diff --git a/.github/workflows/ipa-image-build.yml b/.github/workflows/ipa-image-build.yml
new file mode 100644
index 000000000..a62e91fbf
--- /dev/null
+++ b/.github/workflows/ipa-image-build.yml
@@ -0,0 +1,343 @@
+---
+name: Build IPA images
+on:
+  workflow_dispatch:
+    inputs:
+      rocky9:
+        description: Build Rocky Linux 9
+        type: boolean
+        default: true
+      ubuntu-jammy:
+        description: Build Ubuntu 22.04 Jammy
+        type: boolean
+        default: true
+    secrets:
+      KAYOBE_VAULT_PASSWORD:
+        required: true
+      CLOUDS_YAML:
+        required: true
+      OS_APPLICATION_CREDENTIAL_ID:
+        required: true
+      OS_APPLICATION_CREDENTIAL_SECRET:
+        required: true
+
+env:
+  ANSIBLE_FORCE_COLOR: True
+  KAYOBE_ENVIRONMENT: ci-builder
+  KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
+jobs:
+  ipa-image-build:
+    name: Build IPA images
+    if: github.repository == 'stackhpc/stackhpc-kayobe-config'
+    runs-on: arc-skc-host-image-builder-runner
+    permissions: {}
+    steps:
+      - name: Install Package
+        uses: ConorMacBride/install-package@main
+        with:
+          apt: git unzip nodejs python3-pip python3-venv openssh-server openssh-client jq
+
+      - name: Start the SSH service
+        run: |
+          sudo /etc/init.d/ssh start
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          path: src/kayobe-config
+
+      - name: Output image tag of the builder
+        id: builder_image_tag
+        run: |
+          echo image_tag=$(grep stackhpc_rocky_9_overcloud_host_image_version: etc/kayobe/pulp-host-image-versions.yml | awk '{print $2}') >> $GITHUB_OUTPUT
+
+      - name: Determine OpenStack release
+        id: openstack_release
+        run: |
+          BRANCH=$(awk -F'=' '/defaultbranch/ {print $2}' src/kayobe-config/.gitreview)
+          echo "openstack_release=${BRANCH}" | sed -E "s,(stable|unmaintained)/,," >> $GITHUB_OUTPUT
+
+      - name: Generate IPA image tag
+        id: ipa_image_tag
+        run: |
+          echo "ipa_image_tag=$(date +${{ steps.openstack_release.outputs.openstack_release }}-%Y%m%dT%H%M%S)" >> $GITHUB_OUTPUT
+
+      - name: Display IPA image tag
+        run: |
+          echo "${{ steps.ipa_image_tag.outputs.ipa_image_tag }}"
+
+      - name: Install Kayobe
+        run: |
+          mkdir -p venvs &&
+          pushd venvs &&
+          python3 -m venv kayobe &&
+          source kayobe/bin/activate &&
+          pip install -U pip &&
+          pip install -r ../src/kayobe-config/requirements.txt
+
+      - name: Install terraform
+        uses: hashicorp/setup-terraform@v3
+
+      - name: Initialise terraform
+        run: terraform init
+        working-directory: ${{ github.workspace }}/src/kayobe-config/terraform/aio
+
+      - name: Generate SSH keypair
+        run: ssh-keygen -f id_rsa -N ''
+        working-directory: ${{ github.workspace }}/src/kayobe-config/terraform/aio
+
+      - name: Generate clouds.yaml
+        run: |
+          cat << EOF > clouds.yaml
+          ${{ secrets.CLOUDS_YAML }}
+          EOF
+        working-directory: ${{ github.workspace }}/src/kayobe-config/terraform/aio
+
+      - name: Generate terraform.tfvars
+        run: |
+          cat << EOF > terraform.tfvars
+          ssh_public_key = "id_rsa.pub"
+          ssh_username = "ubuntu"
+          aio_vm_name = "skc-ipa-image-builder"
+          aio_vm_image = "Ubuntu-22.04"
+          aio_vm_flavor = "en1.large"
+          aio_vm_network = "stackhpc-ci"
+          aio_vm_subnet = "stackhpc-ci"
+          aio_vm_interface = "ens3"
