diff --git a/ci-operator/config/openshift/appliance/openshift-appliance-agent-preinstall-image-builder.yaml b/ci-operator/config/openshift/appliance/openshift-appliance-agent-preinstall-image-builder.yaml
new file mode 100644
index 0000000000000..d4231f34bf878
--- /dev/null
+++ b/ci-operator/config/openshift/appliance/openshift-appliance-agent-preinstall-image-builder.yaml
@@ -0,0 +1,92 @@
+base_images:
+  dev-scripts:
+    name: test
+    namespace: ocp-kni
+    tag: dev-scripts
+build_root:
+  project_image:
+    dockerfile_path: Dockerfile.openshift-appliance-build
+images:
+  items:
+  - dockerfile_literal: |
+      FROM ubi9-minimal
+      RUN rm -rf /etc/yum.repos.d/*
+      RUN curl http://base-4-20-rhel9.ocp.svc > /etc/yum.repos.d/base-4-20-rhel9.repo
+    to: ubi9-minimal-entitled
+  - dockerfile_path: Dockerfile.openshift-appliance
+    from: ubi9-minimal-entitled
+    to: agent-preinstall-image-builder
+promotion:
+  to:
+  - excluded_images:
+    - ubi9-minimal-entitled
+    name: "5.0"
+    namespace: ocp
+releases:
+  initial:
+    integration:
+      name: "5.0"
+      namespace: ocp
+  latest:
+    integration:
+      include_built_images: true
+      name: "5.0"
+      namespace: ocp
+resources:
+  '*':
+    requests:
+      cpu: 100m
+      memory: 200Mi
+test_binary_build_commands: |
+  mkdir /.cache && chmod 775 -R /.cache ${GOPATH}
+tests:
+- as: lint
+  commands: |
+    make lint
+  container:
+    from: test-bin
+- as: unit-test
+  commands: |
+    make unit-test
+  container:
+    from: test-bin
+  run_if_changed: ^(cmd/.*|data/.*|hack/.*|pkg/.*|Dockerfile\..*|Makefile|go\.mod|go\.sum)$
+- as: publish
+  cron: '@daily'
+  steps:
+    dependencies:
+      SOURCE_IMAGE_REF: agent-preinstall-image-builder
+    env:
+      IMAGE_REPO: openshift-appliance
+      IMAGE_TAG: latest
+    test:
+    - ref: assisted-baremetal-images-publish
+- as: e2e-compact-ipv4-static
+  capabilities:
+  - intranet
+  run_if_changed: ^(cmd/.*|data/.*|pkg/.*|Dockerfile\..*|Makefile|go\.mod|go\.sum)$
+  steps:
+    allow_skip_on_success: true
+    cluster_profile: packet-assisted
+    workflow: agent-e2e-appliance-ipv4
+- always_run: false
+  as: e2e-sno-dualstack-dhcp
+  capabilities:
+  - intranet
+  optional: true
+  run_if_changed: ^(cmd/.*|data/.*|pkg/.*|Dockerfile\..*|Makefile|go\.mod|go\.sum)$
+  steps:
+    allow_skip_on_success: true
+    cluster_profile: packet-assisted
+    workflow: agent-e2e-appliance-dualstack
+- as: e2e-sno-dualstack-dhcp-periodic
+  capabilities:
+  - intranet
+  cron: 00 00 */1 * 5
+  steps:
+    cluster_profile: packet-assisted
+    workflow: agent-e2e-appliance-dualstack
+zz_generated_metadata:
+  branch: agent-preinstall-image-builder
+  org: openshift
+  repo: appliance
diff --git a/ci-operator/config/openshift/appliance/openshift-appliance-master.yaml b/ci-operator/config/openshift/appliance/openshift-appliance-master.yaml
index 4c7514cec40c6..1a92d6e239092 100644
--- a/ci-operator/config/openshift/appliance/openshift-appliance-master.yaml
+++ b/ci-operator/config/openshift/appliance/openshift-appliance-master.yaml
@@ -15,10 +15,12 @@ images:
     to: ubi9-minimal-entitled
   - dockerfile_path: Dockerfile.openshift-appliance
     from: ubi9-minimal-entitled
-    to: agent-preinstall-image-builder
+    to: agent-release-iso-builder
 promotion:
   to:
-  - name: "5.0"
+  - excluded_images:
+    - ubi9-minimal-entitled
+    name: "5.0"
     namespace: ocp
 releases:
   initial:
@@ -49,16 +51,6 @@ tests:
   container:
     from: test-bin
   run_if_changed: ^(cmd/.*|data/.*|hack/.*|pkg/.*|Dockerfile\..*|Makefile|go\.mod|go\.sum)$
-- as: publish
-  cron: '@daily'
-  steps:
-    dependencies:
-      SOURCE_IMAGE_REF: agent-preinstall-image-builder
-    env:
-      IMAGE_REPO: openshift-appliance
-      IMAGE_TAG: latest
-    test:
-    - ref: assisted-baremetal-images-publish
 - always_run: false
   as: e2e-agent-compact-ipv4-iso-no-registry
   capabilities:
@@ -68,7 +60,7 @@ tests:
   steps:
     cluster_profile: equinix-ocp-metal
     dependencies:
-      APPLIANCE_IMAGE: agent-preinstall-image-builder
+      APPLIANCE_IMAGE: agent-release-iso-builder
     env:
       AGENT_E2E_TEST_BOOT_MODE: ISO_NO_REGISTRY
       DEVSCRIPTS_CONFIG: |
@@ -84,6 +76,8 @@ tests:
   steps:
     allow_skip_on_success: true
     cluster_profile: packet-assisted
+    dependencies:
+      APPLIANCE_IMAGE: agent-release-iso-builder
     workflow: agent-e2e-appliance-ipv4
 - always_run: false
   as: e2e-sno-dualstack-dhcp
@@ -95,7 +89,7 @@ tests:
     allow_skip_on_success: true
     cluster_profile: packet-assisted
     dependencies:
-      APPLIANCE_IMAGE: agent-preinstall-image-builder
+      APPLIANCE_IMAGE: agent-release-iso-builder
     workflow: agent-e2e-appliance-dualstack
 - as: e2e-sno-dualstack-dhcp-periodic
   capabilities:
@@ -103,6 +97,8 @@ tests:
   cron: 00 00 */1 * 5
   steps:
     cluster_profile: packet-assisted
+    dependencies:
+      APPLIANCE_IMAGE: agent-release-iso-builder
     workflow: agent-e2e-appliance-dualstack
 zz_generated_metadata:
   branch: master
diff --git a/ci-operator/config/openshift/appliance/openshift-appliance-release-4.21.yaml b/ci-operator/config/openshift/appliance/openshift-appliance-release-4.21.yaml
index 01e3543bba0cf..a2cec7f85231c 100644
--- a/ci-operator/config/openshift/appliance/openshift-appliance-release-4.21.yaml
+++ b/ci-operator/config/openshift/appliance/openshift-appliance-release-4.21.yaml
@@ -18,7 +18,9 @@ images:
     to: agent-preinstall-image-builder
 promotion:
   to:
-  - name: "4.21"
+  - excluded_images:
+    - ubi9-minimal-entitled
+    name: "4.21"
     namespace: ocp
 releases:
   initial:
diff --git a/ci-operator/config/openshift/appliance/openshift-appliance-release-4.22.yaml b/ci-operator/config/openshift/appliance/openshift-appliance-release-4.22.yaml
index a613017186caf..b3d08cdff8946 100644
--- a/ci-operator/config/openshift/appliance/openshift-appliance-release-4.22.yaml
+++ b/ci-operator/config/openshift/appliance/openshift-appliance-release-4.22.yaml
@@ -18,7 +18,9 @@ images:
     to: agent-preinstall-image-builder
 promotion:
   to:
-  - name: "4.22"
+  - excluded_images:
+    - ubi9-minimal-entitled
+    name: "4.22"
     namespace: ocp
 releases:
   initial:
diff --git a/ci-operator/config/openshift/appliance/openshift-appliance-release-4.23.yaml b/ci-operator/config/openshift/appliance/openshift-appliance-release-4.23.yaml
index 54f61a26da1dc..a2511189a6d6b 100644
--- a/ci-operator/config/openshift/appliance/openshift-appliance-release-4.23.yaml
+++ b/ci-operator/config/openshift/appliance/openshift-appliance-release-4.23.yaml
@@ -15,10 +15,12 @@ images:
     to: ubi9-minimal-entitled
   - dockerfile_path: Dockerfile.openshift-appliance
     from: ubi9-minimal-entitled
-    to: agent-preinstall-image-builder
+    to: agent-release-iso-builder
 promotion:
   to:
-  - name: "4.23"
+  - excluded_images:
+    - ubi9-minimal-entitled
+    name: "4.23"
     namespace: ocp
 releases:
   initial:
@@ -58,7 +60,7 @@ tests:
   steps:
     cluster_profile: equinix-ocp-metal
     dependencies:
-      APPLIANCE_IMAGE: agent-preinstall-image-builder
+      APPLIANCE_IMAGE: agent-release-iso-builder
     env:
       AGENT_E2E_TEST_BOOT_MODE: ISO_NO_REGISTRY
       DEVSCRIPTS_CONFIG: |
@@ -74,6 +76,8 @@ tests:
   steps:
     allow_skip_on_success: true
     cluster_profile: packet-assisted
+    dependencies:
+      APPLIANCE_IMAGE: agent-release-iso-builder
     workflow: agent-e2e-appliance-ipv4
 - always_run: false
   as: e2e-sno-dualstack-dhcp
@@ -85,7 +89,7 @@ tests:
     allow_skip_on_success: true
     cluster_profile: packet-assisted
     dependencies:
-      APPLIANCE_IMAGE: agent-preinstall-image-builder
+      APPLIANCE_IMAGE: agent-release-iso-builder
     workflow: agent-e2e-appliance-dualstack
 zz_generated_metadata:
   branch: release-4.23
diff --git a/ci-operator/config/openshift/appliance/openshift-appliance-release-5.0.yaml b/ci-operator/config/openshift/appliance/openshift-appliance-release-5.0.yaml
index 77402b93ad84a..edeb174080241 100644
--- a/ci-operator/config/openshift/appliance/openshift-appliance-release-5.0.yaml
+++ b/ci-operator/config/openshift/appliance/openshift-appliance-release-5.0.yaml
@@ -15,10 +15,12 @@ images:
     to: ubi9-minimal-entitled
   - dockerfile_path: Dockerfile.openshift-appliance
     from: ubi9-minimal-entitled
-    to: agent-preinstall-image-builder
+    to: agent-release-iso-builder
 promotion:
   to:
   - disabled: true
+    excluded_images:
+    - ubi9-minimal-entitled
     name: "5.0"
     namespace: ocp
 releases:
@@ -59,7 +61,7 @@ tests:
   steps:
     cluster_profile: equinix-ocp-metal
     dependencies:
-      APPLIANCE_IMAGE: agent-preinstall-image-builder
+      APPLIANCE_IMAGE: agent-release-iso-builder
     env:
       AGENT_E2E_TEST_BOOT_MODE: ISO_NO_REGISTRY
       DEVSCRIPTS_CONFIG: |
@@ -75,6 +77,8 @@ tests:
   steps:
     allow_skip_on_success: true
     cluster_profile: packet-assisted
+    dependencies:
+      APPLIANCE_IMAGE: agent-release-iso-builder
     workflow: agent-e2e-appliance-ipv4
 - always_run: false
   as: e2e-sno-dualstack-dhcp
@@ -86,7 +90,7 @@ tests:
     allow_skip_on_success: true
     cluster_profile: packet-assisted
     dependencies:
-      APPLIANCE_IMAGE: agent-preinstall-image-builder
+      APPLIANCE_IMAGE: agent-release-iso-builder
     workflow: agent-e2e-appliance-dualstack
 zz_generated_metadata:
   branch: release-5.0
diff --git a/ci-operator/config/openshift/appliance/openshift-appliance-release-5.1.yaml b/ci-operator/config/openshift/appliance/openshift-appliance-release-5.1.yaml
index 21bc73995c3e0..76f9c6e7563c8 100644
--- a/ci-operator/config/openshift/appliance/openshift-appliance-release-5.1.yaml
+++ b/ci-operator/config/openshift/appliance/openshift-appliance-release-5.1.yaml
@@ -15,10 +15,12 @@ images:
     to: ubi9-minimal-entitled
   - dockerfile_path: Dockerfile.openshift-appliance
     from: ubi9-minimal-entitled
-    to: agent-preinstall-image-builder
+    to: agent-release-iso-builder
 promotion:
   to:
-  - name: "5.1"
+  - excluded_images:
+    - ubi9-minimal-entitled
+    name: "5.1"
     namespace: ocp
 releases:
   initial:
@@ -58,7 +60,7 @@ tests:
   steps:
     cluster_profile: equinix-ocp-metal
     dependencies:
-      APPLIANCE_IMAGE: agent-preinstall-image-builder
+      APPLIANCE_IMAGE: agent-release-iso-builder
     env:
       AGENT_E2E_TEST_BOOT_MODE: ISO_NO_REGISTRY
       DEVSCRIPTS_CONFIG: |
@@ -74,6 +76,8 @@ tests:
   steps:
     allow_skip_on_success: true
     cluster_profile: packet-assisted
+    dependencies:
+      APPLIANCE_IMAGE: agent-release-iso-builder
     workflow: agent-e2e-appliance-ipv4
 - always_run: false
   as: e2e-sno-dualstack-dhcp
@@ -85,7 +89,7 @@ tests:
     allow_skip_on_success: true
     cluster_profile: packet-assisted
     dependencies:
-      APPLIANCE_IMAGE: agent-preinstall-image-builder
+      APPLIANCE_IMAGE: agent-release-iso-builder
     workflow: agent-e2e-appliance-dualstack
 zz_generated_metadata:
   branch: release-5.1
diff --git a/ci-operator/jobs/openshift/appliance/openshift-appliance-agent-preinstall-image-builder-periodics.yaml b/ci-operator/jobs/openshift/appliance/openshift-appliance-agent-preinstall-image-builder-periodics.yaml
new file mode 100644
index 0000000000000..9cfd4ab492db7
--- /dev/null
+++ b/ci-operator/jobs/openshift/appliance/openshift-appliance-agent-preinstall-image-builder-periodics.yaml
@@ -0,0 +1,166 @@
+periodics:
+- agent: kubernetes
+  cluster: build05
+  cron: 00 00 */1 * 5
+  decorate: true
+  decoration_config:
+    sparse_checkout_files:
+    - Dockerfile.openshift-appliance
+  extra_refs:
+  - base_ref: agent-preinstall-image-builder
+    org: openshift
+    repo: appliance
+    sparse_checkout_files:
+    - Dockerfile.openshift-appliance
+  labels:
+    capability/intranet: intranet
+    ci-operator.openshift.io/cloud: packet-edge
+    ci-operator.openshift.io/cloud-cluster-profile: packet-assisted
+    ci.openshift.io/generator: prowgen
+    pj-rehearse.openshift.io/can-be-rehearsed: "true"
+  name: periodic-ci-openshift-appliance-agent-preinstall-image-builder-e2e-sno-dualstack-dhcp-periodic
+  spec:
+    containers:
+    - args:
+      - --gcs-upload-secret=/secrets/gcs/service-account.json
+      - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+      - --lease-server-credentials-file=/etc/boskos/credentials
+      - --report-credentials-file=/etc/report/credentials
+      - --secret-dir=/secrets/ci-pull-credentials
+      - --target=e2e-sno-dualstack-dhcp-periodic
+      command:
+      - ci-operator
+      env:
+      - name: HTTP_SERVER_IP
+        valueFrom:
+          fieldRef:
+            fieldPath: status.podIP
+      image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+      imagePullPolicy: Always
+      name: ""
+      ports:
+      - containerPort: 8080
+        name: http
+      resources:
+        requests:
+          cpu: 10m
+      volumeMounts:
+      - mountPath: /etc/boskos
+        name: boskos
+        readOnly: true
+      - mountPath: /secrets/ci-pull-credentials
+        name: ci-pull-credentials
+        readOnly: true
+      - mountPath: /secrets/gcs
+        name: gcs-credentials
+        readOnly: true
+      - mountPath: /secrets/manifest-tool
+        name: manifest-tool-local-pusher
+        readOnly: true
+      - mountPath: /etc/pull-secret
+        name: pull-secret
+        readOnly: true
+      - mountPath: /etc/report
+        name: result-aggregator
+        readOnly: true
+    serviceAccountName: ci-operator
+    volumes:
+    - name: boskos
+      secret:
+        items:
+        - key: credentials
+          path: credentials
+        secretName: boskos-credentials
+    - name: ci-pull-credentials
+      secret:
+        secretName: ci-pull-credentials
+    - name: manifest-tool-local-pusher
+      secret:
+        secretName: manifest-tool-local-pusher
+    - name: pull-secret
+      secret:
+        secretName: registry-pull-credentials
+    - name: result-aggregator
+      secret:
+        secretName: result-aggregator
+- agent: kubernetes
+  cluster: build01
+  cron: 39 1 * * *
+  decorate: true
+  decoration_config:
+    sparse_checkout_files:
+    - Dockerfile.openshift-appliance
+  extra_refs:
+  - base_ref: agent-preinstall-image-builder
+    org: openshift
+    repo: appliance
+    sparse_checkout_files:
+    - Dockerfile.openshift-appliance
+  labels:
+    ci.openshift.io/generator: prowgen
+    pj-rehearse.openshift.io/can-be-rehearsed: "true"
+  name: periodic-ci-openshift-appliance-agent-preinstall-image-builder-publish
+  spec:
+    containers:
+    - args:
+      - --gcs-upload-secret=/secrets/gcs/service-account.json
+      - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+      - --lease-server-credentials-file=/etc/boskos/credentials
+      - --report-credentials-file=/etc/report/credentials
+      - --secret-dir=/secrets/ci-pull-credentials
+      - --target=publish
+      command:
+      - ci-operator
+      env:
+      - name: HTTP_SERVER_IP
+        valueFrom:
+          fieldRef:
+            fieldPath: status.podIP
+      image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+      imagePullPolicy: Always
+      name: ""
+      ports:
+      - containerPort: 8080
+        name: http
+      resources:
+        requests:
+          cpu: 10m
+      volumeMounts:
+      - mountPath: /etc/boskos
+        name: boskos
+        readOnly: true
+      - mountPath: /secrets/ci-pull-credentials
+        name: ci-pull-credentials
+        readOnly: true
+      - mountPath: /secrets/gcs
+        name: gcs-credentials
+        readOnly: true
+      - mountPath: /secrets/manifest-tool
+        name: manifest-tool-local-pusher
+        readOnly: true
+      - mountPath: /etc/pull-secret
+        name: pull-secret
+        readOnly: true
+      - mountPath: /etc/report
+        name: result-aggregator
+        readOnly: true
+    serviceAccountName: ci-operator
+    volumes:
+    - name: boskos
+      secret:
+        items:
+        - key: credentials
+          path: credentials
+        secretName: boskos-credentials
+    - name: ci-pull-credentials
+      secret:
+        secretName: ci-pull-credentials
+    - name: manifest-tool-local-pusher
+      secret:
+        secretName: manifest-tool-local-pusher
+    - name: pull-secret
+      secret:
+        secretName: registry-pull-credentials
+    - name: result-aggregator
+      secret:
+        secretName: result-aggregator
diff --git a/ci-operator/jobs/openshift/appliance/openshift-appliance-agent-preinstall-image-builder-postsubmits.yaml b/ci-operator/jobs/openshift/appliance/openshift-appliance-agent-preinstall-image-builder-postsubmits.yaml
new file mode 100644
index 0000000000000..6f9b049f5b2c9
--- /dev/null
+++ b/ci-operator/jobs/openshift/appliance/openshift-appliance-agent-preinstall-image-builder-postsubmits.yaml
@@ -0,0 +1,63 @@
+postsubmits:
+  openshift/appliance:
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^agent-preinstall-image-builder$
+    cluster: build01
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - Dockerfile.openshift-appliance
+    labels:
+      ci-operator.openshift.io/is-promotion: "true"
+      ci.openshift.io/generator: prowgen
+    max_concurrency: 1
+    name: branch-ci-openshift-appliance-agent-preinstall-image-builder-images
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --image-mirror-push-secret=/etc/push-secret/.dockerconfigjson
+        - --promote
+        - --report-credentials-file=/etc/report/credentials
+        - --target=[images]
+        command:
+        - ci-operator
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/push-secret
+          name: push-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: push-secret
+        secret:
+          secretName: registry-push-credentials-ci-central
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
diff --git a/ci-operator/jobs/openshift/appliance/openshift-appliance-agent-preinstall-image-builder-presubmits.yaml b/ci-operator/jobs/openshift/appliance/openshift-appliance-agent-preinstall-image-builder-presubmits.yaml
new file mode 100644
index 0000000000000..f2cf2f8982cfd
--- /dev/null
+++ b/ci-operator/jobs/openshift/appliance/openshift-appliance-agent-preinstall-image-builder-presubmits.yaml
@@ -0,0 +1,359 @@
+presubmits:
+  openshift/appliance:
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^agent-preinstall-image-builder$
+    - ^agent-preinstall-image-builder-
+    cluster: build06
+    context: ci/prow/e2e-compact-ipv4-static
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - Dockerfile.openshift-appliance
+    labels:
+      capability/intranet: intranet
+      ci-operator.openshift.io/cloud: packet-edge
+      ci-operator.openshift.io/cloud-cluster-profile: packet-assisted
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-appliance-agent-preinstall-image-builder-e2e-compact-ipv4-static
+    rerun_command: /test e2e-compact-ipv4-static
+    run_if_changed: ^(cmd/.*|data/.*|pkg/.*|Dockerfile\..*|Makefile|go\.mod|go\.sum)$
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=e2e-compact-ipv4-static
