diff --git a/.yamllint b/.yamllint
new file mode 100644
index 0000000000..016ae71e8b
--- /dev/null
+++ b/.yamllint
@@ -0,0 +1,27 @@
+extends: default
+
+rules:
+  comments:
+    # https://github.com/prettier/prettier/issues/6780
+    min-spaces-from-content: 1
+  # https://github.com/adrienverge/yamllint/issues/384
+  comments-indentation: false
+  document-start: disable
+  # 160 chars was the default used by old E204 rule, but
+  # you can easily change it or disable in your .yamllint file.
+  line-length:
+    ignore: |
+      kolla/common/sources.yaml
+    max: 160
+  # We are adding an extra space inside braces as that's how prettier does it
+  # and we are trying not to fight other linters.
+  braces:
+    min-spaces-inside: 0 # yamllint defaults to 0
+    max-spaces-inside: 1 # yamllint defaults to 0
+  # key-duplicates:
+  #   forbid-duplicated-merge-keys: true # not enabled by default
+  octal-values:
+    forbid-implicit-octal: true # yamllint defaults to false
+    forbid-explicit-octal: true # yamllint defaults to false
+  # quoted-strings:
+  #   quote-type: double
diff --git a/kolla/common/sources.py b/kolla/common/sources.py
index 59d2796f23..61dd10263b 100644
--- a/kolla/common/sources.py
+++ b/kolla/common/sources.py
@@ -10,440 +10,11 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-SOURCES = {
-    'openstack-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/requirements/'
-                     'requirements-${openstack_branch}.tar.gz')},
-    'aodh-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/aodh/'
-                     'aodh-${openstack_branch}.tar.gz')},
-    'barbican-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/barbican/'
-                     'barbican-${openstack_branch}.tar.gz')},
-    'bifrost-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/bifrost/'
-                     'bifrost-${openstack_branch}.tar.gz')},
-    'blazar-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/blazar/'
-                     'blazar-${openstack_branch}.tar.gz')},
-    'ceilometer-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/ceilometer/'
-                     'ceilometer-${openstack_branch}.tar.gz')},
-    'cinder-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/cinder/'
-                     'cinder-${openstack_branch}.tar.gz')},
-    'cloudkitty-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/cloudkitty/'
-                     'cloudkitty-${openstack_branch}.tar.gz')},
-    'cyborg-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/cyborg/'
-                     'cyborg-${openstack_branch}.tar.gz')},
-    'designate-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/designate/'
-                     'designate-${openstack_branch}.tar.gz')},
-    'etcd': {
-        # NOTE(wszumski): Upgrade one minor version at a time:
-        # https://etcd.io/docs/v3.6/upgrades/upgrade_3_6/
-        # NOTE(mnasiadka): lts_branch pins check_sources.py to the 3.6.x
-        # release series instead of jumping to the latest major.minor.
-        'lts_branch': '3.6',
-        'version': '3.6.5',
-        'type': 'url',
-        'sha256': {
-            'amd64': '66bad39ed920f6fc15fd74adcb8bfd38ba9a6412f8c7852d09eb11670e88cac3',  # noqa: E501
-            'arm64': '7010161787077b07de29b15b76825ceacbbcedcb77fe2e6832f509be102cab6b'},  # noqa: E501
-        'location': ('https://github.com/etcd-io/etcd/'
-                     'releases/download/v${version}'
-                     '/etcd-v${version}-linux-${debian_arch}.tar.gz')},
-    'glance-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/glance/'
-                     'glance-${openstack_branch}.tar.gz')},
-    'gnocchi-base': {
-        'type': 'git',
-        'reference': '4.7.0',
-        'location': ('https://github.com/gnocchixyz/'
-                     'gnocchi.git')},
-    'heat-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/heat/'
-                     'heat-${openstack_branch}.tar.gz')},
-    'horizon': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/horizon/'
-                     'horizon-${openstack_branch}.tar.gz')},
-    'horizon-plugin-blazar-dashboard': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/blazar-dashboard/'
-                     'blazar-dashboard-${openstack_branch}.tar.gz')},
-    'horizon-plugin-cloudkitty-dashboard': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/cloudkitty-dashboard/'
-                     'cloudkitty-dashboard-${openstack_branch}.tar.gz')},
-    'horizon-plugin-designate-dashboard': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/designate-dashboard/'
-                     'designate-dashboard-${openstack_branch}.tar.gz')},
-    'horizon-plugin-fwaas-dashboard': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/neutron-fwaas-dashboard/'
-                     'neutron-fwaas-dashboard-${openstack_branch}.tar.gz')},
-    'horizon-plugin-heat-dashboard': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/heat-dashboard/'
-                     'heat-dashboard-${openstack_branch}.tar.gz')},
-    'horizon-plugin-ironic-ui': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/ironic-ui/'
-                     'ironic-ui-${openstack_branch}.tar.gz')},
-    'horizon-plugin-magnum-ui': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/magnum-ui/'
-                     'magnum-ui-${openstack_branch}.tar.gz')},
-    'horizon-plugin-manila-ui': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/manila-ui/'
-                     'manila-ui-${openstack_branch}.tar.gz')},
-    'horizon-plugin-masakari-dashboard': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/masakari-dashboard/'
-                     'masakari-dashboard-${openstack_branch}.tar.gz')},
-    'horizon-plugin-mistral-dashboard': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/mistral-dashboard/'
-                     'mistral-dashboard-${openstack_branch}.tar.gz')},
-    'horizon-plugin-neutron-vpnaas-dashboard': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/neutron-vpnaas-dashboard/'
-                     'neutron-vpnaas-dashboard-${openstack_branch}.tar.gz')},
-    'horizon-plugin-octavia-dashboard': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/octavia-dashboard/'
-                     'octavia-dashboard-${openstack_branch}.tar.gz')},
-    'horizon-plugin-tacker-dashboard': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/tacker-horizon/'
-                     'tacker-horizon-${openstack_branch}.tar.gz')},
-    'horizon-plugin-trove-dashboard': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/trove-dashboard/'
-                     'trove-dashboard-${openstack_branch}.tar.gz')},
-    'horizon-plugin-watcher-dashboard': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/watcher-dashboard/'
-                     'watcher-dashboard-${openstack_branch}.tar.gz')},
-    'ironic-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/ironic/'
-                     'ironic-${openstack_branch}.tar.gz')},
-    'ironic-conductor-plugin-prometheus-exporter': {
-        'type': 'url',
-        'location': (
-            '$tarballs_base/openstack/ironic-prometheus-exporter/'
-            'ironic-prometheus-exporter-${openstack_branch}.tar.gz')},
-    'keystone-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/keystone/'
-                     'keystone-${openstack_branch}.tar.gz')},
-    'kerbside-base': {
-        'type': 'git',
-        'reference': 'develop',
-        'location': ('https://github.com/shakenfist/kerbside')},
-    'kolla-toolbox': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/requirements/'
-                     'requirements-${openstack_branch}.tar.gz')},
-    'letsencrypt-lego': {
