openshift · openshift-merge-bot · Apr 29, 2026 · Apr 29, 2026 · Apr 29, 2026 · Apr 29, 2026
diff --git a/Makefile.version.aarch64.var b/Makefile.version.aarch64.var
@@ -1 +1 @@
-OCP_VERSION := 5.0.0-0.nightly-arm64-2026-04-26-061912
+OCP_VERSION := 5.0.0-0.nightly-arm64-2026-04-28-233705
diff --git a/assets/components/multus/kustomization.aarch64.yaml b/assets/components/multus/kustomization.aarch64.yaml
@@ -2,7 +2,7 @@
 images:
   - name: multus-cni-microshift
     newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev
-    digest: sha256:0ff82fc01ef11f9c8c967b068a153081a4b19165eaa15fbb7f6f26e722f57bb9
+    digest: sha256:d1a37c0124888c17bfd578e6312443aed062ab8a0f47ef6be518ba11feaf7fc3
   - name: containernetworking-plugins-microshift
     newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev
-    digest: sha256:6c85c16c63d0c4a0aa3b9d1ddbf07a4fed224ee680fab72167d80039d9d1db6d
+    digest: sha256:e412d7bfc2bc103930fdd4680e02733e9ad515f724bf1651b1f34202ad026e6a
diff --git a/assets/components/multus/release-multus-aarch64.json b/assets/components/multus/release-multus-aarch64.json
@@ -1,9 +1,9 @@
 {
   "release": {
-    "base": "5.0.0-0.nightly-arm64-2026-04-26-061912"
+    "base": "5.0.0-0.nightly-arm64-2026-04-28-233705"
   },
   "images": {
-    "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:0ff82fc01ef11f9c8c967b068a153081a4b19165eaa15fbb7f6f26e722f57bb9",
-    "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:6c85c16c63d0c4a0aa3b9d1ddbf07a4fed224ee680fab72167d80039d9d1db6d"
+    "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:d1a37c0124888c17bfd578e6312443aed062ab8a0f47ef6be518ba11feaf7fc3",
+    "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:e412d7bfc2bc103930fdd4680e02733e9ad515f724bf1651b1f34202ad026e6a"
   }
 }
diff --git a/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml b/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml
@@ -2,26 +2,26 @@
 images:
   - name: quay.io/operator-framework/olm
     newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev
-    digest: sha256:b96dd6dc0b0c403ba36dd7166ea5c0e8ac874b6bd482c91853dafda62471bcf3
+    digest: sha256:61b31ed5c54ccda514efad91215557de2b019c2f31210671ac0ad48f72f32ccf
   - name: quay.io/operator-framework/configmap-operator-registry
     newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev
-    digest: sha256:dd783995e5f3ed48d50f06be68ed27c76271f65c896003a17a65355636828a40
+    digest: sha256:05b26c0cbac278f457b1c05778e3195368f835f71fc0e36c31ad2cb99a11d4db
   - name: quay.io/openshift/origin-kube-rbac-proxy
     newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev
-    digest: sha256:188e0afb591fde5922b2a3df21597a7f42a4e1e1f3b4e1e68f66b9691be5a6da
+    digest: sha256:613bb10734418c7e80b2913c49705fff5846e3beb8ac1a3871509e38a3a2fb8f
 
 patches:
   - patch: |-
      - op: add
        path: /spec/template/spec/containers/0/env/-
        value:
          name: OPERATOR_REGISTRY_IMAGE
-         value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:dd783995e5f3ed48d50f06be68ed27c76271f65c896003a17a65355636828a40
+         value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:05b26c0cbac278f457b1c05778e3195368f835f71fc0e36c31ad2cb99a11d4db
      - op: add
        path: /spec/template/spec/containers/0/env/-
        value:
          name: OLM_IMAGE
-         value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:b96dd6dc0b0c403ba36dd7166ea5c0e8ac874b6bd482c91853dafda62471bcf3
+         value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:61b31ed5c54ccda514efad91215557de2b019c2f31210671ac0ad48f72f32ccf
     target:
       kind: Deployment
       labelSelector: app=catalog-operator
