diff --git a/ci-operator/step-registry/ipi/aws/pre/ipi-aws-pre-chain.yaml b/ci-operator/step-registry/ipi/aws/pre/ipi-aws-pre-chain.yaml
index 2e613a29dedf8..cd275213f8ccf 100644
--- a/ci-operator/step-registry/ipi/aws/pre/ipi-aws-pre-chain.yaml
+++ b/ci-operator/step-registry/ipi/aws/pre/ipi-aws-pre-chain.yaml
@@ -3,6 +3,7 @@ chain:
   steps:
   - chain: ipi-conf-aws
   - chain: ipi-install
+  - ref: manifests
   documentation: |-
     The IPI setup step contains all steps that provision an OpenShift cluster
     with a default configuration on AWS.
diff --git a/ci-operator/step-registry/ipi/azure/pre/ipi-azure-pre-chain.yaml b/ci-operator/step-registry/ipi/azure/pre/ipi-azure-pre-chain.yaml
index 5d103a4592b16..df493e91c5278 100644
--- a/ci-operator/step-registry/ipi/azure/pre/ipi-azure-pre-chain.yaml
+++ b/ci-operator/step-registry/ipi/azure/pre/ipi-azure-pre-chain.yaml
@@ -3,6 +3,7 @@ chain:
   steps:
   - chain: ipi-conf-azure
   - chain: ipi-install
+  - ref: manifests
   documentation: |-
     The IPI setup step contains all steps that provision an OpenShift cluster
     with a default configuration on Azure.
diff --git a/ci-operator/step-registry/ipi/azure/pre/sharednetwork/ipi-azure-pre-sharednetwork-chain.yaml b/ci-operator/step-registry/ipi/azure/pre/sharednetwork/ipi-azure-pre-sharednetwork-chain.yaml
index ef8cec888d244..5722e53289c34 100644
--- a/ci-operator/step-registry/ipi/azure/pre/sharednetwork/ipi-azure-pre-sharednetwork-chain.yaml
+++ b/ci-operator/step-registry/ipi/azure/pre/sharednetwork/ipi-azure-pre-sharednetwork-chain.yaml
@@ -3,6 +3,7 @@ chain:
   steps:
   - chain: ipi-conf-azure-sharednetwork
   - chain: ipi-install
+  - ref: manifests
   documentation: |-
     The IPI setup step contains all steps that provision an OpenShift cluster
     in a shared Virtual Network configuration on Azure.
diff --git a/ci-operator/step-registry/ipi/gcp/pre/ipi-gcp-pre-chain.yaml b/ci-operator/step-registry/ipi/gcp/pre/ipi-gcp-pre-chain.yaml
index 826b7da0d9eab..2115464814ba5 100644
--- a/ci-operator/step-registry/ipi/gcp/pre/ipi-gcp-pre-chain.yaml
+++ b/ci-operator/step-registry/ipi/gcp/pre/ipi-gcp-pre-chain.yaml
@@ -3,6 +3,7 @@ chain:
   steps:
   - chain: ipi-conf-gcp
   - chain: ipi-install
+  - ref: manifests
   documentation: |-
     The IPI setup step contains all steps that provision an OpenShift cluster
     with a default configuration on GCP.
diff --git a/ci-operator/step-registry/ipi/gcp/pre/sharednetwork/ipi-gcp-pre-sharednetwork-chain.yaml b/ci-operator/step-registry/ipi/gcp/pre/sharednetwork/ipi-gcp-pre-sharednetwork-chain.yaml
index cbb7d22e415f9..15404647f5c24 100644
--- a/ci-operator/step-registry/ipi/gcp/pre/sharednetwork/ipi-gcp-pre-sharednetwork-chain.yaml
+++ b/ci-operator/step-registry/ipi/gcp/pre/sharednetwork/ipi-gcp-pre-sharednetwork-chain.yaml
@@ -3,6 +3,7 @@ chain:
   steps:
   - chain: ipi-conf-gcp-sharednetwork
   - chain: ipi-install
+  - ref: manifests
   documentation: |-
     The IPI setup step contains all steps that provision an OpenShift cluster
     in a shared network configuration on GCP.
diff --git a/ci-operator/step-registry/ipi/vsphere/pre/ipi-vsphere-pre-chain.yaml b/ci-operator/step-registry/ipi/vsphere/pre/ipi-vsphere-pre-chain.yaml
index 7dea99a17beac..a1e24562fd050 100644
--- a/ci-operator/step-registry/ipi/vsphere/pre/ipi-vsphere-pre-chain.yaml
+++ b/ci-operator/step-registry/ipi/vsphere/pre/ipi-vsphere-pre-chain.yaml
@@ -3,6 +3,7 @@ chain:
   steps:
   - chain: ipi-conf-vsphere
   - chain: ipi-install-vsphere
+  - ref: manifests
   documentation: |-
     The IPI setup step contains all steps that provision an OpenShift cluster
     with a default configuration on vSphere.
diff --git a/ci-operator/step-registry/manifests/OWNERS b/ci-operator/step-registry/manifests/OWNERS
new file mode 100644
index 0000000000000..f14198cff70e7
--- /dev/null
+++ b/ci-operator/step-registry/manifests/OWNERS
@@ -0,0 +1,11 @@
+approvers:
+- smarterclayton
+- wking
+- stevekuznetsov
+- vrutkovs
+- abhinavdahiya
+- deads2k
+- crawford
+- ewolinetz
+- csrwng
+- staebler
diff --git a/ci-operator/step-registry/manifests/manifests-commands.sh b/ci-operator/step-registry/manifests/manifests-commands.sh
new file mode 100755
index 0000000000000..408c75a9e72f9
--- /dev/null
+++ b/ci-operator/step-registry/manifests/manifests-commands.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+set -o nounset
+set -o errexit
+set -o pipefail
+
+if [[ -f "${CLUSTER_PROFILE_DIR}/insights-live.yaml" ]]
+then
+	# HACK: backwards-compat while the cluster profiles are updated.
+	cp "${CLUSTER_PROFILE_DIR}/insights-live.yaml" "${CLUSTER_PROFILE_DIR}/day-2-manifests-insights-live.yaml"
+fi
+
+for FILE in "${CLUSTER_PROFILE_DIR}"/day-2-manifests-*.yaml "${SHARED_DIR}"/day-2-manifests-*.yaml
+do
+	echo "Creating ${FILE}..."
+	oc create -f "${FILE}"
+done
+
+echo "Finished creating manifests."
diff --git a/ci-operator/step-registry/manifests/manifests-ref.yaml b/ci-operator/step-registry/manifests/manifests-ref.yaml
new file mode 100644
index 0000000000000..58f1e63eadbb0
--- /dev/null
+++ b/ci-operator/step-registry/manifests/manifests-ref.yaml
@@ -0,0 +1,11 @@
+ref:
+  as: manifests
+  from: cli
+  commands: manifests-commands.sh
+  resources:
+    requests:
+      cpu: 300m
+      memory: 300Mi
+  documentation: |-
+    The manifests step applies additional manifests to the cluster with 'oc create -f ...'.
+    Manifests are read from ${CLUSTER_PROFILE_DIR}/day-2-manifests-*.yaml and ${SHARED_DIR}/day-2-manifests-*.yaml in that order, and application failures are fatal.
diff --git a/ci-operator/step-registry/openshift/e2e/aws/ovn/hybrid/openshift-e2e-aws-ovn-hybrid-workflow.yaml b/ci-operator/step-registry/openshift/e2e/aws/ovn/hybrid/openshift-e2e-aws-ovn-hybrid-workflow.yaml
index 3ba5e6130f7b6..0c2772cb0026a 100644
--- a/ci-operator/step-registry/openshift/e2e/aws/ovn/hybrid/openshift-e2e-aws-ovn-hybrid-workflow.yaml
+++ b/ci-operator/step-registry/openshift/e2e/aws/ovn/hybrid/openshift-e2e-aws-ovn-hybrid-workflow.yaml
@@ -6,6 +6,7 @@ workflow:
     - ref: ovn-conf
     - ref: ovn-conf-hybrid-manifest
     - chain: ipi-install
+    - ref: manifests
     test:
     - ref: openshift-e2e-test
     post:
diff --git a/ci-operator/step-registry/openshift/e2e/aws/ovn/openshift-e2e-aws-ovn-workflow.yaml b/ci-operator/step-registry/openshift/e2e/aws/ovn/openshift-e2e-aws-ovn-workflow.yaml
index 6a5f5d5506c9e..bfb8c9648f746 100644
--- a/ci-operator/step-registry/openshift/e2e/aws/ovn/openshift-e2e-aws-ovn-workflow.yaml
+++ b/ci-operator/step-registry/openshift/e2e/aws/ovn/openshift-e2e-aws-ovn-workflow.yaml
@@ -5,6 +5,7 @@ workflow:
     - chain: ipi-conf-aws
     - ref: ovn-conf
     - chain: ipi-install
+    - ref: manifests
     test:
     - ref: openshift-e2e-test
     post:
diff --git a/ci-operator/step-registry/openshift/e2e/aws/sdn/multi/openshift-e2e-aws-sdn-multi-workflow.yaml b/ci-operator/step-registry/openshift/e2e/aws/sdn/multi/openshift-e2e-aws-sdn-multi-workflow.yaml
index a749bb9fffc14..9b097b40636e5 100644
--- a/ci-operator/step-registry/openshift/e2e/aws/sdn/multi/openshift-e2e-aws-sdn-multi-workflow.yaml
+++ b/ci-operator/step-registry/openshift/e2e/aws/sdn/multi/openshift-e2e-aws-sdn-multi-workflow.yaml
@@ -6,6 +6,7 @@ workflow:
     - ref: sdn-conf
