diff --git a/doc/source/ceph_versions.csv b/doc/source/ceph_versions.csv
index acfe9a9998..9042bcbc14 100644
--- a/doc/source/ceph_versions.csv
+++ b/doc/source/ceph_versions.csv
@@ -1,5 +1,5 @@
 Distro,Ceph,
 ,Source, Release
-Rocky Linux,CentOS Storage SIG,Reef
+Rocky Linux,download.ceph.com,Squid
 Ubuntu,Ubuntu,Reef
 Debian,Debian,Pacific
diff --git a/docker/base/Dockerfile.j2 b/docker/base/Dockerfile.j2
index a52e513005..9dbc56aa1f 100644
--- a/docker/base/Dockerfile.j2
+++ b/docker/base/Dockerfile.j2
@@ -63,6 +63,12 @@ COPY dnf.conf /etc/dnf/dnf.conf
     'td.repo',
 ] %}
 
+# NOTE(bbezak): The CentOS Storage SIG only built Ceph Squid 19.2.5 for el9,
+# which misses the 19.2.6 CVE fixes, so get Ceph from download.ceph.com here.
+{% set base_yum_repo_files = base_yum_repo_files + [
+    'ceph.repo',
+] %}
+
 {% set base_yum_url_packages = [
 ] %}
 
diff --git a/docker/base/ceph.repo b/docker/base/ceph.repo
new file mode 100644
index 0000000000..c5648d6a14
--- /dev/null
+++ b/docker/base/ceph.repo
@@ -0,0 +1,6 @@
+[ceph-squid]
+name = Ceph Squid
+baseurl = https://download.ceph.com/rpm-squid/el9/$basearch
+gpgcheck = 1
+enabled = 0
+gpgkey = https://download.ceph.com/keys/release.asc
diff --git a/kolla/template/repos.yaml b/kolla/template/repos.yaml
index 6c1c1bd6b6..810484ea11 100644
--- a/kolla/template/repos.yaml
+++ b/kolla/template/repos.yaml
@@ -1,6 +1,6 @@
 ---
 centos:
-  ceph: "centos-ceph-reef"
+  ceph: "ceph-squid"
   crb: "crb"
   epel: "epel"
   erlang: "rabbitmq_rabbitmq-erlang"
@@ -18,7 +18,7 @@ centos:
   rabbitmq: "rabbitmq_rabbitmq-server"
 
 centos-aarch64:
-  ceph: "centos-ceph-reef"
+  ceph: "ceph-squid"
   crb: "crb"
   epel: "epel"
   erlang-26: "copr-rabbitmq-erlang-26"
@@ -147,7 +147,7 @@ debian-aarch64:
     gpg_key: "rabbitmq.gpg"
 
 rocky:
-  ceph: "centos-ceph-reef"
+  ceph: "ceph-squid"
   crb: "crb"
   epel: "epel"
   erlang: "rabbitmq_rabbitmq-erlang"
@@ -165,7 +165,7 @@ rocky:
   rabbitmq: "rabbitmq_rabbitmq-server"
 
 rocky-aarch64:
-  ceph: "centos-ceph-reef"
+  ceph: "ceph-squid"
   crb: "crb"
   epel: "epel"
   erlang-26: "copr-rabbitmq-erlang-26"
diff --git a/kolla/tests/test_methods.py b/kolla/tests/test_methods.py
index e55bc2a537..a178d4cd80 100644
--- a/kolla/tests/test_methods.py
+++ b/kolla/tests/test_methods.py
@@ -55,7 +55,7 @@ def test_enable_repos_centos_multiple(self):
         result = methods.handle_repos(template_vars, ['grafana', 'ceph'],
                                       'enable')
         expectCmd = 'RUN dnf config-manager  --enable grafana '
-        expectCmd += '--enable centos-ceph-reef || true'
+        expectCmd += '--enable ceph-squid || true'
         self.assertEqual(expectCmd, result)
 
     def test_enable_repos_debian(self):
@@ -167,7 +167,7 @@ def test_disable_repos_centos_multiple(self):
         result = methods.handle_repos(template_vars, ['grafana', 'ceph'],
                                       'disable')
         expectCmd = 'RUN dnf config-manager  --disable grafana '
-        expectCmd += '--disable centos-ceph-reef || true'
+        expectCmd += '--disable ceph-squid || true'
         self.assertEqual(expectCmd, result)
 
     # NOTE(hrw): there is no disabling of repos for Debian/Ubuntu
diff --git a/releasenotes/notes/ceph-squid-el9-3f1d7a0c95b4e28d.yaml b/releasenotes/notes/ceph-squid-el9-3f1d7a0c95b4e28d.yaml
new file mode 100644
index 0000000000..0c3830d08f
--- /dev/null
+++ b/releasenotes/notes/ceph-squid-el9-3f1d7a0c95b4e28d.yaml
@@ -0,0 +1,14 @@
+---
+security:
+  - |
+    Ceph in Rocky Linux 9 and CentOS Stream 9 images is updated from Reef
+    18.2.8 to Squid 19.2.6. This fixes CVE-2025-30156, CVE-2026-39944,
+    CVE-2026-50152 and CVE-2026-54330. The packages come from
+    download.ceph.com, because the CentOS Storage SIG only built Squid 19.2.5
+    for el9.
+upgrade:
+  - |
+    On Rocky Linux 9 and CentOS Stream 9 the Ceph repository is now
+    ``ceph-squid`` at ``https://download.ceph.com/rpm-squid/el9``, and no
+    longer ``centos-ceph-reef``. If you mirror repositories, add a mirror of
+    the new one and use the new name.