diff --git a/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json b/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json
@@ -1,10 +1,10 @@
 {
   "release": {
-    "base": "5.0.0-0.nightly-arm64-2026-04-26-061912"
+    "base": "5.0.0-0.nightly-arm64-2026-04-28-233705"
   },
   "images": {
-    "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:b96dd6dc0b0c403ba36dd7166ea5c0e8ac874b6bd482c91853dafda62471bcf3",
-    "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:dd783995e5f3ed48d50f06be68ed27c76271f65c896003a17a65355636828a40",
-    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:188e0afb591fde5922b2a3df21597a7f42a4e1e1f3b4e1e68f66b9691be5a6da"
+    "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:61b31ed5c54ccda514efad91215557de2b019c2f31210671ac0ad48f72f32ccf",
+    "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:05b26c0cbac278f457b1c05778e3195368f835f71fc0e36c31ad2cb99a11d4db",
+    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:613bb10734418c7e80b2913c49705fff5846e3beb8ac1a3871509e38a3a2fb8f"
   }
 }
diff --git a/assets/release/release-aarch64.json b/assets/release/release-aarch64.json
@@ -1,16 +1,16 @@
 {
   "release": {
-    "base": "5.0.0-0.nightly-arm64-2026-04-26-061912"
+    "base": "5.0.0-0.nightly-arm64-2026-04-28-233705"
   },
   "images": {
-    "cli": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:b45003e3d4165bc1be8d60a0d3e1dcf8ba09f43e899a37644bc9b2a5ffe31465",
-    "coredns": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:ce6323527616cf848ecffc431bbd356c94e99a8a4d0d8b6133fdbf962e7654d6",
-    "haproxy-router": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:17552ef39754cf1b53c4c96dd107d1a0f59213a695bfff31d5a21acf941fa84a",
-    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:188e0afb591fde5922b2a3df21597a7f42a4e1e1f3b4e1e68f66b9691be5a6da",
-    "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:d9a45a6d73117cc3dbc49d6525ab2002f9fba659d59bd81491654f766af70ef0",
-    "pod": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:38547ae2d0f8c57fbb5f2513434725013f738a9bd59850e593ec60ce7c07b3f9",
-    "service-ca-operator": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:20f72cb0464291673aad8cfee875a822514b307d2326b70f2bf3caa8ccd3048a",
+    "cli": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:20abfa12212c9f9dd0325a8b0151011743e1e7cdc35d821ca6bb697ecf2bfb76",
+    "coredns": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:5a3b80c36e17b250d1af8c14892a3335714ecf82db75d069a5daa4a1b99464ed",
+    "haproxy-router": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:68dbd10a0844352b10ffd8f806e1f601df3a1b9902ba4d7822c614613a511645",
+    "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:613bb10734418c7e80b2913c49705fff5846e3beb8ac1a3871509e38a3a2fb8f",
+    "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:301bd3b3da542ada92d563a9bcc0ca64bb0ad446ec0a65b743bf8bd1bbfa8f9f",
+    "pod": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:17d238add9f701323815480d278c4fa5e857fffd582289ba73ca49708fb19480",
+    "service-ca-operator": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:44d4715d6e5275c659419f3717b926c2e323ea8661d95b754b14b1ad9dd70ed9",
     "lvms_operator": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:3766640b19c336b443619ecdb35f36b479c79ea71b21de97febf024a5eaf6c84",
-    "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:0948fefd33dca6abef683a5280b79e0766c11ffccd9780e66de363d774331196"
+    "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:b3909056067d61252190b978b5e816008bf9a0f8b112c536e6226f0d57c24b83"
   }
 }
diff --git a/etcd/go.mod b/etcd/go.mod
@@ -5,7 +5,7 @@ go 1.25.0
 replace github.com/openshift/microshift => ../
 
 require (
