diff --git a/ansible/compute-libvirt-host.yml b/ansible/compute-libvirt-host.yml
index 99f8988ed..7700f2cbb 100644
--- a/ansible/compute-libvirt-host.yml
+++ b/ansible/compute-libvirt-host.yml
@@ -15,7 +15,7 @@
         state: present
       when:
         - compute_libvirt_enabled | bool
-        - ansible_facts.distribution in ['CentOS', 'Rocky']
+        - ansible_facts.distribution == 'Rocky'
         - compute_libvirt_ceph_repo_install | bool
       become: true
 
diff --git a/ansible/inventory/group_vars/all/compute b/ansible/inventory/group_vars/all/compute
index 4a2f399b1..27c508a7e 100644
--- a/ansible/inventory/group_vars/all/compute
+++ b/ansible/inventory/group_vars/all/compute
@@ -3,9 +3,8 @@
 # Compute node configuration.
 
 # User with which to access the compute nodes via SSH during bootstrap, in
-# order to setup the Kayobe user account. Default is 'cloud-user' if
-# os_distribution is set to centos, otherwise {{ os_distribution }}.
-compute_bootstrap_user: "{{ 'cloud-user' if os_distribution == 'centos' else os_distribution }}"
+# order to setup the Kayobe user account. Default is {{ os_distribution }}.
+compute_bootstrap_user: "{{ os_distribution }}"
 
 ###############################################################################
 # Compute network interface configuration.
@@ -255,11 +254,11 @@ compute_libvirt_sasl_password:
 # Whether to enable a libvirt TLS listener. Default is false.
 compute_libvirt_enable_tls: false
 
-# Whether to install a Ceph package repository on CentOS and Rocky hosts.
+# Whether to install a Ceph package repository on Rocky Linux hosts.
 # Default is true.
 compute_libvirt_ceph_repo_install: true
 
-# Ceph package repository release to install on CentOS and Rocky hosts when
+# Ceph package repository release to install on Rocky Linux hosts when
 # compute_libvirt_ceph_repo_install is true. Default is 'squid'.
 compute_libvirt_ceph_repo_release: squid
 
diff --git a/ansible/inventory/group_vars/all/controllers b/ansible/inventory/group_vars/all/controllers
index a0cffca4b..32e9470ce 100644
--- a/ansible/inventory/group_vars/all/controllers
+++ b/ansible/inventory/group_vars/all/controllers
@@ -3,9 +3,8 @@
 # Controller node configuration.
 
 # User with which to access the controllers via SSH during bootstrap, in order
-# to setup the Kayobe user account. Default is 'cloud-user' if os_distribution
-# is set to centos, otherwise {{ os_distribution }}.
-controller_bootstrap_user: "{{ 'cloud-user' if os_distribution == 'centos' else os_distribution }}"
+# to setup the Kayobe user account. Default is {{ os_distribution }}.
+controller_bootstrap_user: "{{ os_distribution }}"
 
 ###############################################################################
 # Controller groups.
diff --git a/ansible/inventory/group_vars/all/dnf b/ansible/inventory/group_vars/all/dnf
index 01bcd8375..4ab29c358 100644
--- a/ansible/inventory/group_vars/all/dnf
+++ b/ansible/inventory/group_vars/all/dnf
@@ -12,12 +12,6 @@ dnf_config: {}
 # Whether or not to use a local DNF mirror. Default value is 'false'.
 dnf_use_local_mirror: false
 
-# Mirror FQDN for DNF CentOS repos. Default value is 'mirror.stream.centos.org'.
-dnf_centos_mirror_host: 'mirror.stream.centos.org'
-
-# Mirror directory for DNF CentOS repos. Default value is ''.
-dnf_centos_mirror_directory: ''
-
 # Mirror FQDN for DNF Rocky repos. Default value is 'dl.rockylinux.org'.
 dnf_rocky_mirror_host: 'dl.rockylinux.org'
 
diff --git a/ansible/inventory/group_vars/all/globals b/ansible/inventory/group_vars/all/globals
index 085ef0e10..868e1ff59 100644
--- a/ansible/inventory/group_vars/all/globals
+++ b/ansible/inventory/group_vars/all/globals
@@ -51,14 +51,13 @@ kayobe_ansible_user: "stack"
 ###############################################################################
 # OS distribution.
 
-# OS distribution name. Valid options are "centos", "rocky", "ubuntu". Default
-# is "rocky".
+# OS distribution name. Valid options are "rocky" and "ubuntu". Default is
+# "rocky".
 os_distribution: "rocky"
 
-# Mapping from OS distribution name to OS family. Supported keys are
-# "centos", "rocky", and "ubuntu".
+# Mapping from OS distribution name to OS family. Supported keys are "rocky"
+# and "ubuntu".
 os_family_map:
-  centos: RedHat
   rocky: RedHat
   ubuntu: Debian
 
@@ -66,12 +65,10 @@ os_family_map:
 # os_distribution.
 os_family: "{{ os_family_map[os_distribution | lower] }}"
 
-# OS release. Valid options are "10-stream" when os_distribution is "centos",
-# "10" when os_distribution is "rocky", or "noble" when os_distribution is
-# "ubuntu".
+# OS release. Valid options are "10" when os_distribution is "rocky", or
+# "noble" when os_distribution is "ubuntu".
 os_release: >-
-  {{ '10-stream' if os_distribution == 'centos'
-  else '10' if os_distribution == 'rocky'
+  {{ '10' if os_distribution == 'rocky'
   else 'noble' }}
 
 ###############################################################################
diff --git a/ansible/inventory/group_vars/all/infra-vms b/ansible/inventory/group_vars/all/infra-vms
index 16439ece9..b0f578db6 100644
--- a/ansible/inventory/group_vars/all/infra-vms
+++ b/ansible/inventory/group_vars/all/infra-vms
@@ -42,18 +42,14 @@ infra_vm_root_format: qcow2
 
 # Base image for the infra VM root volume. Default is
 # "https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img"
-# when os_distribution is "ubuntu",
+# when os_distribution is "ubuntu", or
 # "https://dl.rockylinux.org/pub/rocky/10/images/x86_64/Rocky-10-GenericCloud-Base.latest.x86_64.qcow2"
-# when os_distribution is "rocky", or
-# "https://cloud.centos.org/centos/10-stream/x86_64/images/CentOS-Stream-GenericCloud-x86_64-10-latest.x86_64.qcow2"
 # otherwise.
 infra_vm_root_image: >-
   {%- if os_distribution == 'ubuntu' %}
   https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img
-  {%- elif os_distribution == 'rocky' %}
-  https://dl.rockylinux.org/pub/rocky/10/images/x86_64/Rocky-10-GenericCloud-Base.latest.x86_64.qcow2
   {%- else -%}
-  https://cloud.centos.org/centos/10-stream/x86_64/images/CentOS-Stream-GenericCloud-x86_64-10-latest.x86_64.qcow2
+  https://dl.rockylinux.org/pub/rocky/10/images/x86_64/Rocky-10-GenericCloud-Base.latest.x86_64.qcow2
   {%- endif %}
 
 # Capacity of the infra VM data volume.
@@ -73,7 +69,7 @@ infra_vm_hypervisor: "{{ groups['seed-hypervisor'] | first }}"
 infra_vm_wait_connection_ssh_extra_args: '-o StrictHostKeyChecking=no'
 
 # OS family. Needed for config drive generation.
-infra_vm_os_family: "{{ 'RedHat' if os_distribution in ['centos', 'rocky'] else 'Debian' }}"
+infra_vm_os_family: "{{ 'RedHat' if os_distribution == 'rocky' else 'Debian' }}"
 
 # Boot firmware. Possible values are 'bios' or 'efi'. Default is 'efi'.
 infra_vm_boot_firmware: "efi"
@@ -85,9 +81,8 @@ infra_vm_machine:
 # Infrastructure VM node configuration.
 
 # User with which to access the infrastructure vm via SSH during bootstrap, in
-# order to setup the Kayobe user account. Default is 'cloud-user' if
-# os_distribution is set to centos, otherwise {{ os_distribution }}.
-infra_vm_bootstrap_user: "{{ 'cloud-user' if os_distribution == 'centos' else os_distribution }}"
+# order to setup the Kayobe user account. Default is {{ os_distribution }}.
+infra_vm_bootstrap_user: "{{ os_distribution }}"
 
 ###############################################################################
 # Infrastructure VM network interface configuration.
diff --git a/ansible/inventory/group_vars/all/kolla b/ansible/inventory/group_vars/all/kolla
index e21f89767..d626df0bd 100644
--- a/ansible/inventory/group_vars/all/kolla
+++ b/ansible/inventory/group_vars/all/kolla
@@ -56,14 +56,13 @@ kolla_node_custom_config_path: "{{ kolla_config_path }}/config"
 # Default is "{{ ansible_facts.architecture }}"
 kolla_base_arch: "{{ ansible_facts.architecture }}"
 
-# Kolla base container image distribution. Options are "centos", "debian",
-# "rocky", "ubuntu". Default is {{ os_distribution }}.
+# Kolla base container image distribution. Options are "debian", "rocky",
+# "ubuntu". Default is {{ os_distribution }}.
 kolla_base_distro: "{{ os_distribution }}"
 
 # Kolla base container image distribution version default map.
 # Defines default versions for each distribution.
 kolla_base_distro_version_default_map: {
-  "centos": "stream10",
   "debian": "bookworm",
   "rocky": "10",
   "ubuntu": "noble",
@@ -696,4 +695,4 @@ kolla_no_proxy: "{{ no_proxy }}"
 
 ##############################################################################
 # Inspector configuration
-kolla_inspector_enable_discovery: "{{ inspector_enable_discovery | bool }}"
\ No newline at end of file
+kolla_inspector_enable_discovery: "{{ inspector_enable_discovery | bool }}"
diff --git a/ansible/inventory/group_vars/all/seed b/ansible/inventory/group_vars/all/seed
index 261b8b747..3dc104904 100644
--- a/ansible/inventory/group_vars/all/seed
+++ b/ansible/inventory/group_vars/all/seed
@@ -3,9 +3,8 @@
 # Seed node configuration.
 
