diff --git a/containers/keystone/Dockerfile b/containers/keystone/Dockerfile
index dd9e62d5c..6c8833370 100644
--- a/containers/keystone/Dockerfile
+++ b/containers/keystone/Dockerfile
@@ -1,7 +1,26 @@
 # syntax=docker/dockerfile:1
 
 ARG OPENSTACK_VERSION="required_argument"
-FROM quay.io/airshipit/keystone:${OPENSTACK_VERSION}-ubuntu_noble
+FROM quay.io/airshipit/keystone:${OPENSTACK_VERSION}-ubuntu_noble AS build
+
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+
+# renovate: name=openstack/keystone repo=https://github.com/rackerlabs/keystone.git branch=understack/2026.1
+ARG KEYSTONE_GIT_REF=f01950b7caf547970e961c076b74f6157b7bad84
+ADD --keep-git-dir=true https://github.com/rackerlabs/keystone.git#${KEYSTONE_GIT_REF} /src/keystone
+RUN git -C /src/keystone fetch --unshallow --tags
+
+ARG OPENSTACK_VERSION="required_argument"
+ADD https://releases.openstack.org/constraints/upper/${OPENSTACK_VERSION} /upper-constraints.txt
+
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv pip install \
+      --upgrade \
+      --constraint /upper-constraints.txt \
+        /src/keystone
+
+ARG OPENSTACK_VERSION="required_argument"
+FROM quay.io/airshipit/keystone:${OPENSTACK_VERSION}-ubuntu_noble AS final
 