-        'version': 'v4.27.0',
-        'type': 'url',
-        'sha256': {
-            'amd64': '898b58bbbca4282d706b4f204593cb94fc2ed13232777236c06dc20259bbcd02',  # noqa: E501
-            'arm64': '2973b412d37e5d652a91bda1a6bf7642491e316bc0f855a614e2c996249014dc'},  # noqa: E501
-        'location': ('https://github.com/go-acme/lego/'
-                     'releases/download/${version}/'
-                     'lego_${version}_linux_${debian_arch}.tar.gz')},
-    'magnum-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/magnum/'
-                     'magnum-${openstack_branch}.tar.gz')},
-    'magnum-conductor-plugin-helm': {
-        'version': 'v3.19.0',
-        'type': 'url',
-        # NOTE(mnasiadka): location points to get.helm.sh, but
-        # check_sources needs github releases access
-        'github': 'helm/helm',
-        'sha256': {
-            'amd64': 'a7f81ce08007091b86d8bd696eb4d86b8d0f2e1b9f6c714be62f82f96a594496',  # noqa: E501
-            'arm64': '440cf7add0aee27ebc93fada965523c1dc2e0ab340d4348da2215737fc0d76ad'},  # noqa: E501
-        'location': ('https://get.helm.sh/helm'
-                     '-${version}-linux-${debian_arch}.tar.gz')},
-    'manila-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/manila/'
-                     'manila-${openstack_branch}.tar.gz')},
-    'mariadb-server-plugin-mariadb-docker': {
-        # NOTE(seunghun1ee): This repo is needed to get MariaDB healthcheck.sh
-        'type': 'git',
-        'reference': 'master',
-        'location': ('https://github.com/MariaDB/mariadb-docker')},
-    'masakari-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/masakari/'
-                     'masakari-${openstack_branch}.tar.gz')},
-    'masakari-monitors': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/masakari-monitors/'
-                     'masakari-monitors-${openstack_branch}.tar.gz')},
-    'mistral-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/mistral/'
-                     'mistral-${openstack_branch}.tar.gz')},
-    'mistral-base-plugin-tacker': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/tacker/'
-                     'tacker-${openstack_branch}.tar.gz')},
-    'neutron-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/neutron/'
-                     'neutron-${openstack_branch}.tar.gz')},
-    'neutron-base-plugin-neutron-fwaas': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/neutron-fwaas/'
-                     'neutron-fwaas-${openstack_branch}.tar.gz')},
-    'neutron-base-plugin-networking-baremetal': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/networking-baremetal/'
-                     'networking-baremetal-${openstack_branch}.tar.gz')},
-    'neutron-base-plugin-networking-generic-switch': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/networking-generic-switch/'
-                     'networking-generic-switch-${openstack_branch}.tar.gz')},
-    'neutron-base-plugin-networking-sfc': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/networking-sfc/'
-                     'networking-sfc-${openstack_branch}.tar.gz')},
-    'neutron-base-plugin-tap-as-a-service': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/tap-as-a-service/'
-                     'tap-as-a-service-${openstack_branch}.tar.gz')},
-    'neutron-base-plugin-vpnaas-agent': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/neutron-vpnaas/'
-                     'neutron-vpnaas-${openstack_branch}.tar.gz')},
-    'neutron-bgp-dragent': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/neutron-dynamic-routing/'
-                     'neutron-dynamic-routing-${openstack_branch}.tar.gz')},
-    'neutron-server-plugin-neutron-dynamic-routing': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/neutron-dynamic-routing/'
-                     'neutron-dynamic-routing-${openstack_branch}.tar.gz')},
-    'neutron-vpnaas-agent': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/neutron-vpnaas/'
-                     'neutron-vpnaas-${openstack_branch}.tar.gz')},
-    'nova-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/nova/'
-                     'nova-${openstack_branch}.tar.gz')},
-    'nova-base-plugin-blazar': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/blazar-nova/'
-                     'blazar-nova-${openstack_branch}.tar.gz')},
-    'octavia-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/octavia/'
-                     'octavia-${openstack_branch}.tar.gz')},
-    'octavia-api-plugin-ovn-octavia-provider': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/ovn-octavia-provider/'
-                     'ovn-octavia-provider-${openstack_branch}.tar.gz')},
-    'octavia-driver-agent-plugin-ovn-octavia-provider': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/ovn-octavia-provider/'
-                     'ovn-octavia-provider-${openstack_branch}.tar.gz')},
-    'placement-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/placement/'
-                     'placement-${openstack_branch}.tar.gz')},
-    'prometheus-alertmanager': {
-        'version': '0.31.1',
-        'type': 'url',
-        'sha256': {
-            'amd64': '35191cbd9d4f8162458b78dd7e93990cccd246044d9a6f788adb1c66ac3ea07b',  # noqa: E501
-            'arm64': '266dda88b64318c27847ef9af4ff450fc178c827550a8039420c5ca8657a4a8b'},  # noqa: E501
-        'location': ('https://github.com/'
-                     'prometheus/alertmanager/'
-                     'releases/download/v${version}/'
-                     'alertmanager'
-                     '-${version}.linux-${debian_arch}.tar.gz')},
-    'prometheus-blackbox-exporter': {
-        'version': '0.28.0',
-        'type': 'url',
-        'sha256': {
-            'amd64': 'caf5d242fb1cf6d5cb678f3f799f22703d4fafea26b03dcbbd7e1f1825e06329',  # noqa: E501
-            'arm64': '63312be0983d85e5109710a7dc93df3051157ae581853fa3655d171cc1b2806e'},  # noqa: E501
-        'location': ('https://github.com/'
-                     'prometheus/blackbox_exporter/'
-                     'releases/download/v${version}/'
-                     'blackbox_exporter'
-                     '-${version}.linux-${debian_arch}.tar.gz')},
-    'prometheus-cadvisor': {
-        'version': '0.56.2',
-        'type': 'url',
-        'sha256': {
-            'amd64': 'ad92930f16a2f9da15190675e09eeaceb8fd38637d07a686bb0dd68695f692af',  # noqa: E501
-            'arm64': 'b7a707379496fd7a7b5d2768c5c494427112f534ba5069f889af28ffe6ad11bb'},  # noqa: E501
-        'location': ('https://github.com/'
-                     'google/cadvisor/'
-                     'releases/download/v${version}/'
-                     'cadvisor'
-                     '-v${version}-linux-${debian_arch}')},
-    'prometheus-elasticsearch-exporter': {
-        'version': '1.10.0',
-        'type': 'url',
-        'sha256': {
-            'amd64': '1dcf288082a25b2741e98da6c9fc012b6c821696a26c6ac57c20042f24714a74',  # noqa: E501
-            'arm64': '0ff4753a975eb5611c03123d565e8aaa84e4c05f698ce0a2d6c0f437a14bfe34'},  # noqa: E501
-        'location': ('https://github.com/'
-                     'prometheus-community/elasticsearch_exporter/'
-                     'releases/download/v${version}/'
-                     'elasticsearch_exporter'
-                     '-${version}.linux-${debian_arch}.tar.gz')},
-    'prometheus-libvirt-exporter': {
-        'version': '2.3.1',
-        'type': 'url',
-        'sha256': {
-            'amd64': '2e1657d10291059f420a467cbe3363c7353bbce9d5445f0d8d302bd96caaf0a8',  # noqa: E501
-            'arm64': '676dc76766ce4a2eaa8324a3aca8cfe89711536337d3b5b862ddf141fb57a224'},  # noqa: E501
-        'location': ('https://github.com/'
-                     'inovex/prometheus-libvirt-exporter/'