 # User with which to access the seed via SSH during bootstrap, in order to
-# setup the Kayobe user account. Default is 'cloud-user' if os_distribution is
-# set to centos, otherwise {{ os_distribution }}.
-seed_bootstrap_user: "{{ 'cloud-user' if os_distribution == 'centos' else os_distribution }}"
+# setup the Kayobe user account. Default is {{ os_distribution }}.
+seed_bootstrap_user: "{{ os_distribution }}"
 
 ###############################################################################
 # Seed network interface configuration.
diff --git a/ansible/inventory/group_vars/all/seed-hypervisor b/ansible/inventory/group_vars/all/seed-hypervisor
index 67b2f352f..1b899dcfc 100644
--- a/ansible/inventory/group_vars/all/seed-hypervisor
+++ b/ansible/inventory/group_vars/all/seed-hypervisor
@@ -3,9 +3,8 @@
 # Seed hypervisor node configuration.
 
 # User with which to access the seed hypervisor via SSH during bootstrap, in
-# order to setup the Kayobe user account. Default is 'cloud-user' if
-# os_distribution is set to centos, otherwise {{ os_distribution }}.
-seed_hypervisor_bootstrap_user: "{{ 'cloud-user' if os_distribution == 'centos' else os_distribution }}"
+# order to setup the Kayobe user account. Default is {{ os_distribution }}.
+seed_hypervisor_bootstrap_user: "{{ os_distribution }}"
 
 ###############################################################################
 # Seed hypervisor network interface configuration.
diff --git a/ansible/inventory/group_vars/all/seed-vm b/ansible/inventory/group_vars/all/seed-vm
index 73c50ed73..e61406394 100644
--- a/ansible/inventory/group_vars/all/seed-vm
+++ b/ansible/inventory/group_vars/all/seed-vm
@@ -42,18 +42,14 @@ seed_vm_root_format: qcow2
 
 # Base image for the seed VM root volume. Default is
 # "https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img"
-# when os_distribution is "ubuntu",
+# when os_distribution is "ubuntu", or
 # "https://dl.rockylinux.org/pub/rocky/10/images/x86_64/Rocky-10-GenericCloud-Base.latest.x86_64.qcow2"
-# when os_distribution is "rocky", or
-# "https://cloud.centos.org/centos/10-stream/x86_64/images/CentOS-Stream-GenericCloud-x86_64-10-latest.x86_64.qcow2"
 # otherwise.
 seed_vm_root_image: >-
   {%- if os_distribution == 'ubuntu' %}
   https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img
-  {%- elif os_distribution == 'rocky' %}
-  https://dl.rockylinux.org/pub/rocky/10/images/x86_64/Rocky-10-GenericCloud-Base.latest.x86_64.qcow2
   {%- else -%}
-  https://cloud.centos.org/centos/10-stream/x86_64/images/CentOS-Stream-GenericCloud-x86_64-10-latest.x86_64.qcow2
+  https://dl.rockylinux.org/pub/rocky/10/images/x86_64/Rocky-10-GenericCloud-Base.latest.x86_64.qcow2
   {%- endif %}
 
 # Capacity of the seed VM data volume.
diff --git a/ansible/inventory/group_vars/all/storage b/ansible/inventory/group_vars/all/storage
index fce656df8..4c08ec771 100644
--- a/ansible/inventory/group_vars/all/storage
+++ b/ansible/inventory/group_vars/all/storage
@@ -3,9 +3,8 @@
 # Storage node configuration.
 
 # User with which to access the storage nodes via SSH during bootstrap, in
-# order to setup the Kayobe user account. Default is 'cloud-user' if
-# os_distribution is set to centos, otherwise {{ os_distribution }}.
-storage_bootstrap_user: "{{ 'cloud-user' if os_distribution == 'centos' else os_distribution }}"
+# order to setup the Kayobe user account. Default is {{ os_distribution }}.
+storage_bootstrap_user: "{{ os_distribution }}"
 
 ###############################################################################
 # Storage network interface configuration.
diff --git a/ansible/roles/alliedware-plus-switch/tasks/main.yml b/ansible/roles/alliedware-plus-switch/tasks/main.yml
index ceb0d434c..be27a7d10 100644
--- a/ansible/roles/alliedware-plus-switch/tasks/main.yml
+++ b/ansible/roles/alliedware-plus-switch/tasks/main.yml
@@ -1,6 +1,7 @@
 ---
 - name: Ensure AlliedWare Plus switches are configured
   alliedtelesis.awplus.awplus_config:
+    diff_against: "running"
     lines: "{{ lookup('template', 'alliedware-plus-config.j2') }}"
     save_when: >-
       {{ alliedware_plus_switch_save | bool | ternary('modified', 'never') }}
diff --git a/ansible/roles/bootstrap/tasks/main.yml b/ansible/roles/bootstrap/tasks/main.yml
index 802fb9889..f62a6ddd8 100644
--- a/ansible/roles/bootstrap/tasks/main.yml
+++ b/ansible/roles/bootstrap/tasks/main.yml
@@ -16,7 +16,7 @@
     key: "{{ lookup('file', bootstrap_ssh_private_key_path ~ '.pub') }}"
 
 # NOTE(priteau): Exclude comments from ssh-keyscan output because they break
-# known_hosts on centos/rocky 10.
+# known_hosts on Rocky Linux 10.
 - name: Scan for SSH keys
   shell: ssh-keyscan {{ item }} | grep -v '^#'
   with_items:
diff --git a/ansible/roles/dnf/defaults/main.yml b/ansible/roles/dnf/defaults/main.yml
index 24bc4acf1..e62bb08f0 100644
--- a/ansible/roles/dnf/defaults/main.yml
+++ b/ansible/roles/dnf/defaults/main.yml
@@ -7,12 +7,6 @@ dnf_config: {}
 # Whether or not to use a local DNF mirror.
 dnf_use_local_mirror: false
 
-# Mirror FQDN for DNF CentOS repos. Default value is 'mirror.stream.centos.org'.
-dnf_centos_mirror_host: 'mirror.stream.centos.org'
-
-# Mirror directory for DNF CentOS repos. Default value is ''.
-dnf_centos_mirror_directory: ''
-
 # Mirror FQDN for DNF Rocky repos. Default value is 'dl.rockylinux.org'.
 dnf_rocky_mirror_host: 'dl.rockylinux.org'
 
diff --git a/ansible/roles/dnf/tasks/local-mirror.yml b/ansible/roles/dnf/tasks/local-mirror.yml
index f7726b964..bb3fea31e 100644
--- a/ansible/roles/dnf/tasks/local-mirror.yml
+++ b/ansible/roles/dnf/tasks/local-mirror.yml
@@ -1,5 +1,5 @@
 ---
-- name: Copy Rocky/CentOS repo templates
+- name: Copy Rocky Linux repo templates
   vars:
     repo_file_prefix: "{{ ansible_facts.distribution | lower }}"
   template:
diff --git a/ansible/roles/dnf/templates/centos-addons.repo.j2 b/ansible/roles/dnf/templates/centos-addons.repo.j2
deleted file mode 100644
index 88d33e84e..000000000
--- a/ansible/roles/dnf/templates/centos-addons.repo.j2
+++ /dev/null
@@ -1,130 +0,0 @@
-[highavailability]
-name=CentOS Stream $releasever - HighAvailability
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/HighAvailability/$basearch/os/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-countme=1
-enabled=0
-
-[highavailability-debuginfo]
-name=CentOS Stream $releasever - HighAvailability - Debug
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/HighAvailability/debug/$basearch/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-enabled=0
-
-[highavailability-source]
-name=CentOS Stream $releasever - HighAvailability - Source
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/HighAvailability/source/tree/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-enabled=0
-
-[nfv]
-name=CentOS Stream $releasever - NFV
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/NFV/$basearch/os/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-countme=1
-enabled=0
-
-[nfv-debuginfo]
-name=CentOS Stream $releasever - NFV - Debug
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/NFV/debug/$basearch/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-enabled=0
-
-[nfv-source]
-name=CentOS Stream $releasever - NFV - Source
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/NFV/source/tree/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-enabled=0
-
-[rt]
-name=CentOS Stream $releasever - RT
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/RT/$basearch/os/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-countme=1
-enabled=0
-
-[rt-debuginfo]
-name=CentOS Stream $releasever - RT - Debug
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/RT/debug/$basearch/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-enabled=0
-
-[rt-source]
-name=CentOS Stream $releasever - RT - Source
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/RT/source/tree/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-enabled=0
-
-[resilientstorage]
-name=CentOS Stream $releasever - ResilientStorage
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/ResilientStorage/$basearch/os/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-countme=1
-enabled=0
-
-[resilientstorage-debuginfo]
-name=CentOS Stream $releasever - ResilientStorage - Debug
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/ResilientStorage/debug/$basearch/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-enabled=0
-
-[resilientstorage-source]
-name=CentOS Stream $releasever - ResilientStorage - Source
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/ResilientStorage/source/tree/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-enabled=0
-
-[extras-common]
-name=CentOS Stream $releasever - Extras packages
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/SIGs/$stream/extras/$basearch/extras-common/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Extras-SHA512
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-countme=1
-enabled=1
-
-[extras-common-source]
-name=CentOS Stream $releasever - Extras packages - Source
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/SIGs/$stream/extras/source/extras-common/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Extras-SHA512
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-enabled=0
diff --git a/ansible/roles/dnf/templates/centos.repo.j2 b/ansible/roles/dnf/templates/centos.repo.j2
deleted file mode 100644
index 2451bc9cb..000000000
--- a/ansible/roles/dnf/templates/centos.repo.j2
+++ /dev/null
@@ -1,83 +0,0 @@
-[baseos]
-name=CentOS Stream $releasever - BaseOS
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/BaseOS/$basearch/os/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-countme=1
-enabled=1
-
-[baseos-debuginfo]
-name=CentOS Stream $releasever - BaseOS - Debug
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/BaseOS/debug/$basearch/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-enabled=0
-
-[baseos-source]
-name=CentOS Stream $releasever - BaseOS - Source
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/BaseOS/source/tree/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-enabled=0
-
-[appstream]
-name=CentOS Stream $releasever - AppStream
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/AppStream/$basearch/os/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-countme=1
-enabled=1
-
-[appstream-debuginfo]
-name=CentOS Stream $releasever - AppStream - Debug
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/AppStream/debug/$basearch/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-enabled=0
-
-[appstream-source]
-name=CentOS Stream $releasever - AppStream - Source
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/AppStream/source/tree/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-enabled=0
-
-[crb]
-name=CentOS Stream $releasever - CRB
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/CRB/$basearch/os/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-countme=1
-enabled=0
-
-[crb-debuginfo]
-name=CentOS Stream $releasever - CRB - Debug
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/CRB/debug/$basearch/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-enabled=0
-
-[crb-source]
-name=CentOS Stream $releasever - CRB - Source
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/CRB/source/tree/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256
-gpgcheck=1
-repo_gpgcheck=0
-metadata_expire=6h
-enabled=0
diff --git a/ansible/roles/kolla-ansible/defaults/main.yml b/ansible/roles/kolla-ansible/defaults/main.yml
index a044b5d53..0484502d8 100644
--- a/ansible/roles/kolla-ansible/defaults/main.yml
+++ b/ansible/roles/kolla-ansible/defaults/main.yml
@@ -138,7 +138,7 @@ kolla_overcloud_inventory_kolla_top_level_groups: []
 ###############################################################################
 # Kolla-ansible global configuration options.
 
