diff --git a/ansible/configure_tasks.yaml b/ansible/configure_tasks.yaml
index 4706457..d06fb3d 100644
--- a/ansible/configure_tasks.yaml
+++ b/ansible/configure_tasks.yaml
@@ -7,6 +7,9 @@
 - name: hub init
   ansible.builtin.include_tasks: hub_init.yaml
   when: "'hub' in group_names"
+- name: Keycloak init
+  ansible.builtin.include_tasks: keycloak_init_tasks.yaml
+  when: "'hub' in group_names"
 - name: Handle certificates
   ansible.builtin.include_tasks: certs.yaml
   when: "ca_certs != 'internal'"
diff --git a/ansible/hub_api_tasks.yaml b/ansible/hub_api_tasks.yaml
index 098bd61..159aa01 100644
--- a/ansible/hub_api_tasks.yaml
+++ b/ansible/hub_api_tasks.yaml
@@ -19,7 +19,13 @@
     headers:
       Content-Type: "application/json-patch+json"
     body: |-
-      [{ "op": "add", "path": "/unixHomeDirectory", "value":"{{ admin.linux_home_dir }}"}, { "op": "add", "path":"/unixUserName", "value":"{{ admin.linux_username }}" }]
+      [
+        { "op": "add", "path": "/firstName", "value": "Hub" },
+        { "op": "add", "path": "/lastName", "value": "Administrator" },
+        { "op": "add", "path": "/displayName", "value": "Hub Administrator" },
+        { "op": "add", "path": "/unixHomeDirectory", "value": "{{ admin.linux_home_dir }}" },
+        { "op": "add", "path": "/unixUserName", "value": "{{ admin.linux_username }}" }
+      ]
   when: "(hub_res.json['unixUserName'] is not defined)"
 