+          aio_vm_volume_size = 100
+          EOF
+        working-directory: ${{ github.workspace }}/src/kayobe-config/terraform/aio
+
+      - name: Terraform Plan
+        run: terraform plan
+        working-directory: ${{ github.workspace }}/src/kayobe-config/terraform/aio
+        env:
+          OS_CLOUD: "openstack"
+          OS_APPLICATION_CREDENTIAL_ID: ${{ secrets.OS_APPLICATION_CREDENTIAL_ID }}
+          OS_APPLICATION_CREDENTIAL_SECRET: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
+
+      - name: Terraform Apply
+        run: |
+          for attempt in $(seq 5); do
+              if terraform apply -auto-approve; then
+                  echo "Created infrastructure on attempt $attempt"
+                  exit 0
+              fi
+              echo "Failed to create infrastructure on attempt $attempt"
+              sleep 10
+              terraform destroy -auto-approve
+              sleep 60
+          done
+          echo "Failed to create infrastructure after $attempt attempts"
+          exit 1
+        working-directory: ${{ github.workspace }}/src/kayobe-config/terraform/aio
+        env:
+          OS_CLOUD: "openstack"
+          OS_APPLICATION_CREDENTIAL_ID: ${{ secrets.OS_APPLICATION_CREDENTIAL_ID }}
+          OS_APPLICATION_CREDENTIAL_SECRET: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
+
+      - name: Get Terraform outputs
+        id: tf_outputs
+        run: |
+          terraform output -json
+        working-directory: ${{ github.workspace }}/src/kayobe-config/terraform/aio
+
+      - name: Write Terraform outputs
+        run: |
+          cat << EOF > src/kayobe-config/etc/kayobe/environments/ci-builder/tf-outputs.yml
+          ${{ steps.tf_outputs.outputs.stdout }}
+          EOF
+
+      - name: Write Terraform network config
+        run: |
+          cat << EOF > src/kayobe-config/etc/kayobe/environments/ci-builder/tf-network-allocation.yml
+          ---
+          aio_ips:
+            builder: "{{ access_ip_v4.value }}"
+          EOF
+
+      - name: Write Terraform network interface config
+        run: |
+          mkdir -p src/kayobe-config/etc/kayobe/environments/$KAYOBE_ENVIRONMENT/inventory/group_vars/seed
+          rm -f src/kayobe-config/etc/kayobe/environments/$KAYOBE_ENVIRONMENT/inventory/group_vars/seed/network-interfaces
+          cat << EOF > src/kayobe-config/etc/kayobe/environments/$KAYOBE_ENVIRONMENT/inventory/group_vars/seed/network-interfaces
+          admin_interface: "{{ access_interface.value }}"
+          aio_interface: "{{ access_interface.value }}"
+          EOF
+
+      - name: Manage SSH keys
+        run: |
+          mkdir -p ~/.ssh
+          touch ~/.ssh/authorized_keys
+          cat src/kayobe-config/terraform/aio/id_rsa.pub >> ~/.ssh/authorized_keys
+          cp src/kayobe-config/terraform/aio/id_rsa* ~/.ssh/
+
+      - name: Bootstrap the control host
+        run: |
+          source venvs/kayobe/bin/activate &&
+          source src/kayobe-config/kayobe-env --environment ci-builder &&
+          kayobe control host bootstrap
+
+      - name: Configure the seed host (Builder VM)
+        run: |
+          source venvs/kayobe/bin/activate &&
+          source src/kayobe-config/kayobe-env --environment ci-builder &&
+          kayobe seed host configure \
+          -e seed_bootstrap_user=ubuntu \
+          --skip-tags network,apt,docker,docker-registry
+        env:
+          KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
+
+      - name: Install dependencies
+        run: |
+          source venvs/kayobe/bin/activate &&
+          source src/kayobe-config/kayobe-env --environment ci-builder &&