-# Valid options are [ centos, debian, rocky, ubuntu ]
+# Valid options are [ debian, rocky, ubuntu ]
 kolla_base_distro:
 
 # Kolla base container image distribution version.
diff --git a/ansible/roles/kolla-ansible/templates/kolla/globals.yml b/ansible/roles/kolla-ansible/templates/kolla/globals.yml
index ddd18b2b7..577f6c988 100644
--- a/ansible/roles/kolla-ansible/templates/kolla/globals.yml
+++ b/ansible/roles/kolla-ansible/templates/kolla/globals.yml
@@ -11,7 +11,7 @@
 # Valid options are [ COPY_ONCE, COPY_ALWAYS ]
 config_strategy: "COPY_ALWAYS"
 
-# Valid options are ['centos', 'debian', 'rocky', 'ubuntu']
+# Valid options are ['debian', 'rocky', 'ubuntu']
 kolla_base_distro: "{{ kolla_base_distro }}"
 
 kolla_base_distro_version: "{{ kolla_base_distro_version }}"
diff --git a/ansible/roles/kolla-build/defaults/main.yml b/ansible/roles/kolla-build/defaults/main.yml
index a6673be79..4dfea3301 100644
--- a/ansible/roles/kolla-build/defaults/main.yml
+++ b/ansible/roles/kolla-build/defaults/main.yml
@@ -15,7 +15,7 @@ kolla_build_config_paths: "{{ kolla_build_config_paths_default + kolla_build_con
 # Valid options are [ x86_64, aarch64 ]
 kolla_base_arch:
 
-# Valid options are [ centos, debian, rocky, ubuntu ]
+# Valid options are [ debian, rocky, ubuntu ]
 kolla_base_distro:
 
 # Kolla base container image tag.
diff --git a/ansible/roles/ssh-known-host/tasks/main.yml b/ansible/roles/ssh-known-host/tasks/main.yml
index 75257f71c..c3ca072c9 100644
--- a/ansible/roles/ssh-known-host/tasks/main.yml
+++ b/ansible/roles/ssh-known-host/tasks/main.yml
@@ -14,7 +14,7 @@
   when: not ansible_host | default(inventory_hostname)
 
 # NOTE(priteau): Exclude comments from ssh-keyscan output because they break
-# known_hosts on centos/rocky 10.
+# known_hosts on Rocky Linux 10.
 - name: Scan for SSH keys
   delegate_to: localhost
   shell: ssh-keyscan {{ item }} | grep -v '^#'
diff --git a/dev/functions b/dev/functions
index 57c343654..2a282a819 100644
--- a/dev/functions
+++ b/dev/functions
@@ -105,12 +105,6 @@ function config_defaults {
 
     # Log directory in case of errors
     export LOGDIR=${LOGDIR:-}
-
-    # Test with broken conditionals support disabled. We do not want to allow
-    # new upstream code to add broken conditionals, but want to continue to
-    # enable ANSIBLE_ALLOW_BROKEN_CONDITIONALS by default for a period of time
-    # so that users have a chance to update their playbooks.
-    export ANSIBLE_ALLOW_BROKEN_CONDITIONALS=${ANSIBLE_ALLOW_BROKEN_CONDITIONALS:-false}
 }
 
 function config_set {
@@ -146,28 +140,17 @@ function config_init {
 # Installation
 
 function is_dnf {
-    if [[ -e /etc/centos-release || -e /etc/rocky-release ]]; then
+    if [[ -e /etc/rocky-release ]]; then
         command -v dnf >/dev/null 2>&1
     else
         return 1
     fi
 }
 
-function is_yum {
-    if [[ -e /etc/centos-release || -e /etc/rocky-release ]]; then
-        command -v yum >/dev/null 2>&1
-    else
-        return 1
-    fi
-}
-
 function install_dependencies {
     echo "Installing package dependencies for kayobe"
     if is_dnf; then
         sudo dnf -y install gcc git vim python3-devel python3-pyyaml libffi-devel
-    elif is_yum; then
-        echo "CentOS 7 is no longer supported"
-        exit 1
     else
         sudo apt update
         sudo apt install -y python-is-python3 python3-dev python3-venv gcc git libffi-dev
@@ -497,7 +480,7 @@ function overcloud_deploy {
             sudo cp $ca_cert "/usr/local/share/ca-certificates/kayobe-customca.crt"
             sudo update-ca-certificates
         elif [[ -e /etc/redhat-release ]]; then
-            # CentOS
+            # Rocky Linux
             sudo cp $ca_cert "/etc/pki/ca-trust/source/anchors/kayobe-customca.crt"
             sudo update-ca-trust
         fi
diff --git a/doc/source/administration/ansible-control.rst b/doc/source/administration/ansible-control.rst
index 21c3f0dbc..02cc83f94 100644
--- a/doc/source/administration/ansible-control.rst
+++ b/doc/source/administration/ansible-control.rst
@@ -10,9 +10,9 @@ It is possible to update packages on the Ansible control host.
 Package Repositories
 --------------------
 
-If using custom DNF package repositories on CentOS or Rocky, it may be
-necessary to update these prior to running a package update. To do this, update
-the configuration in ``${KAYOBE_CONFIG_PATH}/dnf.yml`` and run the following
+If using custom DNF package repositories on Rocky Linux, it may be necessary to
+update these prior to running a package update. To do this, update the
+configuration in ``${KAYOBE_CONFIG_PATH}/dnf.yml`` and run the following
 command::
 
     (kayobe) $ kayobe control host configure --tags dnf
diff --git a/doc/source/administration/infra-vms.rst b/doc/source/administration/infra-vms.rst
index 71e9993ac..b57492f87 100644
--- a/doc/source/administration/infra-vms.rst
+++ b/doc/source/administration/infra-vms.rst
@@ -26,9 +26,9 @@ It is possible to update packages on the infrastructure VMs.
 Package Repositories
 --------------------
 
-If using custom DNF package repositories on CentOS or Rocky, it may be
-necessary to update these prior to running a package update. To do this, update
-the configuration in ``${KAYOBE_CONFIG_PATH}/dnf.yml`` and run the following
+If using custom DNF package repositories on Rocky Linux, it may be necessary to
+update these prior to running a package update. To do this, update the
+configuration in ``${KAYOBE_CONFIG_PATH}/dnf.yml`` and run the following
 command::
 
     (kayobe) $ kayobe infra vm host configure --tags dnf
diff --git a/doc/source/administration/overcloud.rst b/doc/source/administration/overcloud.rst
index 871c07b85..a5433d5f3 100644
--- a/doc/source/administration/overcloud.rst
+++ b/doc/source/administration/overcloud.rst
@@ -10,9 +10,9 @@ It is possible to update packages on the overcloud hosts.
 Package Repositories
 --------------------
 
-If using custom DNF package repositories on CentOS or Rocky, it may be
-necessary to update these prior to running a package update. To do this, update
-the configuration in ``${KAYOBE_CONFIG_PATH}/dnf.yml`` and run the following
+If using custom DNF package repositories on Rocky Linux, it may be necessary to
+update these prior to running a package update. To do this, update the
+configuration in ``${KAYOBE_CONFIG_PATH}/dnf.yml`` and run the following
 command::
 
     (kayobe) $ kayobe overcloud host configure --tags dnf
diff --git a/doc/source/administration/seed.rst b/doc/source/administration/seed.rst
index 7664305a7..c289382b9 100644
--- a/doc/source/administration/seed.rst
+++ b/doc/source/administration/seed.rst
@@ -41,9 +41,9 @@ It is possible to update packages on the seed host.
 Package Repositories
 --------------------
 
-If using custom DNF package repositories on CentOS or Rocky, it may be
-necessary to update these prior to running a package update. To do this, update
-the configuration in ``${KAYOBE_CONFIG_PATH}/dnf.yml`` and run the following
+If using custom DNF package repositories on Rocky Linux, it may be necessary to
+update these prior to running a package update. To do this, update the
+configuration in ``${KAYOBE_CONFIG_PATH}/dnf.yml`` and run the following
 command::
 
     (kayobe) $ kayobe seed host configure --tags dnf
diff --git a/doc/source/configuration/reference/bifrost.rst b/doc/source/configuration/reference/bifrost.rst
index c2acb5e35..3e04804a9 100644
--- a/doc/source/configuration/reference/bifrost.rst
+++ b/doc/source/configuration/reference/bifrost.rst
@@ -76,10 +76,7 @@ configure how this image is built.  Consult the
 information on building disk images.
 
 The default configuration builds a whole disk (partitioned) image using the
-selected :ref:`OS distribution <os-distribution>` with serial console enabled,
-and SELinux disabled if CentOS Stream is used. Rocky Linux 10 users should use
-the default method of building images with
-:ref:`Diskimage builder directly <overcloud-dib>`.
+selected :ref:`OS distribution <os-distribution>` with serial console enabled.
 
 ``kolla_bifrost_dib_os_element``
     DIB base OS element. Default is ``{{ os_distribution }}``.
diff --git a/doc/source/configuration/reference/hosts.rst b/doc/source/configuration/reference/hosts.rst
index 02364e142..9ec86dc90 100644
--- a/doc/source/configuration/reference/hosts.rst
+++ b/doc/source/configuration/reference/hosts.rst
@@ -82,8 +82,7 @@ Typically, the image used to provision these hosts will not include this user
 account, so Kayobe performs a bootstrapping step to create it, as a different
 user. In cloud images, there is often a user named after the OS distro, e.g.
 ``rocky`` or ``ubuntu``. This user defaults to the ``os_distribution``
-variable, except for CentOS which uses ``cloud-user``, but may be set via the
-following variables:
+variable, but may be set via the following variables:
 
 * ``ansible_control_bootstrap_user``
 * ``seed_hypervisor_bootstrap_user``
@@ -216,8 +215,8 @@ DNF Package Repositories
 *tags:*
   | ``dnf``
 
-On CentOS and Rocky, Kayobe supports configuration of package repositories via
-DNF, via variables in ``${KAYOBE_CONFIG_PATH}/dnf.yml``.
+On Rocky Linux, Kayobe supports configuration of package repositories via DNF,
+via variables in ``${KAYOBE_CONFIG_PATH}/dnf.yml``.
 
