diff --git a/.circleci/config.yml b/.circleci/config.yml
deleted file mode 100644
index 447fadb..0000000
--- a/.circleci/config.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-version: 2.1
-orbs:
-  architect: giantswarm/architect@4.24.0
-
-workflows:
-  package-and-push-chart-on-tag:
-    jobs:
-      - architect/push-to-app-catalog:
-          context: "architect"
-          executor: "app-build-suite"
-          name: "push-to-app-catalog"
-          app_catalog: "cluster-catalog"
-          app_catalog_test: "cluster-test-catalog"
-          chart: "default-apps-openstack"
-          # Trigger job on git tag.
-          filters:
-            tags:
-              only: /^v.*/
diff --git a/.github/workflows/push_to_test_app_catalog.yaml b/.github/workflows/push_to_test_app_catalog.yaml
new file mode 100644
index 0000000..bbd1562
--- /dev/null
+++ b/.github/workflows/push_to_test_app_catalog.yaml
@@ -0,0 +1,16 @@
+name: 'Push to ICE Cluster Test Catalog'
+
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+-rc.[0-9]+'
+
+jobs:
+  push_to_app_catalog:
+    uses: giantswarm/app-build-suite/.github/workflows/push-to-app-catalog.yaml@v1.1.2
+    with:
+      app_catalog: ice-cluster-test-catalog
+      chart: default-apps-openstack
+      organization: thg-ice
+    secrets:
+      envPAT: ${{ secrets.WORKFLOW_WRITE }}
diff --git a/.github/workflows/zz_generated.create_release.yaml b/.github/workflows/zz_generated.create_release.yaml
deleted file mode 100644
index e9c6c4d..0000000
--- a/.github/workflows/zz_generated.create_release.yaml
+++ /dev/null
@@ -1,253 +0,0 @@
-# DO NOT EDIT. Generated with:
-#
-#    devctl@5.9.0
-#
-name: Create Release
-on:
-  push:
-    branches:
-      - 'legacy'
-      - 'main'
-      - 'master'
-      - 'release-v*.*.x'
-      # "!" negates previous positive patterns so it has to be at the end.
-      - '!release-v*.x.x'
-jobs:
-  debug_info:
-    name: Debug info
-    runs-on: ubuntu-20.04
-    steps:
-      - name: Print github context JSON
-        run: |
-          cat <<EOF
-          ${{ toJson(github) }}
-          EOF
-  gather_facts:
-    name: Gather facts
-    runs-on: ubuntu-20.04
-    outputs:
-      project_go_path: ${{ steps.get_project_go_path.outputs.path }}
-      ref_version: ${{ steps.ref_version.outputs.refversion }}
-      version: ${{ steps.get_version.outputs.version }}
-    steps:
-      - name: Get version
-        id: get_version
-        run: |
-          title="$(cat <<- 'COMMIT_MESSAGE_END' | head -n 1 -
-          ${{ github.event.head_commit.message }}
-          COMMIT_MESSAGE_END
-          )"
-          # Matches strings like:
-          #
-          #   - "Release v1.2.3"
-          #   - "Release v1.2.3-r4"
-          #   - "Release v1.2.3 (#56)"
-          #   - "Release v1.2.3-r4 (#56)"
-          #
-          # And outputs version part (1.2.3).
-          if echo "${title}" | grep -iqE '^Release v[0-9]+\.[0-9]+\.[0-9]+([.-][^ .-][^ ]*)?( \(#[0-9]+\))?$' ; then
-          version=$(echo "${title}" | cut -d ' ' -f 2)
-          fi
-          version="${version#v}" # Strip "v" prefix.
-          echo "version=\"${version}\""
-          echo "::set-output name=version::${version}"
-      - name: Checkout code
-        if: ${{ steps.get_version.outputs.version != '' }}
-        uses: actions/checkout@v3
-      - name: Get project.go path
-        id: get_project_go_path
-        if: ${{ steps.get_version.outputs.version != '' }}
-        run: |
-          path='./pkg/project/project.go'
-          if [[ ! -f $path ]] ; then
-            path=''
-          fi
-          echo "path=\"$path\""
-          echo "::set-output name=path::${path}"
-      - name: Check if reference version
-        id: ref_version
-        run: |
-          title="$(cat <<- 'COMMIT_MESSAGE_END' | head -n 1 -
-          ${{ github.event.head_commit.message }}
-          COMMIT_MESSAGE_END
-          )"
-          if echo "${title}" | grep -qE '^release v[0-9]+\.[0-9]+\.[0-9]+([.-][^ .-][^ ]*)?( \(#[0-9]+\))?$' ; then
-            version=$(echo "${title}" | cut -d ' ' -f 2)
-          fi
-          version=$(echo "${title}" | cut -d ' ' -f 2)
-          version="${version#v}" # Strip "v" prefix.
-          refversion=false
-          if [[ "${version}" =~ ^[0-9]+.[0-9]+.[0-9]+-[0-9]+$ ]]; then
-            refversion=true
-          fi
-          echo "refversion =\"${refversion}\""
-          echo "::set-output name=refversion::${refversion}"
-  update_project_go:
-    name: Update project.go
-    runs-on: ubuntu-20.04
-    if: ${{ needs.gather_facts.outputs.version != '' && needs.gather_facts.outputs.project_go_path != '' && needs.gather_facts.outputs.ref_version != 'true' }}
-    needs:
-      - gather_facts
-    steps:
-      - name: Install architect
-        uses: giantswarm/install-binary-action@v1.0.0
-        with:
-          binary: "architect"
-          version: "6.1.0"
-      - name: Install semver
-        uses: giantswarm/install-binary-action@v1.0.0
-        with:
-          binary: "semver"
-          version: "3.2.0"
-          download_url: "https://github.com/fsaintjacques/${binary}-tool/archive/${version}.tar.gz"
-          tarball_binary_path: "*/src/${binary}"
-          smoke_test: "${binary} --version"
-      - name: Checkout code
-        uses: actions/checkout@v3
-      - name: Update project.go
-        id: update_project_go
-        env:
-          branch: "${{ github.ref }}-version-bump"
-        run: |
-          git checkout -b ${{ env.branch }}
-          file="${{ needs.gather_facts.outputs.project_go_path }}"
-          version="${{ needs.gather_facts.outputs.version }}"
-          new_version="$(semver bump patch $version)-dev"
-          echo "version=\"$version\" new_version=\"$new_version\""
-          echo "::set-output name=new_version::${new_version}"
-          sed -Ei "s/(version[[:space:]]*=[[:space:]]*)\"${version}\"/\1\"${new_version}\"/" $file
-          if git diff --exit-code $file ; then
-            echo "error: no changes in \"$file\"" >&2
-            exit 1
-          fi
-      - name: Set up git identity
-        run: |
-          git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --local user.name "github-actions[bot]"
-      - name: Commit changes
-        run: |
-          file="${{ needs.gather_facts.outputs.project_go_path }}"
-          git add $file
-          git commit -m "Bump version to ${{ steps.update_project_go.outputs.new_version }}"
-      - name: Push changes
-        env:
-          REMOTE_REPO: "https://${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git"
-          branch: "${{ github.ref }}-version-bump"
-        run: |
-          git push "${REMOTE_REPO}" HEAD:${{ env.branch }}
-      - name: Create PR
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-          base: "${{ github.ref }}"
-          branch: "${{ github.ref }}-version-bump"
-          version: "${{ needs.gather_facts.outputs.version }}"
-          title: "Bump version to ${{ steps.update_project_go.outputs.new_version }}"
-        run: |
-          hub pull-request -f  -m "${{ env.title }}" -b ${{ env.base }} -h ${{ env.branch }} -r ${{ github.actor }}
-  create_release:
-    name: Create release
-    runs-on: ubuntu-20.04
-    needs:
-      - gather_facts
-    if: ${{ needs.gather_facts.outputs.version }}
-    outputs:
-      upload_url: ${{ steps.create_gh_release.outputs.upload_url }}
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-        with:
-          ref: ${{ github.sha }}
-      - name: Ensure correct version in project.go
-        if: ${{ needs.gather_facts.outputs.project_go_path != '' && needs.gather_facts.outputs.ref_version != 'true' }}
-        run: |
-          file="${{ needs.gather_facts.outputs.project_go_path }}"
-          version="${{ needs.gather_facts.outputs.version }}"
-          grep -qE "version[[:space:]]*=[[:space:]]*\"$version\"" $file
-      - name: Get Changelog Entry
-        id: changelog_reader
-        uses: mindsers/changelog-reader-action@v2
-        with:
-          version: ${{ needs.gather_facts.outputs.version }}
-          path: ./CHANGELOG.md
-      - name: Set up git identity
-        run: |
-          git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --local user.name "github-actions[bot]"
