diff --git a/pkg/asset/machines/azure/azuremachines.go b/pkg/asset/machines/azure/azuremachines.go
index 7015600cea0..1d3012045b3 100644
--- a/pkg/asset/machines/azure/azuremachines.go
+++ b/pkg/asset/machines/azure/azuremachines.go
@@ -399,6 +399,9 @@ func capzImage(osImage aztypes.OSImage, azEnv aztypes.CloudEnvironment, confiden
 				ThirdPartyImage: false,
 			},
 		}
+	case strings.HasPrefix(rhcosImg, "/subscriptions/"):
+		// An explicit non-marketplace resource path was supplied. Use it as is.
+		return &capz.Image{ID: &rhcosImg}
 	case rhcosImg == "" && !confidentialVM:
 		// hive calls the machines function, but may pass an empty
 		// string for rhcos. In which case, allow MAO to choose default.
diff --git a/pkg/asset/machines/azure/machines.go b/pkg/asset/machines/azure/machines.go
index 5d517d7c50c..70395b27e67 100644
--- a/pkg/asset/machines/azure/machines.go
+++ b/pkg/asset/machines/azure/machines.go
@@ -458,5 +458,9 @@ func mapiImage(osImage azure.OSImage, azEnv azure.CloudEnvironment, confidential
 // for MAPI, by removing the /subspcription/ prefix.
 func trimSubscriptionPrefix(image string) string {
 	rgIndex := strings.Index(image, "/resourceGroups/")
+	// Allow invalid inputs to fail downstream
+	if rgIndex < 0 {
+		return image
+	}
 	return image[rgIndex:]
 }