 Configuration of dnf.conf
 -------------------------
@@ -232,19 +231,13 @@ section of the file. For example, to configure DNF to use a proxy server:
    dnf_config:
      proxy: https://proxy.example.com
 
-CentOS/Rocky and EPEL Mirrors
------------------------------
-
-CentOS/Rocky and EPEL mirrors can be enabled by setting
-``dnf_use_local_mirror`` to ``true``. CentOS repository mirrors are configured
-via the following variables:
+Rocky Linux and EPEL Mirrors
+----------------------------
 
-* ``dnf_centos_mirror_host`` (default ``mirror.stream.centos.org``) is the
-  mirror hostname.
-* ``dnf_centos_mirror_directory`` (default ``''``) is a directory on the mirror
-  in which repositories may be accessed.
+Rocky Linux and EPEL mirrors can be enabled by setting ``dnf_use_local_mirror``
+to ``true``.
 
-Rocky repository mirrors are configured via the following variables:
+Rocky Linux repository mirrors are configured via the following variables:
 
 * ``dnf_rocky_mirror_host`` (default ``dl.rockylinux.org``) is the mirror
   hostname
@@ -258,13 +251,13 @@ EPEL repository mirrors are configured via the following variables:
 * ``dnf_epel_mirror_directory`` (default ``pub/epel``) is a directory on the
   mirror in which repositories may be accessed.
 
-For example, to configure CentOS and EPEL mirrors at mirror.example.com:
+For example, to configure Rocky Linux and EPEL mirrors at mirror.example.com:
 
 .. code-block:: yaml
    :caption: ``dnf.yml``
 
    dnf_use_local_mirror: true
-   dnf_centos_mirror_host: mirror.example.com
+   dnf_rocky_mirror_host: mirror.example.com
    dnf_epel_mirror_host: mirror.example.com
 
 Custom DNF Repositories
@@ -575,7 +568,7 @@ SELinux
 *tags:*
   | ``selinux``
 
-.. note:: SELinux applies to CentOS and Rocky systems only.
+.. note:: SELinux applies to Rocky Linux systems only.
 
 SELinux is not supported by Kolla Ansible currently, so it is set to permissive
 by Kayobe. If necessary, it can be configured to disabled by setting
@@ -720,7 +713,7 @@ ones that conduct too many failed login attempts. Kayobe can install and configu
 Fail2Ban on hosts.
 
 In order to use fail2ban, it is important to note that the user should enable
-``dnf_install_epel`` in their configuration when using Rocky Linux or CentOS.
+``dnf_install_epel`` in their configuration when using Rocky Linux.
 
 The following variables can be used to set whether to enable fail2ban:
 
@@ -1333,10 +1326,10 @@ are relevant only when using the libvirt daemon rather than the
 ``compute_libvirt_enable_tls``
     Whether to enable a libvirt TLS listener. Default is false.
 ``compute_libvirt_ceph_repo_install``
-    Whether to install a Ceph package repository on CentOS and Rocky hosts.
+    Whether to install a Ceph package repository on Rocky Linux hosts.
     Default is ``true``.
 ``compute_libvirt_ceph_repo_release``
-    Ceph package repository release to install on CentOS and Rocky hosts when
+    Ceph package repository release to install on Rocky Linux hosts when
     ``compute_libvirt_ceph_repo_install`` is ``true``. Default is ``squid``.
 
 Example: custom libvirtd.conf
@@ -1421,9 +1414,9 @@ Kolla Ansible, for use by the ``nova_compute`` service.
 Example: disabling Ceph repository installation
 -----------------------------------------------
 
-On CentOS and Rocky hosts, a CentOS Storage SIG Ceph repository is installed
-that provides more recent Ceph libraries than those available in CentOS/Rocky
-AppStream.  This may be necessary when using Ceph for Cinder volumes or Nova
+On Rocky Linux hosts, a CentOS Storage SIG Ceph repository is installed that
+provides more recent Ceph libraries than those available in Rocky Linux
+AppStream. This may be necessary when using Ceph for Cinder volumes or Nova
 ephemeral block devices. In some cases, such as when using local package
 mirrors, the upstream repository may not be appropriate. The installation of
 the repository may be disabled as follows:
diff --git a/doc/source/configuration/reference/kolla.rst b/doc/source/configuration/reference/kolla.rst
index 3a03dfb94..4792eef75 100644
--- a/doc/source/configuration/reference/kolla.rst
+++ b/doc/source/configuration/reference/kolla.rst
@@ -76,8 +76,8 @@ affect :ref:`Kolla Ansible configuration <configuration-kolla-ansible-global>`.
     Kolla base container image architecture. Options are ``x86_64``,
     ``aarch64``. Default is ``{{ ansible_facts.architecture }}``.
 ``kolla_base_distro``
-    Kolla base container image distribution. Options are ``centos``,
-    ``debian``, ``rocky`` or ``ubuntu``. Default is ``{{ os_distribution }}``.
+    Kolla base container image distribution. Options are ``debian``, ``rocky``
+    or ``ubuntu``. Default is ``{{ os_distribution }}``.
 ``kolla_base_distro_version``
     Kolla base container image distribution version. Default is dependent on
     ``kolla_base_distro``.
diff --git a/doc/source/configuration/reference/network.rst b/doc/source/configuration/reference/network.rst
index 27caeb72a..cf7e1d8f7 100644
--- a/doc/source/configuration/reference/network.rst
+++ b/doc/source/configuration/reference/network.rst
@@ -86,7 +86,7 @@ supported:
     The required format depends on the network engine:
 
     * ``nmstate`` engine: each rule must be a dict.
-    * ``default`` engine on CentOS/Rocky: each rule may be a string or dict.
+    * ``default`` engine on Rocky Linux: each rule may be a string or dict.
     * ``default`` engine on Ubuntu (systemd-networkd): each rule must be a dict.
 
     Dict rules support optional keys ``from``, ``to``, ``priority``, and
@@ -452,7 +452,7 @@ for a network to a list of rules. Two formats are available (dict and string),
 but support depends on the network engine:
 
 * ``nmstate`` engine: dict format only.
-* ``default`` engine on CentOS Stream/Rocky Linux: dict and string format.
+* ``default`` engine on Rocky Linux: dict and string format.
 * ``default`` engine on Ubuntu (systemd-networkd): dict format only.
 
 Dict format rules
@@ -475,7 +475,7 @@ handle traffic from the subnet ``10.1.0.0/24`` using the routing table
 
 These rules will be configured on all hosts to which the network is mapped.
 
-String format rules (default engine on CentOS Stream/Rocky Linux only)
+String format rules (default engine on Rocky Linux only)
 """"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
 
 The string format of a rule is the string which would be appended to ``ip rule
diff --git a/doc/source/configuration/reference/os-distribution.rst b/doc/source/configuration/reference/os-distribution.rst
index 716f68777..ae3158b6b 100644
--- a/doc/source/configuration/reference/os-distribution.rst
+++ b/doc/source/configuration/reference/os-distribution.rst
@@ -10,20 +10,17 @@ for a list of supported OS distributions. The same OS distribution should be
 used throughout the system.
 
 The ``os_distribution`` variable in ``etc/kayobe/globals.yml`` can be used to
-set the OS distribution to use.  It may be set to either ``centos`` or
-or ``rocky`` or ``ubuntu``, and defaults to ``rocky``.
+set the OS distribution to use.  It may be set to either ``rocky`` or
+``ubuntu``, and defaults to ``rocky``.
 
 The ``os_release`` variable in ``etc/kayobe/globals.yml`` can be used to set
-the release of the OS. When ``os_distribution`` is set to ``centos`` it may be
-set to ``10-stream``, and this is its default value. When ``os_distribution``
-is set to ``rocky`` it may be set to ``10``, and this is its default value.
-When ``os_distribution`` is set to ``ubuntu`` it may be set to ``noble``, and
-this is its default value.
+the release of the OS. When ``os_distribution`` is set to ``rocky`` it may be
+set to ``10``, and this is its default value. When ``os_distribution`` is set
+to ``ubuntu`` it may be set to ``noble``, and this is its default value.
 
 The ``os_family_map`` variable in ``etc/kayobe/globals.yml`` maps
 ``os_distribution`` values to OS families. The default mapping is:
 
-* ``centos`` -> ``RedHat``
 * ``rocky`` -> ``RedHat``
 * ``ubuntu`` -> ``Debian``
 
diff --git a/doc/source/configuration/reference/overcloud-dib.rst b/doc/source/configuration/reference/overcloud-dib.rst
index db537f9a6..1e4049866 100644
--- a/doc/source/configuration/reference/overcloud-dib.rst
+++ b/doc/source/configuration/reference/overcloud-dib.rst
@@ -35,8 +35,7 @@ information on building disk images.
 
 The default configuration builds a whole disk (partitioned) image using the
 selected :ref:`OS distribution <os-distribution>` (Rocky Linux 10 by default)
-with serial console enabled, and SELinux disabled if CentOS Stream or Rocky
-Linux is used.
+with serial console enabled.
 `Cloud-init <https://cloudinit.readthedocs.io/en/latest/>`__ is used to process
 the configuration drive built by Bifrost during provisioning.
 
diff --git a/doc/source/configuration/scenarios/all-in-one/overcloud.rst b/doc/source/configuration/scenarios/all-in-one/overcloud.rst
index ed8b01bd8..d894472bd 100644
--- a/doc/source/configuration/scenarios/all-in-one/overcloud.rst
+++ b/doc/source/configuration/scenarios/all-in-one/overcloud.rst
@@ -200,9 +200,9 @@ Use the correct hostname and IP address for your environment.
    aio_ips:
      controller0: 192.168.33.3
 
-The default OS distribution in Kayobe is CentOS. If using an Ubuntu host, set
-the ``os_distribution`` variable in ``etc/kayobe/globals.yml`` to ``ubuntu``
-or ``rocky`` if using Rocky Linux..
+The default OS distribution in Kayobe is Rocky Linux. If using an Ubuntu host,
+set the ``os_distribution`` variable in ``etc/kayobe/globals.yml`` to
+``ubuntu``.
 