-                     'releases/download/v${version}/'
-                     'prometheus-libvirt-exporter'
-                     '-${version}.linux-${debian_arch}.tar.gz')},
-    'prometheus-memcached-exporter': {
-        'version': '0.15.5',
-        'type': 'url',
-        'sha256': {
-            'amd64': '5b82e6579b77fae00683d10d5923329173925a5abd95a799f5489a66136b884c',  # noqa: E501
-            'arm64': '609e6d7484f22fd9e405c0022a9e2d7f86eedef1cfa55772231528271082aeae'},  # noqa: E501
-        'location': ('https://github.com/'
-                     'prometheus/memcached_exporter/'
-                     'releases/download/v${version}/'
-                     'memcached_exporter'
-                     '-${version}.linux-${debian_arch}.tar.gz')},
-    'prometheus-mtail': {
-        'version': '3.4.0',
-        'type': 'url',
-        'sha256': {
-            'amd64': 'd3d0d34909d03ffba11baccd87989c1825fc5c68b1f59307fe188a6dd8e0da5a',  # noqa: E501
-            'arm64': '2b166f4d4165b508b9c9b96de6364bc35ff019545810ad07d919ee5ea3d064c7'},  # noqa: E501
-        'location': ('https://github.com/'
-                     'jaqx0r/mtail/'
-                     'releases/download/v${version}/'
-                     'mtail'
-                     '_${version}_linux_${debian_arch}.tar.gz')},
-    'prometheus-mysqld-exporter': {
-        'version': '0.18.0',
-        'type': 'url',
-        'sha256': {
-            'amd64': '46e8f45654352bdd42d162b2b4a68f00055d45acc168f9c068235b9e3acc39c1',  # noqa: E501
-            'arm64': 'abdb452600ca086b68244aadf8045fbf0b6a48dcb76eed5576995806c176f6ce'},  # noqa: E501
-        'location': ('https://github.com/'
-                     'prometheus/mysqld_exporter/'
-                     'releases/download/v${version}/'
-                     'mysqld_exporter'
-                     '-${version}.linux-${debian_arch}.tar.gz')},
-    'prometheus-node-exporter': {
-        'version': '1.10.2',
-        'type': 'url',
-        'sha256': {
-            'amd64': 'c46e5b6f53948477ff3a19d97c58307394a29fe64a01905646f026ddc32cb65b',  # noqa: E501
-            'arm64': 'de69ec8341c8068b7c8e4cfe3eb85065d24d984a3b33007f575d307d13eb89a6'},  # noqa: E501
-        'location': ('https://github.com/'
-                     'prometheus/node_exporter/'
-                     'releases/download/v${version}/'
-                     'node_exporter'
-                     '-${version}.linux-${debian_arch}.tar.gz')},
-    'prometheus-openstack-exporter': {
-        'version': '1.7.0',
-        'type': 'url',
-        'sha256': {
-            'amd64': 'dfaa0d3dcff22e882d3f61c56bb9ac6f70790df9d67361464159bbb4c7223192',  # noqa: E501
-            'arm64': 'd6e0b23fe755732a93796255e3a2be8ec5a699b0a64c21afd377c60ccf60cd55'},  # noqa: E501
-        'location': ('https://github.com/'
-                     'openstack-exporter/openstack-exporter/'
-                     'releases/download/v${version}/'
-                     'openstack-exporter'
-                     '_${version}_linux_${debian_arch}.tar.gz')},
-    'prometheus-openstack-network-exporter': {
-        'version': '0.2.0',
-        'type': 'url',
-        'sha256': {
-            'amd64': 'c93e6c62a0b861af50292f51b1443114e2178d89450b37cb0462723eaa3b2338',  # noqa: E501
-            'arm64': '478de6e005188d0e2545e34ca2c5b93a33a32dc7d1f1b03dc3210c4ef7e44305'},  # noqa: E501
-        'location': ('https://github.com/'
-                     'openstack-k8s-operators/openstack-network-exporter/'
-                     'releases/download/v${version}/'
-                     'openstack-network-exporter'
-                     '-linux-${debian_arch}')},
-    'prometheus-server': {
-        # NOTE(mnasiadka): lts_branch pins check_sources.py to the 3.5.x
-        # release series instead of jumping to the latest major.minor.
-        'lts_branch': '3.5',
-        'version': '3.5.4',
-        'type': 'url',
-        'sha256': {
-            'amd64': 'be64e1cf657e6e7d132aca022f6135abedd660db053952e3f69e8affa3b9cc9e',  # noqa: E501
-            'arm64': '97634b9b6ed9ef18689e3b3572f1b277714650657516494fd164dcc53c1d3f48'},  # noqa: E501
-        'location': ('https://github.com/'
-                     'prometheus/prometheus/'
-                     'releases/download/v${version}/'
-                     'prometheus'
-                     '-${version}.linux-${debian_arch}.tar.gz')},
-    'prometheus-valkey-exporter': {
-        'version': '1.82.0',
-        'type': 'url',
-        'sha256': {
-            'amd64': '2d98dd0888f46e206bf3ad1b7c1784934a3a39cd8774cf47615f4c15594547cd',  # noqa: E501
-            'arm64': '13aaa6acbb145848cb97ed3bab22747e094b3f0ed22df83c8ace593e3c527c95'},  # noqa: E501
-        'location': ('https://github.com/'
-                     'oliver006/redis_exporter/'
-                     'releases/download/v${version}/'
-                     'redis_exporter'
-                     '-v${version}.linux-${debian_arch}.tar.gz')},
-    'skyline-apiserver': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/skyline-apiserver/'
-                     'skyline-apiserver-${openstack_branch}.tar.gz')},
-    'skyline-console': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/skyline-console/'
-                     'skyline-console-${openstack_branch}.tar.gz')},
-    'tacker-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/tacker/'
-                     'tacker-${openstack_branch}.tar.gz')},
-    'tacker-base-plugin-networking-sfc': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/networking-sfc/'
-                     'networking-sfc-${openstack_branch}.tar.gz')},
-    'trove-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/trove/'
-                     'trove-${openstack_branch}.tar.gz')},
-    'watcher-base': {
-        'type': 'url',
-        'location': ('$tarballs_base/openstack/watcher/'
-                     'watcher-${openstack_branch}.tar.gz')}
-}
+import os
+
+import yaml
+
+SOURCES_YAML = os.path.dirname(os.path.realpath(__file__)) + '/sources.yaml'
+
+with open(SOURCES_YAML, 'r') as f:
+    SOURCES = yaml.safe_load(f)
diff --git a/kolla/common/sources.yaml b/kolla/common/sources.yaml
new file mode 100644
index 0000000000..1214bd5da6
--- /dev/null
+++ b/kolla/common/sources.yaml
@@ -0,0 +1,317 @@
+---
+openstack-base:
+  type: "url"
+  location: "$tarballs_base/openstack/requirements/requirements-${openstack_branch}.tar.gz"
+aodh-base:
+  type: "url"
+  location: "$tarballs_base/openstack/aodh/aodh-${openstack_branch}.tar.gz"
+barbican-base:
+  type: "url"
+  location: "$tarballs_base/openstack/barbican/barbican-${openstack_branch}.tar.gz"
+bifrost-base:
+  type: "url"
+  location: "$tarballs_base/openstack/bifrost/bifrost-${openstack_branch}.tar.gz"
+blazar-base:
+  type: "url"
+  location: "$tarballs_base/openstack/blazar/blazar-${openstack_branch}.tar.gz"
+ceilometer-base:
+  type: "url"
+  location: "$tarballs_base/openstack/ceilometer/ceilometer-${openstack_branch}.tar.gz"
+cinder-base:
+  type: "url"
+  location: "$tarballs_base/openstack/cinder/cinder-${openstack_branch}.tar.gz"
+cloudkitty-base:
+  type: "url"
+  location: "$tarballs_base/openstack/cloudkitty/cloudkitty-${openstack_branch}.tar.gz"
+cyborg-base:
+  type: "url"
+  location: "$tarballs_base/openstack/cyborg/cyborg-${openstack_branch}.tar.gz"
+designate-base:
+  type: "url"
+  location: "$tarballs_base/openstack/designate/designate-${openstack_branch}.tar.gz"
+etcd:
+  # NOTE(wszumski): Upgrade one minor version at a time:
+  # https://etcd.io/docs/v3.6/upgrades/upgrade_3_6/
+  # NOTE(mnasiadka): lts_branch pins check_sources.py to the 3.6.x
+  # release series instead of jumping to the latest major.minor.
+  lts_branch: "3.6"
+  version: "3.6.14"
+  type: "url"
+  sha256:
+    amd64: "ffe840ff9295808e88cce2794a18a5ac87f12a5203c8314d0bf6aa119b41bac5"
+    arm64: "fa1b80565ee6fc2df1ae6f57a508b221f3ecc7d591c317c581cd8281b0842b3e"
+  location: "https://github.com/etcd-io/etcd/releases/download/v${version}/etcd-v${version}-linux-${debian_arch}.tar.gz"
+glance-base:
+  type: "url"
+  location: "$tarballs_base/openstack/glance/glance-${openstack_branch}.tar.gz"
+gnocchi-base:
+  type: "git"
+  reference: "4.7.0"
+  location: "https://github.com/gnocchixyz/gnocchi.git"
+heat-base:
+  type: "url"
+  location: "$tarballs_base/openstack/heat/heat-${openstack_branch}.tar.gz"
+horizon:
+  type: "url"
+  location: "$tarballs_base/openstack/horizon/horizon-${openstack_branch}.tar.gz"
+horizon-plugin-blazar-dashboard:
+  type: "url"
+  location: "$tarballs_base/openstack/blazar-dashboard/blazar-dashboard-${openstack_branch}.tar.gz"
+horizon-plugin-cloudkitty-dashboard:
+  type: "url"
+  location: "$tarballs_base/openstack/cloudkitty-dashboard/cloudkitty-dashboard-${openstack_branch}.tar.gz"
+horizon-plugin-designate-dashboard:
+  type: "url"
+  location: "$tarballs_base/openstack/designate-dashboard/designate-dashboard-${openstack_branch}.tar.gz"
+horizon-plugin-fwaas-dashboard:
+  type: "url"
+  location: "$tarballs_base/openstack/neutron-fwaas-dashboard/neutron-fwaas-dashboard-${openstack_branch}.tar.gz"
+horizon-plugin-heat-dashboard:
+  type: "url"
+  location: "$tarballs_base/openstack/heat-dashboard/heat-dashboard-${openstack_branch}.tar.gz"
+horizon-plugin-ironic-ui:
+  type: "url"
+  location: "$tarballs_base/openstack/ironic-ui/ironic-ui-${openstack_branch}.tar.gz"
+horizon-plugin-magnum-ui:
+  type: "url"
+  location: "$tarballs_base/openstack/magnum-ui/magnum-ui-${openstack_branch}.tar.gz"
+horizon-plugin-manila-ui:
+  type: "url"
+  location: "$tarballs_base/openstack/manila-ui/manila-ui-${openstack_branch}.tar.gz"
+horizon-plugin-masakari-dashboard:
+  type: "url"
+  location: "$tarballs_base/openstack/masakari-dashboard/masakari-dashboard-${openstack_branch}.tar.gz"
+horizon-plugin-mistral-dashboard:
+  type: "url"
+  location: "$tarballs_base/openstack/mistral-dashboard/mistral-dashboard-${openstack_branch}.tar.gz"
+horizon-plugin-neutron-vpnaas-dashboard:
+  type: "url"
+  location: "$tarballs_base/openstack/neutron-vpnaas-dashboard/neutron-vpnaas-dashboard-${openstack_branch}.tar.gz"
+horizon-plugin-octavia-dashboard:
+  type: "url"
+  location: "$tarballs_base/openstack/octavia-dashboard/octavia-dashboard-${openstack_branch}.tar.gz"
+horizon-plugin-tacker-dashboard:
+  type: "url"
+  location: "$tarballs_base/openstack/tacker-horizon/tacker-horizon-${openstack_branch}.tar.gz"
+horizon-plugin-trove-dashboard:
+  type: "url"
+  location: "$tarballs_base/openstack/trove-dashboard/trove-dashboard-${openstack_branch}.tar.gz"
+horizon-plugin-watcher-dashboard:
+  type: "url"
+  location: "$tarballs_base/openstack/watcher-dashboard/watcher-dashboard-${openstack_branch}.tar.gz"
+ironic-base:
+  type: "url"
+  location: "$tarballs_base/openstack/ironic/ironic-${openstack_branch}.tar.gz"
+ironic-conductor-plugin-prometheus-exporter:
+  type: "url"
+  location: "$tarballs_base/openstack/ironic-prometheus-exporter/ironic-prometheus-exporter-${openstack_branch}.tar.gz"
+keystone-base:
+  type: "url"
+  location: "$tarballs_base/openstack/keystone/keystone-${openstack_branch}.tar.gz"
+kerbside-base:
+  type: "git"
+  reference: "develop"
+  location: "https://github.com/shakenfist/kerbside"
+kolla-toolbox:
+  type: "url"
+  location: "$tarballs_base/openstack/requirements/requirements-${openstack_branch}.tar.gz"
+letsencrypt-lego:
+  version: "v5.4.0"
+  type: "url"
+  sha256:
+    amd64: "d3adf89392d606ce84d485c1cc20832edd42ace6ff9ced9dd3670d9d8b8aca38"
+    arm64: "a86e946e0415e14e28d6dfe3c95914b088b3f5f6e13209e07e2e8c3a64d7280b"
+  location: "https://github.com/go-acme/lego/releases/download/${version}/lego_${version}_linux_${debian_arch}.tar.gz"
+magnum-base:
+  type: "url"
+  location: "$tarballs_base/openstack/magnum/magnum-${openstack_branch}.tar.gz"
+magnum-conductor-plugin-helm:
+  version: "v4.2.4"
+  type: "url"
+  # NOTE(mnasiadka): location points to get.helm.sh, but
+  # check_sources needs github releases access
+  github: "helm/helm"
+  sha256:
+    amd64: "c306b46f719b0a4da32d0f78ee21bf90ce8d602f15b22ab753f0674d1670a7f3"
+    arm64: "564de2191b881e9f71b5606b25345821ea1682f06ab90499d3ab22b530176da1"
+  location: "https://get.helm.sh/helm-${version}-linux-${debian_arch}.tar.gz"
+manila-base:
+  type: "url"
+  location: "$tarballs_base/openstack/manila/manila-${openstack_branch}.tar.gz"
+mariadb-server-plugin-mariadb-docker:
+  # NOTE(seunghun1ee): This repo is needed to get MariaDB healthcheck.sh
+  type: "git"
+  reference: "master"
+  location: "https://github.com/MariaDB/mariadb-docker"
+masakari-base:
+  type: "url"
+  location: "$tarballs_base/openstack/masakari/masakari-${openstack_branch}.tar.gz"
+masakari-monitors:
+  type: "url"
+  location: "$tarballs_base/openstack/masakari-monitors/masakari-monitors-${openstack_branch}.tar.gz"
+mistral-base:
+  type: "url"
+  location: "$tarballs_base/openstack/mistral/mistral-${openstack_branch}.tar.gz"
+mistral-base-plugin-tacker:
+  type: "url"
+  location: "$tarballs_base/openstack/tacker/tacker-${openstack_branch}.tar.gz"
+neutron-base:
+  type: "url"
+  location: "$tarballs_base/openstack/neutron/neutron-${openstack_branch}.tar.gz"
+neutron-base-plugin-neutron-fwaas:
+  type: "url"
+  location: "$tarballs_base/openstack/neutron-fwaas/neutron-fwaas-${openstack_branch}.tar.gz"
+neutron-base-plugin-networking-baremetal:
+  type: "url"
+  location: "$tarballs_base/openstack/networking-baremetal/networking-baremetal-${openstack_branch}.tar.gz"
+neutron-base-plugin-networking-generic-switch:
+  type: "url"
+  location: "$tarballs_base/openstack/networking-generic-switch/networking-generic-switch-${openstack_branch}.tar.gz"
+neutron-base-plugin-networking-sfc:
+  type: "url"
+  location: "$tarballs_base/openstack/networking-sfc/networking-sfc-${openstack_branch}.tar.gz"
+neutron-base-plugin-tap-as-a-service:
+  type: "url"
+  location: "$tarballs_base/openstack/tap-as-a-service/tap-as-a-service-${openstack_branch}.tar.gz"
+neutron-base-plugin-vpnaas-agent:
+  type: "url"
+  location: "$tarballs_base/openstack/neutron-vpnaas/neutron-vpnaas-${openstack_branch}.tar.gz"
+neutron-bgp-dragent:
+  type: "url"
+  location: "$tarballs_base/openstack/neutron-dynamic-routing/neutron-dynamic-routing-${openstack_branch}.tar.gz"
+neutron-server-plugin-neutron-dynamic-routing:
+  type: "url"
+  location: "$tarballs_base/openstack/neutron-dynamic-routing/neutron-dynamic-routing-${openstack_branch}.tar.gz"
+neutron-vpnaas-agent:
+  type: "url"
+  location: "$tarballs_base/openstack/neutron-vpnaas/neutron-vpnaas-${openstack_branch}.tar.gz"
+nova-base:
+  type: "url"
+  location: "$tarballs_base/openstack/nova/nova-${openstack_branch}.tar.gz"
+nova-base-plugin-blazar:
+  type: "url"
+  location: "$tarballs_base/openstack/blazar-nova/blazar-nova-${openstack_branch}.tar.gz"
+octavia-base:
+  type: "url"
+  location: "$tarballs_base/openstack/octavia/octavia-${openstack_branch}.tar.gz"
+octavia-api-plugin-ovn-octavia-provider:
+  type: "url"
+  location: "$tarballs_base/openstack/ovn-octavia-provider/ovn-octavia-provider-${openstack_branch}.tar.gz"
+octavia-driver-agent-plugin-ovn-octavia-provider:
+  type: "url"
+  location: "$tarballs_base/openstack/ovn-octavia-provider/ovn-octavia-provider-${openstack_branch}.tar.gz"
+placement-base:
+  type: "url"
+  location: "$tarballs_base/openstack/placement/placement-${openstack_branch}.tar.gz"
+prometheus-alertmanager:
+  version: "0.34.0"
+  type: "url"
+  sha256:
+    amd64: "19c75a11d8c03dc4ade7abdbddfb3a8f28c9e7b000d0849cda0cd71dffd74a03"
+    arm64: "a96ef16598ddc58e84d28167b3352b30e3205698d76c56ef467e4504d7664da4"
+  location: "https://github.com/prometheus/alertmanager/releases/download/v${version}/alertmanager-${version}.linux-${debian_arch}.tar.gz"
+prometheus-blackbox-exporter:
+  version: "0.28.0"
+  type: "url"
+  sha256:
+    amd64: "caf5d242fb1cf6d5cb678f3f799f22703d4fafea26b03dcbbd7e1f1825e06329"
+    arm64: "63312be0983d85e5109710a7dc93df3051157ae581853fa3655d171cc1b2806e"
+  location: "https://github.com/prometheus/blackbox_exporter/releases/download/v${version}/blackbox_exporter-${version}.linux-${debian_arch}.tar.gz"
+prometheus-cadvisor:
+  version: "0.60.5"
+  type: "url"
+  sha256:
+    amd64: "6f258bed28113218c88729634c47ead8d928b81b1504b75fd911b98d29003a87"
+    arm64: "6f93087c114bc64a7b8d5c4148190b4d9b95511b9bf023246ce4c76dc448a48a"
+  location: "https://github.com/google/cadvisor/releases/download/v${version}/cadvisor-v${version}-linux-${debian_arch}"
+prometheus-elasticsearch-exporter:
+  version: "1.11.0"
+  type: "url"
+  sha256:
+    amd64: "2bebc50d6980578ad37a376000bc039485ceea129ae229f78baed3379db4f61c"
+    arm64: "7020d10e29896d329cecc7bfe2e90dcc376d68fc0c75ac27014af3747870ce1f"
+  location: "https://github.com/prometheus-community/elasticsearch_exporter/releases/download/v${version}/elasticsearch_exporter-${version}.linux-${debian_arch}.tar.gz"
+prometheus-libvirt-exporter:
+  version: "2.5.0"
+  type: "url"
+  sha256:
+    amd64: "07a49f3d0424259eba88cbc41310017fbbbd6d8ce0b2a0e4dfad3d973b55f558"
+    arm64: "4d13a4a930adabc9c2be8c83c7a8bb2b3e81d8743e9b645590f3d28311e1e8cb"
+  location: "https://github.com/inovex/prometheus-libvirt-exporter/releases/download/v${version}/prometheus-libvirt-exporter-${version}.linux-${debian_arch}.tar.gz"
+prometheus-memcached-exporter:
+  version: "0.17.0"
+  type: "url"
+  sha256:
+    amd64: "40e85262e4340a56fa7cc96722cd596d25ed76ab501459b0b42f1f8e0562d0d1"
+    arm64: "d1abf0ef1196ff5de5cf3462eb962b4a3d6733327951ae6d81c062902b5f2a60"
+  location: "https://github.com/prometheus/memcached_exporter/releases/download/v${version}/memcached_exporter-${version}.linux-${debian_arch}.tar.gz"
+prometheus-mtail:
+  version: "3.4.9"
+  type: "url"
+  sha256:
+    amd64: "2d8f076432d260a26cdcdac9480942aa10c5cb95b0cc43e920d5bb5269a145f1"
+    arm64: "fb24e6b3270b8e9c8dbd7e263d27e2310249dd9d5a793608fe80b19784fefcf9"
+  location: "https://github.com/jaqx0r/mtail/releases/download/v${version}/mtail_${version}_linux_${debian_arch}.tar.gz"
+prometheus-mysqld-exporter:
+  version: "0.20.0"
+  type: "url"
+  sha256:
+    amd64: "5773496e9962ca3817b3599fe4d74f218c95c1295eb2a742462df8e035fe51bd"
+    arm64: "837804c0a59cbe1f3ab46670dec1b4c37940c8d48062374691b27f1f37abf8dd"
+  location: "https://github.com/prometheus/mysqld_exporter/releases/download/v${version}/mysqld_exporter-${version}.linux-${debian_arch}.tar.gz"
+prometheus-node-exporter:
+  version: "1.12.1"
+  type: "url"
+  sha256:
+    amd64: "b51d8a76aa2a9156a55d501aca6276fae09e262259a5e4e831d2c2222f084e63"
+    arm64: "ad35b605f9954b9f1ffddf5ba054bdc5a98d790b9eae5291e1eeb83f1ecbd0e7"
+  location: "https://github.com/prometheus/node_exporter/releases/download/v${version}/node_exporter-${version}.linux-${debian_arch}.tar.gz"
+prometheus-openstack-exporter:
+  version: "1.7.0"
+  type: "url"
+  sha256:
+    amd64: "dfaa0d3dcff22e882d3f61c56bb9ac6f70790df9d67361464159bbb4c7223192"
+    arm64: "d6e0b23fe755732a93796255e3a2be8ec5a699b0a64c21afd377c60ccf60cd55"
+  location: "https://github.com/openstack-exporter/openstack-exporter/releases/download/v${version}/openstack-exporter_${version}_linux_${debian_arch}.tar.gz"
+prometheus-openstack-network-exporter:
+  version: "0.2.0"
+  type: "url"
+  sha256:
+    amd64: "c93e6c62a0b861af50292f51b1443114e2178d89450b37cb0462723eaa3b2338"
+    arm64: "478de6e005188d0e2545e34ca2c5b93a33a32dc7d1f1b03dc3210c4ef7e44305"
+  location: "https://github.com/openstack-k8s-operators/openstack-network-exporter/releases/download/v${version}/openstack-network-exporter-linux-${debian_arch}"
+prometheus-server:
+  # NOTE(mnasiadka): lts_branch pins check_sources.py to the 3.5.x
+  # release series instead of jumping to the latest major.minor.
+  lts_branch: "3.5"
+  version: "3.5.5"
+  type: "url"
+  sha256:
+    amd64: "64d0beab873272b861a91df41668bc852c7e2e5b23f75c16059fb15b5630c577"
+    arm64: "b4676dba3271deea2a92a3e85ac31cde67be707fdff54c5dbf48c9f2ecac5085"
+  location: "https://github.com/prometheus/prometheus/releases/download/v${version}/prometheus-${version}.linux-${debian_arch}.tar.gz"
+prometheus-valkey-exporter:
+  version: "1.89.0"
+  type: "url"
+  sha256:
+    amd64: "f7db4f86272f272bbc08971ce0e34dd675f992c55bd788b0c9fb21158bcec502"
+    arm64: "1a70d42cd1d96a9388f8b528f55ad5bdc2c3cbd911c1dff3875fcb9ac01fa28a"
+  location: "https://github.com/oliver006/redis_exporter/releases/download/v${version}/redis_exporter-v${version}.linux-${debian_arch}.tar.gz"
+skyline-apiserver:
+  type: "url"
+  location: "$tarballs_base/openstack/skyline-apiserver/skyline-apiserver-${openstack_branch}.tar.gz"
+skyline-console:
+  type: "url"
+  location: "$tarballs_base/openstack/skyline-console/skyline-console-${openstack_branch}.tar.gz"
+tacker-base:
+  type: "url"
+  location: "$tarballs_base/openstack/tacker/tacker-${openstack_branch}.tar.gz"
+tacker-base-plugin-networking-sfc:
+  type: "url"
+  location: "$tarballs_base/openstack/networking-sfc/networking-sfc-${openstack_branch}.tar.gz"
+trove-base:
+  type: "url"
+  location: "$tarballs_base/openstack/trove/trove-${openstack_branch}.tar.gz"
+watcher-base:
+  type: "url"
+  location: "$tarballs_base/openstack/watcher/watcher-${openstack_branch}.tar.gz"
diff --git a/releasenotes/notes/update-external-components-7ad94672447b4901.yaml b/releasenotes/notes/update-external-components-7ad94672447b4901.yaml
new file mode 100644
index 0000000000..c6bace2f98
--- /dev/null
+++ b/releasenotes/notes/update-external-components-7ad94672447b4901.yaml
@@ -0,0 +1,35 @@
+---
+upgrade:
+  - |
+    ``etcd`` has been updated from ``3.6.5`` to ``3.6.14``.
+  - |
+    ``letsencrypt-lego`` has been updated from ``4.27.0`` to ``5.4.0``.
+  - |
+    ``magnum-conductor-plugin-helm`` has been updated from ``3.19.0`` to
+    ``4.2.4``.
+  - |
+    ``prometheus-alertmanager`` has been updated from ``0.31.1`` to ``0.34.0``.
+  - |
+    ``prometheus-cadvisor`` has been updated from ``0.56.2`` to ``0.60.5``.
+  - |
+    ``prometheus-elasticsearch-exporter`` has been updated from ``1.10.0`` to
+    ``1.11.0``.
+  - |
+    ``prometheus-libvirt-exporter`` has been updated from ``2.3.1`` to
+    ``2.5.0``.
+  - |
+    ``prometheus-memcached-exporter`` has been updated from ``0.15.5`` to
+    ``0.17.0``.
+  - |
+    ``prometheus-mtail`` has been updated from ``3.4.0`` to ``3.4.9``.
+  - |
+    ``prometheus-mysqld-exporter`` has been updated from ``0.18.0`` to
+    ``0.20.0``.
+  - |
+    ``prometheus-node-exporter`` has been updated from ``1.10.2`` to
+    ``1.12.1``.
+  - |
+    ``prometheus-server`` has been updated from ``3.5.4`` to ``3.5.5``.
+  - |
+    ``prometheus-valkey-exporter`` has been updated from ``1.82.0`` to
+    ``1.89.0``.
diff --git a/roles/kolla-build-config/templates/kolla-build.conf.j2 b/roles/kolla-build-config/templates/kolla-build.conf.j2
index 07a50baae5..eddbdab14a 100644
--- a/roles/kolla-build-config/templates/kolla-build.conf.j2
+++ b/roles/kolla-build-config/templates/kolla-build.conf.j2
@@ -10,6 +10,7 @@
 {# Generate a section for every build source Zuul has a checkout for,
    whether it's a required-project or a Depends-On. #}
 
+{% if not (is_upgrade | default(False) | bool) %}
 {% for canonical_name, project in zuul['projects'].items() %}
 {% if project.name in kolla_build_sources %}
 {% set source_names = kolla_build_sources[project.name] %}
@@ -26,3 +27,4 @@ location = {{ ansible_env.PWD ~ '/' ~ project.src_dir }}
 {% endif %}
 {% endif %}
 {% endfor %}
+{% endif %}
diff --git a/tools/check_sources.py b/tools/check_sources.py
index 189ddb1706..38fc03acce 100644
--- a/tools/check_sources.py
+++ b/tools/check_sources.py
@@ -19,10 +19,7 @@
 import textwrap
 
 import requests
-
-sys.path.append(os.getcwd())
-
-from kolla.common.sources import SOURCES  # noqa: E402
+import yaml
 
 
 def github_headers():
@@ -202,14 +199,9 @@ def get_helm_sh_hashes(version, arch_map):
     return hashes
 
 
-SOURCES_PATH = os.path.normpath(
-    os.path.join(os.path.dirname(os.path.abspath(__file__)),
-                 '..', 'kolla', 'common', 'sources.py'))
-
-
-def apply_update(name, info, new_v, new_hashes):
-    """Update version and sha256 entries for one source in sources.py."""
-    with open(SOURCES_PATH) as f:
+def apply_update(name, info, new_v, new_hashes, sources_path):
+    """Update version and sha256 entries for one source in sources.yaml."""
+    with open(sources_path) as f:
         content = f.read()
 
     version_key = 'reference' if info.get('type') == 'git' else 'version'
@@ -217,26 +209,23 @@ def apply_update(name, info, new_v, new_hashes):
     if old_v:
         new_v_str = ('v' + new_v) if old_v.startswith('v') else new_v
         content = content.replace(
-            f"'{version_key}': '{old_v}'",
-            f"'{version_key}': '{new_v_str}'", 1)
+            f'{version_key}: "{old_v}"',
+            f'{version_key}: "{new_v_str}"', 1)
 
     for arch, new_sha in new_hashes.items():
         old_sha = info.get('sha256', {}).get(arch, '')
         if old_sha and old_sha != new_sha:
             content = content.replace(old_sha, new_sha)
 
-    with open(SOURCES_PATH, 'w') as f:
+    with open(sources_path, 'w') as f:
         f.write(content)
 
 
-REPO_ROOT = os.path.normpath(
-    os.path.join(os.path.dirname(os.path.abspath(__file__)), '..'))
-
-
-def create_releasenote(changes):
+def create_releasenote(changes, repo_root):
     """Create a reno release note listing all updated components.
 
     :param changes: list of (name, old_version, new_version) tuples
+    :param repo_root: root of the kolla repository checkout
     """
     if len(changes) == 1:
         slug = f"update-{changes[0][0]}"
@@ -244,7 +233,7 @@ def create_releasenote(changes):
         slug = "update-external-components"
 
     result = subprocess.run(  # nosec
-        ['reno', 'new', slug, REPO_ROOT],
+        ['reno', 'new', slug, repo_root],
         capture_output=True, text=True)
 
     if result.returncode != 0:
@@ -269,8 +258,13 @@ def create_releasenote(changes):
     print(f"Created release note: {note_path}")
 
 
-def check_versions(update=False):
-    """Monitor Kolla architectures and compare with latest releases."""
+def check_versions(sources, sources_path, repo_root, update=False):
+    """Monitor Kolla architectures and compare with latest releases.
+
+    :param sources: the kolla.common.sources.SOURCES dict
+    :param sources_path: path to the sources.yaml file to update
+    :param repo_root: root of the kolla repository checkout
+    """
     check_github_rate_limit()
     arch_map = {'amd64': 'linux-amd64', 'arm64': 'linux-arm64'}
     version_changes = []
@@ -280,7 +274,7 @@ def check_versions(update=False):
     print(header)
     print("-" * 110)
 
-    for name, info in SOURCES.items():
+    for name, info in sources.items():
         current_v = info.get('version') or info.get('reference', '')
         if not re.match(r'^v?\d+[\.\d]+', current_v or ''):
             current_v = None
@@ -324,23 +318,54 @@ def check_versions(update=False):
                     print(line)
 
                 if update and lines_to_print:
-                    apply_update(name, info, latest_v, new_hashes)
+                    apply_update(name, info, latest_v, new_hashes,
+                                 sources_path)
                     if status_v == "UPDATE":
                         version_changes.append(
                             (name, current_v, latest_v))
 
     if update and version_changes:
-        create_releasenote(version_changes)
+        create_releasenote(version_changes, repo_root)
 
