diff --git a/overcloud.j2.yaml b/overcloud.j2.yaml
index 45820f9b3b..a8e090c980 100644
--- a/overcloud.j2.yaml
+++ b/overcloud.j2.yaml
@@ -871,37 +871,12 @@ resources:
     type: OS::Heat::Value
     properties:
       value:
-        ctlplane_subnet_cidr:
-          yaql:
-            expression: coalesce($.data, []).where(not isEmpty($)).first().split('/')[-1]
-            data:
-              if:
-              - ctlplane_subnet_cidr_set
-              - [{get_param: ControlPlaneSubnetCidr}]
-              - {get_attr: [ControlVirtualIP, network, tags]}
-        network_cidrs:
-        {%- for network in networks %}
-        {%- if network.enabled|default(true) and network.name in role.networks|default([]) %}
-          {{network.name}}_cidr:
-            yaql:
-              expression: coalesce($.data, []).where(not isEmpty($)).first().split('/')[-1]
-              data: {get_attr: [Networks, net_cidr_map, {{network.name_lower}}]}
-        {%- endif %}
-        {%- endfor %}
         role_networks:
         {%- for network in networks %}
         {%- if network.enabled|default(true) and network.name in role.networks|default([]) %}
           - {{network.name}}
         {% endif %}
         {% endfor %}
-        {%- for network in networks %}
-        {%- if network.enabled|default(true) and network.name in role.networks|default([]) %}
-        {{network.name_lower}}_cidr:
-          yaql:
-            expression: coalesce($.data, []).where(not isEmpty($)).first().split('/')[-1]
-            data: {get_attr: [Networks, net_cidr_map, {{network.name_lower}}]}
-        {% endif %}
-        {% endfor %}
         service_metadata_settings: {get_attr: [{{role.name}}ServiceChainRoleData, value, service_metadata_settings]}
 
 {% endfor %}
diff --git a/puppet/role.role.j2.yaml b/puppet/role.role.j2.yaml
index 84994903c7..5cc8dce961 100644
--- a/puppet/role.role.j2.yaml
+++ b/puppet/role.role.j2.yaml
@@ -582,10 +582,24 @@ resources:
     properties:
       type: json
       value:
+        ctlplane_subnet_cidr:
+          if:
+            - ctlplane_subnet_cidr_set
+            - {get_param: ControlPlaneSubnetCidr}
+            - yaql:
+                expression: str("{0}".format($.data).split("/")[-1])
+                data: {get_attr: [{{server_resource_name}}, addresses, ctlplane, 0, subnets, 0, cidr]}
   {%- for network in networks %}
   {%- if network.enabled|default(true) and network.name in role.networks|default([]) %}
+        {{network.name_lower}}_cidr: {get_attr: [{{network.name}}Port, cidr]}
         fqdn_{{network.name_lower}}: {get_attr: [NetHostMap, value, {{network.name_lower}}, fqdn]}
   {%- endif %}
+  {%- endfor %}
+        network_cidrs:
+  {%- for network in networks %}
+  {%- if network.enabled|default(true) and network.name in role.networks|default([]) %}
+          {{network.name}}_cidr: {get_attr: [{{network.name}}Port, cidr]}
+  {%- endif %}
   {%- endfor %}
         fqdn_ctlplane: {get_attr: [NetHostMap, value, ctlplane, fqdn]}
         fqdn_canonical: {get_attr: [NetHostMap, value, canonical, fqdn]}
diff --git a/releasenotes/notes/bug-1895899-8d675670a0d05c15.yaml b/releasenotes/notes/bug-1895899-8d675670a0d05c15.yaml
new file mode 100644
index 0000000000..f8df93ef74
--- /dev/null
+++ b/releasenotes/notes/bug-1895899-8d675670a0d05c15.yaml
@@ -0,0 +1,12 @@
+---
+fixes:
+  - |
+    Ansible GroupVars incorrectly keept a single subnet prefix per-network.
+    This caused a problem when multiple subnets using different subnet
+    prefixes where defined. Resulting in the wrong subnet prefix being
+    referenced in the NetworkConfig for roles.
+
+    AnsibleHostVars stores networks subnet prefixes instead.
+    See bug: `1895899
+    <https://bugs.launchpad.net/tripleo/+bug/1895899>`_.
+