diff --git a/.zuul.yaml b/.zuul.yaml
index 73bb78d117..6f415c506d 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -64,6 +64,11 @@
                 container_runtime: containerd
                 containerd_version: 1.6.28
                 containerd_tarball_sha256: f70736e52d61e5ad225f4fd21643b5ca1220013ab8b6c380434caeefb572da9b
+                cloud_provider_tag: v1.27.3
+                cinder_csi_plugin_tag: v1.27.3
+                k8s_keystone_auth_tag: v1.27.3
+                magnum_auto_healer_tag: v1.27.3
+                octavia_ingress_controller_tag: v1.27.3
 
 - job:
     name: magnum-tempest-plugin-tests-cluster-k8s_fcos_v1-1.27-calico
diff --git a/magnum/drivers/common/templates/kubernetes/fragments/enable-auto-healing.sh b/magnum/drivers/common/templates/kubernetes/fragments/enable-auto-healing.sh
index d14c449ed9..e889e00fc0 100644
--- a/magnum/drivers/common/templates/kubernetes/fragments/enable-auto-healing.sh
+++ b/magnum/drivers/common/templates/kubernetes/fragments/enable-auto-healing.sh
@@ -239,7 +239,7 @@ EOF
 
 function enable_magnum_auto_healer {
     echo "Installing magnum_auto_healer"
-    image_prefix=${CONTAINER_INFRA_PREFIX:-docker.io/k8scloudprovider/}
+    image_prefix=${CONTAINER_INFRA_PREFIX:-registry.k8s.io/provider-os/}
     image_prefix=${image_prefix%/}
     magnum_auto_healer_manifest=/srv/magnum/kubernetes/manifests/magnum_auto_healer.yaml
 
diff --git a/magnum/drivers/common/templates/kubernetes/fragments/enable-cinder-csi.sh b/magnum/drivers/common/templates/kubernetes/fragments/enable-cinder-csi.sh
index 7321d130a0..de42b2d41f 100644
--- a/magnum/drivers/common/templates/kubernetes/fragments/enable-cinder-csi.sh
+++ b/magnum/drivers/common/templates/kubernetes/fragments/enable-cinder-csi.sh
@@ -315,7 +315,7 @@ spec:
             - mountPath: /var/lib/csi/sockets/pluginproxy/
               name: socket-dir
         - name: cinder-csi-plugin
-          image: ${CONTAINER_INFRA_PREFIX:-docker.io/k8scloudprovider/}cinder-csi-plugin:${CINDER_CSI_PLUGIN_TAG}
+          image: ${CONTAINER_INFRA_PREFIX:-registry.k8s.io/provider-os/}cinder-csi-plugin:${CINDER_CSI_PLUGIN_TAG}
           args:
             - /bin/cinder-csi-plugin
             - "--endpoint=\$(CSI_ENDPOINT)"
@@ -451,7 +451,7 @@ spec:
             capabilities:
               add: ["SYS_ADMIN"]
             allowPrivilegeEscalation: true
-          image: ${CONTAINER_INFRA_PREFIX:-docker.io/k8scloudprovider/}cinder-csi-plugin:${CINDER_CSI_PLUGIN_TAG}
+          image: ${CONTAINER_INFRA_PREFIX:-registry.k8s.io/provider-os/}cinder-csi-plugin:${CINDER_CSI_PLUGIN_TAG}
           args:
             - /bin/cinder-csi-plugin
             - "--endpoint=\$(CSI_ENDPOINT)"
diff --git a/magnum/drivers/common/templates/kubernetes/fragments/enable-ingress-octavia.sh b/magnum/drivers/common/templates/kubernetes/fragments/enable-ingress-octavia.sh
index 8fef59a419..26f8c817aa 100644
--- a/magnum/drivers/common/templates/kubernetes/fragments/enable-ingress-octavia.sh
+++ b/magnum/drivers/common/templates/kubernetes/fragments/enable-ingress-octavia.sh
@@ -51,7 +51,7 @@ EOF
 writeFile $OCTAVIA_INGRESS_CONTROLLER_CONFIGMAP "$OCTAVIA_INGRESS_CONTROLLER_CONFIGMAP_CONTENT"
 
