diff --git a/ci/prow-build.sh b/ci/prow-build.sh
index 09b40a525..ab86fb053 100755
--- a/ci/prow-build.sh
+++ b/ci/prow-build.sh
@@ -43,12 +43,10 @@ fi
 ocpver=$(rpm-ostree compose tree --print-only src/config/manifest.yaml | jq -r '.["mutate-os-release"]')
 ocpver_mut=$(rpm-ostree compose tree --print-only src/config/manifest.yaml | jq -r '.["mutate-os-release"]' | sed 's|\.|-|')
 prev_build_url=${REDIRECTOR_URL}/rhcos-${ocpver}/
-# we want to use RHEL 8.5 for testing until we can start using 8.6
-# see https://github.com/openshift/release/pull/26193
-curl -L http://base-"${ocpver_mut}"-rhel85.ocp.svc.cluster.local > src/config/ocp.repo
-# fetch the 8.6 appstream repo to enable building of extensions
-# see: https://github.com/openshift/os/issues/795
-curl -Ls http://base-"${ocpver_mut}"-rhel86.ocp.svc.cluster.local | grep -A 3 rhel-8-appstream | sed '1,3 s/rhel-8-appstream/rhel-86-appstream/g' >> src/config/ocp.repo
+
+# Fetch RHEL 8.6 repos
+curl -L http://base-"${ocpver_mut}"-rhel86.ocp.svc.cluster.local > src/config/ocp.repo
+
 cosa buildfetch --url=${prev_build_url}
 cosa fetch
 cosa build
diff --git a/extensions.yaml b/extensions.yaml
index 1f0d8b805..d989e3b06 100644
--- a/extensions.yaml
+++ b/extensions.yaml
@@ -57,6 +57,6 @@ extensions:
       enable:
         - virt:rhel
     repos:
-      - rhel-86-appstream
+      - rhel-8-appstream
     packages:
       - kata-containers
diff --git a/kola-denylist.yaml b/kola-denylist.yaml
index fc25034b2..3d5e7adc2 100644
--- a/kola-denylist.yaml
+++ b/kola-denylist.yaml
@@ -27,12 +27,3 @@
   tracker: https://github.com/coreos/coreos-assembler/issues/2725
   arches:
   - ppc64le
-# Disable until we rebase back to RHEL 8.6
-- pattern: ext.config.shared.var-mount.scsi-id
-  tracker: https://github.com/openshift/os/issues/710
-  arches:
-  - s390x
-# Disable until we revert NM back to RHEL 8.6
-- pattern: ext.config.shared.networking.default-network-behavior-change
-  tracker: https://bugzilla.redhat.com/show_bug.cgi?id=2077605
-  snooze: 2022-05-05
diff --git a/manifest.yaml b/manifest.yaml
index a15068457..f84ae9869 100644
--- a/manifest.yaml
+++ b/manifest.yaml
@@ -7,13 +7,12 @@ rojig:
 include:
   - fedora-coreos-config/manifests/ignition-and-ostree.yaml
   - fedora-coreos-config/manifests/file-transfer.yaml
-  # - fedora-coreos-config/manifests/networking-tools.yaml
+  - fedora-coreos-config/manifests/networking-tools.yaml
   - fedora-coreos-config/manifests/system-configuration.yaml
   - fedora-coreos-config/manifests/user-experience.yaml
   - fedora-coreos-config/manifests/shared-workarounds.yaml
   # RHCOS owned packages
   - rhcos-packages.yaml
-  - networking-tools.yaml
 
 ostree-layers:
   - overlay/01fcos
@@ -24,7 +23,7 @@ ostree-layers:
   - overlay/15rhcos-tuned-bits
   - overlay/20platform-chrony
   - overlay/21dhcp-chrony
-  - overlay/25rhcos-azure-udev-rules
+  - overlay/25rhcos-azure-udev
 
 arch-include:
   x86_64:
@@ -47,7 +46,7 @@ repos:
 rpmdb: bdb
 
 # We include hours/minutes to avoid version number reuse
-automatic-version-prefix: "411.85.<date:%Y%m%d%H%M>"
+automatic-version-prefix: "411.86.<date:%Y%m%d%H%M>"
 # This ensures we're semver-compatible which OpenShift wants
 automatic-version-suffix: "-"
 # Keep this is sync with the version in postprocess
@@ -156,17 +155,20 @@ postprocess:
      OSTREE_VERSION="${OSTREE_VERSION}"
      EOF
      )
+     rm -f /etc/os-release
+     ln -s ../usr/lib/os-release /etc/os-release
 
