diff --git a/helmfile-deploy/post-orch/environments/profile-vpro.yaml.gotmpl b/helmfile-deploy/post-orch/environments/profile-vpro.yaml.gotmpl
index 4fa1edef04..5c484172d6 100644
--- a/helmfile-deploy/post-orch/environments/profile-vpro.yaml.gotmpl
+++ b/helmfile-deploy/post-orch/environments/profile-vpro.yaml.gotmpl
@@ -9,6 +9,46 @@
 # This enables Modular vPro Edge Infrastructure Manager to support 100 edge nodes.
 # This file ONLY contains values that DIFFER from the EIM features.
 
+# needed for copy-ca-cert-gateway-to-infra
+external-secrets:
+  enabled: true
+# needed for infra-onboarding (orch-infra)
+#rs-proxy:
+#   enabled: false
+# needed for now for orch-cli
+component-status:
+  enabled: true
+# needed for traefik
+traefik-pre:
+  enabled: true
+
+
+
+haproxy-ingress-pxe-boots:
+  enabled: false
+ingress-haproxy:
+  enabled: false
+secret-wait-tls-boots:
+  enabled: false
+certificate-file-server:
+  enabled: false
+copy-ca-cert-boots-to-gateway:
+  enabled: false
+copy-ca-cert-boots-to-infra:
+  enabled: false
+auth-service:
+  enabled: false
+namespace-labe:
+  enabled: false
+platform-autocert:
+  enabled: false
+copy-ca-cert-gateway-to-cattle:
+  enabled: false
+token-fs:
+  enabled: false
+infra-managers:
+  enabled: false
+
 # ═══════════════════════════════════════════════════════════════════════════════
 # Releases to DISABLE (enabled in EIM features, not needed for vPro)
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -50,21 +90,21 @@ infra-core:
 # infra-managers overrides (from enable-edgeinfra-vpro.yaml)
 # Disable managers not needed for vPro, enable provisioning skip
 # ═══════════════════════════════════════════════════════════════════════════════
-infra-managers:
-  enabled: true
-  disabledProvisioning: true
-  host-manager:
-    enabled: true
-  maintenance-manager:
-    enabled: false
-  telemetry-manager:
-    enabled: false
-  os-resource-manager:
-    enabled: false
-  networking-manager:
-    enabled: false
-  attestationstatus-manager:
-    enabled: false
+#infra-managers:
+#  enabled: true
+#  disabledProvisioning: true
+#  host-manager:
+#    enabled: true
+#  maintenance-manager:
+#    enabled: false
+#  telemetry-manager:
+#    enabled: false
+#  os-resource-manager:
+#    enabled: false
+#  networking-manager:
+#    enabled: false
+#  attestationstatus-manager:
+#    enabled: false
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # infra-onboarding overrides (from enable-edgeinfra-vpro.yaml)
@@ -77,7 +117,7 @@ infra-onboarding:
   enMetricsEnabled: "false"
   enTokenClients: "node-agent,platform-manageability-agent"
   tinkerbell:
-    enabled: true
+    enabled: false
   pxe-server:
     enabled: false
   infra-config:
@@ -87,7 +127,7 @@ infra-onboarding:
     service:
       enableIO: false
   dkam:
-    enabled: true
+    enabled: false
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # infra-external overrides (AMT components for vPro)
diff --git a/helmfile-deploy/post-orch/helmfile.yaml.gotmpl b/helmfile-deploy/post-orch/helmfile.yaml.gotmpl
index a4cc825617..5538682484 100644
--- a/helmfile-deploy/post-orch/helmfile.yaml.gotmpl
+++ b/helmfile-deploy/post-orch/helmfile.yaml.gotmpl
@@ -87,7 +87,7 @@ releases:
     namespace: orch-platform
     chart: edge-orch/common/charts/keycloak-operator
     wait: true
-    version: 26.1.2
+    version: 26.1.3
     values:
       - values/keycloak-operator.yaml
     condition: keycloak-operator.enabled
@@ -386,7 +386,7 @@ releases:
     namespace: orch-platform
     chart: edge-orch/common/charts/keycloak-instance
     wait: true
-    version: 26.1.2
+    version: 26.1.4
     timeout: 600
     values:
       - values/platform-keycloak.yaml.gotmpl
diff --git a/helmfile-deploy/post-orch/values/infra-core.yaml.gotmpl b/helmfile-deploy/post-orch/values/infra-core.yaml.gotmpl
index 7d712dc5d1..d76425720a 100644
--- a/helmfile-deploy/post-orch/values/infra-core.yaml.gotmpl
+++ b/helmfile-deploy/post-orch/values/infra-core.yaml.gotmpl
@@ -31,7 +31,7 @@ credentials:
   serviceAccount:
     name: "orch-svc"
   params:
-    keycloakUrl: "http://platform-keycloak.orch-platform.svc.cluster.local:8080"
+    keycloakUrl: "http://platform-keycloak.orch-platform.svc.cluster.local:8080/auth"
     vaultUrl: "http://vault.orch-platform.svc.cluster.local:8200"
   curlImage:
     name: badouralix/curl-jq@sha256
@@ -53,7 +53,7 @@ api:
   oidc:
     name: "keycloak-api"
     oidc_env_name: "OIDC_SERVER_URL"
-    oidc_server_url: "http://platform-keycloak.orch-platform.svc/realms/master"
+    oidc_server_url: "http://platform-keycloak.orch-platform.svc/auth/realms/master"
     oidc_tls_insecure_skip_verify_env_name: "OIDC_TLS_INSECURE_SKIP_VERIFY"
     oidc_tls_insecure_skip_verify_value: "true"
   multiTenancy:
@@ -80,7 +80,7 @@ apiv2:
   oidc:
     name: "keycloak-api"
     oidc_env_name: "OIDC_SERVER_URL"
-    oidc_server_url: "http://platform-keycloak.orch-platform.svc/realms/master"
+    oidc_server_url: "http://platform-keycloak.orch-platform.svc/auth/realms/master"
     oidc_tls_insecure_skip_verify_env_name: "OIDC_TLS_INSECURE_SKIP_VERIFY"
     oidc_tls_insecure_skip_verify_value: "true"
   # Resources: managed by resource-overrides.yaml
@@ -109,7 +109,7 @@ tenant-controller:
     traceURL: "orchestrator-observability-opentelemetry-collector.orch-platform.svc:4318"
     skipOSProvisioning: {{ dig "skipOSProvisioning" false $ic }}
   oidc:
-    oidc_server_url: "http://platform-keycloak.orch-platform.svc.cluster.local/realms/master"
+    oidc_server_url: "http://platform-keycloak.orch-platform.svc.cluster.local/auth/realms/master"
   # Resources: managed by resource-overrides.yaml
   serviceAccount:
     name: "orch-svc"
diff --git a/helmfile-deploy/post-orch/values/infra-external.yaml.gotmpl b/helmfile-deploy/post-orch/values/infra-external.yaml.gotmpl
index 69c14807e3..a3c9f19fef 100644
--- a/helmfile-deploy/post-orch/values/infra-external.yaml.gotmpl
+++ b/helmfile-deploy/post-orch/values/infra-external.yaml.gotmpl
@@ -23,7 +23,7 @@ loca-manager:
   env:
     vaultUrl: "http://vault.orch-platform.svc.cluster.local:8200"
     vaultRole: "orch-svc"
-    keycloakUrl: "http://platform-keycloak.orch-platform.svc.cluster.local:8080"
+    keycloakUrl: "http://platform-keycloak.orch-platform.svc.cluster.local:8080/auth"
 
 loca-metadata-manager:
   serviceAccount:
@@ -82,7 +82,7 @@ loca-credentials:
   serviceAccount:
     name: "orch-svc"
   params:
-    keycloakUrl: "http://platform-keycloak.orch-platform.svc.cluster.local:8080"
+    keycloakUrl: "http://platform-keycloak.orch-platform.svc.cluster.local:8080/auth"
     vaultUrl: "http://vault.orch-platform.svc.cluster.local:8200"
   curlImage:
     name: badouralix/curl-jq@sha256
@@ -149,7 +149,7 @@ amt:
       password: ""
     env:
       oidc:
-        oidc_server_url: "http://platform-keycloak.orch-platform.svc/realms/master"
+        oidc_server_url: "http://platform-keycloak.orch-platform.svc/auth/realms/master"
         oidc_tls_insecure_skip_verify_value: "true"
     curlImage:
       name: badouralix/curl-jq@sha256
diff --git a/helmfile-deploy/post-orch/values/infra-managers.yaml.gotmpl b/helmfile-deploy/post-orch/values/infra-managers.yaml.gotmpl
index a54e0f9dbd..fc280bf982 100644
--- a/helmfile-deploy/post-orch/values/infra-managers.yaml.gotmpl
+++ b/helmfile-deploy/post-orch/values/infra-managers.yaml.gotmpl
@@ -38,7 +38,7 @@ host-manager:
       grpc:
         name: Host(`infra-node.{{ .Values.clusterDomain }}`)
   oidc:
-    oidc_server_url: "http://platform-keycloak.orch-platform.svc/realms/master"
+    oidc_server_url: "http://platform-keycloak.orch-platform.svc/auth/realms/master"
   multiTenancy:
     enforceMultiTenancy: "true"
   # Resources: managed by resource-overrides.yaml
@@ -61,7 +61,7 @@ maintenance-manager:
       grpc:
         name: Host(`update-node.{{ .Values.clusterDomain }}`)
   oidc:
-    oidc_server_url: "http://platform-keycloak.orch-platform.svc/realms/master"
+    oidc_server_url: "http://platform-keycloak.orch-platform.svc/auth/realms/master"
   telemetryMgrArgs:
     enableVal: false  # disable telemetry profile validation
   multiTenancy:
@@ -94,7 +94,7 @@ telemetry-manager:
       grpc:
         name: Host(`telemetry-node.{{ .Values.clusterDomain }}`)
   oidc:
-    oidc_server_url: "http://platform-keycloak.orch-platform.svc/realms/master"
+    oidc_server_url: "http://platform-keycloak.orch-platform.svc/auth/realms/master"
   multiTenancy:
     enforceMultiTenancy: "true"
   # Resources: managed by resource-overrides.yaml
@@ -136,7 +136,7 @@ attestationstatus-manager:
       grpc:
         name: Host(`attest-node.{{ .Values.clusterDomain }}`)
   oidc:
-    oidc_server_url: "http://platform-keycloak.orch-platform.svc/realms/master"
+    oidc_server_url: "http://platform-keycloak.orch-platform.svc/auth/realms/master"
   multiTenancy:
     enforceMultiTenancy: "true"
   # Resources: managed by resource-overrides.yaml
diff --git a/helmfile-deploy/post-orch/values/infra-onboarding.yaml.gotmpl b/helmfile-deploy/post-orch/values/infra-onboarding.yaml.gotmpl
index 39396cf8ce..4349e532a5 100644
--- a/helmfile-deploy/post-orch/values/infra-onboarding.yaml.gotmpl
+++ b/helmfile-deploy/post-orch/values/infra-onboarding.yaml.gotmpl
@@ -154,12 +154,12 @@ onboarding-manager:
   env:
     tinkerActionsVersion: "1.20.2"
     oidc:
-      oidc_server_url: "http://platform-keycloak.orch-platform.svc/realms/master"
+      oidc_server_url: "http://platform-keycloak.orch-platform.svc/auth/realms/master"
       clients:
         bypass: [cdn-boots]
     vaultUrl: "http://vault.orch-platform.svc.cluster.local:8200"
     vaultRole: "orch-svc"
-    keycloakUrl: "http://platform-keycloak.orch-platform.svc.cluster.local:8080"
+    keycloakUrl: "http://platform-keycloak.orch-platform.svc.cluster.local:8080/auth"
     mode: {{ $mode | quote }}
     userName: {{ dig "userName" "user" $io | quote }}
     passWord: {{ dig "passWord" "user" $io | quote }}
@@ -190,7 +190,7 @@ dkam:
   env:
     rs_proxy_address: "rs-proxy.orch-platform.svc.cluster.local:8081/"
     oidc:
-      oidc_server_url: "http://platform-keycloak.orch-platform.svc/realms/master"
+      oidc_server_url: "http://platform-keycloak.orch-platform.svc/auth/realms/master"
     mode: {{ $mode | quote }}
   proxies:
     http_proxy: {{ $httpProxy }}
@@ -221,7 +221,7 @@ infra-config:
     orchRelease: release.{{ $domain }}
     orchPlatformObsLogs: logs-node.{{ $domain }}:443
     orchPlatformObsMetrics: metrics-node.{{ $domain }}:443
-    orchKeycloak: keycloak.{{ $domain }}:443
+    orchKeycloak: keycloak.{{ $domain }}:443/auth
     orchTelemetry: telemetry-node.{{ $domain }}:443
     orchAttestationStatus: attest-node.{{ $domain }}:443
     orchRegistry: {{ .Values.releaseService.ociRegistry }}:9443
diff --git a/helmfile-deploy/post-orch/values/keycloak-tenant-controller.yaml.gotmpl b/helmfile-deploy/post-orch/values/keycloak-tenant-controller.yaml.gotmpl
index 55b721e1ac..66c61d9145 100644
--- a/helmfile-deploy/post-orch/values/keycloak-tenant-controller.yaml.gotmpl
+++ b/helmfile-deploy/post-orch/values/keycloak-tenant-controller.yaml.gotmpl
@@ -15,7 +15,7 @@ curlImage:
   pullPolicy: IfNotPresent
 
 keycloakAdmin:
-  url: "http://platform-keycloak.orch-platform.svc:8080"
+  url: "http://platform-keycloak.orch-platform.svc:8080/auth"
   user: admin
   client: system-client
   passwordSecret:
diff --git a/helmfile-deploy/post-orch/values/metadata-broker.yaml.gotmpl b/helmfile-deploy/post-orch/values/metadata-broker.yaml.gotmpl
index be851b2192..e51460f072 100644
--- a/helmfile-deploy/post-orch/values/metadata-broker.yaml.gotmpl
+++ b/helmfile-deploy/post-orch/values/metadata-broker.yaml.gotmpl
@@ -8,7 +8,7 @@ global:
     imagePullSecrets: []
 
 openidc:
-  issuer: http://platform-keycloak.orch-platform.svc/realms/master
+  issuer: http://platform-keycloak.orch-platform.svc/auth/realms/master
 
 service:
   traefik:
diff --git a/helmfile-deploy/post-orch/values/nexus-api-gw.yaml.gotmpl b/helmfile-deploy/post-orch/values/nexus-api-gw.yaml.gotmpl
index 8956801961..65d13db1b0 100644
--- a/helmfile-deploy/post-orch/values/nexus-api-gw.yaml.gotmpl
+++ b/helmfile-deploy/post-orch/values/nexus-api-gw.yaml.gotmpl
@@ -23,7 +23,7 @@ traefikApiGroup: "traefik.io/v1alpha1"
 oidc:
   name: "keycloak-api"
   oidc_env_name: "OIDC_SERVER_URL"
-  oidc_server_url: "http://platform-keycloak.orch-platform.svc/realms/master"
+  oidc_server_url: "http://platform-keycloak.orch-platform.svc/auth/realms/master"
   oidc_tls_insecure_skip_verify_env_name: "OIDC_TLS_INSECURE_SKIP_VERIFY"
   oidc_tls_insecure_skip_verify_value: "true"
 
diff --git a/helmfile-deploy/post-orch/values/platform-keycloak.yaml.gotmpl b/helmfile-deploy/post-orch/values/platform-keycloak.yaml.gotmpl
index d02fd92540..efc5c18948 100644
--- a/helmfile-deploy/post-orch/values/platform-keycloak.yaml.gotmpl
+++ b/helmfile-deploy/post-orch/values/platform-keycloak.yaml.gotmpl
@@ -12,6 +12,48 @@ namespace: orch-platform
 
 # Database connection via additionalOptions (read from the postgresql-secrets secret)
 keycloak:
+  podTemplate:
+    initContainers:
+      - name: keycloak-builder
+        image: 'quay.io/keycloak/keycloak:26.6.0'
+        imagePullPolicy: IfNotPresent
+        command:
+          - /bin/bash
+        args:
+          - -c
+          - |
+            set -e
+            /opt/keycloak/bin/kc.sh build \
+              --db=postgres \
+              --health-enabled=true \
+              --metrics-enabled=true \
+              --http-relative-path=/auth/
+
+            mkdir -p /shared/keycloak
+            cp -r /opt/keycloak/* /shared/keycloak/
+        resources:
+          requests:
+            cpu: 500m
+            memory: 512Mi
+          limits:
+            cpu: 1500m
+            memory: 1Gi
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: false
+          runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 1000
+          capabilities:
+            drop:
+              - ALL
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts:
+          - name: shared-keycloak
+            mountPath: /shared/keycloak
+          - name: tmp
+            mountPath: /tmp
   database:
     usernameSecret:
       name: {{ $dbSecretName }}
@@ -35,7 +77,7 @@ keycloak:
     - name: hostname-strict
       value: "false"
     - name: http-relative-path
-      value: "/"
+      value: "/auth/"
     - name: http-enabled
       value: "true"
     - name: db-url-properties
@@ -50,6 +92,8 @@ keycloak:
       value: INFO
     - name: log-console-output
       value: json
+m2mSecretsExtractor:
+  keycloak_url: "http://platform-keycloak.{{ .Release.Namespace }}.svc.cluster.local:8080/auth"
 
 # Keycloak Config CLI job configuration
 keycloakConfigCli:
@@ -142,7 +186,7 @@ keycloakConfigCli:
 
       env:
         - name: KEYCLOAK_URL
-          value: "http://platform-keycloak.orch-platform.svc.cluster.local/"
+          value: "http://platform-keycloak.orch-platform.svc.cluster.local:8080/auth/"
         - name: KEYCLOAK_USER
           valueFrom:
             secretKeyRef:
diff --git a/helmfile-deploy/post-orch/values/secrets-config.yaml.gotmpl b/helmfile-deploy/post-orch/values/secrets-config.yaml.gotmpl
index fce6400fc5..265c9a86f5 100644
--- a/helmfile-deploy/post-orch/values/secrets-config.yaml.gotmpl
+++ b/helmfile-deploy/post-orch/values/secrets-config.yaml.gotmpl
@@ -20,5 +20,5 @@ auth:
     roleMaxTTL: 1h
   oidc:
     idPAddr: "http://platform-keycloak.orch-platform.svc"
-    idPDiscoveryURL: "http://platform-keycloak.orch-platform.svc/realms/master"
+    idPDiscoveryURL: "http://platform-keycloak.orch-platform.svc/auth/realms/master"
     roleMaxTTL: 1h