-	github.com/openshift/api v0.0.0-20260416215613-f9587f6e7c60
+	github.com/openshift/api v0.0.0-20260424174501-4f63a40a2970
 	github.com/openshift/build-machinery-go v0.0.0-20251023084048-5d77c1a5e5af
 	github.com/openshift/microshift v0.0.0-00010101000000-000000000000
 	github.com/spf13/cobra v1.10.2

diff --git a/etcd/go.sum b/etcd/go.sum
@@ -152,8 +152,8 @@ github.com/oklog/run v1.2.0 h1:O8x3yXwah4A73hJdlrwo/2X6J62gE5qTMusH0dvz60E=
 github.com/oklog/run v1.2.0/go.mod h1:mgDbKRSwPhJfesJ4PntqFUbKQRZ50NgmZTSPlFA0YFk=
 github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
 github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
-github.com/openshift/api v0.0.0-20260416215613-f9587f6e7c60 h1:/BT4yqpRo6O21GkacqhE7opGGjPvYOjfzecNggZq0QQ=
-github.com/openshift/api v0.0.0-20260416215613-f9587f6e7c60/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo=
+github.com/openshift/api v0.0.0-20260424174501-4f63a40a2970 h1:xyz8VL2VnskV4YTDaHrAmBxFLyyPjxOt5dYZRBeAvmk=
+github.com/openshift/api v0.0.0-20260424174501-4f63a40a2970/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo=
 github.com/openshift/build-machinery-go v0.0.0-20251023084048-5d77c1a5e5af h1:UiYYMi/CCV+kwWrXuXfuUSOY2yNXOpWpNVgHc6aLQlE=
 github.com/openshift/build-machinery-go v0.0.0-20251023084048-5d77c1a5e5af/go.mod h1:8jcm8UPtg2mCAsxfqKil1xrmRMI3a+XU2TZ9fF8A7TE=
 github.com/openshift/etcd/api/v3 v3.5.0-alpha.0.0.20260312150232-d8d67b8ce849 h1:em2blvFukNrVPlEZuMA1rHioi0eFjSk5qvV/Yp02HxQ=

diff --git a/etcd/vendor/github.com/openshift/api/config/v1/types_authentication.go b/etcd/vendor/github.com/openshift/api/config/v1/types_authentication.go
diff --git a/etcd/vendor/modules.txt b/etcd/vendor/modules.txt
@@ -197,7 +197,7 @@ github.com/munnerz/goautoneg
 # github.com/oklog/run v1.2.0
 ## explicit; go 1.20
 github.com/oklog/run
-# github.com/openshift/api v0.0.0-20260416215613-f9587f6e7c60
+# github.com/openshift/api v0.0.0-20260424174501-4f63a40a2970
 ## explicit; go 1.25.0
 github.com/openshift/api/config/v1
 github.com/openshift/api/operator/v1

diff --git a/packaging/crio.conf.d/10-microshift_arm64.conf b/packaging/crio.conf.d/10-microshift_arm64.conf
@@ -2,6 +2,6 @@
 # for community builds on top of OKD, this setting has no effect
 [crio.image]
 global_auth_file="/etc/crio/openshift-pull-secret"
-pause_image = "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:38547ae2d0f8c57fbb5f2513434725013f738a9bd59850e593ec60ce7c07b3f9"
+pause_image = "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:17d238add9f701323815480d278c4fa5e857fffd582289ba73ca49708fb19480"
 pause_image_auth_file = "/etc/crio/openshift-pull-secret"
 pause_command = "/usr/bin/pod"
diff --git a/scripts/auto-rebase/changelog.txt b/scripts/auto-rebase/changelog.txt
@@ -1,66 +1,6 @@
-- api embedded-component 34e60874783e455a38f466e1d0c572bbb3d17c51 to 4f63a40a2970d8bcc2f3767bc6b57e09880544fb
-  - b6544bf1 2026-04-21T11:16:04Z Remove UserNamespacesPodSecurityStandards and UserNamespacesSupport feature gates
+- ovn-kubernetes image-arm64 aaa4085f32001c72a7f02557aae8ded035deb341 to ab5bb67189c6626e5a55ab341a7cfb689d50d88f
+  - ce1390ec 2026-04-21T11:46:36+02:00 OTE: run few EVPN tests which use random VTEP subnet
 
-- cluster-ingress-operator embedded-component f40071e60c14be1ee12772a260c08adaadaf3e94 to 961ac218364fb5f6de970ade1161ece3b8195aed
-  - 2cdc405 2026-04-03T10:00:19-04:00 Fix race condition in internal-to-external LB migration test
-  - 28f66b0 2026-03-31T16:06:00-04:00 NE-2390: Add system context and strategic orientation to AGENTS.md
-  - 76aebbe 2026-03-02T13:02:31Z NE-2390: Address review comments on AGENTS.md
-  - 0e2bf51 2026-01-15T13:13:39Z NE-2390: Adding AGENTS.md file to
-
