diff --git a/clients/redis-4.json b/clients/redis-4.json
new file mode 100644
index 0000000..3a287e0
--- /dev/null
+++ b/clients/redis-4.json
@@ -0,0 +1,4 @@
+{
+  "name": "redis-4",
+  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAn3Zdzfao+n3PdtlJlViJ\nnpVDcL8ofw2rb2/VK7ivpWMKaL7mOq8HIQ+R+ghvllX/vPmN6co3+aUxOvvQ6KGC\nmAcnc7StqOpYUK0g6QZFROESO0vz1hy078AL9D2dEwOj7XS8leWCQyGgA1Z89T9n\naatXqEF1zGuvnVLA340prYkJk5S1X6KHq1WIi9H23hYehvGZlpkJ87wv8sKIo4Y3\nzIVA5hio0t0q+JyStOGr+xRl3mM43b25XcIh2ibrzKp3YoRWSCvMfhAdMKm1WEEI\njM/3fQRtkI1OQSb0o/wUoAmpUEEOTIvbWU2SuFVY7HYRuPwEilvbrGZKgrvbp8R+\nZQIDAQAB\n-----END PUBLIC KEY-----\n"
+}
\ No newline at end of file
diff --git a/environments/production.json b/environments/production.json
index 9a3e2cb..12a372e 100644
--- a/environments/production.json
+++ b/environments/production.json
@@ -81,7 +81,7 @@
           "garage-",
           "lq-",
           "rsk-",
-          "postgres-6"
+          "postgres-11"
         ]
       }
     },
diff --git a/nodes b/nodes
index 503f8ec..13c12de 160000
--- a/nodes
+++ b/nodes
@@ -1 +1 @@
-Subproject commit 503f8ec5ff8252eddc1d9baec9f373eb72eba322
+Subproject commit 13c12de5742a0c3c7b8bc4f75a6eb97d7575e713
diff --git a/site-cookbooks/kosmos_gitea/attributes/default.rb b/site-cookbooks/kosmos_gitea/attributes/default.rb
index 8e632db..7108259 100644
--- a/site-cookbooks/kosmos_gitea/attributes/default.rb
+++ b/site-cookbooks/kosmos_gitea/attributes/default.rb
@@ -1,5 +1,5 @@
-node.default["gitea"]["version"] = "1.26.4"
-node.default["gitea"]["checksum"] = "0faa36d151918f8f7d6e0f3ae67597d1c338583d695add146ac393109d0fc44a"
+node.default["gitea"]["version"] = "1.27.1"
+node.default["gitea"]["checksum"] = "86a7ac26e7f9c9cca0f56c4fac07fff205d5fc3bca0e54af23a204f07b833bc9"
 node.default["gitea"]["repo"] = nil
 node.default["gitea"]["revision"] = nil
 node.default["gitea"]["working_directory"] = "/var/lib/gitea"
diff --git a/site-cookbooks/kosmos_gitea/metadata.rb b/site-cookbooks/kosmos_gitea/metadata.rb
index d643f62..bd9bc2f 100644
--- a/site-cookbooks/kosmos_gitea/metadata.rb
+++ b/site-cookbooks/kosmos_gitea/metadata.rb
@@ -4,7 +4,7 @@ maintainer_email 'ops@kosmos.org'
 license 'MIT'
 description 'Installs/configures Gitea'
 long_description 'Installs/configures Gitea'
-version '0.2.0'
+version '0.2.1'
 chef_version '>= 14.0'
 
 depends "firewall"
diff --git a/site-cookbooks/kosmos_gitea/templates/default/app.ini.erb b/site-cookbooks/kosmos_gitea/templates/default/app.ini.erb
index 9d0fb7b..9b50f1a 100644
--- a/site-cookbooks/kosmos_gitea/templates/default/app.ini.erb
+++ b/site-cookbooks/kosmos_gitea/templates/default/app.ini.erb
@@ -62,6 +62,9 @@ FROM = <%= @email %>
 INTERNAL_TOKEN = <%= @internal_token %>
 INSTALL_LOCK   = true
 SECRET_KEY     = <%= @secret_key %>
+<% if c = @config["webhook"] %>
+<% if c["allowed_host_list"] %>ALLOWED_HOST_LIST = <%= c["allowed_host_list"] %><% end %>
+<% end %>
 
 [service]
 REGISTER_EMAIL_CONFIRM            = false
@@ -101,11 +104,6 @@ RUN_AT_START = false
 NOTICE_ON_SUCCESS = false
 SCHEDULE = @every 15m
 
-<% if c = @config["webhook"] %>
-[webhook]
-<% if c["allowed_host_list"] %>ALLOWED_HOST_LIST = <%= c["allowed_host_list"] %><% end %>
-<% end %>
-
 <% if c = @config["storage"] %>
 [storage]
 <% if c["type"] == "minio" %>
diff --git a/site-cookbooks/kosmos_kvm/recipes/host.rb b/site-cookbooks/kosmos_kvm/recipes/host.rb
index be25ce8..e1d72cf 100644
--- a/site-cookbooks/kosmos_kvm/recipes/host.rb
+++ b/site-cookbooks/kosmos_kvm/recipes/host.rb
@@ -5,6 +5,11 @@
 
 package %w(virtinst libvirt-daemon-system libvirt-clients)
 
+# Required on legacy hosts (Ubuntu 20.04) to build the NoCloud seed ISO
+# via cloud-localds. Modern virt-install (>= 4.0.0, Ubuntu >= 22.04)
+# handles cloud-init natively via --cloud-init and does not need it.
+package "cloud-image-utils" if node["platform_version"].to_f < 22.04
+
 directory "/var/lib/libvirt/images/base" do
   recursive true
   owner "libvirt-qemu"
@@ -24,7 +29,10 @@ end
 template "/usr/local/sbin/create_vm" do
   source "create_vm.erb"
   mode "0750"
-  variables base_image_path: node["kosmos_kvm"]["host"]["qemu_base_image"]["path"]
+  variables(
+    base_image_path: node["kosmos_kvm"]["host"]["qemu_base_image"]["path"],
+    modern_virt_install: node["platform_version"].to_f >= 22.04
+  )
 end
 
 firewall_rule 'ssh-alt-port' do
diff --git a/site-cookbooks/kosmos_kvm/templates/create_vm.erb b/site-cookbooks/kosmos_kvm/templates/create_vm.erb
index b94b79b..8dd3ed7 100644
--- a/site-cookbooks/kosmos_kvm/templates/create_vm.erb
+++ b/site-cookbooks/kosmos_kvm/templates/create_vm.erb
@@ -64,6 +64,7 @@ EOS
   popd
 fi
 
+<% if @modern_virt_install -%>
 virt-install \
   --name "$VMNAME" \
   --ram "$RAM" \
@@ -83,3 +84,30 @@ virt-install \
   --autostart \
   --import \
   --cloud-init root-password-generate=off,disable=on,meta-data=$CIDATA_PATH/meta-data,user-data=$CIDATA_PATH/user-data
+<% else -%>
+# Legacy path for hosts running virt-install < 4.0.0 (e.g. Ubuntu 20.04,
+# virt-install 2.2.x). These versions predate the --osinfo/--cloud-init
+# options, so we build a NoCloud seed ISO from the same user-data and
+# meta-data files and attach it as a cdrom. The guest receives the
+# exact same cloud-init configuration as on modern hosts.
+cloud-localds "$CIDATA_PATH/seed.iso" "$CIDATA_PATH/user-data" "$CIDATA_PATH/meta-data"
+
+virt-install \
+  --name "$VMNAME" \
+  --ram "$RAM" \
+  --vcpus "$CPUS" \
+  --cpu host \
+  --arch x86_64 \
+  --hvm \
+  --virt-type kvm \
+  --disk "$IMAGE_PATH" \
+  --disk "$CIDATA_PATH/seed.iso,device=cdrom" \
+  --boot hd \
+  --network=bridge=virbr0,model=virtio \
+  --graphics none \
+  --serial pty \
+  --console pty \
+  --channel unix,mode=bind,path=/var/lib/libvirt/qemu/$VMNAME.guest_agent.0,target_type=virtio,name=org.qemu.guest_agent.0 \
+  --autostart \
+  --import
+<% end -%>