+          kayobe seed host command run \
+          --command "sudo apt update && sudo apt -y install gcc git libffi-dev python3-dev python-is-python3 python3-venv" --show-output
+        env:
+          KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
+
+      - name: Build a Ubuntu 22.04 Jammy IPA image
+        id: build_ubuntu_jammy_ipa
+        continue-on-error: true
+        run: |
+          source venvs/kayobe/bin/activate &&
+          source src/kayobe-config/kayobe-env --environment ci-builder &&
+          kayobe overcloud deployment image build --force-rebuild \
+          -e os_distribution="ubuntu" \
+          -e os_release="jammy" \
+          -e ipa_ci_builder_distribution="ubuntu"
+        env:
+          KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
+        if: inputs.ubuntu-jammy
+
+      - name: Show last error logs
+        continue-on-error: true
+        run: |
+          source venvs/kayobe/bin/activate &&
+          source src/kayobe-config/kayobe-env --environment ci-builder &&
+          kayobe seed host command run --command "tail -200 /opt/kayobe/images/ipa/ipa.stdout" --show-output
+        env:
+          KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
+        if: steps.build_ubuntu_jammy_ipa.outcome == 'failure'
+
+      - name: Upload Ubuntu 22.04 Jammy IPA kernel image to Ark
+        run: |
+          source venvs/kayobe/bin/activate &&
+          source src/kayobe-config/kayobe-env --environment ci-builder &&
+          kayobe playbook run \
+          src/kayobe-config/etc/kayobe/ansible/pulp-artifact-upload.yml \
+          -e artifact_path=/opt/kayobe/images/ipa \
+          -e artifact_type=ipa-images \
+          -e artifact_tag=${{ steps.ipa_image_tag.outputs.ipa_image_tag }} \
+          -e os_distribution="ubuntu" \
+          -e os_release="jammy" \
+          -e file_regex='*.kernel' \
+          -e upload_checksum=true
+        env:
+          KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
+        if: inputs.ubuntu-jammy && steps.build_ubuntu_jammy_ipa.outcome == 'success'
+
+      - name: Upload Ubuntu 22.04 Jammy IPA ramdisk image to Ark
+        run: |
+          source venvs/kayobe/bin/activate &&
+          source src/kayobe-config/kayobe-env --environment ci-builder &&
+          kayobe playbook run \
+          src/kayobe-config/etc/kayobe/ansible/pulp-artifact-upload.yml \
+          -e artifact_path=/opt/kayobe/images/ipa \
+          -e artifact_type=ipa-images \
+          -e artifact_tag=${{ steps.ipa_image_tag.outputs.ipa_image_tag }} \
+          -e os_distribution="ubuntu" \
+          -e os_release="jammy" \
+          -e file_regex='*.initramfs' \
+          -e upload_checksum=true
+        env:
+          KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
+        if: inputs.ubuntu-jammy && steps.build_ubuntu_jammy_ipa.outcome == 'success'
+
+      - name: Build a Rocky 9 IPA image
+        id: build_rocky_9_ipa
+        continue-on-error: true
+        run: |
+          source venvs/kayobe/bin/activate &&
+          source src/kayobe-config/kayobe-env --environment ci-builder &&
+          kayobe overcloud deployment image build --force-rebuild \
+          -e os_distribution="rocky" \
+          -e os_release="9" \
+          -e ipa_ci_builder_distribution="rocky"
+        env:
+          KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
+        if: inputs.rocky9
+
+      - name: Show last error logs
+        continue-on-error: true
+        run: |
+          source venvs/kayobe/bin/activate &&
+          source src/kayobe-config/kayobe-env --environment ci-builder &&
+          kayobe seed host command run --command "tail -200 /opt/kayobe/images/ipa/ipa.stdout" --show-output
+        env:
+          KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
+        if: steps.build_rocky_9_ipa.outcome == 'failure'
+
+      - name: Upload Rocky 9 IPA kernel image to Ark
+        run: |
+          source venvs/kayobe/bin/activate &&
+          source src/kayobe-config/kayobe-env --environment ci-builder &&
+          kayobe playbook run \
+          src/kayobe-config/etc/kayobe/ansible/pulp-artifact-upload.yml \
+          -e artifact_path=/opt/kayobe/images/ipa \
+          -e artifact_type=ipa-images \
+          -e artifact_tag=${{ steps.ipa_image_tag.outputs.ipa_image_tag }} \
+          -e os_distribution="rocky" \
+          -e os_release="9" \
+          -e file_regex='*.kernel' \
+          -e upload_checksum=true
+        env:
+          KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
+        if: inputs.rocky9 && steps.build_rocky_9_ipa.outcome == 'success'
+
+      - name: Upload Rocky 9 IPA ramdisk image to Ark
+        run: |
+          source venvs/kayobe/bin/activate &&
+          source src/kayobe-config/kayobe-env --environment ci-builder &&
+          kayobe playbook run \
+          src/kayobe-config/etc/kayobe/ansible/pulp-artifact-upload.yml \
+          -e artifact_path=/opt/kayobe/images/ipa \
+          -e artifact_type=ipa-images \
+          -e artifact_tag=${{ steps.ipa_image_tag.outputs.ipa_image_tag }} \
+          -e os_distribution="rocky" \
+          -e os_release="9" \
+          -e file_regex='*.initramfs' \
+          -e upload_checksum=true
+        env:
+          KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
+        if: inputs.rocky9 && steps.build_rocky_9_ipa.outcome == 'success'
+
+      - name: Copy logs back
+        continue-on-error: true
+        run: |
+          mkdir logs
+          scp -r ubuntu@$(jq -r .access_ip_v4.value src/kayobe-config/etc/kayobe/environments/ci-builder/tf-outputs.yml):/opt/kayobe/images/*/*.std* ./logs/
+        if: always()
+
+      - name: Upload logs artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: Build logs
+          path: ./logs
+
+      - name: Fail if the IPA image build failed
+        run: |
+          echo "Builds failed. See workflow artifacts for details." &&
+          exit 1
+        if: steps.build_rocky_9_ipa.outcome == 'failure' ||
+            steps.build_ubuntu_jammy_ipa.outcome == 'failure'
+
+      - name: Destroy
+        run: terraform destroy -auto-approve
+        working-directory: ${{ github.workspace }}/src/kayobe-config/terraform/aio
+        env:
+          OS_CLOUD: openstack
+          OS_APPLICATION_CREDENTIAL_ID: ${{ secrets.OS_APPLICATION_CREDENTIAL_ID }}
+          OS_APPLICATION_CREDENTIAL_SECRET: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
+        if: always()
diff --git a/.github/workflows/ipa-image-promote.yml b/.github/workflows/ipa-image-promote.yml
new file mode 100644
index 000000000..acba60194
--- /dev/null
+++ b/.github/workflows/ipa-image-promote.yml
@@ -0,0 +1,100 @@
+---
+name: Promote IPA image
+on:
+  workflow_dispatch:
+    inputs:
+      rocky9:
+        description: Promote Rocky Linux 9
+        type: boolean
+        default: true
+      ubuntu-jammy:
+        description: Promote Ubuntu 22.04 Jammy
+        type: boolean
+        default: true
+      image_tag:
+        description: Tag to promote
+        type: string
+        required: true
+env:
+  ANSIBLE_FORCE_COLOR: True
+jobs:
+  ipa-image-promote:
+    name: Promote IPA image
