_flag="--enable-multi-network"
-            fi
+            multi_network_enabled_flag="--enable-multi-network"
             network_segmentation_enabled_flag="--enable-network-segmentation"
           fi
 
@@ -204,18 +199,6 @@ spec:
             preconfigured_udn_addresses_enable_flag="--enable-preconfigured-udn-addresses"
           fi
 
-          # Enable multi-network policy if configured (control-plane always full mode)
-          multi_network_policy_enabled_flag=
-          if [[ "{{.OVN_MULTI_NETWORK_POLICY_ENABLE}}" == "true" ]]; then
-            multi_network_policy_enabled_flag="--enable-multi-networkpolicy"
-          fi
-
-          # Enable admin network policy if configured (control-plane always full mode)
-          admin_network_policy_enabled_flag=
-          if [[ "{{.OVN_ADMIN_NETWORK_POLICY_ENABLE}}" == "true" ]]; then
-            admin_network_policy_enabled_flag="--enable-admin-network-policy"
-          fi
-
           echo "I$(date "+%m%d %H:%M:%S.%N") - ovnkube-control-plane - start ovnkube --init-cluster-manager ${K8S_NODE}"
           exec /usr/bin/ovnkube \
             --enable-interconnect \
@@ -237,15 +220,7 @@ spec:
             ${multi_network_enabled_flag} \
             ${network_segmentation_enabled_flag} \
             ${route_advertisements_enable_flag} \
-            ${preconfigured_udn_addresses_enable_flag} \
-            --enable-egress-ip=true \
-            --enable-egress-firewall=true \
-            --enable-egress-qos=true \
-            --enable-egress-service=true \
-            --enable-multicast \
-            --enable-multi-external-gateway=true \
-            ${multi_network_policy_enabled_flag} \
-            ${admin_network_policy_enabled_flag}
+            ${preconfigured_udn_addresses_enable_flag}
         volumeMounts:
         - mountPath: /run/ovnkube-config/
           name: ovnkube-config
diff --git a/bindata/network/ovn-kubernetes/self-hosted/004-config.yaml b/bindata/network/ovn-kubernetes/self-hosted/004-config.yaml
index 717c3e6877..2348cbb3bf 100644
--- a/bindata/network/ovn-kubernetes/self-hosted/004-config.yaml
+++ b/bindata/network/ovn-kubernetes/self-hosted/004-config.yaml
@@ -28,7 +28,7 @@ data:
     no-hostsubnet-nodes="kubernetes.io/os=windows"
 {{- end  }}
 {{- if .IsNetworkTypeLiveMigration }}
-    no-hostsubnet-nodes="migration.network.openshift.io/plugin="
+    no-hostsubnet-nodes="migration.network.openshift.io/plugin=ovn-kubernetes"
 {{- end }}
     platform-type="{{.PlatformType}}"
     healthz-bind-address="0.0.0.0:10256"
@@ -36,13 +36,22 @@ data:
     dns-service-name="dns-default"
  
     [ovnkubernetesfeature]
-
-    {{- if .ReachabilityTotalTimeoutSeconds }}
+{{- if not .DPU_HOST_MODE_ENABLED }}
+    enable-egress-ip=false
+    enable-egress-firewall=false
+    enable-egress-qos=false
+    enable-egress-service=false
+    enable-multi-external-gateway=false
+{{- end }}
+{{- if .ReachabilityTotalTimeoutSeconds }}
     egressip-reachability-total-timeout={{.ReachabilityTotalTimeoutSeconds}}
-    {{- end }}
+{{- end }}
 {{- if .ReachabilityNodePort }}
     egressip-node-healthcheck-port={{.ReachabilityNodePort}}
 {{- end }}
+{{- if .OVN_MULTI_NETWORK_ENABLE }}
+    enable-multi-network=true
+{{- end }}
 {{- if .OVN_NETWORK_SEGMENTATION_ENABLE }}
     {{- if not .OVN_MULTI_NETWORK_ENABLE }}
     enable-multi-network=true
@@ -55,6 +64,9 @@ data:
 {{- if .OVN_MULTI_NETWORK_POLICY_ENABLE }}
     enable-multi-networkpolicy=true
 {{- end }}
+{{- if .OVN_ADMIN_NETWORK_POLICY_ENABLE }}
+    enable-admin-network-policy=true
+{{- end }}
 {{- if .DNS_NAME_RESOLVER_ENABLE }}
     enable-dns-name-resolver=true
 {{- end }}
diff --git a/bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml b/bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml
index c49b3c0574..b08284ba65 100644
--- a/bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml
+++ b/bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml
@@ -135,13 +135,8 @@ spec:
           # will rollout control plane pods as well
           network_segmentation_enabled_flag=
           multi_network_enabled_flag=
-          if [[ "{{.OVN_MULTI_NETWORK_ENABLE}}" == "true" ]]; then
-            multi_network_enabled_flag="--enable-multi-network"
-          fi
           if [[ "{{.OVN_NETWORK_SEGMENTATION_ENABLE}}" == "true" ]]; then
-            if [[ "{{.OVN_MULTI_NETWORK_ENABLE}}" != "true" ]]; then
-              multi_network_enabled_flag="--enable-multi-network"
-            fi
+            multi_network_enabled_flag="--enable-multi-network"
             network_segmentation_enabled_flag="--enable-network-segmentation"
           fi
 
@@ -154,18 +149,6 @@ spec:
           if [[ "{{.OVN_PRE_CONF_UDN_ADDR_ENABLE}}" == "true" ]]; then
             preconfigured_udn_addresses_enable_flag="--enable-preconfigured-udn-addresses"
           fi
-
-          # Enable multi-network policy if configured (control-plane always full mode)
-          multi_network_policy_enabled_flag=
-          if [[ "{{.OVN_MULTI_NETWORK_POLICY_ENABLE}}" == "true" ]]; then
-            multi_network_policy_enabled_flag="--enable-multi-networkpolicy"
-          fi
-
-          # Enable admin network policy if configured (control-plane always full mode)
-          admin_network_policy_enabled_flag=
-          if [[ "{{.OVN_ADMIN_NETWORK_POLICY_ENABLE}}" == "true" ]]; then
-            admin_network_policy_enabled_flag="--enable-admin-network-policy"
-          fi
           
           if [ "{{.OVN_GATEWAY_MODE}}" == "shared" ]; then
             gateway_mode_flags="--gateway-mode shared"
@@ -195,15 +178,7 @@ spec:
             ${network_segmentation_enabled_flag} \
             ${gateway_mode_flags} \
             ${route_advertisements_enable_flag} \
-            ${preconfigured_udn_addresses_enable_flag} \
-            --enable-egress-ip=true \
-            --enable-egress-firewall=true \
-            --enable-egress-qos=true \
-            --enable-egress-service=true \
-            --enable-multicast \
-            --enable-multi-external-gateway=true \
-            ${multi_network_policy_enabled_flag} \
-            ${admin_network_policy_enabled_flag}
+            ${preconfigured_udn_addresses_enable_flag}
         volumeMounts:
         - mountPath: /run/ovnkube-config/
           name: ovnkube-config
diff --git a/docs/architecture.md b/docs/architecture.md
index 6a2339eba8..289e06a3c0 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -141,12 +141,6 @@ The Network operator needs to make sure that the input configuration doesn't cha
 
 The persisted configuration must **make all defaults explicit**. This protects against inadvertent code changes that could destabilize an existing cluster.
 
-### Per-Node Configuration
-
-For certain specialized deployments (e.g., DPU host nodes), some features need to be disabled on a per-node basis even when enabled cluster-wide. Since ConfigMap values cannot be reliably overridden per-node, the CNO implements per-node feature enforcement through conditional logic in the startup scripts.
-
-The `OVN_NODE_MODE` environment variable is injected into `ovnkube-node` pods and consumed by the startup script (`008-script-lib.yaml`) to conditionally enable or disable features based on the node's operational mode. This ensures that unsupported features are deterministically disabled on specialized hardware regardless of cluster-wide configuration.
-
 ## Egress Router
 
 **Input:** `EgressRouter.network.operator.openshift.io`
diff --git a/docs/dpu_host_mode.md b/docs/dpu_host_mode.md
new file mode 100644
index 0000000000..e6283e6d7d
--- /dev/null
+++ b/docs/dpu_host_mode.md
@@ -0,0 +1,189 @@
+# DPU Host Mode
+
+## Overview
+
+DPU (Data Processing Unit) host mode is a cluster-wide feature that automatically disables certain OVN-Kubernetes networking features when DPU hardware is detected in the cluster. This ensures consistent network behavior across all nodes, as DPU hardware has specific limitations that require certain features to be disabled.
+
+## How It Works
+
+### 1. Detection
+
+The cluster network operator automatically detects DPU nodes by looking for nodes with the DPU mode label:
+- **Label**: `network.operator.openshift.io/dpu`
+- **Detection Point**: `pkg/network/ovn_kubernetes.go` in the `bootstrapOVNConfig()` function
+
+```go
+// Detect if DPU nodes are present in cluster
+ovnConfigResult.DpuHostModeEnabled = len(ovnConfigResult.DpuModeNodes) > 0
+```
+
+When **any** DPU node is found in the cluster, DPU host mode is enabled **cluster-wide**.
+
+### 2. Feature Disabling
+
+When DPU host mode is enabled (`DpuHostModeEnabled = true`), the following features are automatically disabled across the **entire cluster**:
+
+#### Egress Features (Template-controlled)
+These features are controlled by the `DPU_HOST_MODE_ENABLED` flag in ConfigMap templates:
+- ❌ Egress IP
+- ❌ Egress Firewall
+- ❌ Egress QoS
+- ❌ Egress Service
+
+#### Network Features (Go-controlled)
+These features are disabled directly in Go code when DPU mode is detected:
+- ❌ Multi-network support (`OVN_MULTI_NETWORK_ENABLE`)
+- ❌ Network segmentation (`OVN_NETWORK_SEGMENTATION_ENABLE`)
+- ❌ Multi-network policies (`OVN_MULTI_NETWORK_POLICY_ENABLE`)
+- ❌ Admin network policies (`OVN_ADMIN_NETWORK_POLICY_ENABLE`)
+- ❌ Multicast support (`OVN_MULTICAST_ENABLE`)
+
+### 3. Implementation Architecture
+
+The implementation uses a hybrid approach with two control mechanisms:
+
+#### Go Code Control (Primary)
+Location: `pkg/network/ovn_kubernetes.go` (lines 394-401)
+
+```go
+// Disable all DPU-incompatible features when DPU host mode enabled
+if dpuHostModeEnabled {
+    // Disable feature gates that are incompatible with DPU
+    data.Data["OVN_ADMIN_NETWORK_POLICY_ENABLE"] = false
+    data.Data["OVN_NETWORK_SEGMENTATION_ENABLE"] = false
+    data.Data["OVN_MULTI_NETWORK_ENABLE"] = false
+    data.Data["OVN_MULTI_NETWORK_POLICY_ENABLE"] = false
+    data.Data["OVN_MULTICAST_ENABLE"] = false
+}
+```
+
+These flags are set to `false` when DPU nodes are present, overriding any feature gate settings.
+
+#### Template Control (Egress Features)
+Location: `bindata/network/ovn-kubernetes/{managed,self-hosted}/004-config.yaml`
+
+```ini
+[ovnkubernetesfeature]
+{{- if not .DPU_HOST_MODE_ENABLED }}
+enable-egress-ip=true
+enable-egress-firewall=true
+enable-egress-qos=true
+enable-egress-service=true
+{{- end }}
+```
+
+Egress features are only rendered in the ConfigMap when `DPU_HOST_MODE_ENABLED` is false.
+
+## Node Configuration
+
+### DPU Host Nodes
+Nodes running in DPU host mode have special configuration:
+- **OVN Node Mode**: Set to `dpu-host`
+- **Gateway Interface**: Uses `derive-from-mgmt-port` instead of `br-ex`
+- **Management Port**: Configured via `OVNKUBE_NODE_MGMT_PORT_NETDEV`
+
+### Regular Nodes
+When DPU nodes are present, regular (full mode) nodes still run in `full` mode but with the same features disabled to maintain cluster consistency.
+
+## Cluster-Wide Behavior
+
+| Scenario | Feature State | Node Modes | Consistency |
+|----------|---------------|------------|-------------|
+| **No DPU nodes** | All features enabled | All nodes: `full` | ✅ Perfect |
+| **DPU nodes present** | DPU-incompatible features disabled | DPU: `dpu-host`<br>Others: `full` | ✅ Perfect |
+
+**Key Point**: Feature disabling is cluster-wide, not per-node. This ensures consistent behavior regardless of which node is handling traffic.
+
+## Configuration Files Affected
+
+### ConfigMaps
+- `bindata/network/ovn-kubernetes/managed/004-config.yaml`
+- `bindata/network/ovn-kubernetes/self-hosted/004-config.yaml`
+
+### Scripts
+- `bindata/network/ovn-kubernetes/common/008-script-lib.yaml`
+
+### Control Plane
+- `bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml`
+- `bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml`
+
+### Node DaemonSets
+- `bindata/network/ovn-kubernetes/managed/ovnkube-node.yaml`
+- `bindata/network/ovn-kubernetes/self-hosted/ovnkube-node.yaml`
+
+## Testing
+
+Comprehensive tests for DPU host mode are located in:
+- `pkg/network/ovn_kubernetes_test.go`
+- Test function: `TestOVNKubernetesDpuHostMode`
+
+The tests verify:
+- ✅ DPU node detection
+- ✅ Feature disabling when DPU nodes are present
+- ✅ Normal operation when no DPU nodes exist
+- ✅ Multiple DPU node scenarios
+- ✅ Gateway interface configuration
+- ✅ ConfigMap rendering
+- ✅ Script template rendering
+
+Run tests with:
+```bash
+go test -v -run TestOVNKubernetesDpuHostMode ./pkg/network/
+```
+
+## Troubleshooting
+
+### Check if DPU Mode is Enabled
+
+Check the cluster-network-operator logs for:
+```
+DPU host mode enabled - DPU-incompatible features will be disabled cluster-wide (N DPU nodes found)
+```
+
+### Verify DPU Node Labels
+
+List nodes with DPU label:
+```bash
+kubectl get nodes -l network.operator.openshift.io/dpu
+```
+
+### Check Feature State
+
+Examine the `ovnkube-config` ConfigMap:
+```bash
+kubectl get configmap ovnkube-config -n openshift-ovn-kubernetes -o yaml
+```
+
+Look for the absence of disabled features (they won't appear in the ConfigMap when disabled).
+
+## Design Decisions
+
+### Why Cluster-Wide?
+DPU hardware limitations require certain features to be disabled. Enabling these features on some nodes but not others would create:
+- Inconsistent behavior depending on which node handles traffic
+- Potential connectivity issues when traffic moves between nodes
+- Complex troubleshooting scenarios
+
+Therefore, when **any** DPU node is present, features are disabled **cluster-wide** to ensure predictable behavior.
+
+### Why Hybrid Approach?
+- **Go Control**: Provides type safety, testability, and centralized logic for feature gates
+- **Template Control**: Maintains backward compatibility for egress features that have always been template-controlled
+
+This hybrid approach balances clean architecture with minimal changes to existing, stable code paths.
+
+## Future Enhancements
+
+Potential future improvements:
+1. Migrate egress features to pure Go control for consistency
+2. Add webhook validation to prevent users from enabling incompatible features
+3. Add status reporting to show which features are disabled and why
+4. Support per-node feature enablement for non-DPU nodes (advanced use case)
+
+## References
+
+- [Architecture Documentation](architecture.md)
+- [Operands Documentation](operands.md)
+- OpenShift OVN-Kubernetes operator source code
+
+
diff --git a/docs/operands.md b/docs/operands.md
index 755ff81e52..1d129a51fe 100644
--- a/docs/operands.md
+++ b/docs/operands.md
@@ -93,26 +93,6 @@ configuration object (which in turn is copied there from the
 configuration) is "`OVNKubernetes`". If the specified network type is
 not "`OVNKubernetes`", the CNO will not render any network plugin.
 
-### OVN-Kubernetes Node Modes
-
-OVN-Kubernetes supports different node operational modes through the `OVN_NODE_MODE` 
-environment variable. This allows per-node feature enforcement, particularly for 
-specialized hardware like DPU (Data Processing Unit) hosts where certain features 
-must be disabled.
-
-The startup script (`008-script-lib.yaml`) contains conditional logic that adjusts 
-feature enablement based on the node mode:
-
-- **`full` mode (default)**: All features enabled as configured
-- **`dpu-host` mode**: Certain features like egress IP, multicast, multi-network 
-  policies, and admin network policies are automatically disabled regardless of 
-  cluster-wide configuration
-
-This approach was necessary because ConfigMap values (`004-config.yaml`) cannot be 
-reliably overridden on a per-node basis, but startup script logic can be conditional.
-
-For detailed information, see `docs/ovn_node_mode.md`.
-
 ## Multus
 
 Multus is deployed as long as `.spec.disableMultiNetwork` is not set.
diff --git a/docs/ovn_node_mode.md b/docs/ovn_node_mode.md
deleted file mode 100644
index a0dea848e0..0000000000
--- a/docs/ovn_node_mode.md
+++ /dev/null
@@ -1,100 +0,0 @@
-## OVN node modes and per-node feature enforcement
-
-This change introduces `OVN_NODE_MODE` as an environment variable injected into the `ovnkube-node` Pod. The value is consumed by the startup script rendered from `bindata/network/ovn-kubernetes/common/008-script-lib.yaml` to tailor behavior per node mode at runtime.
-
-### Why move flags from the config map into the script?
-
-- The INI-based config (`004-config.yaml`) is rendered cluster-wide. Those values are not reliably overridable on a per-node or per-mode basis.
-- In DPU host mode, some features are not supported and must be deterministically disabled on those nodes even if the cluster-wide config enables them.
-- Moving the enablement logic to the entrypoint script allows per-node enforcement using `OVN_NODE_MODE`, preventing unsupported features from being turned on by cluster defaults.
-
-### Behavior by mode
-
-- `full` (default):
-  - `gateway_interface=br-ex`
-  - `init_ovnkube_controller="--init-ovnkube-controller ${K8S_NODE}"`
-  - `enable_multicast_flag="--enable-multicast"`
-  - `egress_features_enable_flag="--enable-egress-ip=true --enable-egress-firewall=true --enable-egress-qos=true --enable-egress-service=true"`
-  - `multi_external_gateway_enable_flag="--enable-multi-external-gateway=true"`
-
-- `dpu-host`:
-  - `gateway_interface="derive-from-mgmt-port"`
-  - `ovnkube_node_mode="--ovnkube-node-mode dpu-host"`
-  - `init_ovnkube_controller=""` (disabled)
-  - `enable_multicast_flag=""` (disabled)
-  - `egress_features_enable_flag=""` (egress IP and related features disabled)
-  - `multi_external_gateway_enable_flag=""` (multi-external gateway disabled)
-  - Multi-network, network segmentation, and multi-network policy/admin network policy are gated and not enabled in this mode.
-
-### Manifests
-
-- `ovnkube-node.yaml` (managed and self-hosted) now inject `OVN_NODE_MODE` into the Pod env so the script can apply mode-aware logic.
-- `ovnkube-control-plane.yaml` (managed and self-hosted) have feature flags moved from ConfigMap to inline script logic.
-- `004-config.yaml` drops hard-coded feature enables that conflict with per-node enforcement.
-
-**Note**: Control-plane components always run in "full" mode since they don't run on DPU hosts and need all features enabled for cluster coordination. Always-enabled features (egress, multicast, multi-external-gateway) are added directly to the command line, while conditional features use script variables.
-
-### Implementation Details
-
-#### Environment Variable Injection
-
-The `OVN_NODE_MODE` environment variable is injected into `ovnkube-node` pods through the DaemonSet specification in both managed and self-hosted variants:
-
-- `bindata/network/ovn-kubernetes/managed/ovnkube-node.yaml`
-- `bindata/network/ovn-kubernetes/self-hosted/ovnkube-node.yaml`
-
-The value is typically derived from node labels or annotations that identify the node's hardware type.
-
-#### Script Logic Flow
-
-The startup script (`008-script-lib.yaml`) implements the following conditional logic:
-
-```bash
-if [[ "${OVN_NODE_MODE}" != "dpu-host" ]]; then
-    # Enable features for full mode
-    egress_ip_enable_flag="--enable-egress-ip=true --enable-egress-firewall=true --enable-egress-qos=true --enable-egress-service=true"
-    enable_multicast_flag="--enable-multicast"
-    # ... other feature flags
-else
-    # DPU host mode - disable features
-    egress_ip_enable_flag=""
-    enable_multicast_flag=""
-    gateway_interface="derive-from-mgmt-port"
-    ovnkube_node_mode="--ovnkube-node-mode dpu-host"
-fi
-```
-
-#### Feature Flag Mapping
-
-The following table shows how cluster-wide configuration translates to per-node enforcement:
-
-| Feature | ConfigMap (004-config.yaml) | Script Variable | DPU Host Behavior |
-|---------|----------------------------|-----------------|-------------------|
-| Egress IP | `enable-egress-ip=true` | `egress_features_enable_flag` | Force disabled |
-| Multicast | `enable-multicast=true` | `enable_multicast_flag` | Force disabled |
-| Multi External Gateway | `enable-multi-external-gateway=true` | `multi_external_gateway_enable_flag` | Force disabled |
-| Multi-network | `enable-multi-network=true` | `multi_network_enabled_flag` | Conditionally disabled |
-| Admin Network Policy | `enable-admin-network-policy=true` | `admin_network_policy_enabled_flag` | Conditionally disabled |
-| Network Segmentation | `enable-network-segmentation=true` | `network_segmentation_enabled_flag` | Conditionally disabled |
-
-### Testing
-
-- Unit tests assert that the rendered script contains the correct assignments for `gateway_interface`, `init_ovnkube_controller`, `enable_multicast_flag`, `egress_features_enable_flag`, and `ovnkube_node_mode` across modes.
-- The comprehensive test `TestOVNKubernetesScriptLibCombined` validates all conditional logic paths and feature flag assignments for node scripts.
-- The test `TestOVNKubernetesControlPlaneFlags` validates that control-plane scripts have:
-  - Always-enabled features added directly to the command line (egress, multicast, multi-external-gateway)
-  - Conditional features handled via script variables (multi-network, network policies, etc.)
-  - Correct multi-network enablement logic (OVN_MULTI_NETWORK_ENABLE or OVN_NETWORK_SEGMENTATION_ENABLE)
-- Tests verify both positive cases (features enabled in full mode) and negative cases (features disabled in DPU host mode).
-
-### Migration Notes
-
-When upgrading clusters that previously relied on ConfigMap-based feature control:
-
-1. Existing ConfigMap values in `004-config.yaml` have been removed for features that require per-node control
-2. The startup scripts (both node and control-plane) now contain the authoritative feature enablement logic
-3. Control-plane components automatically enable all features (always run in "full" mode)
-4. DPU host nodes will automatically have incompatible features disabled regardless of previous ConfigMap settings
-5. No manual intervention is required - the migration is handled automatically during the upgrade process
-
-
diff --git a/pkg/bootstrap/types.go b/pkg/bootstrap/types.go
index 375664bcc4..7a6824ff81 100644
--- a/pkg/bootstrap/types.go
+++ b/pkg/bootstrap/types.go
@@ -36,6 +36,9 @@ type OVNConfigBoostrapResult struct {
 	SmartNicModeNodes     []string
 	SmartNicModeValue     string
 	MgmtPortResourceName  string
+	// DpuHostModeEnabled indicates whether DPU host mode is enabled cluster-wide.
+	// When true, DPU-incompatible features will be disabled cluster-wide.
+	DpuHostModeEnabled bool
 	// ConfigOverrides contains the overrides for the OVN Kubernetes configuration
 	// This is used to set the hidden OVN Kubernetes configuration in the cluster
 	// It is a map of key-value pairs where the key is the configuration option and the
diff --git a/pkg/network/mtu_unsupported.go b/pkg/network/mtu_unsupported.go
index b6aac709f6..39b34998e1 100644
--- a/pkg/network/mtu_unsupported.go
+++ b/pkg/network/mtu_unsupported.go
@@ -3,4 +3,10 @@
 
 package network
 
-func getDefaultMTU() (int, error) { return 1500, nil }
+const (
+	MinMTUIPv4 uint32 = 576  // RFC 791
+	MinMTUIPv6 uint32 = 1280 // RFC 8200
+	MaxMTU     uint32 = 65536
+)
+
+func GetDefaultMTU() (int, error) { return 1500, nil }
diff --git a/pkg/network/ovn_kubernetes.go b/pkg/network/ovn_kubernetes.go
index b58228fe19..5d07c4b911 100644
--- a/pkg/network/ovn_kubernetes.go
+++ b/pkg/network/ovn_kubernetes.go
@@ -329,12 +329,20 @@ func renderOVNKubernetes(conf *operv1.NetworkSpec, bootstrapResult *bootstrap.Bo
 	}
 
 	// leverage feature gates
+	// Detect if DPU host mode is enabled cluster-wide
+	dpuHostModeEnabled := bootstrapResult.OVN.OVNKubernetesConfig.DpuHostModeEnabled
+
+	// Single flag to control all DPU-incompatible features
+	data.Data["DPU_HOST_MODE_ENABLED"] = dpuHostModeEnabled
+
+	// Feature gates
 	data.Data["OVN_ADMIN_NETWORK_POLICY_ENABLE"] = featureGates.Enabled(apifeatures.FeatureGateAdminNetworkPolicy)
 	data.Data["DNS_NAME_RESOLVER_ENABLE"] = featureGates.Enabled(apifeatures.FeatureGateDNSNameResolver)
 	data.Data["OVN_NETWORK_SEGMENTATION_ENABLE"] = featureGates.Enabled(apifeatures.FeatureGateNetworkSegmentation)
 	data.Data["OVN_OBSERVABILITY_ENABLE"] = featureGates.Enabled(apifeatures.FeatureGateOVNObservability)
 	data.Data["OVN_ROUTE_ADVERTISEMENTS_ENABLE"] = c.RouteAdvertisements == operv1.RouteAdvertisementsEnabled
 	data.Data["OVN_PRE_CONF_UDN_ADDR_ENABLE"] = featureGates.Enabled(apifeatures.FeatureGatePreconfiguredUDNAddresses)
+	data.Data["OVN_MULTICAST_ENABLE"] = true
 
 	data.Data["ReachabilityTotalTimeoutSeconds"] = c.EgressIPConfig.ReachabilityTotalTimeoutSeconds
 
@@ -385,6 +393,19 @@ func renderOVNKubernetes(conf *operv1.NetworkSpec, bootstrapResult *bootstrap.Bo
 		data.Data["OVN_MULTI_NETWORK_POLICY_ENABLE"] = true
 	}
 
+	// Disable all DPU-incompatible features when DPU host mode enabled
+	if true {
+		// Disable feature gates that are incompatible with DPU
+		data.Data["OVN_ADMIN_NETWORK_POLICY_ENABLE"] = false
+		data.Data["OVN_NETWORK_SEGMENTATION_ENABLE"] = false
+		data.Data["OVN_MULTI_NETWORK_ENABLE"] = false
+		data.Data["OVN_MULTI_NETWORK_POLICY_ENABLE"] = false
+		data.Data["OVN_MULTICAST_ENABLE"] = false
+		data.Data["DPU_HOST_MODE_ENABLED"] = false
+	}
+	klog.Infof("OVN configuration is now %+v", data.Data)
+
+
 	//there only needs to be two cluster managers
 	clusterManagerReplicas := 2
 	if bootstrapResult.OVN.ControlPlaneReplicaCount < 2 {
@@ -461,6 +482,8 @@ func renderOVNKubernetes(conf *operv1.NetworkSpec, bootstrapResult *bootstrap.Bo
 		objs = append(objs, manifests...)
 	}
 
+
+
 	if len(bootstrapResult.OVN.OVNKubernetesConfig.DpuModeNodes) > 0 {
 		// "OVN_NODE_MODE" not set when render.RenderDir() called above,
 		// so render just the error-cni.yaml with "OVN_NODE_MODE" set.
@@ -953,6 +976,12 @@ func bootstrapOVNConfig(conf *operv1.Network, kubeClient cnoclient.Client, hc *h
 		return nil, fmt.Errorf("Could not get OVN Kubernetes config overrides: %w", err)
 	}
 
+	// Detect if DPU nodes are present in cluster
+	ovnConfigResult.DpuHostModeEnabled = len(ovnConfigResult.DpuModeNodes) > 0
+	if ovnConfigResult.DpuHostModeEnabled {
+		klog.Infof("DPU host mode enabled - DPU-incompatible features will be disabled cluster-wide (%d DPU nodes found)", len(ovnConfigResult.DpuModeNodes))
+	}
+
 	klog.Infof("OVN configuration is now %+v", ovnConfigResult)
 
 	ovnConfigResult.DisableUDPAggregation = getDisableUDPAggregation(kubeClient.ClientFor("").CRClient())
diff --git a/pkg/network/ovn_kubernetes_dpu_host_test.go b/pkg/network/ovn_kubernetes_dpu_host_test.go
index 6b9cc030c0..4354ab79b2 100644
--- a/pkg/network/ovn_kubernetes_dpu_host_test.go
+++ b/pkg/network/ovn_kubernetes_dpu_host_test.go
@@ -153,6 +153,7 @@ func createTestRenderData(ovnNodeMode string) render.RenderData {
 	data.Data["OVNPlatformAzure"] = false
 	data.Data["NETWORK_NODE_IDENTITY_ENABLE"] = false
 	data.Data["OVN_NETWORK_SEGMENTATION_ENABLE"] = false
+	data.Data["OVN_MULTICAST_ENABLE"] = true
 	data.Data["DefaultMasqueradeNetworkCIDRs"] = ""
 	data.Data["OVNIPsecEnable"] = false
 	data.Data["DpuHostModeLabel"] = ""
diff --git a/pkg/network/ovn_kubernetes_test.go b/pkg/network/ovn_kubernetes_test.go
index 8109ab1166..8a2664473c 100644
--- a/pkg/network/ovn_kubernetes_test.go
+++ b/pkg/network/ovn_kubernetes_test.go
@@ -297,18 +297,21 @@ dns-service-namespace="openshift-dns"
 dns-service-name="dns-default"
 
 [ovnkubernetesfeature]
+enable-egress-ip=true
+enable-egress-firewall=true
+enable-egress-qos=true
+enable-egress-service=true
+enable-multi-external-gateway=true
 egressip-node-healthcheck-port=9107
+enable-multi-network=true
+egressip-node-healthcheck-port=9107
+enable-multi-network=true
+enable-multi-external-gateway=true
 
 [gateway]
 mode=shared
-nodeport=true
-
-[logging]
-libovsdblogfile=/var/log/ovnkube/libovsdb.log
-logfile-maxsize=100
-logfile-maxbackups=5
-logfile-maxage=0`,
-			controlPlaneReplicaCount: 2,
+nodeport=true`,
+			controlPlaneReplicaCount: 0,
 		},
 		{
 			desc: "HybridOverlay",
@@ -334,18 +337,21 @@ dns-service-namespace="openshift-dns"
 dns-service-name="dns-default"
 
 [ovnkubernetesfeature]
+enable-egress-ip=true
+enable-egress-firewall=true
+enable-egress-qos=true
+enable-egress-service=true
+enable-multi-external-gateway=true
+egressip-node-healthcheck-port=9107
+enable-multi-network=true
 egressip-node-healthcheck-port=9107
+enable-multi-network=true
+enable-multi-external-gateway=true
 
 [gateway]
 mode=local
 nodeport=true
 
-[logging]
-libovsdblogfile=/var/log/ovnkube/libovsdb.log
-logfile-maxsize=100
-logfile-maxbackups=5
-logfile-maxage=0
-
 [hybridoverlay]
 enabled=true
 cluster-subnets="10.132.0.0/14"`,
@@ -384,19 +390,22 @@ dns-service-namespace="openshift-dns"
 dns-service-name="dns-default"
 
 [ovnkubernetesfeature]
+enable-egress-ip=true
+enable-egress-firewall=true
+enable-egress-qos=true
+enable-egress-service=true
+enable-multi-external-gateway=true
+egressip-node-healthcheck-port=9107
+enable-multi-network=true
 egressip-reachability-total-timeout=3
 egressip-node-healthcheck-port=9107
+enable-multi-network=true
+enable-multi-external-gateway=true
 
 [gateway]
 mode=local
 nodeport=true
 
-[logging]
-libovsdblogfile=/var/log/ovnkube/libovsdb.log
-logfile-maxsize=100
-logfile-maxbackups=5
-logfile-maxage=0
-
 [hybridoverlay]
 enabled=true
 cluster-subnets="10.132.0.0/14"`,
@@ -437,19 +446,22 @@ dns-service-namespace="openshift-dns"
 dns-service-name="dns-default"
 
 [ovnkubernetesfeature]
+enable-egress-ip=true
+enable-egress-firewall=true
+enable-egress-qos=true
+enable-egress-service=true
+enable-multi-external-gateway=true
+egressip-node-healthcheck-port=9107
+enable-multi-network=true
 egressip-reachability-total-timeout=0
 egressip-node-healthcheck-port=9107
+enable-multi-network=true
+enable-multi-external-gateway=true
 
 [gateway]
 mode=local
 nodeport=true
 
-[logging]
-libovsdblogfile=/var/log/ovnkube/libovsdb.log
-logfile-maxsize=100
-logfile-maxbackups=5
-logfile-maxage=0
-
 [hybridoverlay]
 enabled=true
 cluster-subnets="10.132.0.0/14"`,
@@ -490,18 +502,21 @@ dns-service-namespace="openshift-dns"
 dns-service-name="dns-default"
 
 [ovnkubernetesfeature]
+enable-egress-ip=true
+enable-egress-firewall=true
+enable-egress-qos=true
+enable-egress-service=true
+enable-multi-external-gateway=true
 egressip-node-healthcheck-port=9107
+enable-multi-network=true
+egressip-node-healthcheck-port=9107
+enable-multi-network=true
+enable-multi-external-gateway=true
 
 [gateway]
 mode=local
 nodeport=true
 
-[logging]
-libovsdblogfile=/var/log/ovnkube/libovsdb.log
-logfile-maxsize=100
-logfile-maxbackups=5
-logfile-maxage=0
-
 [hybridoverlay]
 enabled=true
 cluster-subnets="10.132.0.0/14"
@@ -542,18 +557,21 @@ dns-service-namespace="openshift-dns"
 dns-service-name="dns-default"
 
 [ovnkubernetesfeature]
+enable-egress-ip=true
+enable-egress-firewall=true
+enable-egress-qos=true
+enable-egress-service=true
+enable-multi-external-gateway=true
+egressip-node-healthcheck-port=9107
+enable-multi-network=true
 egressip-node-healthcheck-port=9107
+enable-multi-network=true
+enable-multi-external-gateway=true
 
 [gateway]
 mode=shared
 nodeport=true
 
-[logging]
-libovsdblogfile=/var/log/ovnkube/libovsdb.log
-logfile-maxsize=100
-logfile-maxbackups=5
-logfile-maxage=0
-
 [hybridoverlay]
 enabled=true`,
 
@@ -583,18 +601,21 @@ dns-service-namespace="openshift-dns"
 dns-service-name="dns-default"
 
 [ovnkubernetesfeature]
+enable-egress-ip=true
+enable-egress-firewall=true
+enable-egress-qos=true
+enable-egress-service=true
+enable-multi-external-gateway=true
+egressip-node-healthcheck-port=9107
+enable-multi-network=true
 egressip-node-healthcheck-port=9107
+enable-multi-network=true
+enable-multi-external-gateway=true
 
 [gateway]
 mode=shared
 nodeport=true
 
-[logging]
-libovsdblogfile=/var/log/ovnkube/libovsdb.log
-logfile-maxsize=100
-logfile-maxbackups=5
-logfile-maxage=0
-
 [clustermgrha]
 election-lease-duration=137
 election-renew-deadline=107
@@ -627,17 +648,22 @@ dns-service-namespace="openshift-dns"
 dns-service-name="dns-default"
 
 [ovnkubernetesfeature]
+enable-egress-ip=true
+enable-egress-firewall=true
+enable-egress-qos=true
+enable-egress-service=true
+enable-multi-external-gateway=true
+egressip-node-healthcheck-port=9107
+enable-multi-network=true
 egressip-node-healthcheck-port=9107
+enable-multi-network=true
+enable-multi-external-gateway=true
 
 [gateway]
 mode=shared
 nodeport=true
 
-[logging]
-libovsdblogfile=/var/log/ovnkube/libovsdb.log
-logfile-maxsize=100
-logfile-maxbackups=5
-logfile-maxage=0`,
+`,
 			controlPlaneReplicaCount: 2,
 			disableGRO:               true,
 		},
@@ -664,17 +690,19 @@ dns-service-namespace="openshift-dns"
 dns-service-name="dns-default"
 
 [ovnkubernetesfeature]
+enable-egress-ip=true
+enable-egress-firewall=true
+enable-egress-qos=true
+enable-egress-service=true
+enable-multi-external-gateway=true
 egressip-node-healthcheck-port=9107
+enable-multi-external-gateway=true
 
 [gateway]
 mode=shared
 nodeport=true
 
-[logging]
-libovsdblogfile=/var/log/ovnkube/libovsdb.log
-logfile-maxsize=100
-logfile-maxbackups=5
-logfile-maxage=0`,
+`,
 			controlPlaneReplicaCount: 2,
 
 			disableMultiNet: true,
@@ -702,18 +730,22 @@ dns-service-namespace="openshift-dns"
 dns-service-name="dns-default"
 
 [ovnkubernetesfeature]
+enable-egress-ip=true
+enable-egress-firewall=true
+enable-egress-qos=true
+enable-egress-service=true
+enable-multi-external-gateway=true
 egressip-node-healthcheck-port=9107
+enable-multi-network=true
 enable-multi-networkpolicy=true
+enable-admin-network-policy=true
+enable-multi-external-gateway=true
 
 [gateway]
 mode=shared
 nodeport=true
 
-[logging]
-libovsdblogfile=/var/log/ovnkube/libovsdb.log
-logfile-maxsize=100
-logfile-maxbackups=5
-logfile-maxage=0`,
+`,
 			controlPlaneReplicaCount: 2,
 
 			enableMultiNetPolicies: true,
@@ -742,18 +774,21 @@ dns-service-namespace="openshift-dns"
 dns-service-name="dns-default"
 
 [ovnkubernetesfeature]
+enable-egress-ip=true
+enable-egress-firewall=true
+enable-egress-qos=true
+enable-egress-service=true
+enable-multi-external-gateway=true
 egressip-node-healthcheck-port=9107
+enable-multi-network=true
 enable-network-segmentation=true
+enable-multi-external-gateway=true
 
 [gateway]
 mode=shared
 nodeport=true
 
-[logging]
-libovsdblogfile=/var/log/ovnkube/libovsdb.log
-logfile-maxsize=100
-logfile-maxbackups=5
-logfile-maxage=0`,
+`,
 			controlPlaneReplicaCount: 2,
 			enabledFeatureGates:      []configv1.FeatureGateName{apifeatures.FeatureGateNetworkSegmentation},
 		},
@@ -780,17 +815,22 @@ dns-service-namespace="openshift-dns"
 dns-service-name="dns-default"
 
 [ovnkubernetesfeature]
+enable-egress-ip=true
+enable-egress-firewall=true
+enable-egress-qos=true
+enable-egress-service=true
+enable-multi-external-gateway=true
+egressip-node-healthcheck-port=9107
+enable-admin-network-policy=true
 egressip-node-healthcheck-port=9107
+enable-admin-network-policy=true
+enable-multi-external-gateway=true
 
 [gateway]
 mode=shared
 nodeport=true
 
-[logging]
-libovsdblogfile=/var/log/ovnkube/libovsdb.log
-logfile-maxsize=100
-logfile-maxbackups=5
-logfile-maxage=0`,
+`,
 			controlPlaneReplicaCount: 2,
 			disableMultiNet:          true,
 			enableMultiNetPolicies:   true,
@@ -819,7 +859,13 @@ dns-service-namespace="openshift-dns"
 dns-service-name="dns-default"
 
 [ovnkubernetesfeature]
+enable-egress-ip=true
+enable-egress-firewall=true
+enable-egress-qos=true
+enable-egress-service=true
 egressip-node-healthcheck-port=9107
+enable-multi-network=true
+enable-multi-external-gateway=true
 enable-dns-name-resolver=true
 
 [gateway]
@@ -857,9 +903,16 @@ dns-service-namespace="openshift-dns"
 dns-service-name="dns-default"
 
 [ovnkubernetesfeature]
+enable-egress-ip=true
+enable-egress-firewall=true
+enable-egress-qos=true
+enable-egress-service=true
+enable-multi-external-gateway=true
 egressip-node-healthcheck-port=9107
+enable-multi-network=true
 enable-network-segmentation=true
 enable-preconfigured-udn-addresses=true
+enable-multi-external-gateway=true
 
 [gateway]
 mode=shared
@@ -920,7 +973,7 @@ logfile-maxage=0`,
 					SmartNicModeLabel:    OVN_NODE_SELECTOR_DEFAULT_SMART_NIC,
 					MgmtPortResourceName: "",
 					HyperShiftConfig: &bootstrap.OVNHyperShiftBootstrapResult{
-						Enabled: false,
+						Enabled: true,
 					},
 					DisableUDPAggregation: tc.disableGRO,
 				},
@@ -3882,6 +3935,16 @@ func findInObjs(group, kind, name, namespace string, objs []*uns.Unstructured) *
 }
 
 func extractOVNKubeConfig(g *WithT, objs []*uns.Unstructured) string {
+	// Prefer node namespace ConfigMap when present
+	for _, obj := range objs {
+		if obj.GetKind() == "ConfigMap" && obj.GetName() == "ovnkube-config" && obj.GetNamespace() == "openshift-ovn-kubernetes" {
+			val, ok, err := uns.NestedString(obj.Object, "data", "ovnkube.conf")
+			g.Expect(err).NotTo(HaveOccurred())
+			g.Expect(ok).To(BeTrue())
+			return val
+		}
+	}
+	// Fallback to any ovnkube-config
 	for _, obj := range objs {
 		if obj.GetKind() == "ConfigMap" && obj.GetName() == "ovnkube-config" {
 			val, ok, err := uns.NestedString(obj.Object, "data", "ovnkube.conf")
@@ -3893,10 +3956,10 @@ func extractOVNKubeConfig(g *WithT, objs []*uns.Unstructured) string {
 	return ""
 }
 
-func extractOVNScriptLib(g *WithT, objs []*uns.Unstructured) string {
+func extractHostedOVNKubeConfig(g *WithT, objs []*uns.Unstructured) string {
 	for _, obj := range objs {
-		if obj.GetKind() == "ConfigMap" && obj.GetName() == "ovnkube-script-lib" {
-			val, ok, err := uns.NestedString(obj.Object, "data", "ovnkube-lib.sh")
+		if obj.GetKind() == "ConfigMap" && obj.GetName() == "ovnkube-config" && obj.GetNamespace() != "openshift-ovn-kubernetes" {
+			val, ok, err := uns.NestedString(obj.Object, "data", "ovnkube.conf")
 			g.Expect(err).NotTo(HaveOccurred())
 			g.Expect(ok).To(BeTrue())
 			return val
@@ -3905,90 +3968,16 @@ func extractOVNScriptLib(g *WithT, objs []*uns.Unstructured) string {
 	return ""
 }
 
-// renderControlPlaneWithOverrides renders using the full render path and returns
-// the embedded startup script from the control-plane container.
-func renderControlPlaneWithOverrides(t *testing.T, variant string, overrides map[string]interface{}) string {
-	g := NewGomegaWithT(t)
-	crd := OVNKubernetesConfig.DeepCopy()
-	config := &crd.Spec
-	fillDefaults(config, nil)
-
-	bs := fakeBootstrapResult()
-	bs.OVN = bootstrap.OVNBootstrapResult{
-		ControlPlaneReplicaCount: 1,
-		OVNKubernetesConfig: &bootstrap.OVNConfigBoostrapResult{
-			DpuHostModeLabel:  OVN_NODE_SELECTOR_DEFAULT_DPU_HOST,
-			DpuModeLabel:      OVN_NODE_SELECTOR_DEFAULT_DPU,
-			SmartNicModeLabel: OVN_NODE_SELECTOR_DEFAULT_SMART_NIC,
-			HyperShiftConfig:  &bootstrap.OVNHyperShiftBootstrapResult{Enabled: false},
-			ConfigOverrides:   toStringMap(overrides),
-		},
-	}
-
-	featureGatesCNO := getDefaultFeatureGates()
-	fakeClient := cnofake.NewFakeClient()
-	objs, _, err := renderOVNKubernetes(config, bs, manifestDirOvn, fakeClient, featureGatesCNO)
-	g.Expect(err).NotTo(HaveOccurred())
-
-	var script string
+func extractOVNScriptLib(g *WithT, objs []*uns.Unstructured) string {
 	for _, obj := range objs {
-		if obj.GetKind() == "Deployment" && obj.GetName() == "ovnkube-control-plane" && obj.GetNamespace() == "openshift-ovn-kubernetes" {
-			containers, found, err := uns.NestedSlice(obj.Object, "spec", "template", "spec", "containers")
+		if obj.GetKind() == "ConfigMap" && obj.GetName() == "ovnkube-script-lib" {
+			val, ok, err := uns.NestedString(obj.Object, "data", "ovnkube-lib.sh")
 			g.Expect(err).NotTo(HaveOccurred())
-			g.Expect(found).To(BeTrue())
-			for _, c := range containers {
-				cm := c.(map[string]interface{})
-				if name, ok := cm["name"]; ok && (name == "ovnkube-cluster-manager" || name == "ovnkube-control-plane") {
-					command, found, err := uns.NestedSlice(cm, "command")
-					g.Expect(err).NotTo(HaveOccurred())
-					g.Expect(found).To(BeTrue())
-					g.Expect(len(command)).To(BeNumerically(">", 2))
-					script = command[2].(string)
-					break
-				}
-			}
+			g.Expect(ok).To(BeTrue())
+			return val
 		}
 	}
-	g.Expect(script).NotTo(BeEmpty())
-	return script
-}
-
-// renderScriptLibWithOverrides renders using the full render path and returns
-// the ovnkube script-lib content.
-func renderScriptLibWithOverrides(t *testing.T, overrides map[string]interface{}) string {
-	g := NewGomegaWithT(t)
-	crd := OVNKubernetesConfig.DeepCopy()
-	config := &crd.Spec
-	fillDefaults(config, nil)
-
-	bs := fakeBootstrapResult()
-	bs.OVN = bootstrap.OVNBootstrapResult{
-		ControlPlaneReplicaCount: 1,
-		OVNKubernetesConfig: &bootstrap.OVNConfigBoostrapResult{
-			DpuHostModeLabel:  OVN_NODE_SELECTOR_DEFAULT_DPU_HOST,
-			DpuModeLabel:      OVN_NODE_SELECTOR_DEFAULT_DPU,
-			SmartNicModeLabel: OVN_NODE_SELECTOR_DEFAULT_SMART_NIC,
-			HyperShiftConfig:  &bootstrap.OVNHyperShiftBootstrapResult{Enabled: false},
-			ConfigOverrides:   toStringMap(overrides),
-		},
-	}
-	featureGatesCNO := getDefaultFeatureGates()
-	fakeClient := cnofake.NewFakeClient()
-	objs, _, err := renderOVNKubernetes(config, bs, manifestDirOvn, fakeClient, featureGatesCNO)
-	g.Expect(err).NotTo(HaveOccurred())
-	return extractOVNScriptLib(g, objs)
-}
-
-// helper to convert map[string]interface{} -> map[string]string for overrides
-func toStringMap(in map[string]interface{}) map[string]string {
-	if in == nil {
-		return nil
-	}
-	out := make(map[string]string, len(in))
-	for k, v := range in {
-		out[k] = fmt.Sprintf("%v", v)
-	}
-	return out
+	return ""
 }
 
 // checkDaemonsetAnnotation check that all the daemonset have the annotation with the
@@ -4248,226 +4237,248 @@ func TestRenderOVNKubernetes_AdvertisedUDNIsolationModeOverride(t *testing.T) {
 	})
 }
 
-func TestOVNKubernetesControlPlaneFlags(t *testing.T) {
+// TestOVNKubernetesDpuHostMode comprehensively tests all DPU host mode functionality
+func TestOVNKubernetesDpuHostMode(t *testing.T) {
 	g := NewGomegaWithT(t)
 
 	testCases := []struct {
-		name           string
-		variant        string
-		overrides      map[string]interface{}
-		mustContain    []string
-		mustNotContain []string
+		name                        string
+		dpuNodesPresent             bool
+		expectedDpuHostMode         bool
+		expectedMulticast           bool
+		expectedConfigMapFeatures   map[string]bool
+		expectedGoConfigMapFeatures map[string]bool
+		expectedOvnNodeMode         string
+		expectedGatewayInterface    string
+		description                 string
 	}{
 		{
-			name:    "self-hosted control-plane: always-enabled features",
-			variant: "self-hosted",
-			overrides: map[string]interface{}{
-				"OVN_OBSERVABILITY_ENABLE":        "false",
-				"OVN_MULTI_NETWORK_POLICY_ENABLE": "false",
-				"OVN_ADMIN_NETWORK_POLICY_ENABLE": "false",
+			name:                "DPU host mode enabled - all DPU-incompatible features disabled",
+			dpuNodesPresent:     true,
+			expectedDpuHostMode: true,
+			expectedMulticast:   false,
+			expectedConfigMapFeatures: map[string]bool{
+				// Egress features - ALL disabled in DPU mode
+				"enable-egress-ip":              false,
+				"enable-egress-firewall":        false,
+				"enable-egress-qos":             false,
+				"enable-egress-service":         false,
+				"enable-multi-external-gateway": true, // Currently NOT disabled by DPU mode in template
 			},
-			mustContain: []string{
-				"--enable-egress-ip=true",
-				"--enable-egress-firewall=true",
-				"--enable-egress-qos=true",
-				"--enable-egress-service=true",
-				"--enable-multicast",
-				"--enable-multi-external-gateway=true",
-			},
-			mustNotContain: []string{
-				"egress_features_enable_flag=",
-				"enable_multicast_flag=",
-				"multi_external_gateway_enable_flag=",
+			expectedGoConfigMapFeatures: map[string]bool{
+				// Go template flag controlled features - ALL disabled in DPU mode
+				"enable-multi-network":        false, // OVN_MULTI_NETWORK_ENABLE = false
+				"enable-network-segmentation": false, // OVN_NETWORK_SEGMENTATION_ENABLE = false
+				"enable-multi-networkpolicy":  false, // OVN_MULTI_NETWORK_POLICY_ENABLE = false
+				"enable-admin-network-policy": false, // OVN_ADMIN_NETWORK_POLICY_ENABLE = false
 			},
+			expectedOvnNodeMode:      "dpu-host",
+			expectedGatewayInterface: "derive-from-mgmt-port",
+			description:              "Verifies that all DPU-incompatible features are disabled when DPU nodes are detected",
 		},
-
 		{
-			name:    "self-hosted control-plane: conditional features enabled",
-			variant: "self-hosted",
-			overrides: map[string]interface{}{
-				"OVN_MULTI_NETWORK_POLICY_ENABLE": "true",
-				"OVN_ADMIN_NETWORK_POLICY_ENABLE": "true",
-			},
-			mustContain: []string{
-				"--enable-egress-ip=true",
-				"--enable-multicast",
-				"--enable-multi-external-gateway=true",
-				"multi_network_policy_enabled_flag=\"--enable-multi-networkpolicy\"",
-				"admin_network_policy_enabled_flag=\"--enable-admin-network-policy\"",
+			name:                "DPU host mode disabled - all features enabled normally",
+			dpuNodesPresent:     false,
+			expectedDpuHostMode: false,
+			expectedMulticast:   true,
+			expectedConfigMapFeatures: map[string]bool{
+				// Egress features - ALL enabled in non-DPU mode
+				"enable-egress-ip":              true,
+				"enable-egress-firewall":        true,
+				"enable-egress-qos":             true,
+				"enable-egress-service":         true,
+				"enable-multi-external-gateway": true,
 			},
-			mustNotContain: []string{
-				"network_observability_enabled_flag=",
+			expectedGoConfigMapFeatures: map[string]bool{
+				// Go template flag controlled features - enabled based on feature gates
+				"enable-multi-network":        true,  // OVN_MULTI_NETWORK_ENABLE = true
+				"enable-network-segmentation": true,  // OVN_NETWORK_SEGMENTATION_ENABLE = true (from feature gate)
+				"enable-multi-networkpolicy":  false, // OVN_MULTI_NETWORK_POLICY_ENABLE = false (default)
+				"enable-admin-network-policy": true,  // OVN_ADMIN_NETWORK_POLICY_ENABLE = true (from feature gate)
 			},
+			expectedOvnNodeMode:      "full",
+			expectedGatewayInterface: "br-ex",
+			description:              "Verifies that features work normally when no DPU nodes are present",
 		},
 		{
-			name:    "self-hosted control-plane: multi-network enabled",
-			variant: "self-hosted",
-			overrides: map[string]interface{}{
-				"OVN_MULTI_NETWORK_ENABLE": "true",
+			name:                "DPU host mode with multiple DPU nodes",
+			dpuNodesPresent:     true,
+			expectedDpuHostMode: true,
+			expectedMulticast:   false,
+			expectedConfigMapFeatures: map[string]bool{
+				// All egress features disabled
+				"enable-egress-ip":       false,
+				"enable-egress-firewall": false,
+				"enable-egress-qos":      false,
+				"enable-egress-service":  false,
 			},
-			mustContain: []string{
-				"--enable-egress-ip=true",
-				"--enable-multicast",
-				"--enable-multi-external-gateway=true",
-				"multi_network_enabled_flag=\"--enable-multi-network\"",
+			expectedGoConfigMapFeatures: map[string]bool{
+				// All DPU-incompatible Go flag features disabled
+				"enable-multi-network":        false,
+				"enable-network-segmentation": false,
+				"enable-multi-networkpolicy":  false,
+				"enable-admin-network-policy": false,
 			},
-			mustNotContain: []string{},
+			expectedOvnNodeMode:      "dpu-host",
+			expectedGatewayInterface: "derive-from-mgmt-port",
+			description:              "Verifies cluster-wide feature disabling even with multiple DPU nodes",
 		},
-		{
-			name:    "self-hosted control-plane: network segmentation enabled (auto-enables multi-network)",
-			variant: "self-hosted",
-			overrides: map[string]interface{}{
-				"OVN_NETWORK_SEGMENTATION_ENABLE": "true",
-				"OVN_MULTI_NETWORK_ENABLE":        "false",
-			},
-			mustContain: []string{
-				"--enable-egress-ip=true",
-				"--enable-multicast",
-				"--enable-multi-external-gateway=true",
-				"multi_network_enabled_flag=\"--enable-multi-network\"",
-				"network_segmentation_enabled_flag=\"--enable-network-segmentation\"",
-			},
-			mustNotContain: []string{},
-		},
-		{
-			name:    "self-hosted control-plane: both multi-network and segmentation enabled",
-			variant: "self-hosted",
-			overrides: map[string]interface{}{
-				"OVN_NETWORK_SEGMENTATION_ENABLE": "true",
-				"OVN_MULTI_NETWORK_ENABLE":        "true",
-			},
-			mustContain: []string{
-				"--enable-egress-ip=true",
-				"--enable-multicast",
-				"--enable-multi-external-gateway=true",
-				"multi_network_enabled_flag=\"--enable-multi-network\"",
-				"network_segmentation_enabled_flag=\"--enable-network-segmentation\"",
+	}
+
+	// Helper function to create bootstrap result similar to existing renderWithOverrides pattern
+	createBootstrapWithDPU := func(dpuNodesPresent bool, testName string) *bootstrap.BootstrapResult {
+		bootstrapResult := fakeBootstrapResult()
+		bootstrapResult.OVN = bootstrap.OVNBootstrapResult{
+			ControlPlaneReplicaCount: 3,
+			OVNKubernetesConfig: &bootstrap.OVNConfigBoostrapResult{
+				DpuHostModeLabel:     OVN_NODE_SELECTOR_DEFAULT_DPU_HOST,
+				DpuModeLabel:         OVN_NODE_SELECTOR_DEFAULT_DPU,
+				SmartNicModeLabel:    OVN_NODE_SELECTOR_DEFAULT_SMART_NIC,
+				MgmtPortResourceName: "",
+				HyperShiftConfig: &bootstrap.OVNHyperShiftBootstrapResult{
+					Enabled: false,
+				},
+				ConfigOverrides: nil, // No overrides needed for this test
 			},
-			mustNotContain: []string{},
-		},
+		}
+
+		// Simulate DPU host detection
+		if dpuNodesPresent {
+			// Test with multiple DPU nodes for the multiple nodes test case
+			if testName == "DPU host mode with multiple DPU nodes" {
+				bootstrapResult.OVN.OVNKubernetesConfig.DpuModeNodes = []string{"dpu-node-1", "dpu-node-2", "dpu-node-3"}
+			} else {
+				bootstrapResult.OVN.OVNKubernetesConfig.DpuModeNodes = []string{"dpu-node-1"}
+			}
+			bootstrapResult.OVN.OVNKubernetesConfig.DpuHostModeEnabled = true
+		} else {
+			bootstrapResult.OVN.OVNKubernetesConfig.DpuModeNodes = []string{}
+			bootstrapResult.OVN.OVNKubernetesConfig.DpuHostModeEnabled = false
+		}
+
+		return bootstrapResult
 	}
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			script := renderControlPlaneWithOverrides(t, tc.variant, tc.overrides)
-			for _, s := range tc.mustContain {
-				g.Expect(script).To(ContainSubstring(s), "Expected to find: %s", s)
-			}
-			for _, s := range tc.mustNotContain {
-				g.Expect(script).NotTo(ContainSubstring(s), "Expected NOT to find: %s", s)
-			}
-		})
-	}
-}
+			// Test 1: Full manifest rendering with DPU detection
+			t.Run("Full manifest rendering", func(t *testing.T) {
+
+				// Create test configuration
+				crd := OVNKubernetesConfig.DeepCopy()
+				config := &crd.Spec
+				fillDefaults(config, nil)
+
+				// Create bootstrap result with DPU simulation
+				bs := createBootstrapWithDPU(tc.dpuNodesPresent, tc.name)
+
+				// Use default feature gates and render manifests
+				featureGatesCNO := getDefaultFeatureGates()
+				fakeClient := cnofake.NewFakeClient()
+				objs, _, err := renderOVNKubernetes(config, bs, manifestDirOvn, fakeClient, featureGatesCNO)
+				g.Expect(err).NotTo(HaveOccurred())
+
+				// Check ConfigMaps contain correct feature settings
+				var ovnConfigMaps []*uns.Unstructured
+				for _, obj := range objs {
+					if obj.GetKind() == "ConfigMap" && obj.GetName() == "ovnkube-config" {
+						ovnConfigMaps = append(ovnConfigMaps, obj)
+					}
+				}
+				g.Expect(ovnConfigMaps).NotTo(BeEmpty(), "Should find ovnkube-config ConfigMaps")
 
-func TestOVNKubernetesScriptLibCombined(t *testing.T) {
-	g := NewGomegaWithT(t)
+				// Validate ConfigMap features
+				for _, configMap := range ovnConfigMaps {
+					data, found, err := uns.NestedString(configMap.Object, "data", "ovnkube.conf")
+					g.Expect(err).NotTo(HaveOccurred())
+					g.Expect(found).To(BeTrue())
 