 .. code-block:: yaml
    :caption: ``etc/kayobe/globals.yml``
@@ -210,11 +210,11 @@ or ``rocky`` if using Rocky Linux..
    os_distribution: "ubuntu"
 
 Kayobe uses a bootstrap user to create a ``stack`` user account. By default,
-this user is ``cloud-user`` on CentOS, ``rocky`` on Rocky and ``ubuntu`` on
-Ubuntu, in line with the default user in the official cloud images. If you are
-using a different bootstrap user, set the ``controller_bootstrap_user``
-variable in ``etc/kayobe/controllers.yml``. For example, to set it to
-``cloud-user`` (as seen in MAAS):
+this user is ``rocky`` on Rocky Linux and ``ubuntu`` on Ubuntu, in line with
+the default user in the official cloud images. If you are using a different
+bootstrap user, set the ``controller_bootstrap_user`` variable in
+``etc/kayobe/controllers.yml``. For example, to set it to ``cloud-user`` (as
+seen in MAAS):
 
 .. code-block:: yaml
    :caption: ``etc/kayobe/controllers.yml``
diff --git a/doc/source/contributor/testing.rst b/doc/source/contributor/testing.rst
index c2ed7088a..b13f91403 100644
--- a/doc/source/contributor/testing.rst
+++ b/doc/source/contributor/testing.rst
@@ -18,7 +18,7 @@ running kayobe's tests.
 
       sudo apt-get install build-essential python3-dev libssl-dev python3-pip git
 
-* Fedora or CentOS Stream 10/Rocky 10/RHEL 10::
+* Fedora or Rocky Linux 10/RHEL 10::
 
       sudo dnf install python3-devel openssl-devel python3-pip git gcc
 
diff --git a/doc/source/deployment.rst b/doc/source/deployment.rst
index aa7ce5947..a0a975096 100644
--- a/doc/source/deployment.rst
+++ b/doc/source/deployment.rst
@@ -155,10 +155,10 @@ VM Provisioning
    bare metal host or a VM provisioned outside of Kayobe, this step may be
    skipped.  Ensure that the Ansible inventory contains a host for the seed.
 
-The seed hypervisor should have CentOS or Rocky or Ubuntu with ``libvirt``
-installed. It should have ``libvirt`` networks configured for all networks
-that the seed VM needs access to and a ``libvirt`` storage pool available
-for the seed VM's volumes.  To provision the seed VM::
+The seed hypervisor should have Rocky Linux or Ubuntu with ``libvirt``
+installed. It should have ``libvirt`` networks configured for all networks that
+the seed VM needs access to and a ``libvirt`` storage pool available for the
+seed VM's volumes. To provision the seed VM::
 
     (kayobe) $ kayobe seed vm provision
 
@@ -354,12 +354,11 @@ VM Provisioning
 
 The hypervisor used to host a VM is controlled via the ``infra_vm_hypervisor``
 variable. It defaults to use the seed hypervisor. All hypervisors should have
-CentOS or Ubuntu with ``libvirt`` installed. It should have ``libvirt`` networks
-configured for all networks that the VM needs access to and a ``libvirt``
-storage pool available for the VM's volumes. The steps needed for for the
-:ref:`seed<deployment-seed-host-configure>` and the
-:ref:`seed hypervisor<deployment-seed-hypervisor-host-configure>` can be found
-above.
+Rocky Linux or Ubuntu with ``libvirt`` installed. It should have ``libvirt``
+networks configured for all networks that the VM needs access to and a
+``libvirt`` storage pool available for the VM's volumes. The steps needed for
+the :ref:`seed<deployment-seed-host-configure>` and the :ref:`seed
+hypervisor<deployment-seed-hypervisor-host-configure>` can be found above.
 
 To provision the infra VMs::
 
diff --git a/doc/source/installation.rst b/doc/source/installation.rst
index a70db3854..de713d0e5 100644
--- a/doc/source/installation.rst
+++ b/doc/source/installation.rst
@@ -15,7 +15,6 @@ Prerequisites
 Currently Kayobe supports the following Operating Systems on the Ansible
 control host:
 
-- CentOS Stream 10 (since Flamingo 19.0.0 release)
 - Rocky Linux 10 (since Flamingo 19.0.0 release)
 - Ubuntu Noble 24.04 (since Dalmatian 17.0.0 release)
 
@@ -28,7 +27,7 @@ it is recommended to install Kayobe in a virtualenv. Ensure that the
 necessary to install the GCC compiler chain in order to build the extensions of
 some of kayobe's python dependencies.
 
-On CentOS/Rocky::
+On Rocky Linux::
 
     $ dnf install -y python3-devel gcc libffi-devel
 
@@ -39,7 +38,7 @@ On Ubuntu::
 If installing Kayobe from source, then Git is required for cloning and working
 with the source code repository.
 
-On CentOS/Rocky::
+On Rocky Linux::
 
     $ dnf install -y git
 
diff --git a/doc/source/resources.rst b/doc/source/resources.rst
index 8874f7fc8..0b393b402 100644
--- a/doc/source/resources.rst
+++ b/doc/source/resources.rst
@@ -22,9 +22,8 @@ OpenStack using Kolla, Ansible and Kayobe. The guide makes use of
 baremetal environment running on a single hypervisor.
 
 To complete the walkthrough you will require a baremetal or VM hypervisor
-running CentOS Stream 10 (since Flamingo 19.0.0), Rocky Linux 10 (since
-Flamingo 19.0.0) or Ubuntu Noble 24.04 (since Dalmatian 17.0.0) with at least
-32GB RAM & 80GB disk space. Preparing the deployment can take some time - where
-possible it is beneficial to snapshot the hypervisor. We advise making a
-snapshot after creating the initial 'seed' VM as this will make additional
-deployments significantly faster.
+running Rocky Linux 10 (since Flamingo 19.0.0) or Ubuntu Noble 24.04 (since
+Dalmatian 17.0.0) with at least 32GB RAM & 80GB disk space. Preparing the
+deployment can take some time - where possible it is beneficial to snapshot the
+hypervisor. We advise making a snapshot after creating the initial 'seed' VM as
+this will make additional deployments significantly faster.
diff --git a/doc/source/support-matrix.rst b/doc/source/support-matrix.rst
index 9a5302554..32d544cbd 100644
--- a/doc/source/support-matrix.rst
+++ b/doc/source/support-matrix.rst
@@ -12,20 +12,10 @@ Kayobe supports the following host Operating Systems (OS):
 * Rocky Linux 10 (since Flamingo 19.0.0 release)
 * Ubuntu Noble 24.04 (since Dalmatian 17.0.0 release)
 
-In addition to that CentOS Stream 10 host OS is functional, but not officially
-supported. Kolla does not publish CentOS Stream 10 images to Docker Hub/Quay.io,
-therefore users need to build them by themselves.
-
-.. note::
-
-   CentOS Stream 9 is no longer supported as a host OS. The 2025.1 Epoxy
-   release supports both CentOS Stream 9 and 10 to provide a route for
-   migration.
-
 .. note::
 
-   Rocky Linux 9 is no longer supported as a host OS. The 2025.1 Epoxy release
-   supports both Rocky Linux 9 and 10 to provide a route for migration.
+   CentOS Stream 10 is no longer supported as a host OS. Rocky Linux 10 can be
+   used in its place.
 
 Supported container images
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/etc/kayobe/compute.yml b/etc/kayobe/compute.yml
index ca7dfa9ad..f5c4c756e 100644
--- a/etc/kayobe/compute.yml
+++ b/etc/kayobe/compute.yml
@@ -3,8 +3,7 @@
 # Compute node configuration.
 
 # User with which to access the compute nodes via SSH during bootstrap, in
-# order to setup the Kayobe user account. Default is 'cloud-user' if
-# os_distribution is set to centos, otherwise {{ os_distribution }}.
+# order to setup the Kayobe user account. Default is {{ os_distribution }}.
 #compute_bootstrap_user:
 
 ###############################################################################
@@ -219,11 +218,11 @@
 # Whether to enable a libvirt TLS listener. Default is false.
 #compute_libvirt_enable_tls:
 
-# Whether to install a Ceph package repository on CentOS and Rocky hosts.
+# Whether to install a Ceph package repository on Rocky Linux hosts.
 # Default is true.
 #compute_libvirt_ceph_repo_install:
 
-# Ceph package repository release to install on CentOS and Rocky hosts when
+# Ceph package repository release to install on Rocky Linux hosts when
 # compute_libvirt_ceph_repo_install is true. Default is 'squid'.
 #compute_libvirt_ceph_repo_release:
 
diff --git a/etc/kayobe/controllers.yml b/etc/kayobe/controllers.yml
index bdccfcfeb..001c2cf89 100644
--- a/etc/kayobe/controllers.yml
+++ b/etc/kayobe/controllers.yml
@@ -3,8 +3,7 @@
 # Controller node configuration.
 
 # User with which to access the controllers via SSH during bootstrap, in order
-# to setup the Kayobe user account. Default is 'cloud-user' if os_distribution
-# is set to centos, otherwise {{ os_distribution }}.
+# to setup the Kayobe user account. Default is {{ os_distribution }}.
 #controller_bootstrap_user:
 
 ###############################################################################
diff --git a/etc/kayobe/dnf.yml b/etc/kayobe/dnf.yml
index 09c8d4001..c53bfab8a 100644
--- a/etc/kayobe/dnf.yml
+++ b/etc/kayobe/dnf.yml
@@ -12,12 +12,6 @@
 # Whether or not to use a local DNF mirror. Default value is 'false'.
 #dnf_use_local_mirror:
 
-# Mirror FQDN for DNF CentOS repos. Default value is 'mirror.stream.centos.org'.
-#dnf_centos_mirror_host:
-
-# Mirror directory for DNF CentOS repos. Default value is ''.
-#dnf_centos_mirror_directory:
-
 # Mirror FQDN for DNF Rocky repos. Default value is 'dl.rockylinux.org'.
 #dnf_rocky_mirror_host:
 
diff --git a/etc/kayobe/globals.yml b/etc/kayobe/globals.yml
index 216bc21e7..c7a086552 100644
--- a/etc/kayobe/globals.yml
+++ b/etc/kayobe/globals.yml
@@ -44,21 +44,20 @@
 ###############################################################################
 # OS distribution.
 