+    if: github.repository == 'stackhpc/stackhpc-kayobe-config'
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Validate inputs
+        run: |
+          if [[ ${{ inputs.rocky9 }} == 'false' && ${{ inputs.ubuntu-jammy }} == 'false' ]]; then
+            echo "At least one distribution must be selected"
+            exit 1
+          fi
+
+      - uses: actions/checkout@v4
+        with:
+          path: src/kayobe-config
+
+      - name: Determine OpenStack release
+        id: openstack_release
+        run: |
+          BRANCH=$(awk -F'=' '/defaultbranch/ {print $2}' .gitreview)
+          echo "openstack_release=${BRANCH}" | sed -E "s,(stable|unmaintained)/,," >> $GITHUB_OUTPUT
+        working-directory: src/kayobe-config
+
+      - name: Setup networking
+        run: |
+          if ! ip l show breth1 >/dev/null 2>&1; then
+              sudo ip l add breth1 type bridge
+          fi
+          sudo ip l set breth1 up
+          if ! ip a show breth1 | grep 192.168.33.3/24; then
+              sudo ip a add 192.168.33.3/24 dev breth1
+          fi
+          if ! ip l show dummy1 >/dev/null 2>&1; then
+              sudo ip l add dummy1 type dummy
+          fi
+          sudo ip l set dummy1 up
+          sudo ip l set dummy1 master breth1
+
+      - name: Install Kayobe
+        run: |
+          mkdir -p venvs &&
+          pushd venvs &&
+          python3 -m venv kayobe &&
+          source kayobe/bin/activate &&
+          pip install -U pip &&
+          pip install -r ../src/kayobe-config/requirements.txt
+
+      - name: Bootstrap the control host
+        run: |
+          source venvs/kayobe/bin/activate &&
+          source src/kayobe-config/kayobe-env --environment ci-builder &&
+          kayobe control host bootstrap
+
+      - name: Promote Rocky Linux 9 IPA image artifact
+        run: |
+          source venvs/kayobe/bin/activate &&
+          source src/kayobe-config/kayobe-env --environment ci-builder &&
+          kayobe playbook run \
+          src/kayobe-config/etc/kayobe/ansible/pulp-artifact-promote.yml \
+          -e artifact_type="ipa-images" \
+          -e os_distribution='rocky' \
+          -e os_release='9'
+        env:
+          ARTIFACT_TAG: ${{ inputs.image_tag }}
+          KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
+        if: inputs.rocky9
+
+      - name: Promote Ubuntu Jammy 22.04 IPA image artifact
+        run: |
+          source venvs/kayobe/bin/activate &&
+          source src/kayobe-config/kayobe-env --environment ci-builder &&
+          kayobe playbook run \
+          src/kayobe-config/etc/kayobe/ansible/pulp-artifact-promote.yml \
+          -e artifact_type="ipa-images" \
+          -e os_distribution='ubuntu' \
+          -e os_release='jammy'
+        env:
+          ARTIFACT_TAG: ${{ inputs.image_tag }}
+          KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
+        if: inputs.ubuntu-jammy
diff --git a/doc/source/configuration/index.rst b/doc/source/configuration/index.rst
index 131dc917f..136cf13a1 100644
--- a/doc/source/configuration/index.rst
+++ b/doc/source/configuration/index.rst
@@ -21,3 +21,4 @@ the various features provided.
    magnum-capi
    ci-cd
    cloudkitty
+   ipa
diff --git a/doc/source/configuration/ipa.rst b/doc/source/configuration/ipa.rst
new file mode 100644
index 000000000..c55b91040
--- /dev/null
+++ b/doc/source/configuration/ipa.rst
@@ -0,0 +1,35 @@
+.. _ipa:
+
+=========================
+Ironic Python Agent (IPA)
+=========================
+
+Release Train IPA
+=================
+
+StackHPC provides prebuilt Ironic Python Agent (IPA) images in Release Train
+through Ark.
