diff --git a/de/heat-templates/scripts/functions.sh b/de/heat-templates/scripts/functions.sh
index 5fc6c28..b106bd9 100644
--- a/de/heat-templates/scripts/functions.sh
+++ b/de/heat-templates/scripts/functions.sh
@@ -535,15 +535,24 @@
 }
 
 function configure_ntp {
-    echo "" > /etc/ntp.conf
+    if [[ ${CODENAME} == "bionic" ]] || [[ ${CODENAME} == "focal" ]] || [[ ${CODENAME} == "jammy" ]]; then
+        local ntp_conf="/etc/ntp.conf"
+        local ntp_driftfile="/var/lib/ntp/ntp.drift"
+        local ntp_service_name="ntp"
+    else
+        local ntp_conf="/etc/ntpsec/ntp.conf"
+        local ntp_driftfile="/var/lib/ntpsec/ntp.drift"
+        local ntp_service_name="ntpsec"
+    fi
+    echo "" > ${ntp_conf}
 
     for server in $NTP_SERVERS; do
-cat << EOF >> /etc/ntp.conf
+cat << EOF >> ${ntp_conf}
 server ${server} iburst
 EOF
     done
 
-    cat << EOF >> /etc/ntp.conf
+    cat << EOF >> ${ntp_conf}
 # Set general access to this service
 restrict -4 default kod nomodify notrap nopeer noquery
 restrict -6 default kod nomodify notrap nopeer noquery
@@ -558,12 +567,14 @@
 interface listen ${DEFAULT_INTERFACE}
 
 # Location of drift file
-driftfile /var/lib/ntp/ntp.drift
+driftfile ${ntp_driftfile}
 EOF
 
-    systemctl disable systemd-timesyncd
-    systemctl enable ntp
-    systemctl restart ntp
+    if systemctl --quiet is-enabled systemd-timesyncd ; then
+        systemctl disable systemd-timesyncd
+    fi
+    systemctl enable ${ntp_service_name}
+    systemctl restart ${ntp_service_name}
 }
 
 function wait_for_external_network {
@@ -674,6 +685,9 @@
     local public_interface=${1:-${PUBLIC_INTERFACE}}
     local cloud_netplan_cfg="/etc/netplan/50-cloud-init.yaml"
     local match_ip_line
+    # Normalize YAML indentation for consistent structure
+    cp ${cloud_netplan_cfg} ${cloud_netplan_cfg}.bak
+    yq r -I 2 ${cloud_netplan_cfg}.bak > ${cloud_netplan_cfg}
 
     install_pkgs bridge-utils
 
@@ -704,18 +718,18 @@
 EOF
 fi
 
-    sed -i 's/.*ethernets:.*/&\n        veth-phy: {}/' ${cloud_netplan_cfg}
-    sed -i 's/.*ethernets:.*/&\n        veth-br: {}/' ${cloud_netplan_cfg}
+    sed -i 's/.*ethernets:.*/&\n    veth-phy: {}/' ${cloud_netplan_cfg}
+    sed -i 's/.*ethernets:.*/&\n    veth-br: {}/' ${cloud_netplan_cfg}
 if [[ -n ${IRONIC_BAREMETAL_INTERFACE} ]]; then
-    sed -i 's/.*ethernets:.*/&\n        veth-bm: {}/' ${cloud_netplan_cfg}
-    sed -i 's/.*ethernets:.*/&\n        veth-bm-br: {}/' ${cloud_netplan_cfg}
-    sed -i 's/.*ethernets:.*/&\n        veth-vbmc: {}/' ${cloud_netplan_cfg}
-    sed -i 's/.*ethernets:.*/&\n        veth-vbmc-br: {}/' ${cloud_netplan_cfg}
+    sed -i 's/.*ethernets:.*/&\n    veth-bm: {}/' ${cloud_netplan_cfg}
+    sed -i 's/.*ethernets:.*/&\n    veth-bm-br: {}/' ${cloud_netplan_cfg}
+    sed -i 's/.*ethernets:.*/&\n    veth-vbmc: {}/' ${cloud_netplan_cfg}
+    sed -i 's/.*ethernets:.*/&\n    veth-vbmc-br: {}/' ${cloud_netplan_cfg}
 
     if [[ "${IRONIC_MT_ENABLED,,}" == true ]] ; then
-        sed -i "s/.*ethernets:.*/&\n        ${IRONIC_BAREMETAL_VXLAN_INTERFACE}: {}/" ${cloud_netplan_cfg}
-        sed -i 's/.*ethernets:.*/&\n        veth-pxe: {}/' ${cloud_netplan_cfg}
-        sed -i 's/.*ethernets:.*/&\n        veth-pxe-br: {}/' ${cloud_netplan_cfg}
+        sed -i "s/.*ethernets:.*/&\n    ${IRONIC_BAREMETAL_VXLAN_INTERFACE}: {}/" ${cloud_netplan_cfg}
+        sed -i 's/.*ethernets:.*/&\n    veth-pxe: {}/' ${cloud_netplan_cfg}
+        sed -i 's/.*ethernets:.*/&\n    veth-pxe-br: {}/' ${cloud_netplan_cfg}
 cat << EOF > /etc/systemd/network/13-veth-pxe.netdev
 [NetDev]
 Name=veth-pxe
@@ -725,12 +739,12 @@
 EOF
         sed -i "s/- ${IRONIC_BAREMETAL_NETWORK_PREFIX}\([0-9]*\)/- ${IRONIC_BAREMETAL_TUNNEL_NETWORK_PREFIX}\1/" ${cloud_netplan_cfg}
 cat << EOF >> ${cloud_netplan_cfg}
-    vlans:
-        pxe.1000:
-            id: 1000
-            link: veth-pxe
-            addresses:
-            - ${IRONIC_BAREMETAL_INTERFACE_IP}/${IRONIC_BAREMETAL_NETWORK_NETMASK}
+  vlans:
+    pxe.1000:
+      id: 1000
+      link: veth-pxe
+      addresses:
+        - ${IRONIC_BAREMETAL_INTERFACE_IP}/${IRONIC_BAREMETAL_NETWORK_NETMASK}
 EOF
     else
         ironic_baremetal_address_match_ip_line=$(grep -nm1 "${IRONIC_BAREMETAL_INTERFACE_IP}/${IRONIC_BAREMETAL_NETWORK_NETMASK}" ${cloud_netplan_cfg} | cut -d: -f1)
@@ -749,23 +763,23 @@
 fi
 
 cat << EOF >> ${cloud_netplan_cfg}
-    bridges:
-        br-public:
-            dhcp4: false
-            interfaces:
-            - ${PUBLIC_INTERFACE}
-            - veth-br
+  bridges:
+    br-public:
+      dhcp4: false
+      interfaces:
+        - ${PUBLIC_INTERFACE}
+        - veth-br
 EOF
 if [[ "${TUNGSTENFABRIC_ENABLED,,}" != true ]]; then
     if [[ ${NODE_METADATA} == *"tempest"* ]]; then
 cat << EOF >> ${cloud_netplan_cfg}
-            addresses:
-            - ${PUBLIC_NODE_IP_ADDRESS}/${PUBLIC_NODE_IP_NETMASK}
+      addresses:
+        - ${PUBLIC_NODE_IP_ADDRESS}/${PUBLIC_NODE_IP_NETMASK}
 EOF
 # Assign more ips for neutron dynamic routing PRODX-31417
         for i in {71..76}; do
 cat << EOF >> ${cloud_netplan_cfg}
-            - ${PUBLIC_NODE_IP_ADDRESS%.*}.${i}/${PUBLIC_NODE_IP_NETMASK}
+        - ${PUBLIC_NODE_IP_ADDRESS%.*}.${i}/${PUBLIC_NODE_IP_NETMASK}
 EOF
         done
     fi
@@ -773,27 +787,27 @@
 
 # Remove Tunnel interface from netplan
 if [[ $TUNNEL_INTERFACE_NETPLAN_MANAGE == false ]]; then
-    sed -i "/        ${TUNNEL_INTERFACE}/,/            set-name: ${TUNNEL_INTERFACE}/d" ${cloud_netplan_cfg}
+    sed -i "/    ${TUNNEL_INTERFACE}/,/      set-name: ${TUNNEL_INTERFACE}/d" ${cloud_netplan_cfg}
 fi
 
 if [[ -n ${IRONIC_BAREMETAL_INTERFACE} ]]; then
 cat << EOF >> ${cloud_netplan_cfg}
-        br-baremetal:
-            dhcp4: false
-            interfaces:
-            - veth-bm-br
-            - veth-vbmc-br
+    br-baremetal:
+      dhcp4: false
+      interfaces:
+        - veth-bm-br
+        - veth-vbmc-br
 EOF
     if [[ "${IRONIC_MT_ENABLED,,}" != true ]] ; then
 cat << EOF >> ${cloud_netplan_cfg}
-            - ${IRONIC_BAREMETAL_INTERFACE}
-            addresses:
-            - ${IRONIC_BAREMETAL_INTERFACE_IP}/${IRONIC_BAREMETAL_NETWORK_NETMASK}
+        - ${IRONIC_BAREMETAL_INTERFACE}
+      addresses:
+        - ${IRONIC_BAREMETAL_INTERFACE_IP}/${IRONIC_BAREMETAL_NETWORK_NETMASK}
 EOF
     else
 cat << EOF >> ${cloud_netplan_cfg}
-            - ${IRONIC_BAREMETAL_VXLAN_INTERFACE}
-            - veth-pxe-br
+        - ${IRONIC_BAREMETAL_VXLAN_INTERFACE}
+        - veth-pxe-br
 EOF
 
 cat << EOF > /etc/systemd/system/ironic-vxlan-tunnel.service
diff --git a/de/heat-templates/scripts/launch.sh b/de/heat-templates/scripts/launch.sh
index ef03877..060c42c 100644
--- a/de/heat-templates/scripts/launch.sh
+++ b/de/heat-templates/scripts/launch.sh
@@ -133,12 +133,12 @@
             wait_for_external_network
             prepare_metadata_files
             disable_rp_filter
+            install_required_packages
             network_config
             prepare_network
             if [[ "${KUBERNETES_INSTALLER}" == "ucp" ]]; then
                 prepare_docker_config
             fi
-            install_required_packages
             install_kubectl
             configure_ntp
             configure_atop
@@ -180,12 +180,12 @@
             nested_virt_config
             prepare_metadata_files
             disable_rp_filter
+            install_required_packages
             network_config
             prepare_network
             if [[ "${KUBERNETES_INSTALLER}" == "ucp" ]]; then
                 prepare_docker_config
             fi
-            install_required_packages
             install_kubectl
             configure_ntp
             configure_atop
@@ -219,12 +219,12 @@
             nested_virt_config
             prepare_metadata_files
             disable_rp_filter
+            install_required_packages
             network_config
             prepare_network
             if [[ "${KUBERNETES_INSTALLER}" == "ucp" ]]; then
                 prepare_docker_config
             fi
-            install_required_packages
             install_kubectl
             enable_iscsi
             configure_ntp
@@ -258,12 +258,12 @@
             wait_for_external_network
             prepare_metadata_files
             disable_rp_filter
+            install_required_packages
             network_config
             prepare_network
             if [[ "${KUBERNETES_INSTALLER}" == "ucp" ]]; then
                 prepare_docker_config
             fi
-            install_required_packages
             configure_ntp
             configure_atop
             if [[ "${KUBERNETES_INSTALLER}" == "ucp" ]]; then