diff --git a/doc/source/ceph_versions.csv b/doc/source/ceph_versions.csv
index eed1141aa8..8a549322d3 100644
--- a/doc/source/ceph_versions.csv
+++ b/doc/source/ceph_versions.csv
@@ -1,6 +1,6 @@
 Distro,Ceph,
 ,Source, Release
-Rocky Linux 9,CentOS Storage SIG,Reef
+Rocky Linux 9,download.ceph.com,Squid
 Rocky Linux 10,CentOS Storage SIG,Squid
 Ubuntu,Ubuntu,Squid
 Debian,Debian,Pacific
diff --git a/docker/base/Dockerfile.j2 b/docker/base/Dockerfile.j2
index 82126a8a9f..c0f895ac3b 100644
--- a/docker/base/Dockerfile.j2
+++ b/docker/base/Dockerfile.j2
@@ -63,6 +63,15 @@ COPY dnf.conf /etc/dnf/dnf.conf
     'td.repo',
 ] %}
 
+{% if base_distro_tag.startswith('9') or base_distro_tag.startswith('stream9') %}
+# NOTE(bbezak): The CentOS Storage SIG only built Ceph Squid 19.2.5 for el9,
+# which misses the 19.2.6 CVE fixes, so get Ceph from download.ceph.com here.
+# el10 keeps using centos-release-ceph-squid.
+    {% set base_yum_repo_files = base_yum_repo_files + [
+        'ceph.repo',
+    ] %}
+{% endif %}
+
 {% set base_yum_url_packages = [
 ] %}
 
diff --git a/docker/base/ceph.repo b/docker/base/ceph.repo
new file mode 100644
index 0000000000..c5648d6a14
--- /dev/null
+++ b/docker/base/ceph.repo
@@ -0,0 +1,6 @@
+[ceph-squid]
+name = Ceph Squid
+baseurl = https://download.ceph.com/rpm-squid/el9/$basearch
+gpgcheck = 1
+enabled = 0
+gpgkey = https://download.ceph.com/keys/release.asc
diff --git a/kolla/image/unbuildable.py b/kolla/image/unbuildable.py
index f85317322f..745f2aae03 100644
--- a/kolla/image/unbuildable.py
+++ b/kolla/image/unbuildable.py
@@ -29,6 +29,7 @@
     },
 
     'centos+stream9': {
+        "releaser",  # releases repo no longer supports py3.9
     },
 
     'centos+stream10': {
diff --git a/kolla/template/repos.yaml b/kolla/template/repos.yaml
index 437b67a138..6c0b0cdef8 100644
--- a/kolla/template/repos.yaml
+++ b/kolla/template/repos.yaml
@@ -1,6 +1,6 @@
 ---
 centos:
-  ceph: "centos-ceph-reef"
+  ceph: "ceph-squid"
   crb: "crb"
   docker-ce: "docker-ce"
   epel: "epel"
@@ -20,7 +20,7 @@ centos:
   rabbitmq: "rabbitmq_rabbitmq-server"
 
 centos-aarch64:
-  ceph: "centos-ceph-reef"
+  ceph: "ceph-squid"
   crb: "crb"
   docker-ce: "docker-ce"
   epel: "epel"
@@ -171,7 +171,7 @@ debian-aarch64:
     gpg_key: "rabbitmq.gpg"
 
 rocky:
-  ceph: "centos-ceph-reef"
+  ceph: "ceph-squid"
   crb: "crb"
   docker-ce: "docker-ce"
   epel: "epel"
@@ -191,7 +191,7 @@ rocky:
   rabbitmq: "rabbitmq_rabbitmq-server"
 
 rocky-aarch64:
-  ceph: "centos-ceph-reef"
+  ceph: "ceph-squid"
   crb: "crb"
   docker-ce: "docker-ce"
   epel: "epel"
diff --git a/kolla/tests/test_methods.py b/kolla/tests/test_methods.py
index e55bc2a537..a178d4cd80 100644
--- a/kolla/tests/test_methods.py
+++ b/kolla/tests/test_methods.py
@@ -55,7 +55,7 @@ def test_enable_repos_centos_multiple(self):
         result = methods.handle_repos(template_vars, ['grafana', 'ceph'],
                                       'enable')
         expectCmd = 'RUN dnf config-manager  --enable grafana '
-        expectCmd += '--enable centos-ceph-reef || true'
+        expectCmd += '--enable ceph-squid || true'
         self.assertEqual(expectCmd, result)
 
     def test_enable_repos_debian(self):
@@ -167,7 +167,7 @@ def test_disable_repos_centos_multiple(self):
         result = methods.handle_repos(template_vars, ['grafana', 'ceph'],
                                       'disable')
         expectCmd = 'RUN dnf config-manager  --disable grafana '
-        expectCmd += '--disable centos-ceph-reef || true'
+        expectCmd += '--disable ceph-squid || true'
         self.assertEqual(expectCmd, result)
 
     # NOTE(hrw): there is no disabling of repos for Debian/Ubuntu
diff --git a/releasenotes/notes/ceph-squid-el9-3f1d7a0c95b4e28d.yaml b/releasenotes/notes/ceph-squid-el9-3f1d7a0c95b4e28d.yaml
new file mode 100644
index 0000000000..a1316ae5e9
--- /dev/null
+++ b/releasenotes/notes/ceph-squid-el9-3f1d7a0c95b4e28d.yaml
@@ -0,0 +1,14 @@
+---
+security:
+  - |
+    Ceph in Rocky Linux 9 and CentOS Stream 9 images is updated from Reef
+    18.2.8 to Squid 19.2.6. This fixes CVE-2025-30156, CVE-2026-39944,
+    CVE-2026-50152 and CVE-2026-54330. The packages come from
+    download.ceph.com, because the CentOS Storage SIG only built Squid 19.2.5
+    for el9. Rocky Linux 10 images already have Squid 19.2.6 from the SIG.
+upgrade:
+  - |
+    On Rocky Linux 9 and CentOS Stream 9 the Ceph repository is now
+    ``ceph-squid`` at ``https://download.ceph.com/rpm-squid/el9``, and no
+    longer ``centos-ceph-reef``. If you mirror repositories, add a mirror of
+    the new one and use the new name.