     - ref: sdn-conf-multi-manifest
     - chain: ipi-install
+    - ref: manifests
     test:
     - ref: openshift-e2e-test
     post:
diff --git a/ci-operator/step-registry/openshift/e2e/aws/sdn/single/openshift-e2e-aws-sdn-single-workflow.yaml b/ci-operator/step-registry/openshift/e2e/aws/sdn/single/openshift-e2e-aws-sdn-single-workflow.yaml
index 7221f2843eea0..e2a6529efc8e9 100644
--- a/ci-operator/step-registry/openshift/e2e/aws/sdn/single/openshift-e2e-aws-sdn-single-workflow.yaml
+++ b/ci-operator/step-registry/openshift/e2e/aws/sdn/single/openshift-e2e-aws-sdn-single-workflow.yaml
@@ -6,6 +6,7 @@ workflow:
     - ref: sdn-conf
     - ref: sdn-conf-single-manifest
     - chain: ipi-install
+    - ref: manifests
     test:
     - ref: openshift-e2e-test
     post:
diff --git a/ci-operator/step-registry/openshift/e2e/azure/ovn/openshift-e2e-azure-ovn-workflow.yaml b/ci-operator/step-registry/openshift/e2e/azure/ovn/openshift-e2e-azure-ovn-workflow.yaml
index df73494271f95..3b17b6b3699d5 100644
--- a/ci-operator/step-registry/openshift/e2e/azure/ovn/openshift-e2e-azure-ovn-workflow.yaml
+++ b/ci-operator/step-registry/openshift/e2e/azure/ovn/openshift-e2e-azure-ovn-workflow.yaml
@@ -5,6 +5,7 @@ workflow:
     - chain: ipi-conf-azure
     - ref: ovn-conf
     - chain: ipi-install
+    - ref: manifests
     test:
     - ref: openshift-e2e-test
     post:
diff --git a/ci-operator/step-registry/openshift/e2e/test/openshift-e2e-test-commands.sh b/ci-operator/step-registry/openshift/e2e/test/openshift-e2e-test-commands.sh
index c52d7693b8129..f5cfdff905661 100644
--- a/ci-operator/step-registry/openshift/e2e/test/openshift-e2e-test-commands.sh
+++ b/ci-operator/step-registry/openshift/e2e/test/openshift-e2e-test-commands.sh
@@ -14,12 +14,6 @@ trap 'CHILDREN=$(jobs -p); if test -n "${CHILDREN}"; then kill ${CHILDREN} && wa
 
 mkdir -p "${HOME}"
 
-# if the cluster profile included an insights secret, install it to the cluster to
-# report support data from the support-operator
-if [[ -f "${CLUSTER_PROFILE_DIR}/insights-live.yaml" ]]; then
-    oc create -f "${CLUSTER_PROFILE_DIR}/insights-live.yaml" || true
-fi
-
 # set up cloud-provider-specific env vars
 KUBE_SSH_BASTION="$( oc --insecure-skip-tls-verify get node -l node-role.kubernetes.io/master -o 'jsonpath={.items[0].status.addresses[?(@.type=="ExternalIP")].address}' ):22"
 KUBE_SSH_KEY_PATH=${CLUSTER_PROFILE_DIR}/ssh-privatekey
diff --git a/ci-operator/step-registry/openshift/e2e/vsphere/ovn/openshift-e2e-vsphere-ovn-workflow.yaml b/ci-operator/step-registry/openshift/e2e/vsphere/ovn/openshift-e2e-vsphere-ovn-workflow.yaml
index c5aba26b7a282..b8ab58e950a8b 100644
--- a/ci-operator/step-registry/openshift/e2e/vsphere/ovn/openshift-e2e-vsphere-ovn-workflow.yaml
+++ b/ci-operator/step-registry/openshift/e2e/vsphere/ovn/openshift-e2e-vsphere-ovn-workflow.yaml
@@ -5,6 +5,7 @@ workflow:
     - chain: ipi-conf-vsphere
     - ref: ovn-conf
     - chain: ipi-install-vsphere
+    - ref: manifests
     test:
     - ref: openshift-e2e-test
     post:
diff --git a/ci-operator/step-registry/upi/gcp/pre/upi-gcp-pre-chain.yaml b/ci-operator/step-registry/upi/gcp/pre/upi-gcp-pre-chain.yaml
index 9d09746c12b87..8ae93217a610e 100644
--- a/ci-operator/step-registry/upi/gcp/pre/upi-gcp-pre-chain.yaml
+++ b/ci-operator/step-registry/upi/gcp/pre/upi-gcp-pre-chain.yaml
@@ -4,5 +4,6 @@ chain:
   - ref: ipi-install-rbac
   - chain: upi-conf-gcp
   - ref: upi-install-gcp
+  - ref: manifests
   documentation: >-
     This chain contains all of the steps to provision an OpenShift cluster using the GCP UPI workflow.