 # renovate: datasource=github-releases depName=OpenIDC/mod_auth_openidc
 ARG MOD_AUTH_OPENIDC_VERSION=2.4.16.11
@@ -12,3 +31,6 @@ RUN apt-get update && \
     apt-get install -y --no-install-recommends \
         /tmp/libapache2-mod-auth-openidc_${MOD_AUTH_OPENIDC_VERSION}-1.noble_amd64.deb \
     && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/*.deb
+
+RUN rm -rf /var/lib/openstack
+COPY --from=build --link /var/lib/openstack /var/lib/openstack
diff --git a/containers/keystone/README.md b/containers/keystone/README.md
new file mode 100644
index 000000000..bff75d15e
--- /dev/null
+++ b/containers/keystone/README.md
@@ -0,0 +1,123 @@
+# Keystone Patches
+
+Patches are derived from cherry-picking patches to the stable series we follow.
+
+[https://github.com/rackerlabs/keystone]
+
+The branch for these are `understack/$OPENSTACK_VERSION`
+
+## To clone everything down do the following
+
+```bash
+git clone https://github.com/openstack/keystone
+git checkout --track origin/stable/2026.1
+git remote add rackerlabs https://github.com/rackerlabs/keystone
+git fetch rackerlabs
+git checkout --track rackerlabs/understack/2026.1
+```
+
+## Adding patches is done via `git cherry-pick`
+
+```bash
+git checkout understack/2026.1
+git cherry-pick GITISH_TO_PORT
+git push rackerlabs understack/2026.1
+```
+
+## Creating the next stable series
+
+```bash
+git checkout --track origin/stable/2026.2
+git checkout -b understack/2026.2
+```
+
+## Rebasing to keep things clean
+
+The `scripts/git-understack-rebase` script in the understack repo automates this: it checks your
+remotes and branches, shows you the commits involved, performs the rebase, and force-pushes both
+branches to `rackerlabs` after you confirm each step. It expects a remote named `upstream`
+(pointing at `openstack/keystone`, not `origin`) and a remote named `rackerlabs`.
+
+```bash
+scripts/git-understack-rebase ~/work/keystone 2026.1
+```
+
+### Patches that landed upstream (possibly tweaked)
+
+Before rebasing, the script checks whether any patch we carry has since landed
+in `upstream/stable/$VERSION`. It matches on the Gerrit `Change-Id:` trailer,
+which survives cherry-picking, so it recognizes our copy of a change even if the
+content drifted. It then splits the matches into two groups:
+
+- **identical** — same content as upstream. `git rebase` drops these on its own;
+  the script just tells you it happened.
+- **MODIFIED** — same `Change-Id` but the content differs. A patch that was
+  cherry-picked and then tweaked (e.g. a reworded release note) before it merged
+  upstream cannot be dropped by git via patch-id, so it conflicts on rebase.
+
+For the MODIFIED group the script prompts you. The default is to **drop them and
+keep upstream's version** (done by scripting an interactive rebase to mark those
+commits `drop`). If you decline, they are replayed as-is and you resolve the
+conflicts by hand, preferring upstream. Either way you are told exactly which
+commits are involved before anything is rewritten.
+
+To do it manually instead:
+
+```bash
+git checkout stable/2026.1
+git pull -p
+git checkout understack/2026.1
+git rebase stable/2026.1
+git push rackerlabs understack/2026.1
+```
+
+## Updating the container
+
+```bash
+git checkout understack/2026.1
+git show
+# ensure KEYSTONE_GIT_REF in the Dockerfile matches
+```
+
+## Backporting patches from upstream master
+
+To backport a patch from upstream master (or another branch) to understack/2026.1:
+
+```bash
+# Fetch all branches from upstream (openstack/keystone)
+# This fetches master, stable branches, and all other refs
+git fetch origin
+
+# Fetch all branches from rackerlabs fork
+git fetch rackerlabs
+
+# Checkout the understack branch
+git checkout understack/2026.1
+
+# Cherry-pick the commit from master
+# You can get the commit hash from the PR or upstream repository
+git cherry-pick <UPSTREAM_COMMIT_HASH>
+
+# If there are conflicts, resolve them:
+git add <conflicted-files>
+git cherry-pick --continue
+
+# Push to rackerlabs fork
+git push rackerlabs understack/2026.1
+```
+
+### Example workflow for a specific PR
+
+Following the backporting workflow above results in a PR like https://github.com/rackerlabs/keystone/pull/XXX:
+
+1. Find the commit hash from upstream master
+2. Cherry-pick it to the branch: `git cherry-pick <COMMIT_HASH>`
+3. Resolve any conflicts if needed
+4. Test the changes locally
+5. Push to the rackerlabs understack branch
+
+### Note on patch sources
+
+Patches can come from:
+- OpenStack upstream master branch (`openstack/keystone` - origin/master)
+- Other branches or forks that have fixes needed
diff --git a/docs/contributing/index.md b/docs/contributing/index.md
index 83b7d87c3..abb48f648 100644
--- a/docs/contributing/index.md
+++ b/docs/contributing/index.md
@@ -33,7 +33,7 @@ links open the current version on GitHub:
 | Go operators and CLIs | [understackctl][go-understackctl], [dexop][go-dexop], [nautobotop][go-nautobotop], [Ironic hardware exporter][go-ihe] |
 | Helm charts | [ArgoCD UnderStack chart][chart-argocd], [site workflows][chart-workflows] |
 | Ansible | [Playbooks and roles][ansible] |
-| Containers | [Ironic][container-ironic], [Nautobot][container-nautobot], [Neutron][container-neutron], [Nova][container-nova] |
+| Containers | [Ironic][container-ironic], [Keystone][container-keystone], [Nautobot][container-nautobot], [Neutron][container-neutron], [Nova][container-nova] |
 | End-to-end tests | [understack-tests][tests] |
 
 Python packages use [uv](https://docs.astral.sh/uv/) with `pytest` and `ruff`;
@@ -75,6 +75,7 @@ Two things to know before you add a page:
 [chart-workflows]: https://github.com/rackerlabs/understack/blob/main/charts/site-workflows/README.md
 [ansible]: https://github.com/rackerlabs/understack/blob/main/ansible/README.md
 [container-ironic]: https://github.com/rackerlabs/understack/blob/main/containers/ironic/README.md
+[container-keystone]: https://github.com/rackerlabs/understack/blob/main/containers/keystone/README.md
 [container-nautobot]: https://github.com/rackerlabs/understack/blob/main/containers/nautobot/README.md
 [container-neutron]: https://github.com/rackerlabs/understack/blob/main/containers/neutron/README.md
 [container-nova]: https://github.com/rackerlabs/understack/blob/main/containers/nova/README.md