      # Tweak /etc/system-release, /etc/system-release-cpe & /etc/redhat-release
      (
      . /etc/os-release
-     cat > /etc/system-release-cpe <<EOF
+     cat > /usr/lib/system-release-cpe <<EOF
      ${CPE_NAME}
      EOF
-     cat > /usr/lib/redhat-release <<EOF
+     cat > /usr/lib/system-release <<EOF
      ${NAME} release ${VERSION_ID}
      EOF
-     rm -f /etc/system-release /etc/redhat-release
+     rm -f /etc/system-release-cpe /etc/system-release /etc/redhat-release
+     ln -s /usr/lib/system-release-cpe /etc/system-release-cpe
      ln -s /usr/lib/system-release /etc/system-release
      ln -s /usr/lib/system-release /etc/redhat-release
      )
@@ -353,32 +355,24 @@ repo-packages:
       - nss-altfiles
   - repo: rhel-8-server-ose
     packages:
-      # eventually, we want the one from the container-tools module, but we're
-      # not there yet
-      - toolbox
-      # These are the only container stack packages we don't get from modularity
-      # nor from base RHEL for various reasons. See:
-      # https://github.com/openshift/os/pull/681#issuecomment-1022443830
-      #
-      # newer than what is included in RHEL 8.4.Z EUS, but addresses some BZs
-      # that customers were encountering
+      # Starting with 4.11, we are working with the Containers team to build
+      # certain container-tools RPMs in the RHAOS branches for RHCOS + RHEL
+      # worker nodes.
+      - conmon
       - container-selinux
-      # newer than what is included in RHEL 8.4.Z EUS, because the k8s folks
-      # wanted to start testing with 1.x versions of crun
+      - containernetworking-plugins
+      - containers-common
+      - criu
       - crun
-      # slightly newer than what is included in RHEL 8.4.Z EUS, because we had
-      # previously shipped a newer version in OCP/RHCOS 4.9 and had to preserve
-      # the upgrade path
+      - fuse-overlayfs
+      - podman
       - runc
-      # Need an updated skopeo for https://github.com/containers/skopeo/pull/1476
-      # for coreos layering work
-      - containers-common
       - skopeo
+      - slirp4netns
+      - toolbox
 
 modules:
   enable:
-    # podman stack; see https://github.com/openshift/os/pull/681#issuecomment-1022443830
-    - container-tools:rhel8
     # qemu-guest-agent
     - virt:rhel
 
