diff --git a/all/001-kolla-defaults.yml b/all/001-kolla-defaults.yml
index d756d10..88ca9cc 100644
--- a/all/001-kolla-defaults.yml
+++ b/all/001-kolla-defaults.yml
@@ -494,6 +494,7 @@ keystone_public_port: "{{ haproxy_single_external_frontend_public_port if haprox
 keystone_public_listen_port: "5000"
 keystone_internal_port: "5000"
 keystone_internal_listen_port: "{{ keystone_internal_port }}"
+keystone_listen_port: "{{ keystone_internal_listen_port }}"
 
 keystone_ssh_port: "8023"
 
@@ -892,6 +893,7 @@ enable_ironic_dnsmasq: "{{ enable_ironic | bool }}"
 enable_ironic_inspector: "no"
 enable_ironic_neutron_agent: "no"
 enable_ironic_prometheus_exporter: "{{ enable_ironic | bool and enable_prometheus | bool }}"
+enable_ironic_pxe_filter: "no"
 enable_iscsid: "{{ enable_cinder | bool and enable_cinder_backend_iscsi | bool }}"
 enable_kuryr: "no"
 enable_letsencrypt: "no"
@@ -1243,7 +1245,16 @@ nova_console: "novnc"
 #######################
 # Nova Database
 #######################
+nova_database_address: "{{ database_address | put_address_in_context('url') }}:{{ database_port }}"
+nova_database_name: "nova"
 nova_database_shard_id: "{{ mariadb_default_database_shard_id | int }}"
+nova_database_user: "{% if use_preconfigured_databases | bool and use_common_mariadb_user | bool %}{{ database_user }}{% else %}nova{% endif %}"
+
+nova_cell0_database_address: "{{ nova_database_address }}"
+nova_cell0_database_name: "{{ nova_database_name }}_cell0"
+nova_cell0_database_password: "{{ nova_database_password }}"
+nova_cell0_database_shard_id: "{{ nova_database_shard_id | int }}"
+nova_cell0_database_user: "{{ nova_database_user }}"
 
 #######################
 # Horizon options
diff --git a/all/099-kolla.yml b/all/099-kolla.yml
index a0ba351..d3bba06 100644
--- a/all/099-kolla.yml
+++ b/all/099-kolla.yml
@@ -28,8 +28,10 @@ enable_prometheus_openstack_exporter: "no"
 # We don't usually use heat anywhere. Enable it explicitly if required.
 enable_heat: "no"
 
-# Backward compatibility for < 2025.1
-enable_proxysql: "no"
+# ProxySQL became the default MariaDB load balancer in 2025.2 (the internal
+# HAProxy MariaDB frontend was removed upstream); enable it for 2025.2+, keep
+# HAProxy for <= 2025.1.
+enable_proxysql: "{{ 'no' if openstack_version in ['2024.1', '2024.2', '2025.1'] else 'yes' }}"
 
 proxysql_version: 3
 
@@ -68,6 +70,11 @@ enable_mariabackup: "yes"
 
 # horizon
 horizon_backend_database: "yes"
+# 2025.2 switched Horizon to uWSGI (horizon_wsgi_provider defaults to uwsgi);
+# behind HAProxy the uWSGI backend must listen on the unprivileged 8080, not
+# the privileged 80. Match upstream for 2025.2+, keep the pre-uWSGI value for
+# <= 2025.1.
+horizon_listen_port: "{{ '8080' if (enable_haproxy | bool and openstack_version not in ['2024.1', '2024.2', '2025.1']) else horizon_tls_port if horizon_enable_tls_backend | bool else horizon_port }}"
 
 # ironic
 ironic_agent_files_directory: /share/ironic