-- cluster-network-operator embedded-component bdbba59d992a4b2846591ac5260ea12fd14481e0 to 142432afacfb9cd11a9bd4e5e333bd6a4cdcd555
-  - 18ef2d9 2026-03-30T08:53:55+02:00 Allowlist controller: fix error handling in config map existence check
-  - f3abaf7 2026-03-30T08:53:55+02:00 Allowlist controller: inline single-use helper functions
-  - 01a4fc1 2026-03-30T08:53:55+02:00 Allowlist controller: remove unused scheme field
-  - 8682b2e 2026-03-30T08:53:55+02:00 Allowlist controller: remove unused configmap template
-  - 8f4d3bb 2026-03-30T08:53:55+02:00 Allowlist controller: refactor names in controller code
-
-- cluster-openshift-controller-manager-operator embedded-component e1c3674198c6c1274fd3fd3c3108eb4cade4eb0a to c941a99dd2b9200c0de23606c4372d33d656a756
-  - 2221135 2026-04-17T12:50:54-04:00 Add control-plane-approvers to OWNERS
-
-- kubernetes embedded-component 354a124256da76c98d191bf53149eb4578fee0d7 to 757ccdfcf9a1f89059acaba311c3625c495a6732
-  - 6cb4b77d1 2026-04-10T17:24:36+02:00 UPSTREAM: 138318: DRA: use full image name in test manifests
-  - 6bdaf8d14 2026-04-09T17:48:14+02:00 UPSTREAM: 136337: DRA E2E: use image utils to manage hostpath image
-  - 7158cad4a 2026-04-09T17:38:44+02:00 UPSTREAM: 136913: Update the csi-driver-host-path version to 1.17.1
-
-- machine-config-operator embedded-component c3a9db7663f116037e10ed526e35f1c20e5a6f3b to b5d168576877cda02f8c8764b49a98fda23df825
-  - fd094b02 2026-04-23T14:29:45+02:00 OCPBUGS-84218: Fix units rollback if update failure
-  - 7aeb7b85 2026-04-22T10:46:35-04:00 add RootCA cert to the sysContextBuilder certs
-  - 006070e7 2026-04-13T10:15:44-04:00 improve JSON unmarshalling for secret decoding
-
-- operator-framework-olm embedded-component e627823c743797da91b4ae8a318d2420a511b752 to 122728c856e9436ea5ab763bf57977047691bb90
-  - f31d8dec 2026-04-15T00:05:09Z Bump softprops/action-gh-release from 2 to 3 (#3815)
-  - fe2ab6f6 2026-04-15T00:04:22Z :seedling: Bump golang.org/x/net from 0.52.0 to 0.53.0 (#3814)
-  - 1001b6a7 2026-04-15T00:04:02Z remove stale owners (#3813)
-  - 24ea4fb7 2026-04-15T00:03:44Z :seedling: Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 (#3811)
-
-- service-ca-operator embedded-component 7b3033bba87d7b40684b66f8f44a3525433d1ac7 to 95674f775bcff10cfec79a61a0e3451e4c48eb71
-  - 63ecf71 2026-03-03T10:22:22+01:00 controller/servingcerts: Align log verbosity
-
-- oc image-amd64 30bb6e56a38d49b6d646a260be79b072dc27dab1 to 6b8e30c5b39aa742147846341a203905e04834f3
-  - ad1b93fb 2026-04-21T22:31:23+05:30 Add support for groups via YAML/JSON
-
-- ovn-kubernetes image-amd64 90d101f8b4ebae811d1a0ea195d98a5a85ffaef1 to aaa4085f32001c72a7f02557aae8ded035deb341
-  - 85383e01 2026-04-21T15:44:44-07:00 OTE: tolerate missing OpenShift CRDs on MicroShift
-  - 5ae54ebf 2026-04-13T14:11:22+02:00 OTE: Wait for default sa to be provisioned in test namespace
-  - bf97aec4 2026-04-13T14:11:22+02:00 OTE: Add FeatureGate:EVPN label for EVPN E2Es
-  - f2653a31 2026-04-13T14:11:22+02:00 OTE: Extract external container networking to dedicated provider
-  - 924d6e3b 2026-04-13T14:11:22+02:00 OTE: Enable EVPN E2Es
-  - 73db83b9 2026-04-13T14:11:22+02:00 OTE: Add external container support to infra provider
-
-- kubernetes image-amd64 354a124256da76c98d191bf53149eb4578fee0d7 to 757ccdfcf9a1f89059acaba311c3625c495a6732
-  - 6cb4b77d1 2026-04-10T17:24:36+02:00 UPSTREAM: 138318: DRA: use full image name in test manifests
-  - 6bdaf8d14 2026-04-09T17:48:14+02:00 UPSTREAM: 136337: DRA E2E: use image utils to manage hostpath image
-  - 7158cad4a 2026-04-09T17:38:44+02:00 UPSTREAM: 136913: Update the csi-driver-host-path version to 1.17.1
-
-- service-ca-operator image-amd64 7b3033bba87d7b40684b66f8f44a3525433d1ac7 to 95674f775bcff10cfec79a61a0e3451e4c48eb71