-      - name: Create tag
-        run: |
-          version="${{ needs.gather_facts.outputs.version }}"
-          git tag "v$version" ${{ github.sha }}
-      - name: Push tag
-        env:
-          REMOTE_REPO: "https://${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git"
-        run: |
-          git push "${REMOTE_REPO}" --tags
-      - name: Create release
-        id: create_gh_release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          body: ${{ steps.changelog_reader.outputs.changes }}
-          tag_name: "v${{ needs.gather_facts.outputs.version }}"
-          release_name: "v${{ needs.gather_facts.outputs.version }}"
-
-  create-release-branch:
-    name: Create release branch
-    runs-on: ubuntu-20.04
-    needs:
-      - gather_facts
-    if: ${{ needs.gather_facts.outputs.version }}
-    steps:
-      - name: Install semver
-        uses: giantswarm/install-binary-action@v1.0.0
-        with:
-          binary: "semver"
-          version: "3.0.0"
-          download_url: "https://github.com/fsaintjacques/${binary}-tool/archive/${version}.tar.gz"
-          tarball_binary_path: "*/src/${binary}"
-          smoke_test: "${binary} --version"
-      - name: Check out the repository
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0  # Clone the whole history, not just the most recent commit.
-      - name: Fetch all tags and branches
-        run: "git fetch --all"
-      - name: Create long-lived release branch
-        run: |
-          current_version="${{ needs.gather_facts.outputs.version }}"
-          parent_version="$(git describe --tags --abbrev=0 HEAD^ || true)"
-          parent_version="${parent_version#v}" # Strip "v" prefix.
-
-          if [[ -z "$parent_version" ]] ; then
-            echo "Unable to find a parent tag version. No branch to create."
-            exit 0
-          fi
-
-          echo "current_version=$current_version parent_version=$parent_version"
-
-          current_major=$(semver get major $current_version)
-          current_minor=$(semver get minor $current_version)
-          parent_major=$(semver get major $parent_version)
-          parent_minor=$(semver get minor $parent_version)
-          echo "current_major=$current_major current_minor=$current_minor parent_major=$parent_major parent_minor=$parent_minor"
-
-          if [[ $current_major -gt $parent_major ]] ; then
-            echo "Current tag is a new major version"
-          elif [[ $current_major -eq $parent_major ]] && [[ $current_minor -gt $parent_minor ]] ; then
-            echo "Current tag is a new minor version"
-          else
-            echo "Current tag is not a new major or minor version. Nothing to do here."
-            exit 0
-          fi
-
-          release_branch="release-v${parent_major}.${parent_minor}.x"
-          echo "release_branch=$release_branch"
-
-          if git rev-parse --verify $release_branch ; then
-            echo "Release branch $release_branch already exists. Nothing to do here."
-            exit 0
-          fi
-
-          git branch $release_branch HEAD^
-          git push origin $release_branch
diff --git a/.github/workflows/zz_generated.create_release_pr.yaml b/.github/workflows/zz_generated.create_release_pr.yaml
deleted file mode 100644
index d5cec93..0000000
--- a/.github/workflows/zz_generated.create_release_pr.yaml
+++ /dev/null
@@ -1,212 +0,0 @@
-# DO NOT EDIT. Generated with:
-#
-#    devctl@5.9.0
-#
-name: Create Release PR
-on:
-  push:
-    branches:
-      - 'legacy#release#v*.*.*'
-      - 'main#release#v*.*.*'
-      - 'main#release#major'
-      - 'main#release#minor'
-      - 'main#release#patch'
-      - 'master#release#v*.*.*'
-      - 'master#release#major'
-      - 'master#release#minor'
-      - 'master#release#patch'
-      - 'release#v*.*.*'
-      - 'release#major'
-      - 'release#minor'
-      - 'release#patch'
-      - 'release-v*.*.x#release#v*.*.*'
-      # "!" negates previous positive patterns so it has to be at the end.
-      - '!release-v*.x.x#release#v*.*.*'
-  workflow_call:
-    inputs:
-      branch:
-        required: true
-        type: string
-jobs:
-  debug_info:
-    name: Debug info
-    runs-on: ubuntu-20.04
-    steps:
-      - name: Print github context JSON
-        run: |
-          cat <<EOF
-          ${{ toJson(github) }}
-          EOF
-  gather_facts:
-    name: Gather facts
-    runs-on: ubuntu-20.04
-    outputs:
-      repo_name: ${{ steps.gather_facts.outputs.repo_name }}
-      branch: ${{ steps.gather_facts.outputs.branch }}
-      base: ${{ steps.gather_facts.outputs.base }}
-      is_major: ${{ steps.gather_facts.outputs.is_major }}
-      skip: ${{ steps.pr_exists.outputs.skip }}
-      version: ${{ steps.gather_facts.outputs.version }}
-    steps:
-      - name: Gather facts
-        id: gather_facts
-        run: |
-          head="${{ inputs.branch || github.event.ref }}"
-          echo "::set-output name=branch::${head}"
-
-          head="${head#refs/heads/}" # Strip "refs/heads/" prefix.
-          if [[ $(echo "$head" | grep -o '#' | wc -l) -gt 1 ]]; then
-            base="$(echo $head | cut -d '#' -f 1)"
-          else
-            base="${{ github.event.base_ref }}"
-          fi
-
-          base="${base#refs/heads/}" # Strip "refs/heads/" prefix.
-
-          version="$(echo $head | awk -F# '{print $NF}')"
-          if [[ $version =~ ^major|minor|patch$ ]]; then
-            gh auth login --with-token <<<$(echo -n ${{ secrets.GITHUB_TOKEN }})
-            version_parts=($(gh api "repos/${{ github.repository }}/releases/latest" --jq '.tag_name[1:] | split(".") | .[0], .[1], .[2]'))
-            version_major=${version_parts[0]}
-            version_minor=${version_parts[1]}
-            version_patch=${version_parts[2]}
-            case ${version} in
-              patch)
-                version_patch=$((version_patch+1))
-                ;;
-              minor)
-                version_minor=$((version_minor+1))
-                version_patch=0
-                ;;
-              major)
-                version_major=$((version_major+1))
-                version_minor=0
-                version_patch=0
-                echo "::set-output name=is_major::true"
-                ;;
-              *)
-                echo "Unknown Semver level provided"
-                exit 1
-                ;;
-            esac
-            version="${version_major}.${version_minor}.${version_patch}"
-          else
-            version="${version#v}" # Strip "v" prefix.
-            version_major=$(echo "${version}" | cut -d "." -f 1)
-            version_minor=$(echo "${version}" | cut -d "." -f 2)
-            version_patch=$(echo "${version}" | cut -d "." -f 3)
-            if [[ $version_minor = 0 && $version_patch = 0 ]]; then
-              echo "::set-output name=is_major::true"
-            fi
-          fi
-          repo_name="$(echo '${{ github.repository }}' | awk -F '/' '{print $2}')"
-          echo "repo_name=\"$repo_name\" base=\"$base\" head=\"$head\" version=\"$version\""
-          echo "::set-output name=repo_name::${repo_name}"
-          echo "::set-output name=base::${base}"
-          echo "::set-output name=head::${head}"
-          echo "::set-output name=version::${version}"
-      - name: Check if PR exists
-        id: pr_exists
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-        run: |
-          if gh pr view --repo ${{ github.repository }} ${{ steps.gather_facts.outputs.branch }} | grep -i 'state:[[:space:]]*open' >/dev/null; then
-            gh pr view --repo ${{ github.repository }} ${{ steps.gather_facts.outputs.branch }}
-            echo "::set-output name=skip::true"
-          else
-            echo "::set-output name=skip::false"
-          fi
-  create_release_pr:
-    name: Create release PR
-    runs-on: ubuntu-20.04
-    needs:
-      - gather_facts
-    if: ${{ needs.gather_facts.outputs.skip != 'true' }}
-    env:
-      architect_flags: "--organisation ${{ github.repository_owner }} --project ${{ needs.gather_facts.outputs.repo_name }}"
-    steps:
-      - uses: actions/setup-go@v3
-        with:
-          go-version: '=1.18.1'
-      - name: Install architect
-        uses: giantswarm/install-binary-action@v1.0.0
-        with:
-          binary: "architect"
-          version: "6.1.0"
-      - name: Checkout code
-        uses: actions/checkout@v3
-        with:
-          ref: ${{ needs.gather_facts.outputs.branch }}
-      - name: Prepare release changes
-        run: |
-          architect prepare-release ${{ env.architect_flags }} --version "${{ needs.gather_facts.outputs.version }}"
-      - name: Update version field in Chart.yaml
-        run: |
-          # Define chart_dir
-          repository="${{ needs.gather_facts.outputs.repo_name }}"
-          chart="helm/${repository}"
-
-          # Check chart directory.
-          if [ ! -d "${chart}" ]
-          then
-            echo "Could not find chart directory '${chart}', adding app suffix."
-
-            # Add app suffix.
-            chart="helm/${repository}-app"
-
-            # Check chart directory with app suffix.
-            if [ ! -d "${chart}" ]
-            then
-              echo "Could not find chart directory '${chart}', removing app suffix."
-
-              # Remove app suffix.
-              chart="helm/${repository%-app}"
-
-              if [ ! -d "${chart}" ]
-              then
-                # Print error.
-                echo "Could not find chart directory '${chart}', doing nothing."
-              fi
-            fi
-          fi
-
-          # Define chart YAML.
-          chart_yaml="${chart}/Chart.yaml"
-
-          # Check chart YAML.
-          if [ -f "${chart_yaml}" ]
-          then
-            # check if version in Chart.yaml is templated using architect
-            if [ $(grep -c "^version:.*\.Version.*$" "${chart_yaml}") = "0" ]; then
-              yq -i '.version = "${{ needs.gather_facts.outputs.version }}"' "${chart_yaml}"
-            fi
-          fi
-
-      - name: Bump go module defined in go.mod if needed
-        run: |
-          if [ "${{ needs.gather_facts.outputs.is_major }}" = true ] && test -f "go.mod"; then
-            go install github.com/marwan-at-work/mod/cmd/mod@v0.4.2
-            mod upgrade
-          fi
-      - name: Set up git identity
-        run: |
-          git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --local user.name "github-actions[bot]"
-      - name: Create release commit
-        env:
-          version: "${{ needs.gather_facts.outputs.version }}"
-        run: |
-          git add -A
-          git commit -m "Release v${{ env.version }}"
-      - name: Push changes
-        env:
-          remote_repo: "https://${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git"
-        run: |
-          git push "${remote_repo}" HEAD:${{ needs.gather_facts.outputs.branch }}
-      - name: Create PR
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-          base: "${{ needs.gather_facts.outputs.base }}"
-          version: "${{ needs.gather_facts.outputs.version }}"
-        run: |
-          hub pull-request -f -m "Release v${{ env.version }}" -a ${{ github.actor }} -b ${{ env.base }} -h ${{ needs.gather_facts.outputs.branch }}
diff --git a/helm/default-apps-openstack/Chart.yaml b/helm/default-apps-openstack/Chart.yaml
index 74f6b0a..c6c1619 100644
--- a/helm/default-apps-openstack/Chart.yaml
+++ b/helm/default-apps-openstack/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: default-apps-openstack
 description: A Helm chart defining the preinstalled apps running in all Giant Swarm OpenStack clusters.
 home: https://github.com/giantswarm/default-apps-openstack
-version: 0.7.3
+version: 0.7.4
 annotations:
   application.giantswarm.io/team: "rocket"
   application.giantswarm.io/app-type: "bundle"
diff --git a/helm/default-apps-openstack/templates/apps.yaml b/helm/default-apps-openstack/templates/apps.yaml
index 39a614d..75089e3 100644
--- a/helm/default-apps-openstack/templates/apps.yaml
+++ b/helm/default-apps-openstack/templates/apps.yaml
@@ -44,7 +44,7 @@ spec:
   {{- end }}
   {{- if .secret }}
     secret:
-      name: {{ $.Values.clusterName }}-{{ $appName }}-user-values
+      name: {{ $.Values.clusterName }}-{{ $appName }}-user-secrets
       namespace: {{ $.Release.Namespace }}
   {{- end }}
   {{- end }}
@@ -72,7 +72,7 @@ kind: Secret
 metadata:
   labels:
     {{- include "labels.common" $ | nindent 4 }}
-  name: {{ $.Values.clusterName }}-{{ $appName }}-user-values
+  name: {{ $.Values.clusterName }}-{{ $appName }}-user-secrets
   namespace: {{ $.Release.Namespace }}
 stringData:
   {{- (tpl (.secret | toYaml | toString) $) | nindent 2 }}