diff --git a/ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/preflight/tasks/vapp.yml b/ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/preflight/tasks/vapp.yml
new file mode 100644
index 0000000..a83f039
--- /dev/null
+++ b/ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/preflight/tasks/vapp.yml
@@ -0,0 +1,24 @@
+- name: Check for expected vApp properties
+  ansible.builtin.assert:
+    that:
+      - vapp[item] is defined
+      - (vapp[item] | length) > 0
+  loop:
+    - deployment.type
+    - guestinfo.dnsserver
+    - guestinfo.gateway
+    - guestinfo.hostname
+    - guestinfo.ipaddress
+    - guestinfo.prefixlength
+    - guestinfo.rootsshkey
+    - hv.fqdn
+    - hv.password
+    - hv.username
+    - ippool.endip
+    - ippool.startip
+    - metacluster.fqdn
+    - metacluster.password
+    - metacluster.token
+    - metacluster.vip
+    - workloadcluster.name
+    - workloadcluster.vip
diff --git a/ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/workloadcluster/tasks/clusterapi.yml b/ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/workloadcluster/tasks/clusterapi.yml
index a26223c..027fa14 100644
--- a/ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/workloadcluster/tasks/clusterapi.yml
+++ b/ansible/roles/firstboot/files/ansible_payload/bootstrap/roles/workloadcluster/tasks/clusterapi.yml
@@ -54,18 +54,20 @@
 
 - name: WORKAROUND - Update image references to use local registry
   ansible.builtin.replace:
-    dest: "{{ item.root ~ '/' ~ item.path }}"
+    dest: "{{ item }}"
     regexp: '([ ]+image:[ "]+)(?!({{ _template.pattern }}|"{{ _template.pattern }}))'
     replace: '\1{{ _template.pattern }}'
   vars:
+    fileglobs:
+      - "{{ query('ansible.builtin.fileglob', '/opt/metacluster/cluster-api/cni-calico/' ~ components.clusterapi.workload.version.calico ~ '/*.yaml') }}"
+      - "{{ query('ansible.builtin.fileglob', '/opt/metacluster/cluster-api/infrastructure-vsphere/' ~ components.clusterapi.management.version.infrastructure_vsphere ~ '/*.yaml') }}"
     _template:
       pattern: registry.{{ vapp['metacluster.fqdn'] }}/library/
-  loop: "{{ lookup('community.general.filetree', '/opt/metacluster/cluster-api') }}"
+  loop: "{{ fileglobs[0:] | flatten | select }}"
   loop_control:
-    label: "{{ item.path }}"
+    label: "{{ item | basename }}"
   when:
-    - item.path is search('.yaml')
-    - item.path is not search("cert-manager.yaml|clusterctl.yaml|components.yaml|metadata.yaml")
+    - item is not search("components.yaml|metadata.yaml")
 
 - name: Generate kustomization template
   ansible.builtin.template:
diff --git a/ansible/roles/firstboot/files/ansible_payload/common/roles/preflight/tasks/main.yml b/ansible/roles/firstboot/files/ansible_payload/common/roles/preflight/tasks/main.yml
index 64af762..25425b6 100644
--- a/ansible/roles/firstboot/files/ansible_payload/common/roles/preflight/tasks/main.yml
+++ b/ansible/roles/firstboot/files/ansible_payload/common/roles/preflight/tasks/main.yml
@@ -1 +1,2 @@
+- import_tasks: vapp.yml
 - import_tasks: vcenter.yml
diff --git a/ansible/roles/firstboot/files/ansible_payload/upgrade/roles/preflight/tasks/main.yml b/ansible/roles/firstboot/files/ansible_payload/upgrade/roles/preflight/tasks/main.yml
index 0b59838..3c3b545 100644
--- a/ansible/roles/firstboot/files/ansible_payload/upgrade/roles/preflight/tasks/main.yml
+++ b/ansible/roles/firstboot/files/ansible_payload/upgrade/roles/preflight/tasks/main.yml
@@ -1,2 +1,3 @@
+- import_tasks: vapp.yml
 - import_tasks: vcenter.yml
 - import_tasks: metacluster.yml
diff --git a/ansible/roles/firstboot/files/ansible_payload/upgrade/roles/preflight/tasks/vapp.yml b/ansible/roles/firstboot/files/ansible_payload/upgrade/roles/preflight/tasks/vapp.yml
new file mode 100644
index 0000000..60b942f
--- /dev/null
+++ b/ansible/roles/firstboot/files/ansible_payload/upgrade/roles/preflight/tasks/vapp.yml
@@ -0,0 +1,19 @@
+- name: Check for expected vApp properties
+  ansible.builtin.assert:
+    that:
+      - vapp[item] is defined
+      - (vapp[item] | length) > 0
+  loop:
+    - guestinfo.dnsserver
+    - guestinfo.gateway
+    - guestinfo.hostname
+    - guestinfo.ipaddress
+    - guestinfo.prefixlength
+    - guestinfo.rootsshkey
+    - hv.fqdn
+    - hv.password
+    - hv.username
+    - metacluster.fqdn
+    - metacluster.password
+    - metacluster.token
+    - metacluster.vip