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )e2e-compact-ipv4-static,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^agent-preinstall-image-builder$
+    - ^agent-preinstall-image-builder-
+    cluster: build06
+    context: ci/prow/e2e-sno-dualstack-dhcp
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - Dockerfile.openshift-appliance
+    labels:
+      capability/intranet: intranet
+      ci-operator.openshift.io/cloud: packet-edge
+      ci-operator.openshift.io/cloud-cluster-profile: packet-assisted
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-appliance-agent-preinstall-image-builder-e2e-sno-dualstack-dhcp
+    optional: true
+    rerun_command: /test e2e-sno-dualstack-dhcp
+    run_if_changed: ^(cmd/.*|data/.*|pkg/.*|Dockerfile\..*|Makefile|go\.mod|go\.sum)$
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=e2e-sno-dualstack-dhcp
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )e2e-sno-dualstack-dhcp,?($|\s.*)
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^agent-preinstall-image-builder$
+    - ^agent-preinstall-image-builder-
+    cluster: build01
+    context: ci/prow/images
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - Dockerfile.openshift-appliance
+    labels:
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-appliance-agent-preinstall-image-builder-images
+    rerun_command: /test images
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --report-credentials-file=/etc/report/credentials
+        - --target=[images]
+        - --target=[release:latest]
+        command:
+        - ci-operator
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )images,?($|\s.*)
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^agent-preinstall-image-builder$
+    - ^agent-preinstall-image-builder-
+    cluster: build01
+    context: ci/prow/lint
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - Dockerfile.openshift-appliance
+    labels:
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-appliance-agent-preinstall-image-builder-lint
+    rerun_command: /test lint
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --report-credentials-file=/etc/report/credentials
+        - --target=lint
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )lint,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^agent-preinstall-image-builder$
+    - ^agent-preinstall-image-builder-
+    cluster: build01
+    context: ci/prow/unit-test
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - Dockerfile.openshift-appliance
+    labels:
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-appliance-agent-preinstall-image-builder-unit-test
+    rerun_command: /test unit-test
+    run_if_changed: ^(cmd/.*|data/.*|hack/.*|pkg/.*|Dockerfile\..*|Makefile|go\.mod|go\.sum)$
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --report-credentials-file=/etc/report/credentials
+        - --target=unit-test
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )unit-test,?($|\s.*)
diff --git a/ci-operator/jobs/openshift/appliance/openshift-appliance-master-periodics.yaml b/ci-operator/jobs/openshift/appliance/openshift-appliance-master-periodics.yaml
index 1dfebd568f4ac..06ff06af55c71 100644
--- a/ci-operator/jobs/openshift/appliance/openshift-appliance-master-periodics.yaml
+++ b/ci-operator/jobs/openshift/appliance/openshift-appliance-master-periodics.yaml
@@ -83,84 +83,3 @@ periodics:
     - name: result-aggregator
       secret:
         secretName: result-aggregator
-- agent: kubernetes
-  cluster: build05
-  cron: 11 3 * * *
-  decorate: true
-  decoration_config:
-    sparse_checkout_files:
-    - Dockerfile.openshift-appliance
-  extra_refs:
-  - base_ref: master
-    org: openshift
-    repo: appliance
-    sparse_checkout_files:
-    - Dockerfile.openshift-appliance
-  labels:
-    ci.openshift.io/generator: prowgen