 - name: Get hub excecution profile id
diff --git a/ansible/hub_run.yaml b/ansible/hub_run.yaml
index c3726e4..7a6e19f 100644
--- a/ansible/hub_run.yaml
+++ b/ansible/hub_run.yaml
@@ -1,9 +1,6 @@
 - name: Enable TLS now
   ansible.builtin.command: /usr/local/bin/hubctl internaltls server
   when: ca_certs == "supplied" or ca_certs == "selfsigned"
-- name: Run ldapsync
-  ansible.builtin.command: /usr/local/bin/hubctl ldapsync
-  when: ldap_enabled == "true"
 - name: Enable hub
   ansible.builtin.command: /usr/local/bin/hubctl service enable
 - name: Start hub
diff --git a/ansible/keycloak_init_tasks.yaml b/ansible/keycloak_init_tasks.yaml
new file mode 100644
index 0000000..0f7ea78
--- /dev/null
+++ b/ansible/keycloak_init_tasks.yaml
@@ -0,0 +1,48 @@
+- name: Read Keycloak HubSuperAdmin password
+  ansible.builtin.slurp:
+    src: /opt/altair/slchub/var/data/keycloak/admin.txt
+  register: kc_admin_pass_encoded
+  no_log: true
+
+- name: Get Keycloak admin token
+  ansible.builtin.uri:
+    url: "{{ 'https' if ca_certs == 'internal' else 'http' }}://127.0.0.1:8216/realms/master/protocol/openid-connect/token"
+    method: POST
+    body_format: form-urlencoded
+    validate_certs: no
+    body:
+      grant_type: password
+      client_id: admin-cli
+      username: HubSuperAdmin
+      password: "{{ kc_admin_pass_encoded.content | b64decode | trim }}"
+  register: kc_token_res
+  no_log: true
+
+- name: Find admin user in Keycloak
+  ansible.builtin.uri:
+    url: "{{ 'https' if ca_certs == 'internal' else 'http' }}://127.0.0.1:8216/admin/realms/slchub/users?username={{ admin.username | urlencode }}&exact=true"
+    headers:
+      Authorization: "Bearer {{ kc_token_res.json.access_token }}"
+    validate_certs: no
+  register: kc_user_res
+  no_log: true
+
+- name: Assert admin user was found in Keycloak
+  ansible.builtin.assert:
+    that: kc_user_res.json[0].id is defined
+    fail_msg: "No Keycloak user found matching '{{ admin.username }}'"
+
+- name: Set admin user password in Keycloak
+  ansible.builtin.uri:
+    url: "{{ 'https' if ca_certs == 'internal' else 'http' }}://127.0.0.1:8216/admin/realms/slchub/users/{{ kc_user_res.json[0].id }}/reset-password"
+    method: PUT
+    headers:
+      Authorization: "Bearer {{ kc_token_res.json.access_token }}"
+    validate_certs: no
+    body_format: json
+    body:
+      type: password
+      value: "{{ admin.password }}"
+      temporary: false
+    status_code: 204
+  no_log: true
diff --git a/ansible/main.yaml b/ansible/main.yaml
index 5941aac..103951c 100644
--- a/ansible/main.yaml
+++ b/ansible/main.yaml
@@ -4,6 +4,7 @@
     - vars/ldap.yaml
     - vars/common.yaml
     - vars/license.yaml
+    - worker.config/slc_installs.yaml
   vars:
     bootstrap_params: "{{ '--nointernaltls' if ca_certs != 'internal' else ''}}"
   tasks:
diff --git a/ansible/main_configure.yaml b/ansible/main_configure.yaml
index cf836c0..7111a47 100644
--- a/ansible/main_configure.yaml
+++ b/ansible/main_configure.yaml
@@ -4,6 +4,7 @@
     - vars/ldap.yaml
     - vars/common.yaml
     - vars/license.yaml
+    - worker.config/slc_installs.yaml
   vars:
     bootstrap_params: "{{ '--nointernaltls' if ca_certs != 'internal' else ''}}"
   tasks:
diff --git a/ansible/main_install.yaml b/ansible/main_install.yaml
index 58e30bc..a7a5b09 100644
--- a/ansible/main_install.yaml
+++ b/ansible/main_install.yaml
@@ -4,6 +4,7 @@
     - vars/ldap.yaml
     - vars/common.yaml
     - vars/license.yaml
+    - worker.config/slc_installs.yaml
   vars:
     bootstrap_params: "{{ '--nointernaltls' if ca_certs != 'internal' else ''}}"
   tasks:
diff --git a/ansible/templates/adminpassword.yaml.j2 b/ansible/templates/adminpassword.yaml.j2
index 211e45f..fb655e5 100644
--- a/ansible/templates/adminpassword.yaml.j2
+++ b/ansible/templates/adminpassword.yaml.j2
@@ -1,3 +1,9 @@
 users:
   - userName: {{admin.username}}
     password: {{admin.password}}
+    firstName: Hub
+    lastName: Administrator
+    displayName: Hub Administrator
+    email: hubadmin@example.com
+    memberOf:
+      - HubAdministrators
diff --git a/ansible/vars/common.yaml b/ansible/vars/common.yaml
index ca7f74d..b8aa799 100644
--- a/ansible/vars/common.yaml
+++ b/ansible/vars/common.yaml
@@ -24,13 +24,13 @@ admin:
 # rpmsdirectory: Location on the target machines.
 rpmsdirectory: /hubrpms
 
-slc_rpm: "altairslc2025"
+slc_rpm: "altairslc2026"
 worker_rpm: "slchub-worker"
 hub_rpm: "slchub"
 
