diff --git a/modules/terraform/azure/aks-cli/main.tf b/modules/terraform/azure/aks-cli/main.tf
index 47395fcab6..2b0eee0985 100644
--- a/modules/terraform/azure/aks-cli/main.tf
+++ b/modules/terraform/azure/aks-cli/main.tf
@@ -281,7 +281,7 @@ resource "terraform_data" "enable_aks_cli_preview_extension" {
     EOT
       ) : (
       <<EOT
-      az extension add -n aks-preview --version 19.0.0b27
+      az extension add -n aks-preview --version 21.0.0b1
       az version
     EOT
     )
diff --git a/pipelines/perf-eval/CRI Benchmark/acl-resource-consume.yml b/pipelines/perf-eval/CRI Benchmark/acl-resource-consume.yml
new file mode 100644
index 0000000000..16ced277cf
--- /dev/null
+++ b/pipelines/perf-eval/CRI Benchmark/acl-resource-consume.yml	
@@ -0,0 +1,50 @@
+trigger: none
+pr: none
+
+variables:
+  SCENARIO_TYPE: perf-eval
+  SCENARIO_NAME: acl-resource-consume
+
+stages:
+  - stage: acl_resource_consume
+    displayName: ACL CRI resource consume (swedencentral)
+    dependsOn: []
+    jobs:
+      - template: /jobs/competitive-test.yml
+        parameters:
+          cloud: azure
+          regions:
+            - swedencentral
+          engine: clusterloader2
+          engine_input:
+            image: "ghcr.io/azure/clusterloader2:v20250513"
+          topology: cri-resource-consume
+          matrix:
+            n10-p300-memory:
+              node_count: 10
+              max_pods: 30
+              repeats: 1
+              operation_timeout: 3m
+              load_type: memory
+              scrape_kubelets: True
+              os_type: linux
+            n10-p700-memory:
+              node_count: 10
+              max_pods: 70
+              repeats: 1
+              operation_timeout: 7m
+              load_type: memory
+              scrape_kubelets: True
+              os_type: linux
+            n10-p1100-memory:
+              node_count: 10
+              max_pods: 110
+              repeats: 1
+              operation_timeout: 11m
+              load_type: memory
+              scrape_kubelets: True
+              os_type: linux
+          max_parallel: 1
+          timeout_in_minutes: 120
+          credential_type: service_connection
+          ssh_key_enabled: false
diff --git a/scenarios/perf-eval/acl-resource-consume/README.md b/scenarios/perf-eval/acl-resource-consume/README.md
new file mode 100644
index 0000000000..e5f6004c3a
--- /dev/null
+++ b/scenarios/perf-eval/acl-resource-consume/README.md
@@ -0,0 +1,21 @@
+# ACL CRI Resource Consume
+
+This scenario runs ACL AKS node performance validation through Telescope v1.
+
+## Pipeline
+
+Register this YAML in Azure DevOps:
+
+```text
+pipelines/perf-eval/CRI Benchmark/acl-resource-consume.yml
+```
+
+Queue it manually for validation runs.
+
+## Azure DevOps Inputs
+
+The pipeline environment must provide `AZURE_SERVICE_CONNECTION`, `AZURE_SUBSCRIPTION_ID`, and `AZURE_TELESCOPE_STORAGE_ACCOUNT_NAME`. The service connection identity needs Contributor on the subscription for temporary resource groups and Storage Blob Data Contributor on the result storage account. Ensure the storage account has a `perf-eval` container, because Telescope uploads results to a container named after `SCENARIO_TYPE`.
+
+## ACL OS Selector
+
+The current Terraform input uses the AKS CLI path and sets `--os-sku AzureContainerLinux` for the cluster and ACL node pools.
\ No newline at end of file
diff --git a/scenarios/perf-eval/acl-resource-consume/terraform-inputs/azure.tfvars b/scenarios/perf-eval/acl-resource-consume/terraform-inputs/azure.tfvars
new file mode 100644
index 0000000000..a38f20d146
--- /dev/null
+++ b/scenarios/perf-eval/acl-resource-consume/terraform-inputs/azure.tfvars
@@ -0,0 +1,118 @@
+scenario_type  = "perf-eval"
+scenario_name  = "acl-resource-consume"
+deletion_delay = "2h"
+owner          = "aks"
+
+aks_cli_config_list = [
+  {
+    role                          = "client"
+    aks_name                      = "acl-resource-consume"
+    sku_tier                      = "standard"
+    kubernetes_version            = "1.35"
+    use_aks_preview_cli_extension = true
+    aks_custom_headers            = []
+    default_node_pool = {
+      name       = "default"
+      node_count = 3
+      vm_size    = "Standard_D16_v5"
+    }
+    extra_node_pool = [
+      {
+        name       = "prompool"
+        node_count = 1
+        vm_size    = "Standard_D16_v5"
+        optional_parameters = [
+          {
+            name  = "labels"
+            value = "prometheus=true"
+          },
+          {
+            name  = "os-sku"
+            value = "AzureContainerLinux"
+          },
+          {
+            name  = "enable-secure-boot"
+            value = ""
+          },
+          {
+            name  = "enable-vtpm"
+            value = ""
+          },
+        ]
+      },
+      {
+        name       = "userpool0"
+        node_count = 10
+        vm_size    = "Standard_D16ds_v6"
+        optional_parameters = [
+          {
+            name  = "node-osdisk-type"
+            value = "Ephemeral"
+          },
+          {
+            name  = "os-sku"
+            value = "AzureContainerLinux"
+          },
+          {
+            name  = "enable-secure-boot"
+            value = ""
+          },
+          {
+            name  = "enable-vtpm"
+            value = ""
+          },
+          {
+            name  = "node-taints"
+            value = "cri-resource-consume=true:NoSchedule,cri-resource-consume=true:NoExecute"
+          },
+          {
+            name  = "labels"
+            value = "cri-resource-consume=true"
+          }
+        ]
+      }
+    ]
+    optional_parameters = [
+      {
+        name  = "network-plugin"
+        value = "azure"
+      },
+      {
+        name  = "network-plugin-mode"
+        value = "overlay"
+      },
+      {
+        name  = "node-init-taints"
+        value = "CriticalAddonsOnly=true:NoSchedule"
+      },
+      {
+        name  = "pod-cidr"
+        value = "10.0.0.0/9"
+      },
+      {
+        name  = "service-cidr"
+        value = "192.168.0.0/16"
+      },
+      {
+        name  = "dns-service-ip"
+        value = "192.168.0.10"
+      },
+      {
+        name  = "os-sku"
+        value = "AzureContainerLinux"
+      },
+      {
+        name  = "enable-secure-boot"
+        value = ""
+      },
+      {
+        name  = "enable-vtpm"
+        value = ""
+      },
+      {
+        name  = "node-os-upgrade-channel"
+        value = "None"
+      }
+    ]
+  }
+]
diff --git a/scenarios/perf-eval/acl-resource-consume/terraform-test-inputs/azure.json b/scenarios/perf-eval/acl-resource-consume/terraform-test-inputs/azure.json
new file mode 100644
index 0000000000..0a6ba308b6
--- /dev/null
+++ b/scenarios/perf-eval/acl-resource-consume/terraform-test-inputs/azure.json
@@ -0,0 +1,4 @@
+{
+    "run_id" : "123456789",
+    "region" : "swedencentral"
+}