diff --git a/ci-operator/step-registry/gather/proxy/gather-proxy-commands.sh b/ci-operator/step-registry/gather/proxy/gather-proxy-commands.sh
index ee400f2d02a44..7490c045959a3 100644
--- a/ci-operator/step-registry/gather/proxy/gather-proxy-commands.sh
+++ b/ci-operator/step-registry/gather/proxy/gather-proxy-commands.sh
@@ -5,25 +5,6 @@ set -o pipefail
 
 trap 'CHILDREN=$(jobs -p); if test -n "${CHILDREN}"; then kill ${CHILDREN} && wait; fi' TERM
 
-export AWS_SHARED_CREDENTIALS_FILE="${CLUSTER_PROFILE_DIR}/.awscred"
-
-if test ! -f "${SHARED_DIR}/proxyregion"
-then
-	echo "No proxyregion, so unknown AWS region, so unable to tear down ."
-	exit 0
-fi
-
-REGION="$(cat "${SHARED_DIR}/proxyregion")"
-PROXY_NAME="${NAMESPACE}-${JOB_NAME_HASH}"
-
-# cleaning up after ourselves
-if aws --region "${REGION}" s3api head-bucket --bucket "${PROXY_NAME}" > /dev/null 2>&1
-then
-  aws --region "${REGION}" s3 rb "s3://${PROXY_NAME}" --force
-fi
-
-STACK_NAME="${PROXY_NAME}-proxy"
-
 # collect logs from the proxy here
 if [ -f "${SHARED_DIR}/proxyip" ]; then
   proxy_ip="$(cat "${SHARED_DIR}/proxyip")"
@@ -36,10 +17,4 @@ if [ -f "${SHARED_DIR}/proxyip" ]; then
   eval "$(ssh-agent)"
   ssh-add "${CLUSTER_PROFILE_DIR}/ssh-privatekey"
   ssh -A -o PreferredAuthentications=publickey -o StrictHostKeyChecking=false -o UserKnownHostsFile=/dev/null "core@${proxy_ip}" 'journalctl -u squid' > "${ARTIFACT_DIR}/squid.service"
-fi
-
-aws --region "${REGION}" cloudformation delete-stack --stack-name "${STACK_NAME}" &
-wait "$!"
-
-aws --region "${REGION}" cloudformation wait stack-delete-complete --stack-name "${STACK_NAME}" &
-wait "$!"
+fi
\ No newline at end of file
diff --git a/ci-operator/step-registry/gather/proxy/gather-proxy-ref.yaml b/ci-operator/step-registry/gather/proxy/gather-proxy-ref.yaml
index fd7bf020a32bd..344ca70366072 100644
--- a/ci-operator/step-registry/gather/proxy/gather-proxy-ref.yaml
+++ b/ci-operator/step-registry/gather/proxy/gather-proxy-ref.yaml
@@ -1,13 +1,10 @@
 ref:
   as: gather-proxy
-  from_image:
-    namespace: ocp
-    name: "4.5"
-    tag: upi-installer
+  from: upi-installer
   commands: gather-proxy-commands.sh
   resources:
     requests:
       cpu: 300m
       memory: 300Mi
   documentation: |-
-    The gather step collects journal logs from the proxy and deprovisions it.
\ No newline at end of file
+    The gather step collects journal logs from the proxy.
\ No newline at end of file
diff --git a/ci-operator/step-registry/ipi/aws/post/proxy/ipi-aws-post-proxy-chain.yaml b/ci-operator/step-registry/ipi/aws/post/proxy/ipi-aws-post-proxy-chain.yaml
index f579990d5a994..39c79d6996efa 100644
--- a/ci-operator/step-registry/ipi/aws/post/proxy/ipi-aws-post-proxy-chain.yaml
+++ b/ci-operator/step-registry/ipi/aws/post/proxy/ipi-aws-post-proxy-chain.yaml
@@ -3,6 +3,7 @@ chain:
   steps:
   - ref: gather-aws-console
   - ref: gather-proxy
+  - ref: ipi-deprovision-proxy
   - chain: ipi-deprovision
   documentation: |-
     The IPI cleanup step contains all steps that gather and deprovision an OpenShift cluster on AWS, provisioned by the `ipi-aws-pre-proxy` chain.
