diff --git a/ci-operator/config/openshift/cluster-monitoring-operator/openshift-cluster-monitoring-operator-main.yaml b/ci-operator/config/openshift/cluster-monitoring-operator/openshift-cluster-monitoring-operator-main.yaml
index 189ff9605357e..6bb4112d1e71d 100644
--- a/ci-operator/config/openshift/cluster-monitoring-operator/openshift-cluster-monitoring-operator-main.yaml
+++ b/ci-operator/config/openshift/cluster-monitoring-operator/openshift-cluster-monitoring-operator-main.yaml
@@ -3,6 +3,10 @@ base_images:
     name: hypershift-operator
     namespace: hypershift
     tag: latest
+  tls-scanner-tool:
+    name: tls-scanner
+    namespace: tls-scanner
+    tag: tls-scanner-tool
 build_root:
   from_repository: true
 images:
@@ -106,8 +110,17 @@ tests:
   steps:
     cluster_profile: openshift-org-aws
     env:
+      ENABLE_USER_WORKLOAD_MONITORING: "true"
+      PQC_CHECK: "true"
+      SCAN_NAMESPACE: openshift-monitoring,openshift-user-workload-monitoring
+      SCANNER_CPU_LIMIT: "4"
+      SCANNER_CPU_REQUEST: 500m
+      SCANNER_MEM_LIMIT: 4Gi
+      SCANNER_MEM_REQUEST: 1Gi
       TELEMETRY_ENABLED: "true"
+      TLS_PROFILE_TYPE: Intermediate
     test:
+    - ref: tls-scanner-run
     - as: test
       cli: latest
       commands: make test-e2e
diff --git a/ci-operator/step-registry/ipi/conf/aws/ipi-conf-aws-chain.yaml b/ci-operator/step-registry/ipi/conf/aws/ipi-conf-aws-chain.yaml
index b190af15a46dd..0ec98094083df 100644
--- a/ci-operator/step-registry/ipi/conf/aws/ipi-conf-aws-chain.yaml
+++ b/ci-operator/step-registry/ipi/conf/aws/ipi-conf-aws-chain.yaml
@@ -6,5 +6,6 @@ chain:
   - ref: ipi-conf-aws
   - ref: ipi-conf-aws-byo-ipv4-pool-public
   - ref: ipi-install-monitoringpvc
+  - ref: ipi-install-monitoring-uwm
   documentation: |-
     The IPI configure step chain generates the install-config.yaml file based on the cluster profile and optional input files.
diff --git a/ci-operator/step-registry/ipi/install/monitoring-uwm/OWNERS b/ci-operator/step-registry/ipi/install/monitoring-uwm/OWNERS
new file mode 100644
index 0000000000000..6ff1f5341c6a1
--- /dev/null
+++ b/ci-operator/step-registry/ipi/install/monitoring-uwm/OWNERS
@@ -0,0 +1,15 @@
+approvers:
+- danielmellado
+- jan--f
+- machine424
+- marioferh
+- simonpasquier
+- slashpai
+options: {}
+reviewers:
+- danielmellado
+- jan--f
+- machine424
+- marioferh
+- simonpasquier
+- slashpai
diff --git a/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-commands.sh b/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-commands.sh
new file mode 100755
index 0000000000000..f9b1a365933be
--- /dev/null
+++ b/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-commands.sh
@@ -0,0 +1,42 @@
+#!/bin/bash
+set -euo pipefail
+
+if [[ "${ENABLE_USER_WORKLOAD_MONITORING}" != "true" ]]; then
+  echo "ENABLE_USER_WORKLOAD_MONITORING is not 'true', nothing to do."
