diff --git a/deployment/nova/nova-compute-container-puppet.yaml b/deployment/nova/nova-compute-container-puppet.yaml
index 70d150c4b4..14613eef65 100644
--- a/deployment/nova/nova-compute-container-puppet.yaml
+++ b/deployment/nova/nova-compute-container-puppet.yaml
@@ -392,6 +392,12 @@ parameters:
     default: ""
     tags:
       - role_specific
+  DockerInsecureRegistryAddress:
+    description: Optional. The IP Address and Port of an insecure docker
+                 namespace that will be configured in /etc/sysconfig/docker.
+                 The value can be multiple addresses separated by commas.
+    type: comma_delimited_list
+    default: []
 
   # DEPRECATED: the following options are deprecated and are currently maintained
   # for backwards compatibility. They will be removed in future release.
@@ -565,6 +571,7 @@ resources:
               NovaPMEMNamespaces: {get_param: NovaPMEMNamespaces}
 
 conditions:
+  insecure_registry_is_empty: {equals : [{get_param: DockerInsecureRegistryAddress}, []]}
   enable_instance_ha: {equals: [{get_param: EnableInstanceHA}, true]}
 
   enable_live_migration_tunnelled:
@@ -1079,6 +1086,58 @@ outputs:
             - tripleo_nvdimm_pmem_namespaces != ''
       external_post_deploy_tasks: {get_attr: [NovaComputeCommon, nova_compute_common_deploy_steps_tasks]}
       upgrade_tasks:
+        - name: Switch compute to hybrid state
+          vars:
+            nova_compute_image: {get_param: ContainerNovaComputeImage}
+          tags:
+            - never
+            - nova_hybrid_state
+          when: step|int == 0
+          block:
+            - name: Check if we need to update the paunch config
+              shell: |
+                set -o pipefail
+                jq ."nova_compute"."image" /var/lib/tripleo-config/docker-container-startup-config-step_4.json
+              register: nova_compute_paunch_image
+            - name: Implement the hybrid state (only if the compute is still Queens)
+              when: nova_compute_paunch_image.stdout != nova_compute_image
+              block:
+                - name: Update the nova_compute paunch image in config
+                  shell: |
+                    set -o pipefail
+                    cat <<< $(jq '.nova_compute.image = "{{ nova_compute_image }}"' \
+                    /var/lib/tripleo-config/docker-container-startup-config-step_4.json) >\
+                    /var/lib/tripleo-config/docker-container-startup-config-step_4.json
+                # Nova compute will not work unless we ensure it will not connect against db and use messaging
+                - name: Remove database section from nova_compute config
+                  shell: crudini --del database /var/lib/config-data/puppet-generated/nova_libvirt/etc/nova/nova.conf
+                - name: Remove api_database section from nova_compute config
+                  shell: crudini --del api_database /var/lib/config-data/puppet-generated/nova_libvirt/etc/nova/nova.conf
+                # This code is partial copy of logic in podman installation
+                - name: Make sure the Undercloud hostname is included in /etc/hosts
+                  when:
+                    - undercloud_hosts_entries is defined
+                  lineinfile:
+                    dest: /etc/hosts
+                    line: "{{ undercloud_hosts_entries | join('') }}"
+                    state: present
+                - name: Set container_registry_insecure_registries fact.
+                  set_fact:
+                    container_registry_insecure_registries:
+                      if:
+                        - insecure_registry_is_empty
+                        - []
+                        - {get_param: DockerInsecureRegistryAddress}
+                - name: Set container_registry_insecure registries
+                  when: container_registry_insecure_registries != []
+                  shell: crudini --set /etc/containers/registries.conf registries.insecure registries "[{{ container_registry_insecure_registries | map('regex_replace', '(.*)', "'\1'") | join(',') }}]"
+                - name: Restart docker
+                  service:
+                    name: docker
+                    state: restarted
+                # Finally apply the paunch config to start the new nova_compute
+                - name: Apply paunch config
+                  shell: paunch apply --file /var/lib/tripleo-config/docker-container-startup-config-step_4.json --config-id tripleo_step4
         - name: Remove openstack-nova-compute and python-nova package during upgrade
           package:
             name: