diff --git a/deployment/neutron/neutron-sriov-agent-container-puppet.yaml b/deployment/neutron/neutron-sriov-agent-container-puppet.yaml
index 47ee1793e4..a8e0792246 100644
--- a/deployment/neutron/neutron-sriov-agent-container-puppet.yaml
+++ b/deployment/neutron/neutron-sriov-agent-container-puppet.yaml
@@ -255,20 +255,19 @@ outputs:
             - nova_hybrid_state
           when: step|int == 0
           block:
-            - name: Check if we need to update the neutron_sriov_agent paunch config
-              shell: |
-                set -o pipefail
-                jq ."neutron_sriov_agent"."image" /var/lib/tripleo-config/docker-container-startup-config-step_4.json
-              register: neutron_sriov_agent_paunch_image
-            - name: Implement the neutron hybrid state (only if the compute is still Queens)
-              when: neutron_sriov_agent_paunch_image.stdout != neutron_sriov_image
+            - name: Check if we need to create neutron_sriov paunch config
+              stat:
+                path: /var/lib/tripleo-config/docker-container-hybrid_neutron_sriov.json
+              register: hybrid_neutron_sriov
+            - name: Implement the hybrid state for neutron_sriov_agent
+              when: not hybrid_neutron_sriov.stat.exists
               block:
-                - name: Update the neutron_sriov paunch image in config
+                - name: Update the neutron_sriov_agent paunch image in config
                   shell: |
                     set -o pipefail
-                    cat <<< $(jq '.neutron_sriov_agent.image = "{{ neutron_sriov_image }}"' \
-                    /var/lib/tripleo-config/docker-container-startup-config-step_4.json) >\
-                    /var/lib/tripleo-config/docker-container-startup-config-step_4.json
+                    jq '.neutron_sriov_agent.image = "{{ neutron_sriov_image }}" | {"neutron_sriov_agent": .neutron_sriov_agent }' \
+                    /var/lib/tripleo-config/docker-container-startup-config-step_4.json >\
+                    /var/lib/tripleo-config/docker-container-hybrid_neutron_sriov.json
                 - name: Make sure the Undercloud hostname is included in /etc/hosts
                   when:
                     - undercloud_hosts_entries is defined
@@ -287,12 +286,13 @@ outputs:
                   when: container_registry_insecure_registries != []
                   shell: crudini --set /etc/containers/registries.conf registries.insecure registries "[{{ container_registry_insecure_registries | map('regex_replace', '(.*)', "'\1'") | join(',') }}]"
                 - name: Restart docker
+                  when: container_registry_insecure_registries != []
                   service:
                     name: docker
                     state: restarted
                 # Finally apply the paunch config to start the new nova_compute
                 - name: Apply paunch config
-                  shell: paunch apply --file /var/lib/tripleo-config/docker-container-startup-config-step_4.json --config-id tripleo_step4
+                  shell: paunch apply --file /var/lib/tripleo-config/docker-container-hybrid_neutron_sriov.json --config-id tripleo_step4
 
         - name: upgrade prepare for leapp to remove extra sriov vfs
           tags:
diff --git a/deployment/nova/nova-compute-container-puppet.yaml b/deployment/nova/nova-compute-container-puppet.yaml
index f2ee7ba197..7e5f86859e 100644
--- a/deployment/nova/nova-compute-container-puppet.yaml
+++ b/deployment/nova/nova-compute-container-puppet.yaml
@@ -1155,20 +1155,19 @@ outputs:
             - nova_hybrid_state
           when: step|int == 0
           block:
-            - name: Check if we need to update the paunch config
-              shell: |
-                set -o pipefail
-                jq ."nova_compute"."image" /var/lib/tripleo-config/docker-container-startup-config-step_4.json
-              register: nova_compute_paunch_image
+            - name: Check if we need to create nova_compute paunch config
+              stat:
+                path: /var/lib/tripleo-config/docker-container-hybrid_nova_compute.json
+              register: hybrid_nova_compute
             - name: Implement the hybrid state (only if the compute is still Queens)
-              when: nova_compute_paunch_image.stdout != nova_compute_image
+              when: not hybrid_nova_compute.stat.exists
               block:
                 - name: Update the nova_compute paunch image in config
                   shell: |
                     set -o pipefail
-                    cat <<< $(jq '.nova_compute.image = "{{ nova_compute_image }}"' \
-                    /var/lib/tripleo-config/docker-container-startup-config-step_4.json) >\
-                    /var/lib/tripleo-config/docker-container-startup-config-step_4.json
+                    jq '.nova_compute.image = "{{ nova_compute_image }}" | {"nova_compute": .nova_compute }' \
+                    /var/lib/tripleo-config/docker-container-startup-config-step_4.json >\