\ No newline at end of file
diff --git a/ci-operator/step-registry/ipi/deprovision/proxy/OWNERS b/ci-operator/step-registry/ipi/deprovision/proxy/OWNERS
new file mode 100644
index 0000000000000..c001880e10a56
--- /dev/null
+++ b/ci-operator/step-registry/ipi/deprovision/proxy/OWNERS
@@ -0,0 +1,3 @@
+approvers:
+- wking
+- ewolinetz
diff --git a/ci-operator/step-registry/ipi/deprovision/proxy/ipi-deprovision-proxy-commands.sh b/ci-operator/step-registry/ipi/deprovision/proxy/ipi-deprovision-proxy-commands.sh
new file mode 100644
index 0000000000000..9b9d63cfd5413
--- /dev/null
+++ b/ci-operator/step-registry/ipi/deprovision/proxy/ipi-deprovision-proxy-commands.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+set -o nounset
+set -o errexit
+set -o pipefail
+
+trap 'CHILDREN=$(jobs -p); if test -n "${CHILDREN}"; then kill ${CHILDREN} && wait; fi' TERM
+
+export AWS_SHARED_CREDENTIALS_FILE="${CLUSTER_PROFILE_DIR}/.awscred"
+
+if test ! -f "${SHARED_DIR}/proxyregion"
+then
+  echo "No proxyregion, so unknown AWS region, so unable to tear down."
+  exit 0
+fi
+
+REGION="$(cat "${SHARED_DIR}/proxyregion")"
+PROXY_NAME="${NAMESPACE}-${JOB_NAME_HASH}"
+STACK_NAME="${PROXY_NAME}-proxy"
+
+# cleaning up after ourselves
+if aws --region "${REGION}" s3api head-bucket --bucket "${PROXY_NAME}" > /dev/null 2>&1
+then
+  aws --region "${REGION}" s3 rb "s3://${PROXY_NAME}" --force
+fi
+
+aws --region "${REGION}" cloudformation delete-stack --stack-name "${STACK_NAME}" &
+wait "$!"
+
+aws --region "${REGION}" cloudformation wait stack-delete-complete --stack-name "${STACK_NAME}" &
+wait "$!"
diff --git a/ci-operator/step-registry/ipi/deprovision/proxy/ipi-deprovision-proxy-ref.yaml b/ci-operator/step-registry/ipi/deprovision/proxy/ipi-deprovision-proxy-ref.yaml
new file mode 100644
index 0000000000000..26551b9cba57b
--- /dev/null
+++ b/ci-operator/step-registry/ipi/deprovision/proxy/ipi-deprovision-proxy-ref.yaml
@@ -0,0 +1,13 @@
+ref:
+  as: ipi-deprovision-proxy
+  from_image:
+    namespace: ocp
+    name: "4.5"
+    tag: upi-installer
+  commands: ipi-deprovision-proxy-commands.sh
+  resources:
+    requests:
+      cpu: 300m
+      memory: 300Mi
+  documentation: |-
+    The deprovision step tears down the proxy and removes its s3 ignition config.
\ No newline at end of file
diff --git a/ci-operator/step-registry/metadata.json b/ci-operator/step-registry/metadata.json
index f3eda692bf262..50661478d94d2 100644
--- a/ci-operator/step-registry/metadata.json
+++ b/ci-operator/step-registry/metadata.json
@@ -808,6 +808,15 @@
 				]
 			}
 		},
+		"ipi-deprovision-proxy-ref.yaml": {
+			"path": "ipi/deprovision/proxy/ipi-deprovision-proxy-ref.yaml",
+			"owners": {
+				"approvers": [
+					"wking",
+					"ewolinetz"
+				]
+			}
+		},
 		"ipi-deprovision-vsphere-dns-ref.yaml": {
 			"path": "ipi/deprovision/vsphere/dns/ipi-deprovision-vsphere-dns-ref.yaml",
 			"owners": {