diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 0000000..5f2ec88
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1,12 @@
+# Trivy vulnerability ignore list
+#
+# GO-2026-5932: golang.org/x/crypto/openpgp is unmaintained and unsafe by design.
+#
+# This advisory has no fixed version ("all versions, no known fixed") and targets
+# the openpgp sub-packages inside golang.org/x/crypto.  This repository pulls in
+# golang.org/x/crypto as an indirect dependency (via github.com/IBM/infra-go-sdk)
+# for its ssh sub-package only — openpgp is never imported anywhere in this
+# codebase — so the vulnerability is not reachable.
+#
+# Reference: https://pkg.go.dev/vuln/GO-2026-5932
+GO-2026-5932
diff --git a/validation/validator.go b/validation/validator.go
index fecdb23..c55c99a 100644
--- a/validation/validator.go
+++ b/validation/validator.go
@@ -526,8 +526,8 @@ func (v *Validator) validateMultiNodeCluster() {
 		if masterCount != 3 {
 			v.errors = append(v.errors, fmt.Sprintf("netboot deployment requires exactly 3 master nodes, got %d", masterCount))
 		}
-		if workerCount < 2 {
-			v.errors = append(v.errors, fmt.Sprintf("netboot deployment requires a minimum of 2 worker nodes, got %d", workerCount))
+		if workerCount < 1 {
+			v.errors = append(v.errors, fmt.Sprintf("netboot deployment requires a minimum of 1 worker node, got %d", workerCount))
 		}
 	} else if v.cfg.Nodes.BootMethod == "agent" {
 		// Agent-based installer dynamically handles bootstrap within a master node.