diff --git a/README.md b/README.md
index d31d2c6..5b8a48e 100644
--- a/README.md
+++ b/README.md
@@ -17,6 +17,7 @@ Download or check selected targets:
 ```bash
 ./download-images.sh debian13
 ./download-images.sh almalinux10
+./download-images.sh rocky9
 ./download-images.sh fedora44
 ./download-images.sh ubuntu2604
 ./download-images.sh virtio-win
@@ -57,6 +58,7 @@ The path interface prints one absolute path without downloading anything:
 ```bash
 ./download-images.sh --print-path debian13
 ./download-images.sh --print-path almalinux10
+./download-images.sh --print-path rocky9
 ./download-images.sh --print-path fedora44
 ./download-images.sh --print-path ubuntu2604
 ./download-images.sh --print-path virtio-win
@@ -71,18 +73,19 @@ ISO (for example `Win11_25H2_English_x64_v2.iso` →
 existing `*Win*11*x64*.qcow2` (`*Win*11*arm64*.qcow2` on arm64) in `base-qcow2/` is used instead.
 
 Download URLs can be overridden with `DEBIAN_IMAGE_URL`, `ALMA_IMAGE_URL`,
-`FEDORA_IMAGE_URL`, `UBUNTU_IMAGE_URL`, `VIRTIO_WIN_ISO_URL`, and
+`ROCKY_IMAGE_URL`, `FEDORA_IMAGE_URL`, `UBUNTU_IMAGE_URL`, `VIRTIO_WIN_ISO_URL`, and
 `OPENSSH_WIN_ZIP_URL`. Each may
 list several mirrors of the same file, separated by whitespace; the Fedora
-image defaults to the TUNA, BFSU and NJU mirrors, and the Ubuntu image to the
+image defaults to the TUNA, BFSU and NJU mirrors, the Rocky Linux image to the official
+dl.rockylinux.org and NJU mirrors, and the Ubuntu image to the
 TUNA, NJU and official cloud-images.ubuntu.com mirrors.
 
 When [aria2](https://aria2.github.io/) is installed (`aria2c`), an image is
 downloaded from all of its mirrors at once, with a single connection to each
 mirror. Without it, `curl` (or `wget`) tries the mirrors in order. A partial
 download is only resumed with the same downloader and mirror list; otherwise
-it starts over. The Fedora and Ubuntu checksums can be overridden with
-`FEDORA_IMAGE_SHA256` and `UBUNTU_IMAGE_SHA256` when using a custom image.
+it starts over. The Rocky Linux, Fedora and Ubuntu checksums can be overridden with
+`ROCKY_IMAGE_SHA256`, `FEDORA_IMAGE_SHA256` and `UBUNTU_IMAGE_SHA256` when using a custom image.
 
 The `openssh-win` target downloads the Win32-OpenSSH zip matching the
 architecture into `tools-iso/`: `OpenSSH-Win64.zip` on amd64 hosts and
diff --git a/download-images.sh b/download-images.sh
index 2ffa965..6c46fb0 100755
--- a/download-images.sh
+++ b/download-images.sh
@@ -19,9 +19,12 @@ if [[ "$image_arch" == arm64 ]]; then
   debian_image="${base_qcow2_dir}/debian-13-generic-arm64-20260810-2566.qcow2"
   alma_image="${base_qcow2_dir}/AlmaLinux-10-GenericCloud-10.2-20260526.0.aarch64.qcow2"
   fedora_image="${base_qcow2_dir}/Fedora-Cloud-Base-Generic-44-1.7.aarch64.qcow2"
+  rocky_image="${base_qcow2_dir}/Rocky-9-GenericCloud-Base-9.8-20260525.0.aarch64.qcow2"
   ubuntu_image="${base_qcow2_dir}/ubuntu-26.04-server-cloudimg-arm64-20260927.img"
   debian_url_default="https://cloud.debian.org/images/cloud/trixie/20260810-2566/debian-13-generic-arm64-20260810-2566.qcow2"
   alma_url_default="https://repo.almalinux.org/almalinux/10/cloud/aarch64/images/AlmaLinux-10-GenericCloud-10.2-20260526.0.aarch64.qcow2"
+  rocky_url_default="https://dl.rockylinux.org/pub/rocky/9/images/aarch64/Rocky-9-GenericCloud-Base-9.8-20260525.0.aarch64.qcow2
+    https://mirrors.nju.edu.cn/rocky/9/images/aarch64/Rocky-9-GenericCloud-Base-9.8-20260525.0.aarch64.qcow2"
   fedora_url_default="https://mirrors.tuna.tsinghua.edu.cn/fedora/releases/44/Cloud/aarch64/images/Fedora-Cloud-Base-Generic-44-1.7.aarch64.qcow2
     https://mirrors.bfsu.edu.cn/fedora/releases/44/Cloud/aarch64/images/Fedora-Cloud-Base-Generic-44-1.7.aarch64.qcow2
     https://mirrors.nju.edu.cn/fedora/releases/44/Cloud/aarch64/images/Fedora-Cloud-Base-Generic-44-1.7.aarch64.qcow2"
@@ -35,14 +38,18 @@ if [[ "$image_arch" == arm64 ]]; then
   # ALMA_IMAGE_SHA256 / FEDORA_IMAGE_SHA256.
   debian_sha512_default=""
   alma_sha256_default=""
+  rocky_sha256_default="24692a444f1f0b8bb95375c38c8b43f8099a115347623691be2c330b40c8a1fe"
   fedora_sha256_default=""
 else
   debian_image="${base_qcow2_dir}/debian-13-generic-amd64-20260810-2566.qcow2"
   alma_image="${base_qcow2_dir}/AlmaLinux-10-GenericCloud-10.2-20260526.0.x86_64.qcow2"
   fedora_image="${base_qcow2_dir}/Fedora-Cloud-Base-Generic-44-1.7.x86_64.qcow2"
+  rocky_image="${base_qcow2_dir}/Rocky-9-GenericCloud-Base-9.8-20260525.0.x86_64.qcow2"
   ubuntu_image="${base_qcow2_dir}/ubuntu-26.04-server-cloudimg-amd64-20260927.img"
   debian_url_default="https://cloud.debian.org/images/cloud/trixie/20260810-2566/debian-13-generic-amd64-20260810-2566.qcow2"
   alma_url_default="https://repo.almalinux.org/almalinux/10/cloud/x86_64/images/AlmaLinux-10-GenericCloud-10.2-20260526.0.x86_64.qcow2"
+  rocky_url_default="https://dl.rockylinux.org/pub/rocky/9/images/x86_64/Rocky-9-GenericCloud-Base-9.8-20260525.0.x86_64.qcow2
+    https://mirrors.nju.edu.cn/rocky/9/images/x86_64/Rocky-9-GenericCloud-Base-9.8-20260525.0.x86_64.qcow2"
   fedora_url_default="https://mirrors.tuna.tsinghua.edu.cn/fedora/releases/44/Cloud/x86_64/images/Fedora-Cloud-Base-Generic-44-1.7.x86_64.qcow2
     https://mirrors.bfsu.edu.cn/fedora/releases/44/Cloud/x86_64/images/Fedora-Cloud-Base-Generic-44-1.7.x86_64.qcow2
     https://mirrors.nju.edu.cn/fedora/releases/44/Cloud/x86_64/images/Fedora-Cloud-Base-Generic-44-1.7.x86_64.qcow2"
@@ -51,6 +58,7 @@ else
     https://cloud-images.ubuntu.com/releases/26.04/release-20260927/ubuntu-26.04-server-cloudimg-amd64.img"
   debian_sha512_default="f6978100d8031c266d55d7815ceea7fcdeacf28e1e5834fdb9c94ac96880a054a6e6f8681c2d3b0584e0057eaf3ef7353856b85212d04134744faa9b3bb1f24f"
   alma_sha256_default="47f2218668dd4776be140dd92fa3bea700be1766e2c7d88bdfd6a4b50f477b4d"
+  rocky_sha256_default="92c206cc6f790c61583247eefe87890f8828420662c17cacf247cec78ab4eec8"
   fedora_sha256_default="28680fe5b371a5a82ebf43a31926e086a168e59949d03969c5093e7071f90b7f"
   ubuntu_sha256_default="8800651811af9a85465ad1d552add729947bb16488dddb4a9b5305a3d97332b2"
 fi
@@ -120,23 +128,25 @@ windows_qcow2_path() {
 # them in order.
 debian_url="${DEBIAN_IMAGE_URL:-$debian_url_default}"
 alma_url="${ALMA_IMAGE_URL:-$alma_url_default}"
+rocky_url="${ROCKY_IMAGE_URL:-$rocky_url_default}"
 fedora_url="${FEDORA_IMAGE_URL:-$fedora_url_default}"
 ubuntu_url="${UBUNTU_IMAGE_URL:-$ubuntu_url_default}"
 openssh_url="${OPENSSH_WIN_ZIP_URL:-https://wangguofang.net/github.com/PowerShell/Win32-OpenSSH/releases/download/10.0.0.0p2-Preview/${openssh_zip}}"
 virtio_url="${VIRTIO_WIN_ISO_URL:-https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/stable-virtio/virtio-win.iso}"
 debian_sha512="${DEBIAN_IMAGE_SHA512:-$debian_sha512_default}"
 alma_sha256="${ALMA_IMAGE_SHA256:-$alma_sha256_default}"
+rocky_sha256="${ROCKY_IMAGE_SHA256:-$rocky_sha256_default}"
 fedora_sha256="${FEDORA_IMAGE_SHA256:-$fedora_sha256_default}"
 ubuntu_sha256="${UBUNTU_IMAGE_SHA256:-$ubuntu_sha256_default}"
 force_download=false
 
