diff --git a/03_launch_mgmt_cluster.sh b/03_launch_mgmt_cluster.sh
index 51912ebb2..01ba34a1d 100755
--- a/03_launch_mgmt_cluster.sh
+++ b/03_launch_mgmt_cluster.sh
@@ -244,15 +244,6 @@ EOF
 
 launch_ironic_standalone_operator()
 {
-    # TODO(dtantsur): IPA branch support
-    # shellcheck disable=SC2311
-    cat > "${IRSOPATH}/config/manager/manager.env" <<EOF
-IRONIC_IMAGE=$(get_component_image "${IRONIC_LOCAL_IMAGE:-${IRONIC_IMAGE}}")
-MARIADB_IMAGE=$(get_component_image "${MARIADB_LOCAL_IMAGE:-${MARIADB_IMAGE}}")
-KEEPALIVED_IMAGE=$(get_component_image "${IRONIC_KEEPALIVED_LOCAL_IMAGE:-${IRONIC_KEEPALIVED_IMAGE}}")
-RAMDISK_DOWNLOADER_IMAGE=$(get_component_image "${IPA_DOWNLOADER_LOCAL_IMAGE:-${IPA_DOWNLOADER_IMAGE}}")
-EOF
-
     # shellcheck disable=SC2311
     make -C "${IRSOPATH}" install deploy IMG="$(get_component_image "${IRSO_LOCAL_IMAGE:-${IRSO_IMAGE}}")"
     kubectl wait --for=condition=Available --timeout=60s \
@@ -279,8 +270,13 @@ metadata:
   name: ironic
   namespace: "${IRONIC_NAMESPACE}"
 spec:
-  credentialsRef:
-    name: ironic-auth
+  credentialsName: ironic-auth
+  images:
+    deployRamdiskBranch: "${IPA_BRANCH}"
+    deployRamdiskDownloader: "$(get_component_image "${IPA_DOWNLOADER_LOCAL_IMAGE:-${IPA_DOWNLOADER_IMAGE}}")"
+    ironic: "$(get_component_image "${IRONIC_LOCAL_IMAGE:-${IRONIC_IMAGE}}")"
+    keepalived: "$(get_component_image "${IRONIC_KEEPALIVED_LOCAL_IMAGE:-${IRONIC_KEEPALIVED_IMAGE}}")"
+  version: "${IRSO_IRONIC_VERSION}"
   networking:
     dhcp:
       rangeBegin: "${CLUSTER_DHCP_RANGE_START}"
@@ -302,8 +298,8 @@ EOF
     if [[ -r "${IRONIC_CERT_FILE}" ]] && [[ -r "${IRONIC_KEY_FILE}" ]]; then
         kubectl create secret tls ironic-cert -n "${IRONIC_NAMESPACE}" --key="${IRONIC_KEY_FILE}" --cert="${IRONIC_CERT_FILE}"
         cat >> "${ironic}" <<EOF
-  tlsRef:
-    name: ironic-cert
+  tls:
+    certificateName: ironic-cert
 EOF
     fi
 
@@ -314,15 +310,15 @@ EOF
 
     if [[ "${IRONIC_USE_MARIADB}" = "true" ]]; then
         cat >> "${ironic}" <<EOF
-  databaseRef:
-    name: ironic-db
+  databaseName: ironic-db
 ---
 apiVersion: metal3.io/v1alpha1
 kind: IronicDatabase
 metadata:
   name: ironic-db
   namespace: "${IRONIC_NAMESPACE}"
-spec: {}
+spec:
+  image: "$(get_component_image "${MARIADB_LOCAL_IMAGE:-${MARIADB_IMAGE}}")"
 EOF
   fi
 
diff --git a/lib/common.sh b/lib/common.sh
index d49d99fd7..a19b98237 100644
--- a/lib/common.sh
+++ b/lib/common.sh
@@ -155,7 +155,8 @@ export CAPM3_BASE_URL="${CAPM3_BASE_URL:-metal3-io/cluster-api-provider-metal3}"
 export CAPM3REPO="${CAPM3REPO:-https://github.com/${CAPM3_BASE_URL}}"
 export CAPM3RELEASEBRANCH="${CAPM3RELEASEBRANCH:-main}"
 
-export USE_IRSO="${USE_IRSO:-false}"
+# FIXME(dtantsur): revert
+export USE_IRSO="${USE_IRSO:-true}"
 export IRSOPATH="${IRSOPATH:-${M3PATH}/ironic-standalone-operator}"
 export IRSO_BASE_URL="${IRSO_BASE_URL:-metal3-io/ironic-standalone-operator}"
 export IRSOREPO="${IRSOREPO:-https://github.com/${IRSO_BASE_URL}}"
@@ -262,8 +263,8 @@ export IRONIC_TAG="${IRONIC_TAG:-latest}"
 export BARE_METAL_OPERATOR_TAG="${BARE_METAL_OPERATOR_TAG:-latest}"
 export KEEPALIVED_TAG="${KEEPALIVED_TAG:-latest}"
 export MARIADB_TAG="${MARIADB_TAG:-latest}"
-# FIXME(dtantsur): pinned temporary to avoid breakages while we're preparing the MVP release
-export IRSO_TAG="${IRSO_TAG:-main@sha256:8fe5e8338d791550cc53d28ae9b63bd4ce3ed687ce147ea33021c21379170a33}"
+export IRSO_TAG="${IRSO_TAG:-latest}"
+export IRSO_IRONIC_VERSION="${IRSO_IRONIC_VERSION:-latest}"
 
 # Docker Hub proxy registry (or docker.io if no proxy)
 export DOCKER_HUB_PROXY="${DOCKER_HUB_PROXY:-docker.io}"
@@ -303,6 +304,7 @@ elif [[ "${CAPM3RELEASEBRANCH}" = "release-1.9" ]]; then
   export BARE_METAL_OPERATOR_TAG="v0.9.0"
   export KEEPALIVED_TAG="v0.9.0"
   export IRONIC_TAG="v27.0.0"
+  export IRSO_IRONIC_VERSION="27.0"
   export BMOBRANCH="${BMORELEASEBRANCH:-release-0.9}"
 else
   export CAPM3_IMAGE="${CAPM3_IMAGE:-${CONTAINER_REGISTRY}/metal3-io/cluster-api-provider-metal3:main}"