diff --git a/core-services/ci-secret-bootstrap/_config.yaml b/core-services/ci-secret-bootstrap/_config.yaml
index 27202f0d13626..1d6dedec12a50 100644
--- a/core-services/ci-secret-bootstrap/_config.yaml
+++ b/core-services/ci-secret-bootstrap/_config.yaml
@@ -1023,6 +1023,75 @@ secret_configs:
     - non_app_ci
     name: cluster-secrets-libvirt-s390x-vpn-oz
     namespace: ci
+- from:
+    pull-secret:
+      dockerconfigJSON:
+      - auth_field: token_image-puller_app.ci_reg_auth_value.txt
+        item: build_farm
+        registry_url: registry.ci.openshift.org
+      - auth_field: token_image-puller_build01_reg_auth_value.txt
+        item: build_farm
+        registry_url: registry.build01.ci.openshift.org
+      - auth_field: token_image-puller_build02_reg_auth_value.txt
+        item: build_farm
+        registry_url: registry.build02.ci.openshift.org
+      - auth_field: token_image-puller_build03_reg_auth_value.txt
+        item: build_farm
+        registry_url: registry.build03.ci.openshift.org
+      - auth_field: token_image-puller_build04_reg_auth_value.txt
+        item: build_farm
+        registry_url: registry.build04.ci.openshift.org
+      - auth_field: token_image-puller_build05_reg_auth_value.txt
+        item: build_farm
+        registry_url: registry.build05.ci.openshift.org
+      - auth_field: token_image-puller_build06_reg_auth_value.txt
+        item: build_farm
+        registry_url: registry.build06.ci.openshift.org
+      - auth_field: token_image-puller_build07_reg_auth_value.txt
+        item: build_farm
+        registry_url: registry.build07.ci.openshift.org
+      - auth_field: token_image-puller_build09_reg_auth_value.txt
+        item: build_farm
+        registry_url: registry.build09.ci.openshift.org
+      - auth_field: token_image-puller_build10_reg_auth_value.txt
+        item: build_farm
+        registry_url: registry.build10.ci.openshift.org
+      - auth_field: token_image-puller_build11_reg_auth_value.txt
+        item: build_farm
+        registry_url: registry.build11.ci.openshift.org
+      - auth_field: auth
+        email_field: email
+        item: cloud.openshift.com-pull-secret
+        registry_url: cloud.openshift.com
+      - auth_field: auth
+        email_field: email
+        item: quay.io-pull-secret
+        registry_url: quay.io
+      - auth_field: auth
+        item: quayio-ci-read-only-robot
+        registry_url: quay-proxy.ci.openshift.org
+      - auth_field: auth
+        item: quayio-ci-read-only-robot
+        registry_url: quay.io/openshift/ci
+      - auth_field: auth
+        email_field: email
+        item: registry.connect.redhat.com-pull-secret
+        registry_url: registry.connect.redhat.com
+      - auth_field: auth
+        email_field: email
+        item: registry.redhat.io-pull-secret
+        registry_url: registry.redhat.io
+    ssh-privatekey:
+      field: ssh-privatekey
+      item: openshift-ci-aws-credentials
+    ssh-publickey:
+      field: ssh-publickey
+      item: openshift-ci-aws-credentials
+  to:
+  - cluster_groups:
+    - non_app_ci
+    name: cluster-secrets-libvirt-s390x-vpn-hcp
+    namespace: ci
 - from:
     pull-secret:
       dockerconfigJSON:
diff --git a/core-services/prow/02_config/_boskos.yaml b/core-services/prow/02_config/_boskos.yaml
index e4d6d04c73de0..e1a22886b4e91 100644
--- a/core-services/prow/02_config/_boskos.yaml
+++ b/core-services/prow/02_config/_boskos.yaml
@@ -5548,6 +5548,11 @@ resources:
   - libvirt-s390x-amd64-0-0
   state: free
   type: libvirt-s390x-amd64-quota-slice
+- names:
+  - libvirt-s390x-oz-3-2
+  - libvirt-s390x-oz-3-3
+  state: free
+  type: libvirt-s390x-vpn-hcp-quota-slice
 - names:
   - libvirt-s390x-oz-0-0
   - libvirt-s390x-oz-0-1
@@ -5563,8 +5568,6 @@ resources:
   - libvirt-s390x-oz-2-3
   - libvirt-s390x-oz-3-0
   - libvirt-s390x-oz-3-1
-  - libvirt-s390x-oz-3-2
-  - libvirt-s390x-oz-3-3
   state: free
   type: libvirt-s390x-vpn-oz-quota-slice
 - names:
diff --git a/core-services/prow/02_config/generate-boskos.py b/core-services/prow/02_config/generate-boskos.py
index 3f66f842e5431..94cc14ec6a30c 100755
--- a/core-services/prow/02_config/generate-boskos.py
+++ b/core-services/prow/02_config/generate-boskos.py
@@ -412,6 +412,7 @@
     },
     'libvirt-s390x-vpn-quota-slice': {},
     'libvirt-s390x-vpn-oz-quota-slice': {},
+    'libvirt-s390x-vpn-hcp-quota-slice': {},
     'libvirt-s390x-vpn-virt-quota-slice': {},
     'libvirt-s390x-vpn-virt-sno-quota-slice': {},
     'libvirt-ppc64le-s2s-quota-slice':{},
@@ -733,6 +734,13 @@
 for i in range(4):
     for j in range(4):
         CONFIG['libvirt-s390x-vpn-oz-quota-slice']['libvirt-s390x-oz-{}-{}'.format(i, j)] = 1
+# Move lnxocp14 slots 2-3 from vpn-oz to the HCP VPN profile (same lease names / host)
+del CONFIG['libvirt-s390x-vpn-oz-quota-slice']['libvirt-s390x-oz-3-2']
+del CONFIG['libvirt-s390x-vpn-oz-quota-slice']['libvirt-s390x-oz-3-3']
+
+# HCP on OZ lnxocp14: reuse former vpn-oz leases oz-3-2 and oz-3-3
+CONFIG['libvirt-s390x-vpn-hcp-quota-slice']['libvirt-s390x-oz-3-2'] = 1
+CONFIG['libvirt-s390x-vpn-hcp-quota-slice']['libvirt-s390x-oz-3-3'] = 1
 
 # Orange zone (OZ) kubevirt06 (0) + kubevirt07 (1), 1 HA + 1 SNO lease each
 for i in range(2):