 usage() {
   cat <<EOF
-Usage: $(basename "$0") [--force] [all|debian13|almalinux10|fedora44|ubuntu2604|virtio-win|openssh-win|windows11] ...
+Usage: $(basename "$0") [--force] [all|debian13|almalinux10|rocky9|fedora44|ubuntu2604|virtio-win|openssh-win|windows11] ...
        $(basename "$0") --print-path TARGET [--iso]
 
 Download one or more shared VM images. With no arguments, all targets are
-processed. The Debian/AlmaLinux/Fedora/Ubuntu image architecture (arm64 or amd64)
+processed. The Debian/AlmaLinux/Rocky Linux/Fedora/Ubuntu image architecture (arm64 or amd64)
 is auto-detected from the host; override it with VM_IMAGE_ARCH.
 
 When aria2c is installed, an image is downloaded with 16 connections in total
@@ -193,6 +203,7 @@ print_image_path() {
   case "$target" in
     debian13) printf '%s\n' "$debian_image" ;;
     almalinux10) printf '%s\n' "$alma_image" ;;
+    rocky9) printf '%s\n' "$rocky_image" ;;
     fedora44) printf '%s\n' "$fedora_image" ;;
     ubuntu2604) printf '%s\n' "$ubuntu_image" ;;
     virtio-win) printf '%s\n' "$virtio_image" ;;
@@ -242,7 +253,7 @@ fi
 
 for target in "${targets[@]}"; do
   case "$target" in
-    all|debian13|almalinux10|fedora44|ubuntu2604|virtio-win|openssh-win|windows11) ;;
+    all|debian13|almalinux10|rocky9|fedora44|ubuntu2604|virtio-win|openssh-win|windows11) ;;
     -h|--help) usage; exit 0 ;;
     *) printf 'Error: unknown download target: %s\n' "$target" >&2; usage >&2; exit 2 ;;
   esac
@@ -499,6 +510,15 @@ if wants_target almalinux10; then
     "$alma_sha256"
 fi
 
+if wants_target rocky9; then
+  download_file \
+    'Rocky Linux 9 cloud image' \
+    "$rocky_url" \
+    "$rocky_image" \
+    sha256 \
+    "$rocky_sha256"
+fi
+
 if wants_target fedora44; then
   download_file \
     'Fedora 44 cloud image' \