+                    /var/lib/tripleo-config/docker-container-hybrid_nova_compute.json
                 # Nova compute will not work unless we ensure it will not connect against db and use messaging
                 - name: Remove database section from nova_compute config
                   shell: crudini --del database /var/lib/config-data/puppet-generated/nova_libvirt/etc/nova/nova.conf
@@ -1193,12 +1192,13 @@ outputs:
                   when: container_registry_insecure_registries != []
                   shell: crudini --set /etc/containers/registries.conf registries.insecure registries "[{{ container_registry_insecure_registries | map('regex_replace', '(.*)', "'\1'") | join(',') }}]"
                 - name: Restart docker
+                  when: container_registry_insecure_registries != []
                   service:
                     name: docker
                     state: restarted
                 # Finally apply the paunch config to start the new nova_compute
                 - name: Apply paunch config
-                  shell: paunch apply --file /var/lib/tripleo-config/docker-container-startup-config-step_4.json --config-id tripleo_step4
+                  shell: paunch apply --file /var/lib/tripleo-config/docker-container-hybrid_nova_compute.json --config-id tripleo_step4
         - name: Remove openstack-nova-compute and python-nova package during upgrade
           package:
             name:
diff --git a/deployment/ovn/ovn-controller-container-puppet.yaml b/deployment/ovn/ovn-controller-container-puppet.yaml
index cbe525b437..386d3282b5 100644
--- a/deployment/ovn/ovn-controller-container-puppet.yaml
+++ b/deployment/ovn/ovn-controller-container-puppet.yaml
@@ -323,26 +323,21 @@ outputs:
             - ansible_facts['distribution'] == 'RedHat'
             - ansible_facts['distribution_major_version'] is version('7', '==')
           block:
-            - name: Check if we need to update the ovn_controller paunch config
-              shell: |
-                set -o pipefail
-                jq ."ovn_controller"."image" /var/lib/tripleo-config/docker-container-startup-config-step_4.json
-              register: ovn_controller_paunch_image
-            - name: Implement the ovn_controller hybrid state (only if the controller is still Queens)
-              when: ovn_controller_paunch_image.stdout != ovn_controller_image
+            - name: Check if we need to create ovn_controller paunch config
+              stat:
+                path: /var/lib/tripleo-config/docker-container-hybrid_ovn_controller.json
+              register: hybrid_ovn_controller
+            - name: Implement the hybrid state for ovn_controller
+              when: not hybrid_ovn_controller.stat.exists
               block:
                 - name: Update the ovn_controller paunch image in config
                   shell: |
                     set -o pipefail
-                    cat <<< $(jq '.ovn_controller.image = "{{ ovn_controller_image }}"' \
-                    /var/lib/tripleo-config/docker-container-startup-config-step_4.json) >\
-                    /var/lib/tripleo-config/docker-container-startup-config-step_4.json
-                - name: Add new volumes to ovn_controller config
-                  shell: |
-                    set -o pipefail
-                    cat <<< $(jq '.ovn_controller.volumes += ["/var/lib/openvswitch/ovn:/run/ovn:shared", "/var/log/containers/openvswitch:/var/log/ovn"]' \
-                    /var/lib/tripleo-config/docker-container-startup-config-step_4.json) >\
-                    /var/lib/tripleo-config/docker-container-startup-config-step_4.json
+                    jq '.ovn_controller.image = "{{ ovn_controller_image }}" |\
+                        .ovn_controller.volumes += ["/var/lib/openvswitch/ovn:/run/ovn:shared", "/var/log/containers/openvswitch:/var/log/ovn"] |\
+                        {"ovn_controller": .ovn_controller }' \
+                    /var/lib/tripleo-config/docker-container-startup-config-step_4.json >\
+                    /var/lib/tripleo-config/docker-container-hybrid_ovn_controller.json
                 - name: Make sure the Undercloud hostname is included in /etc/hosts
                   when:
                     - undercloud_hosts_entries is defined
@@ -369,7 +364,7 @@ outputs:
                     # Restart docker
                     systemctl restart docker
                     # Apply the paunch so if we start even more stuff we start it before shutting down
-                    paunch apply --file /var/lib/tripleo-config/docker-container-startup-config-step_4.json --config-id tripleo_step4
+                    paunch apply --file /var/lib/tripleo-config/docker-container-hybrid_ovn_controller.json --config-id tripleo_step4
                     # Compare running containers now vs before
                     TO_STOP="$(grep -v -f <(echo "${RUNNING}")  <(docker ps --format '{{ '{{' }}.Names{{ '}}' }}'))"
                     # Check if we need to stop anything and stop it