-    pj-rehearse.openshift.io/can-be-rehearsed: "true"
-  name: periodic-ci-openshift-appliance-master-publish
-  spec:
-    containers:
-    - args:
-      - --gcs-upload-secret=/secrets/gcs/service-account.json
-      - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
-      - --lease-server-credentials-file=/etc/boskos/credentials
-      - --report-credentials-file=/etc/report/credentials
-      - --secret-dir=/secrets/ci-pull-credentials
-      - --target=publish
-      command:
-      - ci-operator
-      env:
-      - name: HTTP_SERVER_IP
-        valueFrom:
-          fieldRef:
-            fieldPath: status.podIP
-      image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
-      imagePullPolicy: Always
-      name: ""
-      ports:
-      - containerPort: 8080
-        name: http
-      resources:
-        requests:
-          cpu: 10m
-      volumeMounts:
-      - mountPath: /etc/boskos
-        name: boskos
-        readOnly: true
-      - mountPath: /secrets/ci-pull-credentials
-        name: ci-pull-credentials
-        readOnly: true
-      - mountPath: /secrets/gcs
-        name: gcs-credentials
-        readOnly: true
-      - mountPath: /secrets/manifest-tool
-        name: manifest-tool-local-pusher
-        readOnly: true
-      - mountPath: /etc/pull-secret
-        name: pull-secret
-        readOnly: true
-      - mountPath: /etc/report
-        name: result-aggregator
-        readOnly: true
-    serviceAccountName: ci-operator
-    volumes:
-    - name: boskos
-      secret:
-        items:
-        - key: credentials
-          path: credentials
-        secretName: boskos-credentials
-    - name: ci-pull-credentials
-      secret:
-        secretName: ci-pull-credentials
-    - name: manifest-tool-local-pusher
-      secret:
-        secretName: manifest-tool-local-pusher
-    - name: pull-secret
-      secret:
-        secretName: registry-pull-credentials
-    - name: result-aggregator
-      secret:
-        secretName: result-aggregator
diff --git a/core-services/prow/02_config/openshift/appliance/_prowconfig.yaml b/core-services/prow/02_config/openshift/appliance/_prowconfig.yaml
index 3c877a4aa1b5f..08cbabee7dc37 100644
--- a/core-services/prow/02_config/openshift/appliance/_prowconfig.yaml
+++ b/core-services/prow/02_config/openshift/appliance/_prowconfig.yaml
@@ -1,9 +1,64 @@
 tide:
-  merge_method:
-    openshift/appliance: squash
   queries:
-  - labels:
+  - includedBranches:
+    - release-4.20
+    - release-4.21
+    labels:
     - approved
+    - backport-risk-assessed
+    - jira/valid-bug
+    - jira/valid-reference
+    - lgtm
+    - verified
+    missingLabels:
+    - backports/unvalidated-commits
+    - do-not-merge/hold
+    - do-not-merge/invalid-owners-file
+    - do-not-merge/work-in-progress
+    - jira/invalid-bug
+    - needs-rebase
+    repos:
+    - openshift/appliance
+  - includedBranches:
+    - release-4.22
+    labels:
+    - approved
+    - backport-risk-assessed
+    - jira/valid-bug
+    - jira/valid-reference
+    - lgtm
+    - verified
+    missingLabels:
+    - backports/unvalidated-commits
+    - do-not-merge/hold
+    - do-not-merge/invalid-owners-file
+    - do-not-merge/work-in-progress
+    - jira/invalid-bug
+    - needs-rebase
+    repos:
+    - openshift/appliance
+  - includedBranches:
+    - main
+    - master
+    labels:
+    - approved
+    - jira/valid-reference
+    - lgtm
+    - verified
+    missingLabels:
+    - backports/unvalidated-commits
+    - do-not-merge/hold
+    - do-not-merge/invalid-owners-file
+    - do-not-merge/work-in-progress
+    - jira/invalid-bug
+    - needs-rebase
+    repos:
+    - openshift/appliance
+  - includedBranches:
+    - agent-preinstall-image-builder
+    labels:
+    - approved
+    - jira/valid-reference
     - lgtm
     missingLabels:
     - backports/unvalidated-commits