diff --git a/build-node-image.sh b/build-node-image.sh
index 00a6a618..b8d83fc4 100755
--- a/build-node-image.sh
+++ b/build-node-image.sh
@@ -14,11 +14,14 @@ if [ "${OPENSHIFT_CI}" != 0 ]; then
     /run/src/ci/get-ocp-repo.sh /etc/yum.repos.d/ocp.repo
 fi
 
-# add all the repos from the src repo into `/etc/yum.repos.d` so dnf sees them
-cat /run/src/*.repo >> /etc/yum.repos.d/git.repo
-
 source /etc/os-release
 
+# add CentOS repos from the source - only needed for CentOS/SCOS builds.
+# For RHEL builds, ART injects the correct repos via art-unsigned.repo.
+if [ $ID = centos ]; then
+    cat /run/src/*.repo >> /etc/yum.repos.d/git.repo
+fi
+
 # XXX: For SCOS, only allow certain packages to come from ART; everything else
 # should come from CentOS. We should eventually sever this.
 if [ $ID = centos ]; then
diff --git a/packages-openshift.yaml b/packages-openshift.yaml
index 7658205b..32ccb995 100644
--- a/packages-openshift.yaml
+++ b/packages-openshift.yaml
@@ -2,7 +2,7 @@ metadata:
   # This should match the /etc/os-release manipulation we do below when
   # injecting `OPENSHIFT_VERSION`. It's used by CI to determine the repos to
   # inject when building the layered image.
-  ocp_version: "4.22"
+  ocp_version: "4.23"
 
 conditional-include:
   - if:
@@ -12,22 +12,9 @@ conditional-include:
     - osversion != "centos-10"
     include:
       repos: [ENOEXIST] # We want an error in this case
-  - if: osversion == "rhel-9.8"
-    include:
-      repos:
-        - rhel-9.8-baseos
-        - rhel-9.8-appstream
-        - rhel-9.8-early-kernel
-        - rhel-9.8-fast-datapath
-        - rhel-9.8-server-ose-4.22
-  - if: osversion == "rhel-10.2"
-    include:
-      repos:
-        - rhel-10.2-baseos
-        - rhel-10.2-appstream
-        - rhel-10.2-early-kernel
-        - rhel-10.2-fast-datapath
-        - rhel-10.2-server-ose-4.22
+  # rhel-9.8 and rhel-10.2: no explicit repo includes needed.
+  # ART injects art-unsigned.repo with the correct arch-specific repos.
+  # build-node-image.sh ensures CentOS repos are not added for RHEL builds.
   - if: osversion == "centos-9"
     include:
       repos:
@@ -120,7 +107,7 @@ postprocess:
     #!/usr/bin/env bash
     set -xeuo pipefail
     cat >> /usr/lib/os-release <<EOF
-    OPENSHIFT_VERSION="4.22"
+    OPENSHIFT_VERSION="4.23"
     EOF
 
   - |