diff --git a/networking-tools.yaml b/networking-tools.yaml
deleted file mode 100644
index 3f186fcee..000000000
--- a/networking-tools.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
-# This defines a set of tools that are useful for configuring, debugging,
-# or manipulating the network of a system.  It is desired to keep this list
-# generic enough to be shared downstream with RHCOS.
-
-packages:
-  # Standard tools for configuring network/hostname
-  - hostname
-  # Teaming https://github.com/coreos/fedora-coreos-config/pull/289 
-  # and http://bugzilla.redhat.com/1758162
-  - teamd
-  # Route manipulation and QoS
-  - iproute iproute-tc
-  # Firewall manipulation
-  - iptables nftables
-  # Interactive network tools for admins
-  - socat net-tools bind-utils
diff --git a/overlay.d/25rhcos-azure-udev-rules/statoverride b/overlay.d/25rhcos-azure-udev-rules/statoverride
deleted file mode 100644
index 27a95affe..000000000
--- a/overlay.d/25rhcos-azure-udev-rules/statoverride
+++ /dev/null
@@ -1,2 +0,0 @@
-# Config file for overriding permission bits on overlay files/dirs
-# Format: =<file mode in decimal> <absolute path to a file or directory>
diff --git a/overlay.d/25rhcos-azure-udev-rules/usr/lib/udev/rules.d/66-azure-storage.rules b/overlay.d/25rhcos-azure-udev-rules/usr/lib/udev/rules.d/66-azure-storage.rules
deleted file mode 100644
index 5fb369303..000000000
--- a/overlay.d/25rhcos-azure-udev-rules/usr/lib/udev/rules.d/66-azure-storage.rules
+++ /dev/null
@@ -1,28 +0,0 @@
-ACTION=="add|change", SUBSYSTEM=="block", ENV{ID_VENDOR}=="Msft", ENV{ID_MODEL}=="Virtual_Disk", GOTO="azure_disk"
-GOTO="azure_end"
-
-LABEL="azure_disk"
-# Root has a GUID of 0000 as the second value
-# The resource/resource has GUID of 0001 as the second value
-ATTRS{device_id}=="?00000000-0000-*", ENV{fabric_name}="root", GOTO="azure_names"
-ATTRS{device_id}=="?00000000-0001-*", ENV{fabric_name}="resource", GOTO="azure_names"
-ATTRS{device_id}=="?00000001-0001-*", ENV{fabric_name}="BEK", GOTO="azure_names"
-# Wellknown SCSI controllers
-ATTRS{device_id}=="{f8b3781a-1e82-4818-a1c3-63d806ec15bb}", ENV{fabric_scsi_controller}="scsi0", GOTO="azure_datadisk"
-ATTRS{device_id}=="{f8b3781b-1e82-4818-a1c3-63d806ec15bb}", ENV{fabric_scsi_controller}="scsi1", GOTO="azure_datadisk"
-ATTRS{device_id}=="{f8b3781c-1e82-4818-a1c3-63d806ec15bb}", ENV{fabric_scsi_controller}="scsi2", GOTO="azure_datadisk"
-ATTRS{device_id}=="{f8b3781d-1e82-4818-a1c3-63d806ec15bb}", ENV{fabric_scsi_controller}="scsi3", GOTO="azure_datadisk"
-GOTO="azure_end"
-
-# Retrieve LUN number for datadisks
-LABEL="azure_datadisk"
-ENV{DEVTYPE}=="partition", PROGRAM="/bin/sh -c 'readlink /sys/class/block/%k/../device|cut -d: -f4'", ENV{fabric_name}="$env{fabric_scsi_controller}/lun$result", GOTO="azure_names"
-PROGRAM="/bin/sh -c 'readlink /sys/class/block/%k/device|cut -d: -f4'", ENV{fabric_name}="$env{fabric_scsi_controller}/lun$result", GOTO="azure_names"
-GOTO="azure_end"
-
-# Create the symlinks
-LABEL="azure_names"
-ENV{DEVTYPE}=="disk", SYMLINK+="disk/azure/$env{fabric_name}"
-ENV{DEVTYPE}=="partition", SYMLINK+="disk/azure/$env{fabric_name}-part%n"
-
-LABEL="azure_end"
diff --git a/overlay.d/25rhcos-azure-udev-rules/usr/lib/udev/rules.d/99-azure-product-uuid.rules b/overlay.d/25rhcos-azure-udev-rules/usr/lib/udev/rules.d/99-azure-product-uuid.rules
deleted file mode 100644
index a5af9b1f4..000000000
--- a/overlay.d/25rhcos-azure-udev-rules/usr/lib/udev/rules.d/99-azure-product-uuid.rules
+++ /dev/null
@@ -1,9 +0,0 @@
-SUBSYSTEM!="dmi", GOTO="product_uuid-exit"
-ATTR{sys_vendor}!="Microsoft Corporation", GOTO="product_uuid-exit"
-ATTR{product_name}!="Virtual Machine", GOTO="product_uuid-exit"
-TEST!="/sys/devices/virtual/dmi/id/product_uuid", GOTO="product_uuid-exit"
-
-RUN+="/bin/chmod 0444 /sys/devices/virtual/dmi/id/product_uuid"
-
-LABEL="product_uuid-exit"
-
diff --git a/overlay.d/25rhcos-azure-udev/usr/lib/dracut/modules.d/25rhcos-azure-udev/module-setup.sh b/overlay.d/25rhcos-azure-udev/usr/lib/dracut/modules.d/25rhcos-azure-udev/module-setup.sh
new file mode 100644
index 000000000..277660a0a
--- /dev/null
+++ b/overlay.d/25rhcos-azure-udev/usr/lib/dracut/modules.d/25rhcos-azure-udev/module-setup.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
+# ex: ts=8 sw=4 sts=4 et filetype=sh
+
+# We want to provide Azure udev rules as part of the initrd, so that Ignition
+# is able to detect disks and act on them.
+#
+# The WALinuxAgent-udev has been changed to install udev rules into
+# the initramfs [1], but that change isn't in el8 yet. This can be
+# dropped when moving to el9.
+#
+# [1] https://src.fedoraproject.org/rpms/WALinuxAgent/c/521b67bc8575f53a30b4b2c4e63292e67483a4e1?branch=rawhide 
+
+install() {
+    inst_multiple \
+        /usr/lib/udev/rules.d/66-azure-storage.rules \
+        /usr/lib/udev/rules.d/99-azure-product-uuid.rules
+}
diff --git a/overlay.d/README.md b/overlay.d/README.md
index 7589fca1d..af1d85e1e 100644
--- a/overlay.d/README.md
+++ b/overlay.d/README.md
@@ -38,11 +38,10 @@ and handling in 20-chrony and chrony-helper using the defaults
 lands in downstream packages. See upstream thread:
 https://listengine.tuxfamily.org/chrony.tuxfamily.org/chrony-dev/2020/05/msg00022.html
 
-25rhcos-azure-udev-rules
-------------------------
-
-Ships udev rules for Azure. This works in tandem with the
-`25coreos-azure-udev` dracut module in 05core which ships
-them in the initramfs. In the future, we should be able to
-drop this overlay and instead ship `WALinuxAgent-udev` as we
-do in FCOS (https://bugzilla.redhat.com/show_bug.cgi?id=1913074).
+25rhcos-azure-udev
+-------------
+
+We want to provide Azure udev rules as part of the initrd, so that Ignition
+is able to detect disks and act on them. The WALinuxAgent-udev has been
+changed to install udev rules into the initramfs, but that change isn't
+in el8 yet. This can be dropped when moving to el9.