-# OS distribution name. Valid options are "centos", "rocky", "ubuntu". Default
-# is "rocky".
+# OS distribution name. Valid options are "rocky" and "ubuntu". Default is
+# "rocky".
 #os_distribution:
 
-# Mapping from OS distribution name to OS family. Supported keys are
-# "centos", "rocky", and "ubuntu".
+# Mapping from OS distribution name to OS family. Supported keys are "rocky"
+# and "ubuntu".
 #os_family_map:
 
 # OS family. Valid options are "RedHat" and "Debian". Default depends on
 # os_distribution.
 #os_family:
 
-# OS release. Valid options are "10-stream" when os_distribution is "centos",
-# "10" when os_distribution is "rocky", or "noble" when os_distribution is
-# "ubuntu".
+# OS release. Valid options are "10" when os_distribution is "rocky", or
+# "noble" when os_distribution is "ubuntu".
 #os_release:
 
 ###############################################################################
diff --git a/etc/kayobe/infra-vms.yml b/etc/kayobe/infra-vms.yml
index d327bb650..d44464ee5 100644
--- a/etc/kayobe/infra-vms.yml
+++ b/etc/kayobe/infra-vms.yml
@@ -31,10 +31,8 @@
 
 # Base image for the infra VM root volume. Default is
 # "https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img"
-# when os_distribution is "ubuntu",
+# when os_distribution is "ubuntu", or
 # "https://dl.rockylinux.org/pub/rocky/10/images/x86_64/Rocky-10-GenericCloud-Base.latest.x86_64.qcow2"
-# when os_distribution is "rocky", or
-# "https://cloud.centos.org/centos/10-stream/x86_64/images/CentOS-Stream-GenericCloud-x86_64-10-latest.x86_64.qcow2"
 # otherwise.
 #infra_vm_root_image:
 
@@ -67,8 +65,7 @@
 # Infrastructure VM node configuration.
 
 # User with which to access the infrastructure vm via SSH during bootstrap, in
-# order to setup the Kayobe user account. Default is 'cloud-user' if
-# os_distribution is set to centos, otherwise {{ os_distribution }}.
+# order to setup the Kayobe user account. Default is {{ os_distribution }}.
 #infra_vm_bootstrap_user:
 
 ###############################################################################
diff --git a/etc/kayobe/kolla.yml b/etc/kayobe/kolla.yml
index 475603327..9ff4f8c4a 100644
--- a/etc/kayobe/kolla.yml
+++ b/etc/kayobe/kolla.yml
@@ -70,8 +70,8 @@
 # Default is "{{ ansible_facts.architecture }}"
 #kolla_base_arch:
 
-# Kolla base container image distribution. Options are "centos", "debian",
-# "rocky", "ubuntu". Default is {{ os_distribution }}.
+# Kolla base container image distribution. Options are "debian", "rocky",
+# "ubuntu". Default is {{ os_distribution }}.
 #kolla_base_distro:
 
 # Kolla base container image distribution version default map.
diff --git a/etc/kayobe/seed-hypervisor.yml b/etc/kayobe/seed-hypervisor.yml
index 7e5a6c7f2..782f51d92 100644
--- a/etc/kayobe/seed-hypervisor.yml
+++ b/etc/kayobe/seed-hypervisor.yml
@@ -3,8 +3,7 @@
 # Seed hypervisor node configuration.
 
 # User with which to access the seed hypervisor via SSH during bootstrap, in
-# order to setup the Kayobe user account. Default is 'cloud-user' if
-# os_distribution is set to centos, otherwise {{ os_distribution }}.
+# order to setup the Kayobe user account. Default is {{ os_distribution }}.
 #seed_hypervisor_bootstrap_user:
 
 ###############################################################################
diff --git a/etc/kayobe/seed-vm.yml b/etc/kayobe/seed-vm.yml
index 86be2708f..70e4f423d 100644
--- a/etc/kayobe/seed-vm.yml
+++ b/etc/kayobe/seed-vm.yml
@@ -31,10 +31,8 @@
 
 # Base image for the seed VM root volume. Default is
 # "https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img"
-# when os_distribution is "ubuntu",
+# when os_distribution is "ubuntu", or
 # "https://dl.rockylinux.org/pub/rocky/10/images/x86_64/Rocky-10-GenericCloud-Base.latest.x86_64.qcow2"
-# when os_distribution is "rocky", or
-# "https://cloud.centos.org/centos/10-stream/x86_64/images/CentOS-Stream-GenericCloud-x86_64-10-latest.x86_64.qcow2"
 # otherwise.
 #seed_vm_root_image:
 
diff --git a/etc/kayobe/seed.yml b/etc/kayobe/seed.yml
index 152e09d56..3c06a4970 100644
--- a/etc/kayobe/seed.yml
+++ b/etc/kayobe/seed.yml
@@ -3,8 +3,7 @@
 # Seed node configuration.
 
 # User with which to access the seed via SSH during bootstrap, in order to
-# setup the Kayobe user account. Default is 'cloud-user' if os_distribution is
-# set to centos, otherwise {{ os_distribution }}.
+# setup the Kayobe user account. Default is {{ os_distribution }}.
 #seed_bootstrap_user:
 
 ###############################################################################
diff --git a/etc/kayobe/storage.yml b/etc/kayobe/storage.yml
index c4651f54f..0477587ca 100644
--- a/etc/kayobe/storage.yml
+++ b/etc/kayobe/storage.yml
@@ -3,8 +3,7 @@
 # Storage node configuration.
 
 # User with which to access the storage nodes via SSH during bootstrap, in
-# order to setup the Kayobe user account. Default is 'cloud-user' if
-# os_distribution is set to centos, otherwise {{ os_distribution }}.
+# order to setup the Kayobe user account. Default is {{ os_distribution }}.
 #storage_bootstrap_user:
 
 ###############################################################################
diff --git a/kayobe/ansible.py b/kayobe/ansible.py
index bc411c35b..2ec1361c5 100644
--- a/kayobe/ansible.py
+++ b/kayobe/ansible.py
@@ -387,9 +387,6 @@ def _get_environment(parsed_args, external_playbook=False):
     """Return an environment dict for executing an Ansible playbook."""
     env = os.environ.copy()
     vault.update_environment(parsed_args, env)
-    # TODO(wszusmki): Kayobe still uses broken conditions. Work on fixing these
-    # and remove when that work is complete.
-    env.setdefault("ANSIBLE_ALLOW_BROKEN_CONDITIONALS", "true")
     # If the configuration path has been specified via --config-path, ensure
     # the environment variable is set, so that it can be referenced by
     # playbooks.
diff --git a/kayobe/plugins/filter/networks.py b/kayobe/plugins/filter/networks.py
index 64b8249dd..b9c7984b3 100644
--- a/kayobe/plugins/filter/networks.py
+++ b/kayobe/plugins/filter/networks.py
@@ -419,7 +419,7 @@ def _validate_rules(rules):
         if not isinstance(rule, str) and not isinstance(rule, dict):
             raise errors.AnsibleFilterError(
                 "Routing policy rules must be defined in string or dict "
-                "format for CentOS Stream and Rocky Linux")
+                "format for Rocky Linux")
 
 
 @jinja2.pass_context
diff --git a/kayobe/tests/unit/test_ansible.py b/kayobe/tests/unit/test_ansible.py
index 198f85fad..f4f513271 100644
--- a/kayobe/tests/unit/test_ansible.py
+++ b/kayobe/tests/unit/test_ansible.py
@@ -59,7 +59,6 @@ def test_run_playbooks(self, mock_validate, mock_vars, mock_run):
         ]
 
         expected_env = {
-            "ANSIBLE_ALLOW_BROKEN_CONDITIONALS": "true",
             "KAYOBE_CONFIG_PATH": "/etc/kayobe",
             "ANSIBLE_ROLES_PATH": ":".join([
                 "/etc/kayobe/ansible/roles",
@@ -114,7 +113,6 @@ def test_run_playbooks_internal(self, mock_validate, mock_vars, mock_run):
         ]
 
         expected_env = {
-            "ANSIBLE_ALLOW_BROKEN_CONDITIONALS": "true",
             "KAYOBE_CONFIG_PATH": "/etc/kayobe",
             "ANSIBLE_ROLES_PATH": ":".join([
                 utils.get_data_files_path("ansible", "roles"),
@@ -322,7 +320,6 @@ def test_run_playbooks_all_the_args(self, mock_validate, mock_vars,
         ]
 