+  exit 0
+fi
+
+CONFIG="${SHARED_DIR}/manifest_cluster-monitoring-config.yaml"
+PATCH="${SHARED_DIR}/cluster-monitoring-config.yaml.uwm-patch"
+
+if ! test -e "${CONFIG}"; then
+  cat > "${CONFIG}" << EOF
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cluster-monitoring-config
+  namespace: openshift-monitoring
+data:
+  config.yaml:
+EOF
+fi
+
+cat > "${PATCH}" << EOF
+enableUserWorkload: true
+EOF
+
+CONFIG_CONTENTS="$(yq-go r "${CONFIG}" 'data."config.yaml"')"
+CONFIG_CONTENTS="$(echo "${CONFIG_CONTENTS}" | yq-go m - "${PATCH}")"
+yq-go w --style folded -i "${CONFIG}" 'data."config.yaml"' "${CONFIG_CONTENTS}"
+
+cat > "${SHARED_DIR}/manifest_user-workload-monitoring-config.yaml" << EOF
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: user-workload-monitoring-config
+  namespace: openshift-user-workload-monitoring
+data:
+  config.yaml: |
+    alertmanager:
+      enabled: true
+EOF
diff --git a/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.metadata.json b/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.metadata.json
new file mode 100644
index 0000000000000..8228450608715
--- /dev/null
+++ b/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.metadata.json
@@ -0,0 +1,21 @@
+{
+	"path": "ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.yaml",
+	"owners": {
+		"approvers": [
+			"danielmellado",
+			"jan--f",
+			"machine424",
+			"marioferh",
+			"simonpasquier",
+			"slashpai"
+		],
+		"reviewers": [
+			"danielmellado",
+			"jan--f",
+			"machine424",
+			"marioferh",
+			"simonpasquier",
+			"slashpai"
+		]
+	}
+}
\ No newline at end of file
diff --git a/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.yaml b/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.yaml
new file mode 100644
index 0000000000000..9a93effa18cca
--- /dev/null
+++ b/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.yaml
@@ -0,0 +1,20 @@
+ref:
+  as: ipi-install-monitoring-uwm
+  from_image:
+    namespace: ocp
+    name: "4.22"
+    tag: upi-installer
+  commands: ipi-install-monitoring-uwm-commands.sh
+  resources:
+    requests:
+      cpu: 100m
+      memory: 100Mi
+  env:
+    - name: ENABLE_USER_WORKLOAD_MONITORING
+      default: "false"
+      documentation: |-
+        Enable user workload monitoring:
+        * "false" (default) - do not enable user workload monitoring, making this step a no-op.
+        * "true" - enable user workload monitoring and user workload alertmanager.
+  documentation: |-
+    The IPI install monitoring-uwm step configures cluster-monitoring-operator to enable user workload monitoring and user workload alertmanager. It patches cluster-monitoring-config and creates user-workload-monitoring-config as install-time manifests.
diff --git a/ci-operator/step-registry/ipi/install/monitoringpvc/OWNERS b/ci-operator/step-registry/ipi/install/monitoringpvc/OWNERS
index 32d7adde2d4e1..6ff1f5341c6a1 100644
--- a/ci-operator/step-registry/ipi/install/monitoringpvc/OWNERS
+++ b/ci-operator/step-registry/ipi/install/monitoringpvc/OWNERS
@@ -1,25 +1,15 @@
 approvers:
-- arajkumar
-- bison
-- dgrisonnet
-- fpetkovski
+- danielmellado
 - jan--f
-- philipgough
-- prashbnair
-- raptorsun
+- machine424
+- marioferh
 - simonpasquier
 - slashpai
-- sthaha
 options: {}
 reviewers:
-- arajkumar
-- bison
-- dgrisonnet
-- fpetkovski
+- danielmellado
 - jan--f
-- philipgough
-- prashbnair
-- raptorsun
+- machine424
+- marioferh
 - simonpasquier
 - slashpai
-- sthaha
diff --git a/ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-ref.metadata.json b/ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-ref.metadata.json
index 6ba7d897f480e..36284a492b8ec 100644
--- a/ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-ref.metadata.json
+++ b/ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-ref.metadata.json
@@ -2,30 +2,20 @@
 	"path": "ipi/install/monitoringpvc/ipi-install-monitoringpvc-ref.yaml",
 	"owners": {
 		"approvers": [
-			"arajkumar",
-			"bison",
-			"dgrisonnet",
-			"fpetkovski",
+			"danielmellado",
 			"jan--f",
-			"philipgough",
-			"prashbnair",
-			"raptorsun",
+			"machine424",
+			"marioferh",
 			"simonpasquier",
-			"slashpai",
-			"sthaha"
+			"slashpai"
 		],
 		"reviewers": [
-			"arajkumar",
-			"bison",
-			"dgrisonnet",
-			"fpetkovski",
+			"danielmellado",
 			"jan--f",
-			"philipgough",
-			"prashbnair",
-			"raptorsun",
+			"machine424",
+			"marioferh",
 			"simonpasquier",
-			"slashpai",
-			"sthaha"
+			"slashpai"
 		]
 	}
 }
\ No newline at end of file