diff --git a/playbooks/roles/bifrost-ironic-install/defaults/main.yml b/playbooks/roles/bifrost-ironic-install/defaults/main.yml
index d14fe176a..c69b5c57c 100644
--- a/playbooks/roles/bifrost-ironic-install/defaults/main.yml
+++ b/playbooks/roles/bifrost-ironic-install/defaults/main.yml
@@ -134,6 +134,8 @@ enabled_deploy_interfaces: "iscsi,direct"
 enabled_management_interfaces: "redfish,ilo,ipmitool,noop"
 enabled_power_interfaces: "redfish,ilo,ipmitool,fake"
 
+default_resource_class: baremetal
+
 # Extra pip packages to install with ironic
 # This should be a list of pip-installable references.
 # default: empty list
diff --git a/playbooks/roles/bifrost-ironic-install/tasks/bootstrap.yml b/playbooks/roles/bifrost-ironic-install/tasks/bootstrap.yml
index 920092a3a..14a5c7702 100644
--- a/playbooks/roles/bifrost-ironic-install/tasks/bootstrap.yml
+++ b/playbooks/roles/bifrost-ironic-install/tasks/bootstrap.yml
@@ -300,6 +300,11 @@
     url: "{{ cirros_deploy_image_upstream_url }}"
     dest: "{{ deploy_image }}"
   when: use_cirros | bool == true
+- name: "Create a checksum file for cirros"
+  shell: md5sum {{ deploy_image_filename }} > {{ deploy_image_filename }}.CHECKSUMS
+  args:
+    chdir: "{{ http_boot_folder }}"
+  when: use_cirros | bool
 - name: >
     "Explicitly permit nginx port (TCP) for file downloads from nodes to be provisioned
      and TCP/6385 for IPA callback"
diff --git a/playbooks/roles/bifrost-ironic-install/templates/ironic.conf.j2 b/playbooks/roles/bifrost-ironic-install/templates/ironic.conf.j2
index 778d1b773..ce7a95ec2 100644
--- a/playbooks/roles/bifrost-ironic-install/templates/ironic.conf.j2
+++ b/playbooks/roles/bifrost-ironic-install/templates/ironic.conf.j2
@@ -19,6 +19,8 @@ enabled_deploy_interfaces = {{ enabled_deploy_interfaces }}
 
 enabled_hardware_types = {{ enabled_hardware_types }}
 
+default_resource_class = {{ default_resource_class }}
+
 {% if use_rabbitmq is defined and use_rabbitmq | bool == true %}
 transport_url = rabbit://ironic:{{ironic_db_password }}@{{ message_queue_host | default('127.0.0.1') }}:{{ message_queue_port | default('5672') }}/{{ rabbit_virtual_host | default('') }}
 {% else %}
diff --git a/releasenotes/notes/resource-class-243535c9049cbd73.yaml b/releasenotes/notes/resource-class-243535c9049cbd73.yaml
new file mode 100644
index 000000000..03a445ae5
--- /dev/null
+++ b/releasenotes/notes/resource-class-243535c9049cbd73.yaml
@@ -0,0 +1,6 @@
+---
+features:
+  - |
+    Sets the default resource class for newly enrolled nodes without an
+    explicit resource class. Defaults to ``baremetal``, can be changed via
+    the ``default_resource_class`` parameter.