         expected_env = {
-            "ANSIBLE_ALLOW_BROKEN_CONDITIONALS": "true",
             "KAYOBE_CONFIG_PATH": "/path/to/config",
             "KAYOBE_ENVIRONMENT": "test-env",
             "ANSIBLE_ROLES_PATH": ":".join([
@@ -403,7 +400,6 @@ def test_run_playbooks_all_the_long_args(self, mock_ask, mock_validate,
             "playbook2.yml",
         ]
         expected_env = {
-            "ANSIBLE_ALLOW_BROKEN_CONDITIONALS": "true",
             "KAYOBE_CONFIG_PATH": "/path/to/config",
             "KAYOBE_ENVIRONMENT": "test-env",
             "KAYOBE_VAULT_PASSWORD": "test-pass",
@@ -448,7 +444,6 @@ def test_run_playbooks_vault_password_file(self, mock_update,
             "playbook1.yml",
         ]
         expected_env = {
-            "ANSIBLE_ALLOW_BROKEN_CONDITIONALS": "true",
             "KAYOBE_CONFIG_PATH": "/etc/kayobe",
             "ANSIBLE_ROLES_PATH": mock.ANY,
             "ANSIBLE_COLLECTIONS_PATH": mock.ANY,
@@ -487,7 +482,6 @@ def test_run_playbooks_vault_password_helper(self, mock_validate,
             "playbook1.yml",
         ]
         expected_env = {
-            "ANSIBLE_ALLOW_BROKEN_CONDITIONALS": "true",
             "KAYOBE_CONFIG_PATH": "/etc/kayobe",
             "KAYOBE_VAULT_PASSWORD": "test-pass",
             "ANSIBLE_ROLES_PATH": mock.ANY,
@@ -556,7 +550,6 @@ def test_run_playbooks_func_args(self, mock_validate, mock_vars, mock_run):
             "playbook2.yml",
         ]
         expected_env = {
-            "ANSIBLE_ALLOW_BROKEN_CONDITIONALS": "true",
             "KAYOBE_CONFIG_PATH": "/etc/kayobe",
             "ANSIBLE_ROLES_PATH": mock.ANY,
             "ANSIBLE_COLLECTIONS_PATH": mock.ANY,
@@ -595,7 +588,6 @@ def test_run_playbooks_ignore_limit(self, mock_validate, mock_vars,
             "playbook2.yml",
         ]
         expected_env = {
-            "ANSIBLE_ALLOW_BROKEN_CONDITIONALS": "true",
             "KAYOBE_CONFIG_PATH": "/etc/kayobe",
             "ANSIBLE_ROLES_PATH": mock.ANY,
             "ANSIBLE_COLLECTIONS_PATH": mock.ANY,
@@ -634,7 +626,6 @@ def test_run_playbooks_list_tasks_arg(self, mock_validate, mock_vars,
             "playbook2.yml",
         ]
         expected_env = {
-            "ANSIBLE_ALLOW_BROKEN_CONDITIONALS": "true",
             "KAYOBE_CONFIG_PATH": "/etc/kayobe",
             "ANSIBLE_ROLES_PATH": mock.ANY,
             "ANSIBLE_COLLECTIONS_PATH": mock.ANY,
@@ -669,7 +660,6 @@ def test_run_playbooks_ansible_cfg(self, mock_validate, mock_vars,
         expected_env = {
             "ANSIBLE_CONFIG": "/etc/kayobe/ansible.cfg",
             "KAYOBE_CONFIG_PATH": "/etc/kayobe",
-            "ANSIBLE_ALLOW_BROKEN_CONDITIONALS": "true",
             "ANSIBLE_ROLES_PATH": mock.ANY,
             "ANSIBLE_COLLECTIONS_PATH": mock.ANY,
             "ANSIBLE_ACTION_PLUGINS": mock.ANY,
@@ -703,7 +693,6 @@ def test_run_playbooks_ansible_cfg_env(self, mock_validate, mock_vars,
             "playbook1.yml",
         ]
         expected_env = {
-            "ANSIBLE_ALLOW_BROKEN_CONDITIONALS": "true",
             "ANSIBLE_CONFIG": "/path/to/ansible.cfg",
             "KAYOBE_CONFIG_PATH": "/etc/kayobe",
             "ANSIBLE_ROLES_PATH": mock.ANY,
@@ -1140,7 +1129,6 @@ def test_multiple_inventory_args(self, mock_validate, mock_vars, mock_run):
             "playbook2.yml",
         ]
         expected_env = {
-            "ANSIBLE_ALLOW_BROKEN_CONDITIONALS": "true",
             "KAYOBE_CONFIG_PATH": "/etc/kayobe",
             "ANSIBLE_ROLES_PATH": mock.ANY,
             "ANSIBLE_COLLECTIONS_PATH": mock.ANY,
@@ -1185,7 +1173,6 @@ def exists_replacement(path):
             "playbook2.yml",
         ]
         expected_env = {
-            "ANSIBLE_ALLOW_BROKEN_CONDITIONALS": "true",
             "KAYOBE_CONFIG_PATH": "/etc/kayobe",
             "KAYOBE_ENVIRONMENT": "test-env",
             "ANSIBLE_ROLES_PATH": mock.ANY,
@@ -1229,7 +1216,6 @@ def exists_replacement(path):
             "playbook2.yml",
         ]
         expected_env = {
-            "ANSIBLE_ALLOW_BROKEN_CONDITIONALS": "true",
             "KAYOBE_CONFIG_PATH": "/etc/kayobe",
             "KAYOBE_ENVIRONMENT": "test-env",
             "ANSIBLE_ROLES_PATH": mock.ANY,
@@ -1274,7 +1260,6 @@ def exists_replacement(path):
             "playbook2.yml",
         ]
         expected_env = {
-            "ANSIBLE_ALLOW_BROKEN_CONDITIONALS": "true",
             "KAYOBE_CONFIG_PATH": "/etc/kayobe",
             "KAYOBE_ENVIRONMENT": "test-env",
             "ANSIBLE_ROLES_PATH": mock.ANY,
@@ -1324,7 +1309,6 @@ def exists_replacement(path):
             "playbook2.yml",
         ]
         expected_env = {
-            "ANSIBLE_ALLOW_BROKEN_CONDITIONALS": "true",
             "KAYOBE_CONFIG_PATH": "/etc/kayobe",
             "KAYOBE_ENVIRONMENT": "test-env",
             "ANSIBLE_ROLES_PATH": mock.ANY,
@@ -1406,7 +1390,6 @@ def exists_replacement(path):
             "playbook2.yml",
         ]
         expected_env = {
-            "ANSIBLE_ALLOW_BROKEN_CONDITIONALS": "true",
             "KAYOBE_CONFIG_PATH": "/etc/kayobe",
             "KAYOBE_ENVIRONMENT": "test-env",
             "ANSIBLE_ROLES_PATH": mock.ANY,
diff --git a/playbooks/kayobe-infra-vm-base/infra-vms-group-vars.j2 b/playbooks/kayobe-infra-vm-base/infra-vms-group-vars.j2
index 1d30f2122..24c890755 100644
--- a/playbooks/kayobe-infra-vm-base/infra-vms-group-vars.j2
+++ b/playbooks/kayobe-infra-vm-base/infra-vms-group-vars.j2
@@ -2,7 +2,7 @@
 {% if infra_vm_use_cirros | default(true) %}
 aio_interface: eth0
 {% else %}
-# Required for official cloud images (CentOS Stream 10, Rocky Linux 10, Ubuntu)
+# Required for official cloud images (Rocky Linux 10 and Ubuntu)
 aio_interface: ens2
 {% endif %}
 
diff --git a/playbooks/kayobe-overcloud-base/overrides.yml.j2 b/playbooks/kayobe-overcloud-base/overrides.yml.j2
index 72eeb2018..5151919f7 100644
--- a/playbooks/kayobe-overcloud-base/overrides.yml.j2
+++ b/playbooks/kayobe-overcloud-base/overrides.yml.j2
@@ -59,10 +59,6 @@ kolla_ironic_kernel_append_params_extra:
   - ipa-insecure=1
 {% endif %}
 
-# NOTE(bbezak): Kolla does not build CentOS Stream 10 container images.
-# Using Rocky Linux 10 images on CentOS Stream 10 in CI.
-kolla_base_distro: "{% raw %}{{ 'rocky' if os_distribution == 'centos' else os_distribution }}{% endraw %}"
-
 # Support overriding container_engine
 container_engine: "{{ container_engine }}"
 
diff --git a/playbooks/kayobe-seed-base/overrides.yml.j2 b/playbooks/kayobe-seed-base/overrides.yml.j2
index 15dc71f5d..149e2953f 100644
--- a/playbooks/kayobe-seed-base/overrides.yml.j2
+++ b/playbooks/kayobe-seed-base/overrides.yml.j2
@@ -57,10 +57,6 @@ overcloud_dib_build_host_images: {{ build_images }}
 overcloud_dib_elements_extra:
   - "openstack-ci-mirrors"
 
-# NOTE(bbezak): Kolla does not build CentOS Stream 10 container images.
-# Using Rocky Linux 10 images on CentOS Stream 10 in CI.
-kolla_base_distro: "{% raw %}{{ 'rocky' if os_distribution == 'centos' else os_distribution }}{% endraw %}"
-
 # Support overriding container_engine
 container_engine: "{{ container_engine }}"
 
diff --git a/playbooks/kayobe-seed-vm-base/seed-group-vars.j2 b/playbooks/kayobe-seed-vm-base/seed-group-vars.j2
index ccf57a4e8..464384b29 100644
--- a/playbooks/kayobe-seed-vm-base/seed-group-vars.j2
+++ b/playbooks/kayobe-seed-vm-base/seed-group-vars.j2
@@ -2,7 +2,7 @@
 {% if seed_vm_use_cirros | default(true) %}
 aio_interface: eth0
 {% else %}
-# Required for official cloud images (CentOS Stream 10, Rocky Linux 10, Ubuntu)
+# Required for official cloud images (Rocky Linux 10 and Ubuntu)
 aio_interface: ens2
 {% endif %}
 
diff --git a/releasenotes/notes/add-ansible-pylibssh-35f42c53da60aa5b.yaml b/releasenotes/notes/add-ansible-pylibssh-35f42c53da60aa5b.yaml
new file mode 100644
index 000000000..1e16704ff
--- /dev/null
+++ b/releasenotes/notes/add-ansible-pylibssh-35f42c53da60aa5b.yaml
@@ -0,0 +1,13 @@
+---
+features:
+  - |
+    Adds ``ansible-pylibssh`` to Kayobe's Python requirements. It is used by
+    ``kayobe physical network configure`` for switches using the
+    ``ansible.netcommon.network_cli`` connection, as the ``paramiko``
+    transport for ``network_cli`` is deprecated in ``ansible.netcommon``.
+upgrade:
+  - |
+    Switches using the ``ansible.netcommon.network_cli`` connection now use
+    ``libssh`` rather than ``paramiko``. Set
+    ``ansible_network_cli_ssh_type`` to ``paramiko`` to keep the previous
+    behaviour.
diff --git a/releasenotes/notes/drop-centos-stream-10-0914b9780c644376.yaml b/releasenotes/notes/drop-centos-stream-10-0914b9780c644376.yaml
new file mode 100644
index 000000000..1facbf0e9
--- /dev/null
+++ b/releasenotes/notes/drop-centos-stream-10-0914b9780c644376.yaml
@@ -0,0 +1,4 @@
+---
+upgrade:
+  - |
+    Drops support for CentOS Stream 10. Rocky Linux 10 can be used in its place.
diff --git a/releasenotes/notes/remove-ansible-broken-conditionals-ecb0b0b64a1d3f2e.yaml b/releasenotes/notes/remove-ansible-broken-conditionals-ecb0b0b64a1d3f2e.yaml
new file mode 100644
index 000000000..90432620e
--- /dev/null
+++ b/releasenotes/notes/remove-ansible-broken-conditionals-ecb0b0b64a1d3f2e.yaml
@@ -0,0 +1,11 @@
+---
+upgrade:
+  - |
+    Kayobe no longer sets ``ANSIBLE_ALLOW_BROKEN_CONDITIONALS=true`` in the
+    environment when executing Ansible playbooks. Custom playbooks that use
+    conditionals which do not evaluate to a boolean value will now fail. These
+    should be updated to use explicit boolean expressions, for example
+    ``when: my_list | length > 0`` rather than ``when: my_list``. As a
+    temporary workaround, ``ANSIBLE_ALLOW_BROKEN_CONDITIONALS=true`` may be set
+    in the shell environment, or ``allow_broken_conditionals = True`` may be
+    set in the ``[defaults]`` section of ``${KAYOBE_CONFIG_PATH}/ansible.cfg``.
diff --git a/requirements.txt b/requirements.txt
index 4785c1154..bc8f19589 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -7,6 +7,7 @@ PyYAML>=3.10.0 # MIT
 # INI parsing
 oslo.config>=5.2.0 # Apache-2.0
 paramiko # LGPL
+ansible-pylibssh # LGPL
 jsonschema<5 # MIT
 wcmatch>=8.2,<=9.0 # MIT
 hvac>=0.10.1
diff --git a/requirements.yml b/requirements.yml
index 7bbbf9eec..4a71f7021 100644
--- a/requirements.yml
+++ b/requirements.yml
@@ -59,7 +59,7 @@ roles:
   - src: stackhpc.libvirt-host
     version: v1.15.1
   - src: stackhpc.libvirt-vm
-    version: v1.16.4
+    version: v1.17.1
   - src: stackhpc.luks
     version: 0.4.4
   - src: stackhpc.os-ironic-state
diff --git a/roles/host-configure-test-harness/tests/test_host_configure.py b/roles/host-configure-test-harness/tests/test_host_configure.py
index a5f7a1be0..dce4615f5 100644
--- a/roles/host-configure-test-harness/tests/test_host_configure.py
+++ b/roles/host-configure-test-harness/tests/test_host_configure.py
@@ -23,14 +23,7 @@ def _is_apt():
 
