diff --git a/ansible/fail2ban.yml b/ansible/fail2ban.yml
index 5f85f0a0e..febd3c530 100644
--- a/ansible/fail2ban.yml
+++ b/ansible/fail2ban.yml
@@ -12,6 +12,3 @@
     - role: robertdebock.fail2ban
       become: true
       when: fail2ban_enabled | bool
-  vars:
-    # TODO (L-Chams): Remove fail2ban_sender override when PR https://github.com/robertdebock/ansible-role-fail2ban/pull/18 is merged.
-    fail2ban_sender: root@{{ ansible_facts.fqdn }}
diff --git a/ansible/inventory/group_vars/all/ipa b/ansible/inventory/group_vars/all/ipa
index eb0873271..8b3dbbba7 100644
--- a/ansible/inventory/group_vars/all/ipa
+++ b/ansible/inventory/group_vars/all/ipa
@@ -110,6 +110,10 @@ ipa_build_dib_upper_constraints_file: ""
 ###############################################################################
 # Ironic Python Agent (IPA) images configuration.
 
+# OS version of upstream Ironic deployment image files. Valid options are
+# "centos9" and "centos10". Default is "centos10".
+ipa_images_upstream_os: "centos10"
+
 # Suffix of upstream Ironic deployment image files. Default is based on
 # {{ openstack_branch }}.
 ipa_images_upstream_url_suffix: "-{{ openstack_branch | replace('/', '-') }}"
@@ -118,7 +122,7 @@ ipa_images_upstream_url_suffix: "-{{ openstack_branch | replace('/', '-') }}"
 ipa_images_kernel_name: "ipa.kernel"
 
 # URL of Ironic deployment kernel image to download.
-ipa_kernel_upstream_url: "https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos9{{ ipa_images_upstream_url_suffix }}.kernel"
+ipa_kernel_upstream_url: "https://tarballs.opendev.org/openstack/ironic-python-agent/dib/files/ipa-{{ ipa_images_upstream_os }}{{ ipa_images_upstream_url_suffix }}.kernel"
 
 # URL of checksum of Ironic deployment kernel image.
 ipa_kernel_checksum_url: "{{ ipa_kernel_upstream_url }}.{{ ipa_kernel_checksum_algorithm }}"
@@ -130,7 +134,7 @@ ipa_kernel_checksum_algorithm: "sha256"
 ipa_images_ramdisk_name: "ipa.initramfs"
 
 # URL of Ironic deployment ramdisk image to download.
-ipa_ramdisk_upstream_url: "https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos9{{ ipa_images_upstream_url_suffix }}.initramfs"
+ipa_ramdisk_upstream_url: "https://tarballs.opendev.org/openstack/ironic-python-agent/dib/files/ipa-{{ ipa_images_upstream_os }}{{ ipa_images_upstream_url_suffix }}.initramfs"
 
 # URL of checksum of Ironic deployment ramdisk image.
 ipa_ramdisk_checksum_url: "{{ ipa_ramdisk_upstream_url }}.{{ ipa_ramdisk_checksum_algorithm }}"
diff --git a/ansible/inventory/group_vars/all/ironic b/ansible/inventory/group_vars/all/ironic
index 0e37aba9d..f6eb715b4 100644
--- a/ansible/inventory/group_vars/all/ironic
+++ b/ansible/inventory/group_vars/all/ironic
@@ -100,6 +100,11 @@ kolla_ironic_inspection_network: "{{ kolla_ironic_provisioning_network if inspec
 # Name of the Neutron network to use for provisioning.
 kolla_ironic_provisioning_network: 'provision-net'
 
+# Address of the Ironic Python Agent (IPA) NTP server. The default value maps
+# to the IP address of each controller on the internal API, which should be
+# running chronyd.
+kolla_ironic_ntp_server: "{% raw %}{{ hostvars[inventory_hostname].ansible_facts[api_interface | replace('-', '_')]['ipv4']['address'] }}{% endraw %}"
+
 # List of default kernel parameters to append for baremetal PXE boot.
 kolla_ironic_pxe_append_params_default: "{{ kolla_ironic_kernel_append_params_default }}"
 
@@ -116,6 +121,7 @@ kolla_ironic_kernel_append_params_default:
   - vga=normal
   - console=tty0
   - console=ttyS0,115200n8
+  - ipa-ntp-server={% if kolla_ironic_ntp_server is not none and kolla_ironic_ntp_server | length > 0 %}{{ kolla_ironic_ntp_server }}{% endif %}
 
 # List of additional kernel parameters to append for baremetal boot.
 kolla_ironic_kernel_append_params_extra: []
diff --git a/ansible/inventory/group_vars/all/openstack b/ansible/inventory/group_vars/all/openstack
index 430293d3f..be905c902 100644
--- a/ansible/inventory/group_vars/all/openstack
+++ b/ansible/inventory/group_vars/all/openstack
@@ -2,10 +2,10 @@
 ###############################################################################
 # OpenStack release configuration.
 
-# Name of the current OpenStack release. Default is "master".
-openstack_release: "master"
+# Name of the current OpenStack release. Default is "2026.2".
+openstack_release: "2026.2"
 
-# Name of the current OpenStack branch. Default is "master".
+# Name of the current OpenStack branch. Default is "stable/2026.2".
 openstack_branch: >-
   {% if openstack_release != 'master' %}stable/{% endif %}{{ openstack_release | lower }}
 
diff --git a/ansible/inventory/group_vars/all/seed b/ansible/inventory/group_vars/all/seed
index 3dc104904..1e469a23c 100644
--- a/ansible/inventory/group_vars/all/seed
+++ b/ansible/inventory/group_vars/all/seed
@@ -143,15 +143,9 @@ seed_users: "{{ users_default }}"
 #
 seed_containers: {}
 
-# (Deprecated) Whether to attempt a basic authentication login to a registry when
-# deploying seed containers.
-# TODO(mattcrees): remove seed_deploy_containers_registry_attempt_login in the
-# Hibiscus cycle.
-seed_deploy_containers_registry_attempt_login: "{{ kolla_docker_registry_username is truthy and kolla_docker_registry_password is truthy }}"
-
 # Whether to attempt a basic authentication login to a registry when
 # deploying seed containers.
-seed_manage_containers_registry_attempt_login: "{{ seed_deploy_containers_registry_attempt_login }}"
+seed_manage_containers_registry_attempt_login: "{{ kolla_docker_registry_username is truthy and kolla_docker_registry_password is truthy }}"
 
 ###############################################################################
 # Seed node firewalld configuration.
diff --git a/ansible/manage-containers.yml b/ansible/manage-containers.yml
index 054034039..fc7c0e79b 100644
--- a/ansible/manage-containers.yml
+++ b/ansible/manage-containers.yml
@@ -2,10 +2,6 @@
 - name: "Ensure defined container images are {{ kayobe_action | default('deploy') }}ed"
   hosts: "{{ manage_containers_target_hosts | default('seed') }}"
   tags:
-    # Kept for backward compatibility.
-    # TODO(mattcrees): Will be removed in the Hibiscus release.
-    - seed-deploy-containers
-    - seed-manage-containers
     - manage-containers
   tasks:
     - import_role:
diff --git a/ansible/roles/kolla-ansible/templates/kolla/globals.yml b/ansible/roles/kolla-ansible/templates/kolla/globals.yml
index 577f6c988..2ce8dcfde 100644
--- a/ansible/roles/kolla-ansible/templates/kolla/globals.yml
+++ b/ansible/roles/kolla-ansible/templates/kolla/globals.yml
@@ -292,7 +292,7 @@ enable_{{ feature_flag }}: {{ hostvars[inventory_hostname]['kolla_enable_' ~ fea
 ####################
 # Osprofiler options
 ####################
-# valid values: ["elasticsearch", "redis"]
+# valid values: ["elasticsearch", "valkey"]
 #osprofiler_backend: "elasticsearch"
 
 ##################
@@ -308,8 +308,8 @@ enable_{{ feature_flag }}: {{ hostvars[inventory_hostname]['kolla_enable_' ~ fea
 # Valid options are [ file, ceph ]
 #gnocchi_backend_storage: "{% raw %}{{ 'ceph' if enable_ceph|bool else 'file' }}{% endraw %}"
 
-# Valid options are [redis, '']
-#gnocchi_incoming_storage: "{% raw %}{{ 'redis' if enable_redis | bool else '' }}{% endraw %}"
+# Valid options are [valkey, '']
+#gnocchi_incoming_storage: "{% raw %}{{ 'valkey' if enable_valkey | bool else '' }}{% endraw %}"
 
 ################################
 # Cinder - Block Storage Options
@@ -318,8 +318,8 @@ enable_{{ feature_flag }}: {{ hostvars[inventory_hostname]['kolla_enable_' ~ fea
 #cinder_backend_ceph: "{% raw %}{{ enable_ceph }}{% endraw %}"
 #cinder_backend_vmwarevc_vmdk: "no"
 #cinder_volume_group: "cinder-volumes"
-# Valid options are [ '', redis, etcd ]
-#cinder_coordination_backend: "{% raw %}{{ 'redis' if enable_redis|bool else 'etcd' if enable_etcd|bool else '' }}{% endraw %}"
+# Valid options are [ '', valkey, etcd ]
+#cinder_coordination_backend: "{% raw %}{{ 'valkey' if enable_valkey|bool else 'etcd' if enable_etcd|bool else '' }}{% endraw %}"
 
 # Valid options are [ nfs, ceph, s3 ]
 #cinder_backup_driver: "ceph"
@@ -344,8 +344,8 @@ enable_{{ feature_flag }}: {{ hostvars[inventory_hostname]['kolla_enable_' ~ fea
 # Valid options are [ bind9 ]
 #designate_backend: "bind9"
 #designate_ns_record: "sample.openstack.org"
-# Valid options are [ '', redis, etcd ]
-#designate_coordination_backend: "{% raw %}{{ 'redis' if enable_redis|bool else 'etcd' if enable_etcd|bool else '' }}{% endraw %}"
+# Valid options are [ '', valkey ]
+#designate_coordination_backend: "{% raw %}{{ 'valkey' if enable_valkey|bool else '' }}{% endraw %}"
 
 ########################
 # Nova - Compute Options
@@ -399,6 +399,9 @@ ironic_dnsmasq_dhcp_ranges:
 {% if kolla_inspector_dns_servers %}
     dns_servers: "{{ kolla_inspector_dns_servers | join(',') }}"
 {% endif %}
+{% if kolla_ironic_ntp_server is defined and kolla_ironic_ntp_server is not none and kolla_ironic_ntp_server | length > 0 %}
+    ntp_server: "{{ kolla_ironic_ntp_server }}"
+{% endif %}
 {% endif %}
 {% if kolla_inspector_extra_kernel_options %}
 ironic_kernel_cmdline_extras:
diff --git a/ansible/roles/kolla-ansible/templates/overcloud-components.j2 b/ansible/roles/kolla-ansible/templates/overcloud-components.j2
index 3eea3b95c..544b6c71b 100644
--- a/ansible/roles/kolla-ansible/templates/overcloud-components.j2
+++ b/ansible/roles/kolla-ansible/templates/overcloud-components.j2
@@ -137,10 +137,6 @@ deployment
 [skyline:children]
 control
 
-# TODO(vurmil): Remove after G/2026.1 release as Redis migration is no longer required
-[redis:children]
-control
-
 [valkey:children]
 control
 
diff --git a/ansible/roles/kolla-ansible/vars/main.yml b/ansible/roles/kolla-ansible/vars/main.yml
index c94dbe66e..aa8bdcb64 100644
--- a/ansible/roles/kolla-ansible/vars/main.yml
+++ b/ansible/roles/kolla-ansible/vars/main.yml
@@ -96,6 +96,7 @@ kolla_feature_flags:
   - cinder_backend_pure_nvme_tcp
   - cinder_backend_pure_roce
   - cinder_backend_quobyte
+  - cinder_backend_vast
   - cinder_backup
   - cinder_horizon_policy_file
   - cloudkitty
@@ -157,6 +158,7 @@ kolla_feature_flags:
   - manila_backend_generic
   - manila_backend_glusterfs_nfs
   - manila_backend_hnas
+  - manila_backend_vast
   - mariabackup
   - mariadb
   - masakari
diff --git a/ansible/roles/manage-containers/defaults/main.yml b/ansible/roles/manage-containers/defaults/main.yml
index e79c8ec75..f8d532360 100644
--- a/ansible/roles/manage-containers/defaults/main.yml
+++ b/ansible/roles/manage-containers/defaults/main.yml
@@ -2,10 +2,7 @@
 # Action to perform: One of: "deploy", "destroy".
 manage_containers_action: "deploy"
 
-#TODO(mattcrees): remove deploy_containers_defaults in Hibiscus cycle
-manage_containers_defaults: "{{ deploy_containers_defaults }}"
-
-deploy_containers_defaults:
+manage_containers_defaults:
   comparisons:
     image: strict
     env: strict
@@ -18,8 +15,7 @@ deploy_containers_defaults:
 
 manage_custom_containers: []
 
-#TODO(mattcrees): remove deploy_containers_docker_api_timeout in Hibiscus cycle.
-manage_containers_docker_api_timeout: "{{ deploy_containers_docker_api_timeout | default(120) }}"
+manage_containers_docker_api_timeout: 120
 
 manage_containers_registry:
 manage_containers_registry_username:
diff --git a/ansible/roles/manage-containers/tasks/deploy-container.yml b/ansible/roles/manage-containers/tasks/deploy-container.yml
index c29912758..872e697d5 100644
--- a/ansible/roles/manage-containers/tasks/deploy-container.yml
+++ b/ansible/roles/manage-containers/tasks/deploy-container.yml
@@ -14,18 +14,18 @@
   kayobe_container:
     capabilities: "{{ container_config.capabilities | default(omit) }}"
     command: "{{ container_config.command | default(omit) }}"
-    comparisons: "{{ container_config.comparisons | default(deploy_containers_defaults.comparisons) }}"
-    detach: "{{ container_config.detach | default(deploy_containers_defaults.detach) }}"
+    comparisons: "{{ container_config.comparisons | default(manage_containers_defaults.comparisons) }}"
+    detach: "{{ container_config.detach | default(manage_containers_defaults.detach) }}"
     env: "{{ container_config.env | default(omit) }}"
     name: "{{ container_name }}"
-    network_mode: "{{ container_config.network_mode | default(deploy_containers_defaults.network_mode) }}"
+    network_mode: "{{ container_config.network_mode | default(manage_containers_defaults.network_mode) }}"
     image: "{{ container_config.image }}:{{ container_config.tag | default('latest') }}"
-    init: "{{ container_config.init | default(deploy_containers_defaults.init) }}"
+    init: "{{ container_config.init | default(manage_containers_defaults.init) }}"
     ipc_mode: "{{ container_config.ipc_mode | default(omit) }}"
     pid_mode: "{{ container_config.pid_mode | default(omit) }}"
     ports: "{{ container_config.ports | default(omit) }}"
     privileged: "{{ container_config.privileged | default(omit) }}"
-    restart_policy: "{{ container_config.restart_policy | default(deploy_containers_defaults.restart_policy) }}"
+    restart_policy: "{{ container_config.restart_policy | default(manage_containers_defaults.restart_policy) }}"
     shm_size: "{{ container_config.shm_size | default(omit) }}"
     sysctls: "{{ container_config.sysctls | default(omit) }}"
     timeout: "{{ manage_containers_docker_api_timeout }}"
diff --git a/dev/tenks-deploy-config-overcloud.yml b/dev/tenks-deploy-config-overcloud.yml
index 86209e874..8226653b4 100644
--- a/dev/tenks-deploy-config-overcloud.yml
+++ b/dev/tenks-deploy-config-overcloud.yml
@@ -40,3 +40,9 @@ wait_for_placement: false
 # Nested virtualisation is not working well in CI currently. Force the use of
 # QEMU.
 libvirt_vm_engine: "qemu"
+
+# NOTE(priteau): Disable libvirt_vm_trust_guest_rx_filters, which when enabled
+# triggers the following errors when booting baremetal instances with Tenks on
+# Libvirt 9: Cannot set interface flags on 'macvtap1': Value too large for
+# defined data type
+libvirt_vm_trust_guest_rx_filters: false
diff --git a/doc/source/configuration/reference/ironic-python-agent.rst b/doc/source/configuration/reference/ironic-python-agent.rst
index 3ece11e96..dfc6bf6fe 100644
--- a/doc/source/configuration/reference/ironic-python-agent.rst
+++ b/doc/source/configuration/reference/ironic-python-agent.rst
@@ -261,6 +261,9 @@ The following options configure the source of Ironic Python Agent images for
 inspection and deployment.  Consult the :ironic-python-agent-doc:`Ironic Python
 Agent documentation <>` for full details.
 
+``ipa_images_upstream_os``
+    OS version of upstream Ironic deployment image files. Valid options are
+    ``centos9`` and ``centos10``. Default is ``centos10``.
 ``ipa_images_upstream_url_suffix``
     Suffix of upstream Ironic deployment image files. Default is based on
     ``{{ openstack_branch }}``.
@@ -269,8 +272,8 @@ Agent documentation <>` for full details.
     ``ipa.kernel``.
 ``ipa_kernel_upstream_url``
     URL of Ironic deployment kernel image to download. Default is
-    ``https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos9{{
-    ipa_images_upstream_url_suffix }}.kernel``.
+    ``https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-{{
+    ipa_images_upstream_os }}{{ ipa_images_upstream_url_suffix }}.kernel``.
 ``ipa_kernel_checksum_url``
     URL of checksum of Ironic deployment kernel image. Default is ``{{
     ipa_kernel_upstream_url }}.{{ ipa_kernel_checksum_algorithm }}``.
@@ -282,8 +285,8 @@ Agent documentation <>` for full details.
     ``ipa.initramfs``.
 ``ipa_ramdisk_upstream_url``
     URL of Ironic deployment ramdisk image to download. Default is
-    ``https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos9{{
-    ipa_images_upstream_url_suffix }}.initramfs``.
+    ``https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-{{
+    ipa_images_upstream_os }}{{ ipa_images_upstream_url_suffix }}.initramfs``.
 ``ipa_ramdisk_checksum_url``
     URL of checksum of Ironic deployment ramdisk image. Default is ``{{
     ipa_ramdisk_upstream_url }}.{{ ipa_ramdisk_checksum_algorithm }}``.
diff --git a/etc/kayobe/hostname.yml b/etc/kayobe/hostname.yml
index 34b4b420c..07312a870 100644
--- a/etc/kayobe/hostname.yml
+++ b/etc/kayobe/hostname.yml
@@ -7,3 +7,7 @@
 
 # Custom hostname to set. Default is "{{ inventory_hostname }}".
 #kayobe_custom_hostname:
+
+###############################################################################
+# Dummy variable to allow Ansible to accept this file.
+workaround_ansible_issue_8743: yes
diff --git a/etc/kayobe/ipa.yml b/etc/kayobe/ipa.yml
index 093a425c5..27303a4d2 100644
--- a/etc/kayobe/ipa.yml
+++ b/etc/kayobe/ipa.yml
@@ -88,6 +88,10 @@
 ###############################################################################
 # Ironic Python Agent (IPA) images configuration.
 
+# OS version of upstream Ironic deployment image files. Valid options are
+# "centos9" and "centos10". Default is "centos10".
+#ipa_images_upstream_os:
+
 # Suffix of upstream Ironic deployment image files. Default is based on
 # {{ openstack_branch }}.
 #ipa_images_upstream_url_suffix:
diff --git a/etc/kayobe/ironic.yml b/etc/kayobe/ironic.yml
index 442c5411f..74c3091ec 100644
--- a/etc/kayobe/ironic.yml
+++ b/etc/kayobe/ironic.yml
@@ -100,6 +100,11 @@
 # Name of the Neutron network to use for provisioning.
 #kolla_ironic_provisioning_network:
 
+# Address of the Ironic Python Agent (IPA) NTP server. The default value maps
+# to the IP address of each controller on the internal API, which should be
+# running chronyd.
+#kolla_ironic_ntp_server:
+
 # List of default kernel parameters to append for baremetal PXE boot.
 #kolla_ironic_pxe_append_params_default:
 
diff --git a/etc/kayobe/kolla.yml b/etc/kayobe/kolla.yml
index 9ff4f8c4a..a0ae36a73 100644
--- a/etc/kayobe/kolla.yml
+++ b/etc/kayobe/kolla.yml
@@ -308,6 +308,7 @@
 #kolla_enable_cinder_backend_pure_nvme_tcp:
 #kolla_enable_cinder_backend_pure_roce:
 #kolla_enable_cinder_backend_quobyte:
+#kolla_enable_cinder_backend_vast:
 #kolla_enable_cinder_backup:
 #kolla_enable_cinder_horizon_policy_file:
 #kolla_enable_cloudkitty:
@@ -369,6 +370,7 @@
 #kolla_enable_manila_backend_generic:
 #kolla_enable_manila_backend_glusterfs_nfs:
 #kolla_enable_manila_backend_hnas:
+#kolla_enable_manila_backend_vast:
 #kolla_enable_mariabackup:
 #kolla_enable_mariadb:
 #kolla_enable_masakari:
diff --git a/etc/kayobe/openstack.yml b/etc/kayobe/openstack.yml
index 1acfd0756..d4a919d40 100644
--- a/etc/kayobe/openstack.yml
+++ b/etc/kayobe/openstack.yml
@@ -2,10 +2,10 @@
 ###############################################################################
 # OpenStack release configuration.
 
-# Name of the current OpenStack release. Default is "master".
+# Name of the current OpenStack release. Default is "2026.2".
 #openstack_release:
 
-# Name of the current OpenStack branch. Default is "master".
+# Name of the current OpenStack branch. Default is "stable/2026.2".
 #openstack_branch:
 
 ###############################################################################
diff --git a/playbooks/kayobe-seed-base/bifrost-overrides.yml.j2 b/playbooks/kayobe-seed-base/bifrost-overrides.yml.j2
index b429c01c1..c42e40a0b 100644
--- a/playbooks/kayobe-seed-base/bifrost-overrides.yml.j2
+++ b/playbooks/kayobe-seed-base/bifrost-overrides.yml.j2
@@ -1,7 +1,10 @@
 ---
-# Don't build an IPA deployment image.
+# Don't build an IPA deployment image, instead download upstream images.
 create_ipa_image: false
-download_ipa: false
+download_ipa: true
 
-# Don't build a disk image. It takes time and can be unreliable.
-create_image_via_dib: false
+# Use a CirrOS image
+use_cirros: true
+custom_deploy_image_upstream_url: https://download.cirros-cloud.net/0.5.3/cirros-0.5.3-x86_64-disk.img
+custom_deploy_image_checksum_url: https://download.cirros-cloud.net/0.5.3/MD5SUMS
+custom_deploy_image_checksum_algorithm: md5
\ No newline at end of file
diff --git a/playbooks/kayobe-seed-base/run.yml b/playbooks/kayobe-seed-base/run.yml
index 7d760d895..7cb4e8f23 100644
--- a/playbooks/kayobe-seed-base/run.yml
+++ b/playbooks/kayobe-seed-base/run.yml
@@ -10,6 +10,36 @@
         cmd: "{{ kayobe_src_dir }}/dev/seed-deploy.sh &> {{ logs_dir }}/ansible/seed-deploy"
         executable: /bin/bash
 
+    - name: Ensure test Tenks cluster is deployed
+      shell:
+        # Pass absolute source directory, since otherwise the `chdir` will
+        # cause this to fail.
+        cmd: dev/tenks-deploy-overcloud.sh '{{ tenks_src_dir }}' &> {{ logs_dir }}/ansible/tenks-deploy-overcloud
+        chdir: "{{ kayobe_src_dir }}"
+        executable: /bin/bash
+
+    - name: Perform overcloud inventory discovery
+      shell:
+        cmd: (source dev/environment-setup.sh && kayobe overcloud inventory discover) &> {{ logs_dir }}/ansible/overcloud-inventory-discover
+        chdir: "{{ kayobe_src_dir }}"
+        executable: /bin/bash
+
+    - name: Perform overcloud hardware inspection
+      shell:
+        cmd: (source dev/environment-setup.sh && kayobe overcloud hardware inspect) &> {{ logs_dir }}/ansible/overcloud-hardware-inspect
+        chdir: "{{ kayobe_src_dir }}"
+        executable: /bin/bash
+
+    - name: Perform overcloud provisioning
+      shell:
+        cmd: (source dev/environment-setup.sh && kayobe overcloud provision) &> {{ logs_dir }}/ansible/overcloud-provision
+        chdir: "{{ kayobe_src_dir }}"
+        executable: /bin/bash
+
+    - name: Test network connectivity to the overcloud host
+      shell:
+        cmd: ping -c1 -W1 192.168.33.3 &> {{ logs_dir }}/ansible/overcloud-test
+
     - block:
         # NOTE(mgoddard): The stack user cannot read the kolla source code, which
         # lives in the zuul user's home directory. Copy it to a readable location.
diff --git a/releasenotes/notes/add-default-config-for-the-ipa-ntp-server-b2ab9345e4bf524d.yaml b/releasenotes/notes/add-default-config-for-the-ipa-ntp-server-b2ab9345e4bf524d.yaml
new file mode 100644
index 000000000..6af3c57a1
--- /dev/null
+++ b/releasenotes/notes/add-default-config-for-the-ipa-ntp-server-b2ab9345e4bf524d.yaml
@@ -0,0 +1,9 @@
+---
+features:
+  - |
+    Adds default configuration to Kolla Ansible for the ``ipa-ntp-server``
+    kernel command line argument used by IPA during provisioning and cleaning.
+    Ensures correct system time during certificate creation, preventing issues
+    where Ironic fails to communicate with the Ironic Python Agent due to
+    invalid certificate timestamps. The default NTP server can be overridden by
+    changing ``kolla_ironic_ntp_server``.
diff --git a/releasenotes/notes/handle-304-in-image-download-8ceafad810dae83e.yaml b/releasenotes/notes/handle-304-in-image-download-8ceafad810dae83e.yaml
new file mode 100644
index 000000000..adf5cd0c4
--- /dev/null
+++ b/releasenotes/notes/handle-304-in-image-download-8ceafad810dae83e.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Fixes an error when downloading already downloaded VM images caused by HTTP
+    304 Not Modified.
+    `LP#2170208 <https://bugs.launchpad.net/kayobe/+bug/2170208>`__
diff --git a/releasenotes/notes/ipa-centos10-68d14814840f2a77.yaml b/releasenotes/notes/ipa-centos10-68d14814840f2a77.yaml
new file mode 100644
index 000000000..63e2a99e2
--- /dev/null
+++ b/releasenotes/notes/ipa-centos10-68d14814840f2a77.yaml
@@ -0,0 +1,6 @@
+---
+upgrade:
+  - |
+    When not building Ironic Python Agent (IPA) images locally, images are now
+    based on CentOS Stream 10. CentOS Stream 9 images can still be used by
+    setting ``ipa_images_upstream_os`` to ``centos9``.
diff --git a/releasenotes/notes/remove-deprecated-manage-containers-b074ff60b3f75be7.yaml b/releasenotes/notes/remove-deprecated-manage-containers-b074ff60b3f75be7.yaml
new file mode 100644
index 000000000..0a9e1ff92
--- /dev/null
+++ b/releasenotes/notes/remove-deprecated-manage-containers-b074ff60b3f75be7.yaml
@@ -0,0 +1,13 @@
+---
+upgrade:
+  - |
+    The deprecated tags ``seed-deploy-containers`` and
+    ``seed-manage-containers`` have been removed. Use the
+    ``manage-containers`` tag instead.
+  - |
+    The deprecated variables ``deploy_containers_defaults``,
+    ``deploy_containers_docker_api_timeout`` and
+    ``seed_deploy_containers_registry_attempt_login`` have been removed. Use
+    ``manage_containers_defaults``, ``manage_containers_docker_api_timeout``
+    and ``seed_manage_containers_registry_attempt_login`` respectively
+    instead.
diff --git a/releasenotes/notes/sync-kolla-feature-flags-2026-2-b945b5f6ea601f94.yaml b/releasenotes/notes/sync-kolla-feature-flags-2026-2-b945b5f6ea601f94.yaml
new file mode 100644
index 000000000..4c1052006
--- /dev/null
+++ b/releasenotes/notes/sync-kolla-feature-flags-2026-2-b945b5f6ea601f94.yaml
@@ -0,0 +1,7 @@
+upgrade:
+  - |
+    Synchronises Kayobe feature flags and inventory with Kolla Ansible
+    2026.2. The ``redis`` inventory group has been removed following
+    completion of the Redis to Valkey migration; use
+    ``kolla_enable_valkey`` instead. Redis references in the Kolla Ansible
+    ``globals.yml`` template have been updated to Valkey to match.
diff --git a/requirements.yml b/requirements.yml
index 4a71f7021..b8bf2d7e0 100644
--- a/requirements.yml
+++ b/requirements.yml
@@ -4,11 +4,11 @@ collections:
     version: 1.3.0
   - name: https://opendev.org/openstack/ansible-collection-kolla
     type: git
-    version: master
+    version: stable/2026.2
   - name: cisco.nxos
     version: 13.0.0
   - name: community.docker
-    version: 5.3.0
+    version: 5.4.0
   - name: community.network
     version: 5.1.0
   - name: dellemc.enterprise_sonic
@@ -49,7 +49,7 @@ roles:
   - src: mrlesmithjr.mdadm
     version: v0.1.9
   - src: robertdebock.fail2ban
-    version: 5.0.6
+    version: 5.0.7
   - src: singleplatform-eng.users
     version: v1.2.6
   - src: stackhpc.drac
@@ -59,7 +59,7 @@ roles:
   - src: stackhpc.libvirt-host
     version: v1.15.1
   - src: stackhpc.libvirt-vm
-    version: v1.17.1
+    version: v1.17.2
   - src: stackhpc.luks
     version: 0.4.4
   - src: stackhpc.os-ironic-state
diff --git a/tox.ini b/tox.ini
index 582a843cd..bcbf5d7db 100644
--- a/tox.ini
+++ b/tox.ini
@@ -20,7 +20,7 @@ setenv =
    OS_TEST_TIMEOUT=60
    ANSIBLE_VERBOSITY=3
 deps =
-    -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
+    -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/2026.2}
     -r{toxinidir}/requirements.txt
     -r{toxinidir}/test-requirements.txt
 commands = stestr run {posargs}
@@ -43,7 +43,7 @@ commands =
 
 [testenv:venv]
 deps =
-    -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
+    -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/2026.2}
     -r{toxinidir}/test-requirements.txt
     -r{toxinidir}/doc/requirements.txt
 commands = {posargs}
@@ -61,7 +61,7 @@ commands =
 
 [testenv:molecule]
 deps =
-    -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
+    -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/2026.2}
     -r{toxinidir}/requirements.txt
     -r{toxinidir}/molecule-requirements.txt
 commands =
@@ -131,7 +131,7 @@ commands =
 
 [testenv:docs]
 deps =
-    -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
+    -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/2026.2}
     -r{toxinidir}/doc/requirements.txt
 commands =
   rm -rf doc/build/html
diff --git a/zuul.d/jobs.yaml b/zuul.d/jobs.yaml
index 25d65a9c4..87e91dec5 100644
--- a/zuul.d/jobs.yaml
+++ b/zuul.d/jobs.yaml
@@ -9,6 +9,7 @@
       - playbooks/kayobe-tox-ansible-syntax/pre.yml
     required-projects:
       - name: openstack/ansible-collection-kolla
+    timeout: 3600
     vars:
       tox_envlist: ansible-syntax
       # Use the site's OpenDev Galaxy mirror for role/collection installs.
@@ -92,11 +93,19 @@
     required-projects:
       # Include kayobe to ensure other projects can use this job.
       - name: openstack/ansible-collection-kolla
+        # TODO(rlewandowski): Remove when kayobe stable/2026.2 exists.
+        override-checkout: stable/2026.2
       - name: openstack/kayobe
       - name: openstack/kayobe-config-dev
       - name: openstack/kolla
+        # TODO(rlewandowski): Remove when kayobe stable/2026.2 exists.
+        override-checkout: stable/2026.2
       - name: openstack/kolla-ansible
+        # TODO(rlewandowski): Remove when kayobe stable/2026.2 exists.
+        override-checkout: stable/2026.2
       - name: openstack/requirements
+        # TODO(rlewandowski): Remove when kayobe stable/2026.2 exists.
+        override-checkout: stable/2026.2
       - name: openstack/tenks
     irrelevant-files:
       - ^\..+
@@ -269,7 +278,7 @@
       Configures the primary VM as a seed.
     pre-run: playbooks/kayobe-seed-base/pre.yml
     run: playbooks/kayobe-seed-base/run.yml
-    timeout: 5400
+    timeout: 7200
     vars:
       build_images: false
 
@@ -374,7 +383,7 @@
       and upgrades it to the current release.
     pre-run: playbooks/kayobe-seed-upgrade-base/pre.yml
     run: playbooks/kayobe-seed-upgrade-base/run.yml
-    timeout: 5400
+    timeout: 7200
 
 - job:
     name: kayobe-seed-upgrade-rocky10
@@ -406,7 +415,7 @@
       as a VM.
     pre-run: playbooks/kayobe-seed-vm-base/pre.yml
     run: playbooks/kayobe-seed-vm-base/run.yml
-    timeout: 5400
+    timeout: 7200
 
 - job:
     name: kayobe-seed-vm-rocky10
@@ -464,7 +473,7 @@
       infra VM.
     pre-run: playbooks/kayobe-infra-vm-base/pre.yml
     run: playbooks/kayobe-infra-vm-base/run.yml
-    timeout: 5400
+    timeout: 7200
 
 - job:
     name: kayobe-infra-vm-rocky10