diff --git a/ci-operator/config/openshift/microshift/openshift-microshift-release-5.0__periodics.yaml b/ci-operator/config/openshift/microshift/openshift-microshift-release-5.0__periodics.yaml
index e1051bd3b5533..67334880ebb24 100644
--- a/ci-operator/config/openshift/microshift/openshift-microshift-release-5.0__periodics.yaml
+++ b/ci-operator/config/openshift/microshift/openshift-microshift-release-5.0__periodics.yaml
@@ -34,7 +34,11 @@ resources:
       memory: 200Mi
 tests:
 - as: rebase-on-nightlies
+  capabilities:
+  - intranet
+  - nested-podman
   cron: 0 4 * * 1-5
+  nested_podman: true
   reporter_config:
     channel: '#microshift-alerts'
     job_states_to_report:
@@ -42,8 +46,11 @@ tests:
     - error
     report_template: ':red_jenkins_circle: Job *{{.Spec.Job}}* ended with *{{.Status.State}}*.
       <{{.Status.URL}}|View logs>'
+  restrict_network_access: false
   steps:
-    workflow: openshift-microshift-rebase
+    test:
+    - chain: openshift-microshift-rebase
+    - ref: openshift-microshift-cryptoscan
 - as: publish-release-notes
   cron: 0 5 * * 1-5
   reporter_config:
diff --git a/ci-operator/jobs/openshift/microshift/openshift-microshift-release-5.0-periodics.yaml b/ci-operator/jobs/openshift/microshift/openshift-microshift-release-5.0-periodics.yaml
index 545c1d0cb3992..bf395c4d62469 100644
--- a/ci-operator/jobs/openshift/microshift/openshift-microshift-release-5.0-periodics.yaml
+++ b/ci-operator/jobs/openshift/microshift/openshift-microshift-release-5.0-periodics.yaml
@@ -1918,6 +1918,8 @@ periodics:
     org: openshift
     repo: microshift
   labels:
+    capability/intranet: intranet
+    capability/nested-podman: nested-podman
     ci-operator.openshift.io/variant: periodics
     ci.openshift.io/generator: prowgen
     job-release: "5.0"
diff --git a/ci-operator/step-registry/openshift/microshift/cryptoscan/OWNERS b/ci-operator/step-registry/openshift/microshift/cryptoscan/OWNERS
new file mode 100644
index 0000000000000..f427ff70caa0a
--- /dev/null
+++ b/ci-operator/step-registry/openshift/microshift/cryptoscan/OWNERS
@@ -0,0 +1,5 @@
+approvers:
+- openshift-edge-approvers
+options: {}
+reviewers:
+- openshift-edge-reviewers
diff --git a/ci-operator/step-registry/openshift/microshift/cryptoscan/openshift-microshift-cryptoscan-commands.sh b/ci-operator/step-registry/openshift/microshift/cryptoscan/openshift-microshift-cryptoscan-commands.sh
new file mode 100755
index 0000000000000..3da34e27dd579
--- /dev/null
+++ b/ci-operator/step-registry/openshift/microshift/cryptoscan/openshift-microshift-cryptoscan-commands.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+set -euo pipefail
+
+source "${SHARED_DIR}/ci-functions.sh"
+
+cp /secrets/import-secret/.dockerconfigjson ${HOME}/.pull-secret.json
+
+GOARCH=$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')
+export GOARCH
+
+export CRYPTO_SCAN=true
+cd /go/src/github.com/openshift/microshift/
+./scripts/auto-rebase/rebase_job_entrypoint.sh
diff --git a/ci-operator/step-registry/openshift/microshift/cryptoscan/openshift-microshift-cryptoscan-ref.metadata.json b/ci-operator/step-registry/openshift/microshift/cryptoscan/openshift-microshift-cryptoscan-ref.metadata.json
new file mode 100644
index 0000000000000..c46f0ba8276cd
--- /dev/null
+++ b/ci-operator/step-registry/openshift/microshift/cryptoscan/openshift-microshift-cryptoscan-ref.metadata.json
@@ -0,0 +1,11 @@
+{
+	"path": "openshift/microshift/cryptoscan/openshift-microshift-cryptoscan-ref.yaml",
+	"owners": {
+		"approvers": [
+			"openshift-edge-approvers"
+		],
+		"reviewers": [
+			"openshift-edge-reviewers"
+		]
+	}
+}
\ No newline at end of file
diff --git a/ci-operator/step-registry/openshift/microshift/cryptoscan/openshift-microshift-cryptoscan-ref.yaml b/ci-operator/step-registry/openshift/microshift/cryptoscan/openshift-microshift-cryptoscan-ref.yaml
new file mode 100644
index 0000000000000..94ea28d58d8f8
--- /dev/null
+++ b/ci-operator/step-registry/openshift/microshift/cryptoscan/openshift-microshift-cryptoscan-ref.yaml
@@ -0,0 +1,14 @@
+ref:
+  as: openshift-microshift-cryptoscan
+  from: nested-podman
+  commands: openshift-microshift-cryptoscan-commands.sh
+  resources:
+    requests:
+      cpu: 800m
+      memory: 1800Mi
+  credentials:
+    - name: ci-pull-credentials
+      namespace: test-credentials
+      mount_path: /secrets/import-secret
+  documentation: |-
+    Runs the Red Hat crypto scanner against MicroShift source code using podman.
diff --git a/ci-operator/step-registry/openshift/microshift/rebase/openshift-microshift-rebase-chain.yaml b/ci-operator/step-registry/openshift/microshift/rebase/openshift-microshift-rebase-chain.yaml
index 6a740762ffaea..fe203c736b142 100644
--- a/ci-operator/step-registry/openshift/microshift/rebase/openshift-microshift-rebase-chain.yaml
+++ b/ci-operator/step-registry/openshift/microshift/rebase/openshift-microshift-rebase-chain.yaml
@@ -1,4 +1,5 @@
 chain:
   as: openshift-microshift-rebase
   steps:
+    - ref: openshift-microshift-includes
     - ref: openshift-microshift-rebase
diff --git a/ci-operator/step-registry/openshift/microshift/rebase/openshift-microshift-rebase-commands.sh b/ci-operator/step-registry/openshift/microshift/rebase/openshift-microshift-rebase-commands.sh
index 778ae1697fe73..445c5e540fdae 100644
--- a/ci-operator/step-registry/openshift/microshift/rebase/openshift-microshift-rebase-commands.sh
+++ b/ci-operator/step-registry/openshift/microshift/rebase/openshift-microshift-rebase-commands.sh
@@ -12,6 +12,8 @@ pip3 install setuptools-rust cryptography pyyaml pygithub gitpython
 
 cp /secrets/import-secret/.dockerconfigjson ${HOME}/.pull-secret.json
 
+ci_clone_src true
+
 cd /go/src/github.com/openshift/microshift/
 DEST_DIR=${HOME}/.local/bin ./scripts/fetch_tools.sh yq
 ./scripts/auto-rebase/rebase_job_entrypoint.sh