diff --git a/ansible/inventory/group_vars/all/kolla b/ansible/inventory/group_vars/all/kolla
index 1bf0d52a6..9b63291b7 100644
--- a/ansible/inventory/group_vars/all/kolla
+++ b/ansible/inventory/group_vars/all/kolla
@@ -64,7 +64,7 @@ kolla_base_distro: "{{ os_distribution }}"
 # Defines default versions for each distribution.
 kolla_base_distro_version_default_map: {
   "centos": "stream9",
-  "debian": "bullseye",
+  "debian": "bookworm",
   "rocky": "9",
   "ubuntu": "noble",
 }
diff --git a/ansible/roles/public-openrc/templates/public-openrc.sh.j2 b/ansible/roles/public-openrc/templates/public-openrc.sh.j2
index d11c795dd..49225fc60 100644
--- a/ansible/roles/public-openrc/templates/public-openrc.sh.j2
+++ b/ansible/roles/public-openrc/templates/public-openrc.sh.j2
@@ -11,6 +11,8 @@ export OS_ENDPOINT_TYPE=publicURL
 export OS_MANILA_ENDPOINT_TYPE=publicURL
 {% elif "export OS_MISTRAL_ENDPOINT_TYPE" in line %}
 export OS_MISTRAL_ENDPOINT_TYPE=publicURL
+{% elif "export OS_CACERT" in line %}
+{# NOTE(bbezak): drop admin OS_CACERT; public-openrc sets its own. -#}
 {% else %}
 {{ line }}
 {% endif %}
diff --git a/releasenotes/notes/bug-2116318-44f0c022cde1e686.yaml b/releasenotes/notes/bug-2116318-44f0c022cde1e686.yaml
new file mode 100644
index 000000000..8851717e4
--- /dev/null
+++ b/releasenotes/notes/bug-2116318-44f0c022cde1e686.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Fixes duplicate ``OS_CACERT`` lines in ``public-openrc.sh`` when both admin
+    and public cacert variables are set.
+    `LP#2116318 <https://bugs.launchpad.net/kayobe/+bug/2116318>`__