+
+These images are built in CI using a GitHub workflow and are configured in this
+repository. See  :kayobe-doc: `Kayobe documentation
+<configuration/reference/ironic-python-agent.html>` for more details on IPA.
+
+Release Train IPA images are used by Bifrost and Overcloud Ironic by default in
+the StackHPC Kayobe Configuration, and are pulled in to the Ironic Inspector
+when running ``kayobe seed service deploy`` for Bifrost or ``kayobe overcloud
+post configure`` for Overcloud Ironic. This behaviour can be disabled in
+`stackhpc-ipa-images.yml`:
+
+.. code-block:: yaml
+
+    stackhpc_ipa_image_bifrost_enabled: false
+    stackhpc_ipa_image_overcloud_enabled: false
+
+You can also override the distribution version pulled in during deployment,
+to do this you can change ``stackhpc_ipa_image_version`` to be the opposite
+distribution. For example, the case of switching to Ubuntu 22.04 on a Rocky 9
+cloud:
+
+.. code-block:: yaml
+
+    stackhpc_ipa_image_version: "{{ stackhpc_ubuntu_jammy_ipa_image_version }}"
diff --git a/etc/kayobe/ansible/pulp-artifact-upload.yml b/etc/kayobe/ansible/pulp-artifact-upload.yml
index bbec22099..992da0a7f 100644
--- a/etc/kayobe/ansible/pulp-artifact-upload.yml
+++ b/etc/kayobe/ansible/pulp-artifact-upload.yml
@@ -7,6 +7,7 @@
     remote_pulp_password: "{{ stackhpc_release_pulp_password }}"
     repository_name: "{{ artifact_type }}-{{ openstack_release }}-{{ os_distribution }}-{{ os_release }}"
     pulp_base_path: "{{ artifact_type }}/{{ openstack_release }}/{{ os_distribution }}/{{ os_release }}"
+    upload_checksum: false
   tasks:
     - name: Print artifact tag
       debug:
@@ -36,6 +37,31 @@
         checksum_algorithm: sha256
       register: file_stats
 
+    - name: Write checksum to file
+      ansible.builtin.copy:
+        content: "{{ file_stats.stat.checksum }}"
+        dest: "/tmp/{{ found_files.files[0].path | basename }}.sha256"
+      when: upload_checksum
+
+    - name: Get sha256 hash for checksum
+      ansible.builtin.stat:
+        path: "/tmp/{{ found_files.files[0].path | basename }}.sha256"
+        checksum_algorithm: sha256
+      register: checksum_stats
+
+    - name: Upload checksum artifact
+      pulp.squeezer.artifact:
+        pulp_url: "{{ remote_pulp_url }}"
+        username: "{{ remote_pulp_username }}"
+        password: "{{ remote_pulp_password }}"
+        file: "/tmp/{{ found_files.files[0].path | basename }}.sha256"
+        state: present
+      register: checksum_upload_result
+      until: checksum_upload_result is success
+      retries: 3
+      delay: 60
+      when: upload_checksum
+
     - name: Create file content from artifact
       pulp.squeezer.file_content:
         pulp_url: "{{ remote_pulp_url }}"
@@ -49,6 +75,20 @@
       retries: 3
       delay: 5
 
+    - name: Create checksum content from artifact
+      pulp.squeezer.file_content:
+        pulp_url: "{{ remote_pulp_url }}"
+        username: "{{ remote_pulp_username }}"
+        password: "{{ remote_pulp_password }}"
+        sha256: "{{ checksum_stats.stat.checksum }}"
+        relative_path: "{{ found_files.files[0].path | basename }}.sha256"
+        state: present
+      register: checksum_content_result
