diff --git a/charts/argocd-understack/values.yaml b/charts/argocd-understack/values.yaml
index abf3a677f..31788df95 100644
--- a/charts/argocd-understack/values.yaml
+++ b/charts/argocd-understack/values.yaml
@@ -377,7 +377,7 @@ site:
     wave: 2
     # -- Chart version for Ironic
     # renovate: datasource=helm depName=ironic registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
-    chartVersion: 2025.2.23+ea0d1ecda
+    chartVersion: 2026.1.10+a659ab8a2
 
   # -- Neutron (Networking Service)
   neutron:
diff --git a/components/images-openstack.yaml b/components/images-openstack.yaml
index d63aa6968..f16e54dee 100644
--- a/components/images-openstack.yaml
+++ b/components/images-openstack.yaml
@@ -24,6 +24,7 @@ images:
     # ironic
     ironic_api: "ghcr.io/rackerlabs/understack/ironic:2026.1"
     ironic_conductor: "ghcr.io/rackerlabs/understack/ironic:2026.1"
+    ironic_novncproxy: "ghcr.io/rackerlabs/understack/ironic:2026.1"
     ironic_pxe: "ghcr.io/rackerlabs/understack/ironic:2026.1"
     ironic_pxe_init: "ghcr.io/rackerlabs/understack/ironic:2026.1"
     ironic_pxe_http: "docker.io/nginx:1.29.8"
diff --git a/components/ironic/kustomization.yaml b/components/ironic/kustomization.yaml
index c413942f7..897b75690 100644
--- a/components/ironic/kustomization.yaml
+++ b/components/ironic/kustomization.yaml
@@ -13,9 +13,6 @@ resources:
     # takes precedence over the directory
   - ./runbook-crd
   - ./runbook-operator
-  # Graphical consoles
-  - role-ironic-graphical-console.yaml
-  - role-binding-ironic-graphical-console.yaml
   # Alerting
   - pr-clean-failed-servers.yaml
   - pr-resource-availability.yaml
diff --git a/components/ironic/role-binding-ironic-graphical-console.yaml b/components/ironic/role-binding-ironic-graphical-console.yaml
deleted file mode 100644
index 618d80534..000000000
--- a/components/ironic/role-binding-ironic-graphical-console.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: ironic-openstack-graphical-console
-  namespace: openstack
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: ironic-openstack-console-provider
-subjects:
-  - kind: ServiceAccount
-    name: ironic-conductor
-    namespace: openstack
diff --git a/components/ironic/role-ironic-graphical-console.yaml b/components/ironic/role-ironic-graphical-console.yaml
deleted file mode 100644
index 676a4d5b8..000000000
--- a/components/ironic/role-ironic-graphical-console.yaml
+++ /dev/null
@@ -1,27 +0,0 @@
-# Allows Ironic conductor to appropriately manage resources required to provide
-# graphical console functionality.
-# At the moment, these are console container Pods and Secrets.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: ironic-openstack-console-provider
-  namespace: openstack
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-    verbs:
-      - create
-      - delete
-      - patch
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - create
-      - delete
-      - list
-      - get
-      - patch
diff --git a/components/ironic/values.yaml b/components/ironic/values.yaml
index 4061281f5..0d0c9e0f9 100644
--- a/components/ironic/values.yaml
+++ b/components/ironic/values.yaml
@@ -36,6 +36,9 @@ labels:
   conductor:
     node_selector_key: ironic_role
     node_selector_value: conductor
+  novncproxy:
+    node_selector_key: ironic_role
+    node_selector_value: conductor
 
 conf:
   # Update policies for better integration with OpenStack services
@@ -202,6 +205,11 @@ dependencies:
           service: oslo_db
         - endpoint: internal
           service: oslo_messaging
+    novncproxy:
+      jobs:
+        - ironic-db-sync
+        - ironic-ks-user
+        - ironic-ks-endpoints
     # (nicholas.kuechler) The upstream helm values have ironic-db-init
     # as a dependency for db_sync, but we have job_db_init false so
     # ironic-db-init never gets created, and this dependency won't pass.
@@ -227,6 +235,10 @@ manifests:
   # that is later consumed via components/openstack helm chart
   secret_keystone: false
   secret_ks_etc: false
+  deployment_novncproxy: true
+  role_console_pods: true
+  rolebinding_console_pods: true
+  service_novncproxy: true
 
