diff --git a/etc/kayobe/kolla/kolla-build.conf b/etc/kayobe/kolla/kolla-build.conf
index 83d8bb715..b879dba14 100644
--- a/etc/kayobe/kolla/kolla-build.conf
+++ b/etc/kayobe/kolla/kolla-build.conf
@@ -1,2 +1,6 @@
 [DEFAULT]
+{# Pinning to Rocky 9 minor version used in our repos #}
+{% if kolla_base_distro == 'rocky' %}
+base_tag = 9.{{ stackhpc_pulp_repo_rocky_9_minor_version }}
+{% endif %}
 build_args = {{ kolla_build_args.items() | map('join', ':') | join(',') }}
diff --git a/releasenotes/notes/pin-rocky9-baseimage-3d224df5b6f56b10.yaml b/releasenotes/notes/pin-rocky9-baseimage-3d224df5b6f56b10.yaml
new file mode 100644
index 000000000..5d99432b0
--- /dev/null
+++ b/releasenotes/notes/pin-rocky9-baseimage-3d224df5b6f56b10.yaml
@@ -0,0 +1,6 @@
+fixes:
+  - |
+    Pin the OCI image tag used for the base-image of Rocky 9
+    Kolla image builds. This prevents packages in the image with
+    the latest tag getting in front of StackHPC release-train
+    package repositories.