diff --git a/ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-commands.sh b/ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-commands.sh
index f569d90281277..cfa0f627493dd 100755
--- a/ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-commands.sh
+++ b/ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-commands.sh
@@ -21,7 +21,7 @@ then
   gcloud config set project "${GOOGLE_PROJECT_ID}"
 fi
 
-LOCATION="global"
+LOCATION="${LEASED_RESOURCE}"
 KEY_RING_NAME="openshift-ci"
 KEY_NAME="openshift-ci-e2e"
 
diff --git a/ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-ref.yaml b/ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-ref.yaml
index 68d585fe0fbd4..2055cfbb7f020 100644
--- a/ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-ref.yaml
+++ b/ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-ref.yaml
@@ -12,8 +12,9 @@ ref:
       memory: 100Mi
   documentation: |-
     Ensure a shared GCP Cloud KMS key ring and crypto key exist for CI testing.
-    Uses a global location so the key is accessible from any region. Both the
+    Uses the LEASED_RESOURCE region so the key is co-located with the cluster.
+    GCS (used for bootstrap ignition) requires a regional KMS key. Both the
     key ring (openshift-ci) and key (openshift-ci-e2e) are created only if they
-    do not already exist, and are reused across all CI runs.
+    do not already exist, and are reused across all CI runs in that region.
     The key details are saved to SHARED_DIR for use by subsequent steps
     (e.g., ipi-conf-gcp-osdisk-encryption-key).
diff --git a/ci-operator/step-registry/openshift/e2e/gcp/kms-encryption/openshift-e2e-gcp-kms-encryption-workflow.yaml b/ci-operator/step-registry/openshift/e2e/gcp/kms-encryption/openshift-e2e-gcp-kms-encryption-workflow.yaml
index 6601ce0173e30..0f4b3d4514287 100644
--- a/ci-operator/step-registry/openshift/e2e/gcp/kms-encryption/openshift-e2e-gcp-kms-encryption-workflow.yaml
+++ b/ci-operator/step-registry/openshift/e2e/gcp/kms-encryption/openshift-e2e-gcp-kms-encryption-workflow.yaml
@@ -13,12 +13,12 @@ workflow:
     - chain: ipi-gcp-post
   documentation: |-
     The GCP KMS encryption workflow ensures a shared customer-managed KMS key
-    exists (global location, reused across runs), configures install-config
+    exists (regional, co-located with the cluster), configures install-config
     with OS disk encryption, installs a cluster, verifies KMS encryption is
     applied to GCS buckets (bootstrap ignition and image registry), and runs
     the conformance suite.
 
     Note: The KMS keyring and key are NOT deleted after the test completes.
     This is intentional because GCP does not allow deletion of KMS keys (they
-    can only be disabled). The same key is reused across all CI runs to avoid
-    resource accumulation.
+    can only be disabled). The same key is reused across all CI runs in the
+    same region to avoid resource accumulation.