 pod:
   # Use etcSources to mount the ironic-ks-etc secret at /etc/ironic/ironic.conf.d/
@@ -238,6 +250,9 @@ pod:
     ironic_conductor:
       - secret:
           name: ironic-ks-etc
+    ironic_novncproxy:
+      - secret:
+          name: ironic-ks-etc
   mounts:
     ironic_conductor:
       ironic_conductor:
diff --git a/docs/operator-guide/openstack-ironic-console.md b/docs/operator-guide/openstack-ironic-console.md
index 34612ed1d..98431ec72 100644
--- a/docs/operator-guide/openstack-ironic-console.md
+++ b/docs/operator-guide/openstack-ironic-console.md
@@ -26,12 +26,12 @@ Here is brief explanation of what each component is responsible for:
   only one application - a browser with a HTML5 console exposed by the
   baremetal nodes BMC. These containers are accessible (internally) through
   VNC.
-- **ironic-novncproxy** is launched alongside the **Ironic Conductor** and as
-  the name implies, it proxies users HTTPS traffic. It does that by serving
-  [noVNC](https://github.com/novnc/noVNC) web application to the user's
-  browser. The browser then opens websocket connection to the
-  **ironic-novncproxy** which in turn opens VNC connection to the relevant
-  **container**.
+- **ironic-novncproxy** is deployed by the OpenStack-Helm Ironic chart as its
+  own Kubernetes Deployment and Service. As the name implies, it proxies users'
+  HTTPS traffic. It does that by serving [noVNC](https://github.com/novnc/noVNC)
+  web application to the user's browser. The browser then opens websocket
+  connection to the **ironic-novncproxy** which in turn opens VNC connection to
+  the relevant **container**.
 
 ## Sequence diagram
 
@@ -79,7 +79,9 @@ A typical deployment will have several components running to provide console fun
 Please note:
 
 - Each baremetal node console session gets it's own VNC container
-- There is a 1:1 coupling between the Ironic conductor and the Ironic NOVNCProxy
+- Console URLs are coupled to the conductor responsible for a node. Undercloud
+  currently runs one Ironic conductor and one chart-managed `ironic-novncproxy`
+  endpoint.
 
 ```mermaid
 flowchart LR
@@ -197,14 +199,13 @@ console feature:
 1. The baremetal nodes' console_interface must be set to a graphical driver
    such as `redfish-graphical`.
 2. Ironic must have the relevant drivers enabled in `enabled_console_interfaces`
-3. `ironic-novncproxy` must be launched for each of the ironic conductors. At
-   the time of writing, this is achieved through `extraContainers` because
-   OpenStack Helm does not have direct support for launching that component. We
-   plan to contribute that feature to [OSH][3] soon.
-4. Each instance of the `ironic-novncproxy` must be exposed to the external
-   world. This means, we have to create relevant Kubernetes `Service` and
-   `HTTPRoute` definitions. The `cert-manager` will take care of TLS certificates
-   and `external-dns` will register the DNS domain.
+3. The OpenStack-Helm Ironic chart's native novncproxy resources must be
+   enabled: `deployment_novncproxy`, `service_novncproxy`, `role_console_pods`,
+   and `rolebinding_console_pods`.
+4. The chart-created `ironic-novncproxy` Service must be exposed to the external
+   world. Undercloud routes the existing `console-0...` hostnames to that
+   Service through Envoy Gateway. The `cert-manager` will take care of TLS
+   certificates and `external-dns` will register the DNS domain.
 5. *(Optional)* The RBAC policy may need to be adjusted as the baremetal console,
    by default is only accessible to admins.
 
@@ -215,4 +216,3 @@ console feature:
 
 [1]: https://docs.openstack.org/ironic/latest/configuration/config.html#vnc
 [2]: https://docs.openstack.org/ironic/latest/install/graphical-console.html
-[3]: https://github.com/RSS-Engineering/undercloud-deploy/commit/d7201742ae5e10b9428be17b7418ac1066899214