-slc_rpm_file: altairslc-5.25.2.0.1636_ga_maintenance-1.x86_64.rpm
-worker_rpm_file: slchub_worker_2025.2.0_alpha808_808_1_x86_64.rpm
-hub_rpm_file: slchub_2025.2.0_alpha808_808_1_x86_64.rpm
+slc_rpm_file: altairslc-5.26.2.0.1117_ga_maintenance-1.x86_64.rpm
+worker_rpm_file: slchub_worker_2026.2.0_alpha133_133_1_x86_64.rpm
+hub_rpm_file: slchub_2026.2.0_alpha133_133_1_x86_64.rpm
 
 slchub_dir: /opt/altair/slchub
 slchub_user: slchub
diff --git a/ansible/worker.config/slc_installs.yaml b/ansible/worker.config/slc_installs.yaml
index 8d18b47..c1d841e 100644
--- a/ansible/worker.config/slc_installs.yaml
+++ b/ansible/worker.config/slc_installs.yaml
@@ -1,2 +1,2 @@
 wps_installs:
-  default: /opt/altair/slc/2025
+  default: /opt/altair/slc/2026
diff --git a/ansible/worker_init.yaml b/ansible/worker_init.yaml
index 8dcff14..38d05a4 100644
--- a/ansible/worker_init.yaml
+++ b/ansible/worker_init.yaml
@@ -10,7 +10,7 @@
 
 - name: Generate SLC auth token (a1 auth)
   ansible.builtin.shell: |-
-    /opt/altair/slc/2025/bin/almutil -a1auth -anyhost -code {{ license.auth_code }} \
+    {{ wps_installs.default }}/bin/almutil -a1auth -anyhost -code {{ license.auth_code }} \
     | tail -n 1 | cut -d':' -f 2 | sed -e 's/^\s*//'
   register: new_auth_result
   failed_when: "'ERROR' in new_auth_result.stderr"
@@ -23,7 +23,7 @@
 - name: Check for existing SLC install (For AltairOne Units)
   ansible.builtin.shell: |-
     hubctl slcinstall list | awk '{print $1}' | tail -n +3 \
-    | grep /opt/altair/slc/2025
+    | grep {{ wps_installs.default }}
   ignore_errors: yes
   register: a1_slc_install
   environment:
@@ -34,7 +34,7 @@
 
 - name: Copy SLC install information (For AltairOne Units)
   ansible.builtin.command:
-    cmd: "hubctl slcinstall add /opt/altair/slc/2025"
+    cmd: "hubctl slcinstall add {{ wps_installs.default }}"
   environment:
     ALM_HHWU: "TRUE"
     ALM_HHWU_TOKEN: "{{ auth_token }}"
@@ -44,7 +44,7 @@
 - name: Check for existing SLC install (For ALM)
   ansible.builtin.shell: |-
     hubctl slcinstall list | awk '{print $1}' | tail -n +3 \
-    | grep /opt/altair/slc/2025
+    | grep {{ wps_installs.default }}
   register: alm_slc_install
   environment:
     ALM_HHWU: "FALSE"
@@ -54,7 +54,7 @@
 
 - name: Copy SLC install information (For ALM)
   ansible.builtin.command:
-    cmd: "hubctl slcinstall add /opt/altair/slc/2025"
+    cmd: "hubctl slcinstall add {{ wps_installs.default }}"
   environment:
     ALM_HHWU: "FALSE"
     ALTAIR_LICENSE_PATH: "{{ license.license_path }}"
diff --git a/terraform/azure_azuredns/certificates.tf b/terraform/azure_azuredns/certificates.tf
index df58846..a22e515 100644
--- a/terraform/azure_azuredns/certificates.tf
+++ b/terraform/azure_azuredns/certificates.tf
@@ -18,6 +18,15 @@ resource "acme_certificate" "hub" {
   account_key_pem          = acme_registration.reg.account_key_pem
   certificate_p12_password = var.acme_cert_password
 
+  # Azure DNS refuses non-recursive (RD=0) queries from arbitrary IPs, which
+  # is what LEGO uses for its authoritative propagation check. Disabling the
+  # authoritative check and using a public recursive resolver instead routes
+  # the check through RD=1 queries that Azure accepts from known resolvers.
+  disable_complete_propagation = true
+  recursive_nameservers        = ["8.8.8.8:53", "1.1.1.1:53"]
+
+  depends_on = [azurerm_dns_zone.zone]
+
   dns_challenge {
     provider = "azuredns"
     config = {