Try with sshd_config: false.

There is some kind of conflict that removes this each time.
Subsystem sftp internal-sftp
Resulting in ci-worker-2 being unable to publish packages.

global/overlay/etc/puppet/cosmos-rules.yaml

@@ -38,6 +38,13 @@ pypi-1.sunet.se:
       nodename: A8P9U1IAR58I
       backup_dirs:
         - '/opt/pypi/packages'
+   sunet::server:
+      disable_all_local_users: true
+      disable_ipv6_privacy: true
+      install_scriptherder: true
+      unattended_upgrades: true
+      ntpd_config: false
+      sshd_config: false
 
 test-das-federator.lab.sunet.se:
    sunet::certbot::acmed: