diff --git a/cli/config/configuration.toml.in b/cli/config/configuration.toml.in
index f9fbda1d02..89ea3e560e 100644
--- a/cli/config/configuration.toml.in
+++ b/cli/config/configuration.toml.in
@@ -193,6 +193,8 @@ enable_iothreads = @DEFENABLEIOTHREADS@
 #
 # When disabled, new VMs are created from scratch.
 #
+# Note: Requires "initrd=" to be set ("image=" is not supported).
+#
 # Default false
 #enable_template = true
 
diff --git a/pkg/katautils/config.go b/pkg/katautils/config.go
index f915fb4274..b1703bbe83 100644
--- a/pkg/katautils/config.go
+++ b/pkg/katautils/config.go
@@ -651,11 +651,6 @@ func LoadConfiguration(configPath string, ignoreLogging, builtIn bool) (resolved
 		return "", config, err
 	}
 
-	config.DisableNewNetNs = tomlConf.Runtime.DisableNewNetNs
-	if err := checkNetNsConfig(config); err != nil {
-		return "", config, err
-	}
-
 	// use no proxy if HypervisorConfig.UseVSock is true
 	if config.HypervisorConfig.UseVSock {
 		kataUtilsLogger.Info("VSOCK supported, configure to not use proxy")
@@ -663,13 +658,32 @@ func LoadConfiguration(configPath string, ignoreLogging, builtIn bool) (resolved
 		config.ProxyConfig = vc.ProxyConfig{}
 	}
 
-	if err := checkHypervisorConfig(config.HypervisorConfig); err != nil {
+	config.DisableNewNetNs = tomlConf.Runtime.DisableNewNetNs
+
+	if err := checkConfig(config); err != nil {
 		return "", config, err
 	}
 
 	return resolved, config, nil
 }
 
+// checkConfig checks the validity of the specified config.
+func checkConfig(config oci.RuntimeConfig) error {
+	if err := checkNetNsConfig(config); err != nil {
+		return err
+	}
+
+	if err := checkHypervisorConfig(config.HypervisorConfig); err != nil {
+		return err
+	}
+
+	if err := checkFactoryConfig(config); err != nil {
+		return err
+	}
+
+	return nil
+}
+
 func updateConfig(configPath string, tomlConf tomlConfig, config *oci.RuntimeConfig, builtIn bool) error {
 
 	if err := updateRuntimeConfig(configPath, tomlConf, config); err != nil {
@@ -700,6 +714,15 @@ func checkNetNsConfig(config oci.RuntimeConfig) error {
 	return nil
 }
 
+// checkFactoryConfig ensures the VM factory configuration is valid.
+func checkFactoryConfig(config oci.RuntimeConfig) error {
+	if config.FactoryConfig.Template && config.HypervisorConfig.InitrdPath == "" {
+		return errors.New("Factory option enable_template requires an initrd image")
+	}
+
+	return nil
+}
+
 // checkHypervisorConfig performs basic "sanity checks" on the hypervisor
 // config.
 func checkHypervisorConfig(config vc.HypervisorConfig) error {
diff --git a/pkg/katautils/config_test.go b/pkg/katautils/config_test.go
index 045b526e45..2192509e99 100644
--- a/pkg/katautils/config_test.go
+++ b/pkg/katautils/config_test.go
@@ -1497,3 +1497,44 @@ func TestCheckNetNsConfig(t *testing.T) {
 	err = checkNetNsConfig(config)
 	assert.Error(err)
 }
+
+func TestCheckFactoryConfig(t *testing.T) {
+	assert := assert.New(t)
+
+	type testData struct {
+		factoryEnabled bool
+		imagePath      string
+		initrdPath     string
+		expectError    bool
+	}
+
+	data := []testData{
+		{false, "", "", false},
+		{false, "image", "", false},
+		{false, "", "initrd", false},
+
+		{true, "", "initrd", false},
+		{true, "image", "", true},
+	}
+
+	for i, d := range data {
+		config := oci.RuntimeConfig{
+			HypervisorConfig: vc.HypervisorConfig{
+				ImagePath:  d.imagePath,
+				InitrdPath: d.initrdPath,
+			},
+
+			FactoryConfig: oci.FactoryConfig{
+				Template: d.factoryEnabled,
+			},
+		}
+
+		err := checkFactoryConfig(config)
+
+		if d.expectError {
+			assert.Error(err, "test %d (%+v)", i, d)
+		} else {
+			assert.NoError(err, "test %d (%+v)", i, d)
+		}
+	}
+}