 
-if __name__ == "__main__":
+def parse_args():
     parser = argparse.ArgumentParser(
         description='Check and optionally update Kolla source versions.')
+    parser.add_argument('--repo', default=None,
+                        help='Path to the kolla repository checkout '
+                             '(default: the checkout this script lives in, '
+                             'if any, otherwise the current directory)')
     parser.add_argument('--update', action='store_true',
-                        help='Update kolla/common/sources.py in place')
-    args = parser.parse_args()
+                        help='Update kolla/common/sources.yaml in place')
+    return parser.parse_args()
+
+
+def default_repo_root():
+    """Guess the repo root when run in-tree from <repo>/tools/."""
+    in_tree = os.path.normpath(
+        os.path.join(os.path.dirname(os.path.abspath(__file__)), '..'))
+    if os.path.isfile(
+            os.path.join(in_tree, 'kolla', 'common', 'sources.yaml')):
+        return in_tree
+    return os.getcwd()
+
+
+if __name__ == "__main__":
+    args = parse_args()
     if args.update and not shutil.which('reno'):
         print("ERROR: 'reno' is not installed or not in PATH. "
               "Install it with: pip install reno")
         sys.exit(1)
-    check_versions(update=args.update)
+
+    repo_root = os.path.abspath(args.repo or default_repo_root())
+    sources_path = os.path.join(
+        repo_root, 'kolla', 'common', 'sources.yaml')
+    if not os.path.isfile(sources_path):
+        print(f"ERROR: {sources_path} not found. Pass --repo pointing at "
+              "a kolla repository checkout.")
+        sys.exit(1)
+
+    with open(sources_path) as f:
+        SOURCES = yaml.safe_load(f)
+
+    check_versions(SOURCES, sources_path, repo_root, update=args.update)
diff --git a/tools/validate-build-sources-overrides.py b/tools/validate-build-sources-overrides.py
index 212c380c25..5d9db62f52 100644
--- a/tools/validate-build-sources-overrides.py
+++ b/tools/validate-build-sources-overrides.py
@@ -12,11 +12,11 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-"""Check that every buildable-from-source entry in kolla/common/sources.py
+"""Check that every buildable-from-source entry in kolla/common/sources.yaml
 has a matching CI override in
 roles/kolla-build-config/defaults/main.yml (kolla_build_sources), that
 each such project is declared in the kolla-base job's required-projects
-in zuul.d/base.yaml, and that any pinned git reference in sources.py
+in zuul.d/base.yaml, and that any pinned git reference in sources.yaml
 matches the override-checkout used to fetch it in CI. This ensures CI
 builds every source from a Zuul-cached git checkout instead of
 downloading a tarball from tarballs.opendev.org.
@@ -116,12 +116,12 @@ def main():
             if actual is None:
                 ref_errors.append(
                     f"{project} ({section}) is pinned to reference "
-                    f"'{expected_ref}' in sources.py but has no "
+                    f"'{expected_ref}' in sources.yaml but has no "
                     "override-checkout in zuul.d/base.yaml "
                     "required-projects")
             elif actual != expected_ref:
                 ref_errors.append(
-                    f"{project} ({section}): sources.py reference "
+                    f"{project} ({section}): sources.yaml reference "
                     f"'{expected_ref}' != required-projects "
                     f"override-checkout '{actual}'")
 
@@ -135,23 +135,23 @@ def main():
             ref_errors.append(
                 f"{project} has override-checkout '{checkout}' in "
                 "required-projects but none of its kolla_build_sources "
-                "sections are type 'git' in sources.py")
+                "sections are type 'git' in sources.yaml")
 
     if missing:
-        print("ERROR: sources.py entries missing a kolla_build_sources "
+        print("ERROR: sources.yaml entries missing a kolla_build_sources "
               "override in roles/kolla-build-config/defaults/main.yml:")
         for name in missing:
             print(f"  {name}")
 
     if stale:
         print("ERROR: kolla_build_sources overrides referencing sections "
-              "that no longer exist in kolla/common/sources.py:")
+              "that no longer exist in kolla/common/sources.yaml:")
         for name in stale:
             print(f"  {name}")
 
     if redundant_exclusions:
         print("ERROR: EXCLUDED_SOURCES entries referencing sections that "
-              "no longer exist in kolla/common/sources.py, remove them:")
+              "no longer exist in kolla/common/sources.yaml, remove them:")
         for name in redundant_exclusions:
             print(f"  {name}")
 
@@ -162,7 +162,7 @@ def main():
             print(f"  {name}")
 
     if ref_errors:
-        print("ERROR: git reference mismatches between sources.py and "
+        print("ERROR: git reference mismatches between sources.yaml and "
               "zuul.d/base.yaml required-projects:")
         for msg in ref_errors:
             print(f"  {msg}")
diff --git a/zuul.d/scenarios/aio.yaml b/zuul.d/scenarios/aio.yaml
index 4a8a324ea2..f5acd08c28 100644
--- a/zuul.d/scenarios/aio.yaml
+++ b/zuul.d/scenarios/aio.yaml
@@ -6,7 +6,9 @@
     check:
       jobs:
         - kolla-ansible-centos-10s: &files
-            files: ^kolla/docker/
+            files:
+              - ^kolla/common/sources.yaml
+              - ^kolla/docker/
         - kolla-ansible-debian-trixie: *files
         - kolla-ansible-debian-trixie-upgrade: *files
         - kolla-ansible-rocky-10: *files
diff --git a/zuul.d/scenarios/mariadb.yaml b/zuul.d/scenarios/mariadb.yaml
index 882e1338e2..c53a27fcae 100644
--- a/zuul.d/scenarios/mariadb.yaml
+++ b/zuul.d/scenarios/mariadb.yaml
@@ -6,6 +6,8 @@
     check:
       jobs:
         - kolla-ansible-debian-trixie-mariadb: &files
-            files: ^kolla/docker/(base|mariadb-server)/
+            files:
+              - ^kolla/common/sources.yaml
+              - ^kolla/docker/(base|mariadb-server)/
         - kolla-ansible-rocky-10-mariadb: *files
         - kolla-ansible-ubuntu-noble-mariadb: *files
diff --git a/zuul.d/scenarios/prometheus-opensearch.yaml b/zuul.d/scenarios/prometheus-opensearch.yaml
index 84649c3607..c1a5778def 100644
--- a/zuul.d/scenarios/prometheus-opensearch.yaml
+++ b/zuul.d/scenarios/prometheus-opensearch.yaml
@@ -4,7 +4,9 @@
     check:
       jobs:
         - kolla-ansible-debian-trixie-prometheus-opensearch: &files
-            files: ^kolla/docker/(base|fluentd|grafana|opensearch|prometheus)/
+            files:
+              - ^kolla/common/sources.yaml
+              - ^kolla/docker/(base|fluentd|grafana|opensearch|prometheus)/
         - kolla-ansible-debian-trixie-prometheus-opensearch-upgrade: *files
         - kolla-ansible-rocky-10-prometheus-opensearch: *files
         - kolla-ansible-rocky-10-prometheus-opensearch-upgrade: *files