 # octavia-ingress-controller deployment
-oic_image="${CONTAINER_INFRA_PREFIX:-docker.io/k8scloudprovider/}octavia-ingress-controller:${OCTAVIA_INGRESS_CONTROLLER_TAG}"
+oic_image="${CONTAINER_INFRA_PREFIX:-registry.k8s.io/provider-os/}octavia-ingress-controller:${OCTAVIA_INGRESS_CONTROLLER_TAG}"
 OCTAVIA_INGRESS_CONTROLLER=/srv/magnum/kubernetes/manifests/octavia-ingress-controller.yaml
 OCTAVIA_INGRESS_CONTROLLER_CONTENT=$(cat <<EOF
 ---
diff --git a/magnum/drivers/common/templates/kubernetes/fragments/enable-keystone-auth.sh b/magnum/drivers/common/templates/kubernetes/fragments/enable-keystone-auth.sh
index 5205820f6e..365a97808c 100644
--- a/magnum/drivers/common/templates/kubernetes/fragments/enable-keystone-auth.sh
+++ b/magnum/drivers/common/templates/kubernetes/fragments/enable-keystone-auth.sh
@@ -4,7 +4,7 @@ step="enable-keystone-auth"
 printf "Starting to run ${step}\n"
 
 if [ "$(echo $KEYSTONE_AUTH_ENABLED | tr '[:upper:]' '[:lower:]')" != "false" ]; then
-    _prefix=${CONTAINER_INFRA_PREFIX:-docker.io/k8scloudprovider/}
+    _prefix=${CONTAINER_INFRA_PREFIX:-registry.k8s.io/provider-os/}
     CERT_DIR=/etc/kubernetes/certs
 
     # Create policy configmap for keystone auth
diff --git a/magnum/drivers/common/templates/kubernetes/fragments/kube-apiserver-to-kubelet-role.sh b/magnum/drivers/common/templates/kubernetes/fragments/kube-apiserver-to-kubelet-role.sh
index 74a4146deb..9e989ba10e 100644
--- a/magnum/drivers/common/templates/kubernetes/fragments/kube-apiserver-to-kubelet-role.sh
+++ b/magnum/drivers/common/templates/kubernetes/fragments/kube-apiserver-to-kubelet-role.sh
@@ -89,7 +89,7 @@ kubectl -n kube-system create secret generic os-trustee \
 
 #TODO: add heat variables for master count to determine leaderelect true/False ?
 if [ "$(echo "${CLOUD_PROVIDER_ENABLED}" | tr '[:upper:]' '[:lower:]')" = "true" ]; then
-    occm_image="${CONTAINER_INFRA_PREFIX:-docker.io/k8scloudprovider/}openstack-cloud-controller-manager:${CLOUD_PROVIDER_TAG}"
+    occm_image="${CONTAINER_INFRA_PREFIX:-registry.k8s.io/provider-os/}openstack-cloud-controller-manager:${CLOUD_PROVIDER_TAG}"
     OCCM=/srv/magnum/kubernetes/openstack-cloud-controller-manager.yaml
 
     [ -f ${OCCM} ] || {
diff --git a/releasenotes/notes/update-cloud-provider-openstack-repo-e6209ce2e3986e12.yaml b/releasenotes/notes/update-cloud-provider-openstack-repo-e6209ce2e3986e12.yaml
new file mode 100644
index 0000000000..0c58230a96
--- /dev/null
+++ b/releasenotes/notes/update-cloud-provider-openstack-repo-e6209ce2e3986e12.yaml
@@ -0,0 +1,18 @@
+---
+upgrade:
+  - |
+    The registry for cloud-provider-openstack has been updated from
+    `docker.io/k8scloudprovider` to `registry.k8s.io/provider-os/`.
+critical:
+  - |
+    Magnum Core Team has historically limit changing of defaults in labels.
+    This is because existing Cluster Templates in a deployment falls back to
+    using the defaults in code if a specific label is not specified. If
+    defaults change, an existing deployment's Cluster Templates may stop
+    working after a Magnum upgrade.
+
+    Magnum will now no longer keep image tag labels (e.g. cloud_provider_tag,
+    flannel_tag) static. Please specify explicitly all image tags for the
+    images your Cluster Templates will be using, to prevent a future change
+    breaking your Cluster Templates. Refer to the documentation under
+    'Supported Labels' for a list of labels Magnum is tested with.