diff --git a/tests/hypervisor_helpers.sh b/tests/hypervisor_helpers.sh
index db60c976dc..209ecbcf15 100644
--- a/tests/hypervisor_helpers.sh
+++ b/tests/hypervisor_helpers.sh
@@ -122,6 +122,21 @@ function is_confidential_runtime_class() {
 	fi
 }
 
+# Runtime classes that boot with shared_fs=none, where the host cannot read
+# guest files directly. Data such as a container's termination log must then be
+# retrieved over the agent GetDiagnosticData RPC instead of a shared filesystem.
+# This covers the confidential runtime classes and the non-confidential NVIDIA
+# CPU runtime-rs handler. The plain qemu-nvidia-cpu (Go) class still uses
+# virtio-fs, so it is intentionally excluded.
+function is_shared_fs_none_runtime_class() {
+	local hypervisor="${1:-${KATA_HYPERVISOR}}"
+	if is_confidential_runtime_class "${hypervisor}"; then
+		return 0
+	fi
+	[[ "${hypervisor}" == "qemu-nvidia-cpu-runtime-rs" ]] && return 0
+	return 1
+}
+
 # Runtime classes that boot a measured (dm-verity) rootfs: the confidential
 # classes plus the CPU-only NVIDIA classes, which boot the verity-backed
 # nvidia base image without being confidential.
diff --git a/tests/integration/kubernetes/k8s-termination-log.bats b/tests/integration/kubernetes/k8s-termination-log.bats
index 2c398f518b..3c0ae2ab5c 100644
--- a/tests/integration/kubernetes/k8s-termination-log.bats
+++ b/tests/integration/kubernetes/k8s-termination-log.bats
@@ -5,8 +5,9 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 # Test termination log propagation via GetDiagnosticData RPC.
-# These tests target shared_fs=none configurations (e.g. qemu-coco-dev)
-# where the host cannot directly read guest files.
+# These tests target shared_fs=none configurations (e.g. qemu-coco-dev or the
+# NVIDIA CPU runtime-rs handler) where the host cannot directly read guest
+# files.
 
 load "${BATS_TEST_DIRNAME}/lib.sh"
 load "${BATS_TEST_DIRNAME}/../../common.bash"
@@ -14,9 +15,11 @@ load "${BATS_TEST_DIRNAME}/tests_common.sh"
 load "${BATS_TEST_DIRNAME}/confidential_common.sh"
 
 setup() {
-	# These tests only make sense on CoCo platforms (shared_fs=none).
-	if ! is_confidential_runtime_class; then
-		skip "Test requires a CoCo runtime class (shared_fs=none)"
+	# These tests only make sense on shared_fs=none configurations, where the
+	# host cannot read guest files directly and the termination log has to be
+	# fetched over the agent GetDiagnosticData RPC.
+	if ! is_shared_fs_none_runtime_class; then
+		skip "Test requires a shared_fs=none runtime class"
 	fi
 
 	setup_common || die "setup_common failed"
@@ -95,6 +98,13 @@ wait_for_pod_terminated() {
 }
 
 @test "Termination log: request blocked by default CoCo policy" {
+	# The default-deny behaviour is specific to the confidential runtime
+	# classes; non-confidential shared_fs=none classes (e.g. NVIDIA CPU
+	# runtime-rs) do not ship a default policy that blocks the RPC.
+	if ! is_confidential_runtime_class; then
+		skip "Default-deny policy check only applies to CoCo runtime classes"
+	fi
+
 	if ! auto_generate_policy_enabled; then
 		echo "# Skipping default CoCo policy check: requires AUTO_GENERATE_POLICY=yes" >&3
 		return 0
@@ -128,7 +138,7 @@ wait_for_pod_terminated() {
 }
 
 teardown() {
-	if ! is_confidential_runtime_class; then
+	if ! is_shared_fs_none_runtime_class; then
 		return
 	fi