-  - 63ecf71 2026-03-03T10:22:22+01:00 controller/servingcerts: Align log verbosity
-
-- oc image-arm64 30bb6e56a38d49b6d646a260be79b072dc27dab1 to 6b8e30c5b39aa742147846341a203905e04834f3
-  - ad1b93fb 2026-04-21T22:31:23+05:30 Add support for groups via YAML/JSON
-
-- ovn-kubernetes image-arm64 ad4056529c72b7c0cebdffa9b49ff04a7828748e to aaa4085f32001c72a7f02557aae8ded035deb341
-  - 85383e01 2026-04-21T15:44:44-07:00 OTE: tolerate missing OpenShift CRDs on MicroShift
-
-- service-ca-operator image-arm64 7b3033bba87d7b40684b66f8f44a3525433d1ac7 to 95674f775bcff10cfec79a61a0e3451e4c48eb71
-  - 63ecf71 2026-03-03T10:22:22+01:00 controller/servingcerts: Align log verbosity
+- service-ca-operator image-arm64 95674f775bcff10cfec79a61a0e3451e4c48eb71 to 2aa88ace39a1abe7647bc5b03e6a599985b31605
+  - d88fd6f 2026-04-27T10:34:13-04:00 Add control-plane-approvers to OWNERS
 
diff --git a/scripts/auto-rebase/commits.txt b/scripts/auto-rebase/commits.txt
@@ -30,6 +30,6 @@ https://github.com/openshift/coredns image-arm64 0dded2d232dab43c107b1dab9d0d9fd
 https://github.com/openshift/csi-external-snapshotter image-arm64 d1bc3ffaa9759c13a06c2ec61c541342e71bd109
 https://github.com/openshift/router image-arm64 896390778ebe15f57f87e6ca78f11c96e64c2652
 https://github.com/openshift/kube-rbac-proxy image-arm64 d12e274605248f6c59373240a7eae7a7a357dcb3
-https://github.com/openshift/ovn-kubernetes image-arm64 aaa4085f32001c72a7f02557aae8ded035deb341
+https://github.com/openshift/ovn-kubernetes image-arm64 ab5bb67189c6626e5a55ab341a7cfb689d50d88f
 https://github.com/openshift/kubernetes image-arm64 757ccdfcf9a1f89059acaba311c3625c495a6732
-https://github.com/openshift/service-ca-operator image-arm64 95674f775bcff10cfec79a61a0e3451e4c48eb71
+https://github.com/openshift/service-ca-operator image-arm64 2aa88ace39a1abe7647bc5b03e6a599985b31605
diff --git a/scripts/auto-rebase/last_rebase.sh b/scripts/auto-rebase/last_rebase.sh
@@ -1,2 +1,2 @@
 #!/bin/bash -x
-./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-04-26-064718" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.0.0-0.nightly-arm64-2026-04-26-061912"
+./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-04-26-064718" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.0.0-0.nightly-arm64-2026-04-28-233705"
diff --git a/scripts/auto-rebase/rebase.sh b/scripts/auto-rebase/rebase.sh
@@ -1135,6 +1135,12 @@ update_olm_images() {
     sed -i -r 's,(image: [a-z./-]*)[@:].*,\1,' "${REPOROOT}/assets/optional/operator-lifecycle-manager/0000_50_olm_07-olm-operator.deployment.yaml"
     sed -i -r 's,(image: [a-z./-]*)[@:].*,\1,' "${REPOROOT}/assets/optional/operator-lifecycle-manager/0000_50_olm_08-catalog-operator.deployment.yaml"
 
+    # If the marketplace default-deny-all NetworkPolicy is not referenced in kustomization - add it.
+    # Downstream carry for OCPBUGS-59566 that upstream OLM does not include.
+    if ! grep -q "0000_50_olm_01-marketplace-networkpolicy.yaml" "${olm_kustomization}"; then
+        sed -i '/0000_50_olm_01-networkpolicies.yaml/a\  - 0000_50_olm_01-marketplace-networkpolicy.yaml' "${olm_kustomization}"
+    fi
+
     # If namespaces sourced from openshift/operator-lifecycle-manager do not contain openshift-marketplace - add it.
     # This conditional will make the transition easier when the namespace is added in upstream manifests.
     if ! grep -qw "openshift-marketplace" "${REPOROOT}/assets/optional/operator-lifecycle-manager/0000_50_olm_00-namespace.yaml"; then
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		OCP_VERSION := 5.0.0-0.nightly-arm64-2026-04-26-061912
		OCP_VERSION := 5.0.0-0.nightly-arm64-2026-04-28-233705