+      until: checksum_content_result is success
+      retries: 3
+      delay: 5
+      when: upload_checksum
+
     - name: Ensure file repo exists
       pulp.squeezer.file_repository:
         pulp_url: "{{ remote_pulp_url }}"
@@ -75,6 +115,21 @@
       retries: 3
       delay: 5
 
+    - name: Add checksum content to file repo
+      pulp.squeezer.file_repository_content:
+        pulp_url: "{{ remote_pulp_url }}"
+        username: "{{ remote_pulp_username }}"
+        password: "{{ remote_pulp_password }}"
+        repository: "{{ repository_name }}"
+        present_content:
+          - relative_path: "{{ found_files.files[0].path | basename }}.sha256"
+            sha256: "{{ checksum_stats.stat.checksum }}"
+      register: checksum_repo_content_result
+      until: checksum_repo_content_result is success
+      retries: 3
+      delay: 5
+      when: upload_checksum
+
     - name: Create a new publication to point to this version
       pulp.squeezer.file_publication:
         pulp_url: "{{ remote_pulp_url }}"
diff --git a/etc/kayobe/bifrost.yml b/etc/kayobe/bifrost.yml
index 123c53d23..4a060deb6 100644
--- a/etc/kayobe/bifrost.yml
+++ b/etc/kayobe/bifrost.yml
@@ -135,7 +135,7 @@
 # Ironic Python Agent (IPA) configuration.
 
 # URL of Ironic Python Agent (IPA) kernel image.
-#kolla_bifrost_ipa_kernel_upstream_url:
+kolla_bifrost_ipa_kernel_upstream_url: "{{ (stackhpc_ipa_image_url + '/ipa.kernel') if stackhpc_ipa_image_bifrost_enabled | bool }}"
 
 # URL of checksum of Ironic Python Agent (IPA) kernel image.
 #kolla_bifrost_ipa_kernel_checksum_url:
@@ -144,7 +144,7 @@
 #kolla_bifrost_ipa_kernel_checksum_algorithm:
 
 # URL of Ironic Python Agent (IPA) ramdisk image.
-#kolla_bifrost_ipa_ramdisk_upstream_url:
+kolla_bifrost_ipa_ramdisk_upstream_url: "{{ (stackhpc_ipa_image_url + '/ipa.initramfs') if stackhpc_ipa_image_bifrost_enabled | bool }}"
 
 # URL of checksum of Ironic Python Agent (IPA) ramdisk image.
 #kolla_bifrost_ipa_ramdisk_checksum_url:
diff --git a/etc/kayobe/environments/ci-builder/inventory/hosts b/etc/kayobe/environments/ci-builder/inventory/hosts
index 759e41184..e2b89f71b 100644
--- a/etc/kayobe/environments/ci-builder/inventory/hosts
+++ b/etc/kayobe/environments/ci-builder/inventory/hosts
@@ -3,5 +3,9 @@
 [ofed-builder:children]
 seed
 
+# This is neccesary to run `overcloud deployment image build`
+[controllers]
+builder
+
 [seed]
 builder
diff --git a/etc/kayobe/environments/ci-builder/stackhpc-ci.yml b/etc/kayobe/environments/ci-builder/stackhpc-ci.yml
index 22258a838..4c3feb0ee 100644
--- a/etc/kayobe/environments/ci-builder/stackhpc-ci.yml
+++ b/etc/kayobe/environments/ci-builder/stackhpc-ci.yml
@@ -96,3 +96,13 @@ stackhpc_docker_registry_password: !vault |
 # Username and password of the overcloud host image repository.
 stackhpc_release_pulp_username: "{{ stackhpc_docker_registry_username }}"
 stackhpc_release_pulp_password: "{{ stackhpc_docker_registry_password }}"
+
+# Build during IPA builder workflow
+ipa_build_images: true
+ipa_build_dib_env_extra:
+  DISTRO_NAME: "{{ ipa_ci_builder_distribution | default('ubuntu') }}"
+
+# Ensure Ark repos are disabled during CI runs, this is due to
+# builder being a member of the 'overcloud' group for IPA builds.
+stackhpc_repos_enabled: false
+enable_docker_repo: true
diff --git a/etc/kayobe/ipa.yml b/etc/kayobe/ipa.yml
index e1d1a6f0b..74b964536 100644
--- a/etc/kayobe/ipa.yml
+++ b/etc/kayobe/ipa.yml
@@ -87,7 +87,7 @@ ipa_build_dib_elements_extra:
 #ipa_images_kernel_name:
 
 # URL of Ironic deployment kernel image to download.
-#ipa_kernel_upstream_url:
+ipa_kernel_upstream_url: "{{ (stackhpc_ipa_image_url + '/ipa.kernel') if stackhpc_ipa_image_overcloud_enabled | bool }}"
 
 # URL of checksum of Ironic deployment kernel image.
 #ipa_kernel_checksum_url:
@@ -99,7 +99,7 @@ ipa_build_dib_elements_extra:
 #ipa_images_ramdisk_name:
 
 # URL of Ironic deployment ramdisk image to download.
-#ipa_ramdisk_upstream_url:
+ipa_ramdisk_upstream_url: "{{ (stackhpc_ipa_image_url + '/ipa.initramfs') if stackhpc_ipa_image_overcloud_enabled | bool }}"
 
 # URL of checksum of Ironic deployment ramdisk image.
 #ipa_ramdisk_checksum_url:
diff --git a/etc/kayobe/pulp-ipa-image-versions.yml b/etc/kayobe/pulp-ipa-image-versions.yml
new file mode 100644
index 000000000..778831c05
--- /dev/null
+++ b/etc/kayobe/pulp-ipa-image-versions.yml
@@ -0,0 +1,4 @@
+---
+# IPA image versioning tags
+stackhpc_rocky_9_ipa_image_version: "2024.1-20241206T160829"
+stackhpc_ubuntu_jammy_ipa_image_version: "2024.1-20241206T160829"
diff --git a/etc/kayobe/stackhpc-ipa-images.yml b/etc/kayobe/stackhpc-ipa-images.yml
new file mode 100644
index 000000000..2246e678a
--- /dev/null
+++ b/etc/kayobe/stackhpc-ipa-images.yml
@@ -0,0 +1,20 @@
+---
+#################################
+# Release train IPA image sources
+
+# Whether to use Release Train IPA images for Bifrost
+stackhpc_ipa_image_bifrost_enabled: true
+
+# Whether to use Release Train IPA images for Overcloud Ironic
+stackhpc_ipa_image_overcloud_enabled: true
+
+# The IPA image source, defined by os_distribution,
+# os_release, and the current stable version.
+stackhpc_ipa_image_url: "{{ stackhpc_release_pulp_content_url }}/ipa-images/\
+                         {{ openstack_release }}/{{ os_distribution }}/\
+                         {{ os_release }}/{{ stackhpc_ipa_image_version }}"
+
+# IPA image version tag selection
+stackhpc_ipa_image_version: >-
+  {{ stackhpc_rocky_9_ipa_image_version if os_distribution == 'rocky' and os_release == '9' else
+  stackhpc_ubuntu_jammy_ipa_image_version if os_distribution == 'ubuntu' and os_release == 'jammy' }}
diff --git a/releasenotes/notes/ipa-build-workflow-cde24f3b9e3e0667.yaml b/releasenotes/notes/ipa-build-workflow-cde24f3b9e3e0667.yaml
new file mode 100644
index 000000000..2b1612b41
--- /dev/null
+++ b/releasenotes/notes/ipa-build-workflow-cde24f3b9e3e0667.yaml
@@ -0,0 +1,8 @@
+---
+features:
+  - |
+    Adds a new build workflow to Release Train for building IPA
+    images, and deployment for Release Train IPA images to Bifrost
+    and Ironic inspector.
+  - |
+    Release Train IPA is enabled by default.