Hi Martin, Not OP, but I did just deploy a brand new oVirt 4.5.4 HE setup. As you mentioned, there's an issue during deployment with the latest java-11-openjdk-headless. I had to do the deploy with "hosted-engine --deploy --ansible-extra-vars=he_pause_before_engine_setup=true". Once the deployment paused, I was able to hop into the local VM and "dnf downgrade -y java-11-openjdk-headless-11.0.15.0.10-3.el8 && dnf versionlock add java-11-openjdk-headless", after which I could remove the lockfile from /tmp on the deploy host and everything went great. That said, I now wonder if I need to leave java-11-openjdk-headless locked to that version on the HE VM, or should I remove the versionlock and allow it to update? Do you know if keycloak in general is having issues with the latest jdk, or is it just a deploy-time problem? Thanks! Mark