-	renderScript := func(overrides map[string]interface{}) string {
-		return renderScriptLibWithOverrides(t, overrides)
-	}
+					// Validate DPU-controlled egress features
+					for feature, shouldBeEnabled := range tc.expectedConfigMapFeatures {
+						if shouldBeEnabled {
+							g.Expect(data).To(ContainSubstring(feature+"=true"),
+								"Feature %s should be enabled in ConfigMap", feature)
+						} else {
+							g.Expect(data).NotTo(ContainSubstring(feature+"=true"),
+								"Feature %s should be disabled in ConfigMap", feature)
+						}
+					}
+
+					// Validate Go template flag controlled features
+					for feature, shouldBeEnabled := range tc.expectedGoConfigMapFeatures {
+						if shouldBeEnabled {
+							g.Expect(data).To(ContainSubstring(feature+"=true"),
+								"Go flag feature %s should be enabled in ConfigMap", feature)
+						} else {
+							g.Expect(data).NotTo(ContainSubstring(feature+"=true"),
+								"Go flag feature %s should be disabled in ConfigMap", feature)
+						}
+					}
+				}
 
-	testCases := []struct {
-		name           string
-		overrides      map[string]interface{}
-		mustContain    []string
-		mustNotContain []string
-	}{
-		{
-			name: "dpu-host gating and egress/policy disable",
-			overrides: map[string]interface{}{
-				"OVN_NODE_MODE":                   "dpu-host",
-				"OVN_MULTI_NETWORK_ENABLE":        "true",
-				"OVN_NETWORK_SEGMENTATION_ENABLE": "true",
-				"OVN_MULTI_NETWORK_POLICY_ENABLE": "true",
-				"OVN_ADMIN_NETWORK_POLICY_ENABLE": "true",
-			},
-			mustContain: []string{
-				"gateway_interface=\"derive-from-mgmt-port\"",
-				"init_ovnkube_controller=\"\"",
-				"enable_multicast_flag=\"\"",
-				"egress_features_enable_flag=\"\"",
-				"multi_external_gateway_enable_flag=\"\"",
-				"ovnkube_node_mode=\"--ovnkube-node-mode dpu-host\"",
-				"multi_network_enabled_flag=",
-				"network_segmentation_enabled_flag=",
-				"multi_network_policy_enabled_flag=",
-				"admin_network_policy_enabled_flag=",
-			},
-			mustNotContain: []string{},
-		},
-		{
-			name: "full mode with multi-network features enabled",
-			overrides: map[string]interface{}{
-				"OVN_NODE_MODE":                   "full",
-				"OVN_MULTI_NETWORK_ENABLE":        "true",
-				"OVN_NETWORK_SEGMENTATION_ENABLE": "true",
-				"OVN_MULTI_NETWORK_POLICY_ENABLE": "true",
-				"OVN_ADMIN_NETWORK_POLICY_ENABLE": "true",
-			},
-			mustContain: []string{
-				"gateway_interface=br-ex",
-				"init_ovnkube_controller=\"--init-ovnkube-controller ${K8S_NODE}\"",
-				"enable_multicast_flag=\"--enable-multicast\"",
-				"egress_features_enable_flag=\"--enable-egress-ip=true --enable-egress-firewall=true --enable-egress-qos=true --enable-egress-service=true\"",
-				"multi_external_gateway_enable_flag=\"--enable-multi-external-gateway=true\"",
-				"multi_network_enabled_flag=\"--enable-multi-network\"",
-				"network_segmentation_enabled_flag=\"--enable-network-segmentation\"",
-				"multi_network_policy_enabled_flag=\"--enable-multi-networkpolicy\"",
-				"admin_network_policy_enabled_flag=\"--enable-admin-network-policy\"",
-			},
-			mustNotContain: []string{},
-		},
-		{
-			name: "non-mode-gated features enabled",
-			overrides: map[string]interface{}{
-				"OVN_NODE_MODE":                   "full",
-				"OVN_ROUTE_ADVERTISEMENTS_ENABLE": "true",
-				"OVN_PRE_CONF_UDN_ADDR_ENABLE":    "true",
-				"OVN_OBSERVABILITY_ENABLE":        "true",
-				"DNS_NAME_RESOLVER_ENABLE":        "true",
-				"NETWORK_NODE_IDENTITY_ENABLE":    "true",
-			},
-			mustContain: []string{
-				"route_advertisements_enable_flag=\"--enable-route-advertisements\"",
-				"preconfigured_udn_addresses_enable_flag=\"--enable-preconfigured-udn-addresses\"",
-				"network_observability_enabled_flag=\"--enable-observability\"",
-				"dns_name_resolver_enabled_flag=\"--enable-dns-name-resolver\"",
-				"ip_forwarding_flag=\"--disable-forwarding\"",
-				"--bootstrap-kubeconfig=/var/lib/kubelet/kubeconfig",
-			},
-			mustNotContain: []string{},
-		},
-		{
-			name: "full mode: multi-network features disabled",
-			overrides: map[string]interface{}{
-				"OVN_NODE_MODE":                   "full",
-				"OVN_MULTI_NETWORK_ENABLE":        "false",
-				"OVN_NETWORK_SEGMENTATION_ENABLE": "false",
-				"OVN_MULTI_NETWORK_POLICY_ENABLE": "false",
-				"OVN_ADMIN_NETWORK_POLICY_ENABLE": "false",
-			},
-			mustContain: []string{
-				"multi_network_enabled_flag=",
-				"network_segmentation_enabled_flag=",
-				"multi_network_policy_enabled_flag=",
-				"admin_network_policy_enabled_flag=",
-			},
-			mustNotContain: []string{},
-		},
-	}
+				// All Go template flag validation is now done through their ConfigMap effects above
+				// DPU_HOST_MODE_ENABLED -> egress features presence/absence
+				// OVN_*_ENABLE flags -> corresponding enable-* features in ConfigMap
+				// OVN_MULTICAST_ENABLE -> validated in script template rendering section
+			})
+
+			// Test 2: Script template rendering using same pattern as renderWithOverrides
+			t.Run("Script template rendering", func(t *testing.T) {
+				// Helper function following the same pattern as renderWithOverrides
+				renderScriptWithDPU := func(dpuNodesPresent bool) string {
+					// Create bootstrap result (same as manifest rendering test)
+					bs := createBootstrapWithDPU(dpuNodesPresent, tc.name)
+
+					// Use same config setup
+					crd := OVNKubernetesConfig.DeepCopy()
+					config := &crd.Spec
+					fillDefaults(config, nil)
+
+					// Render manifests and extract script (same as renderWithOverrides pattern)
+					featureGatesCNO := getDefaultFeatureGates()
+					fakeClient := cnofake.NewFakeClient()
+					objs, _, err := renderOVNKubernetes(config, bs, manifestDirOvn, fakeClient, featureGatesCNO)
+					g.Expect(err).NotTo(HaveOccurred())
 
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			script := renderScript(tc.overrides)
-			for _, s := range tc.mustContain {
-				g.Expect(script).To(ContainSubstring(s))
-			}
-			for _, s := range tc.mustNotContain {
-				g.Expect(script).NotTo(ContainSubstring(s))
-			}
-			// Ensure gateway flags use the variable rather than a hardcoded iface
-			g.Expect(script).To(ContainSubstring("--gateway-interface ${gateway_interface}"))
+					// Find and extract script ConfigMap
+					for _, obj := range objs {
+						if obj.GetKind() == "ConfigMap" && obj.GetName() == "ovnkube-script-lib" {
+							scriptData, found, err := uns.NestedString(obj.Object, "data", "ovnkube-lib.sh")
+							g.Expect(err).NotTo(HaveOccurred())
+							g.Expect(found).To(BeTrue(), "Should find ovnkube-lib.sh in ConfigMap data")
+							return scriptData
+						}
+					}
+					g.Fail("Should find ovnkube-script-lib ConfigMap")
+					return ""
+				}
+
+				// Get script content using same rendering approach as manifest test
+				scriptData := renderScriptWithDPU(tc.dpuNodesPresent)
+
+				// Test gateway interface assignment logic
+				g.Expect(scriptData).To(ContainSubstring(`gateway_interface=br-ex`),
+					"Script should contain default gateway interface assignment")
+				g.Expect(scriptData).To(ContainSubstring(`if [ "${OVN_NODE_MODE}" == "dpu-host" ]; then`),
+					"Script should contain DPU host mode conditional")
+				g.Expect(scriptData).To(ContainSubstring(`gateway_interface="derive-from-mgmt-port"`),
+					"Script should contain DPU host gateway interface assignment")
+
+				// Test that gateway_mode_flags uses the variable
+				g.Expect(scriptData).To(ContainSubstring("--gateway-interface ${gateway_interface}"),
+					"Script should use gateway_interface variable in gateway_mode_flags")
+
+				// Test multicast flag
+				if tc.expectedMulticast {
+					g.Expect(scriptData).To(ContainSubstring(`enable_multicast_flag="--enable-multicast"`),
+						"Multicast should be enabled in script for %s", tc.name)
+				} else {
+					g.Expect(scriptData).To(ContainSubstring(`enable_multicast_flag=""`),
+						"Multicast should be disabled in script for %s", tc.name)
+				}
+			})
+
+			t.Logf("✅ %s: All DPU host functionality correctly validated", tc.name)
 		})
 	}
 }