 def _is_dnf():
     info = distro.id()
-    return info in ['centos', 'rocky']
-
-
-# NOTE: There are OpenDev mirrors only for centos-stream/9-stream and epel/9.
-def _is_dnf_mirror():
-    info = distro.id()
-    version = distro.version()
-    return info == 'centos' and version == '9'
+    return info == 'rocky'
 
 
 def _is_ubuntu_noble():
@@ -249,8 +242,7 @@ def test_ntp_running(host):
 def test_ntp_non_default_time_server(host):
     # Tests that the NTP pool has been changed from pool.ntp.org to
     # time.cloudflare.com
-    if ('centos' in host.system_info.distribution.lower() or
-       'rocky' in host.system_info.distribution.lower()):
+    if 'rocky' in host.system_info.distribution.lower():
         chrony_config = host.file("/etc/chrony.conf")
     else:
         # Debian based distributions use the following path
@@ -299,28 +291,14 @@ def test_apt_auth(host):
     assert "password bar" in auth_lines
 
 
-@pytest.mark.parametrize('repo', ["appstream", "baseos", "extras", "epel"])
-@pytest.mark.skipif(not _is_dnf_mirror(),
-                    reason="DNF OpenDev mirror only for CentOS Stream 9")
-def test_dnf_local_package_mirrors(host, repo):
-    # Depends on SITE_MIRROR_FQDN environment variable.
-    assert os.getenv('SITE_MIRROR_FQDN')
-    # NOTE(mgoddard): Should not require sudo but some files
-    # (/var/cache/dnf/expired_repos.json) can have incorrect permissions.
-    # https://bugzilla.redhat.com/show_bug.cgi?id=1636909
-    with host.sudo():
-        info = host.check_output("dnf repoinfo %s", repo)
-    assert os.getenv('SITE_MIRROR_FQDN') in info
-
-
-@pytest.mark.skipif(not _is_dnf(), reason="DNF only supported on CentOS/Rocky")
+@pytest.mark.skipif(not _is_dnf(), reason="DNF only supported on Rocky Linux")
 def test_dnf_custom_package_repository_is_available(host):
     with host.sudo():
         host.check_output("dnf -y install fluent-package")
     assert host.package("fluent-package").is_installed
 
 
-@pytest.mark.skipif(not _is_dnf(), reason="DNF only supported on CentOS/Rocky")
+@pytest.mark.skipif(not _is_dnf(), reason="DNF only supported on Rocky Linux")
 def test_dnf_automatic(host):
     assert host.package("dnf-automatic").is_installed
     assert host.service("dnf-automatic.timer").is_enabled
@@ -411,7 +389,7 @@ def test_fail2ban_default_jail_config(host):
     assert "Status for the jail: sshd" in status
 
 @pytest.mark.skipif(not _is_dnf(),
-                    reason="SELinux only supported on CentOS/Rocky")
+                    reason="SELinux only supported on Rocky Linux")
 def test_selinux(host):
     selinux = host.check_output("sestatus")
     selinux = selinux.splitlines()
diff --git a/zuul.d/jobs.yaml b/zuul.d/jobs.yaml
index da3cb55a0..81a4a3cc0 100644
--- a/zuul.d/jobs.yaml
+++ b/zuul.d/jobs.yaml
@@ -147,12 +147,6 @@
     run: playbooks/kayobe-ansible-control-host-configure-base/run.yml
     timeout: 7200
 
-- job:
-    name: kayobe-ansible-control-host-configure-centos10s
-    parent: kayobe-ansible-control-host-configure-base
-    nodeset: kayobe-centos10s
-    voting: false
-
 - job:
     name: kayobe-ansible-control-host-configure-rocky10
     parent: kayobe-ansible-control-host-configure-base
@@ -194,12 +188,6 @@
     run: playbooks/kayobe-overcloud-base/run.yml
     timeout: 10800
 
-- job:
-    name: kayobe-overcloud-centos10s
-    parent: kayobe-overcloud-base
-    nodeset: kayobe-centos10s-16GB
-    voting: false
-
 - job:
     name: kayobe-overcloud-rocky10
     parent: kayobe-overcloud-base
@@ -235,12 +223,6 @@
       tls_enabled: true
       ironic_boot_mode: "uefi"
 
-- job:
-    name: kayobe-overcloud-tls-centos10s
-    parent: kayobe-overcloud-tls-base
-    nodeset: kayobe-centos10s-16GB
-    voting: false
-
 - job:
     name: kayobe-overcloud-tls-rocky10
     parent: kayobe-overcloud-tls-base
@@ -291,12 +273,6 @@
     vars:
       build_images: false
 
-- job:
-    name: kayobe-seed-centos10s
-    parent: kayobe-seed-base
-    nodeset: kayobe-centos10s
-    voting: false
-
 - job:
     name: kayobe-seed-rocky10
     parent: kayobe-seed-base
@@ -331,12 +307,6 @@
     vars:
       build_images: true
 
-- job:
-    name: kayobe-seed-images-centos10s
-    parent: kayobe-seed-images-base
-    nodeset: kayobe-centos10s
-    voting: false
-
 - job:
     name: kayobe-seed-images-rocky10
     parent: kayobe-seed-images-base
@@ -377,12 +347,6 @@
     run: playbooks/kayobe-overcloud-host-configure-base/run.yml
     timeout: 7200
 
-- job:
-    name: kayobe-overcloud-host-configure-centos10s
-    parent: kayobe-overcloud-host-configure-base
-    nodeset: kayobe-centos10s
-    voting: false
-
 - job:
     name: kayobe-overcloud-host-configure-rocky10
     parent: kayobe-overcloud-host-configure-base
@@ -444,12 +408,6 @@
     run: playbooks/kayobe-seed-vm-base/run.yml
     timeout: 5400
 
-- job:
-    name: kayobe-seed-vm-centos10s
-    parent: kayobe-seed-vm-base
-    nodeset: kayobe-centos10s
-    voting: false
-
 - job:
     name: kayobe-seed-vm-rocky10
     parent: kayobe-seed-vm-base
@@ -462,14 +420,6 @@
     vars:
       kayobe_control_host_become: false
 
-- job:
-    name: kayobe-seed-vm-centos10s-cloud-image
-    parent: kayobe-seed-vm-base
-    nodeset: kayobe-centos10s
-    voting: false
-    vars:
-      seed_vm_use_cirros: false
-
 - job:
     name: kayobe-seed-vm-rocky10-cloud-image
     parent: kayobe-seed-vm-base
@@ -493,12 +443,6 @@
     vars:
       seed_vm_machine: q35
 
-- job:
-    name: kayobe-seed-vm-centos10s-q35
-    parent: kayobe-seed-vm-q35-base
-    nodeset: kayobe-centos10s
-    voting: false
-
 - job:
     name: kayobe-seed-vm-rocky10-q35
     parent: kayobe-seed-vm-q35-base
@@ -523,12 +467,6 @@
     run: playbooks/kayobe-infra-vm-base/run.yml
     timeout: 5400
 
-- job:
-    name: kayobe-infra-vm-centos10s
-    parent: kayobe-infra-vm-base
-    nodeset: kayobe-centos10s
-    voting: false
-
 - job:
     name: kayobe-infra-vm-rocky10
     parent: kayobe-infra-vm-base
@@ -541,14 +479,6 @@
     parent: kayobe-infra-vm-base
     nodeset: kayobe-ubuntu-noble
 
-- job:
-    name: kayobe-infra-vm-centos10s-cloud-image
-    parent: kayobe-infra-vm-base
-    nodeset: kayobe-centos10s
-    voting: false
-    vars:
-      infra_vm_use_cirros: false
-
 - job:
     name: kayobe-infra-vm-rocky10-cloud-image
     parent: kayobe-infra-vm-base
diff --git a/zuul.d/nodesets.yaml b/zuul.d/nodesets.yaml
index 32c72a536..129b0ee79 100644
--- a/zuul.d/nodesets.yaml
+++ b/zuul.d/nodesets.yaml
@@ -1,16 +1,4 @@
 ---
-- nodeset:
-    name: kayobe-centos10s
-    nodes:
-      - name: primary
-        label: centos-10-stream-8GB
-
-- nodeset:
-    name: kayobe-centos10s-16GB
-    nodes:
-      - name: primary
-        label: centos-10-stream-16GB
-
 - nodeset:
     name: kayobe-rocky10
     nodes:
diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml
index b10876f99..3051acb16 100644
--- a/zuul.d/project.yaml
+++ b/zuul.d/project.yaml
@@ -70,23 +70,12 @@
 
     experimental:
       jobs:
-        - kayobe-ansible-control-host-configure-centos10s
-        - kayobe-infra-vm-centos10s
-        - kayobe-infra-vm-centos10s-cloud-image
         - kayobe-infra-vm-rocky10-cloud-image
         - kayobe-infra-vm-ubuntu-noble-cloud-image
-        - kayobe-overcloud-centos10s
-        - kayobe-overcloud-host-configure-centos10s
-        - kayobe-overcloud-tls-centos10s
-        - kayobe-seed-centos10s
-        - kayobe-seed-images-centos10s
         - kayobe-seed-images-rocky10
         - kayobe-seed-images-rocky10-podman
         - kayobe-seed-images-ubuntu-noble
         - kayobe-seed-images-ubuntu-noble-podman
-        - kayobe-seed-vm-centos10s
-        - kayobe-seed-vm-centos10s-cloud-image
-        - kayobe-seed-vm-centos10s-q35
         - kayobe-seed-vm-rocky10-cloud-image
         - kayobe-seed-vm-rocky10-q35
         - kayobe-seed-vm-ubuntu-noble-cloud-image