diff --git a/doc/source/user/howto.rst b/doc/source/user/howto.rst
index 6b3698741..b495b2a9a 100644
--- a/doc/source/user/howto.rst
+++ b/doc/source/user/howto.rst
@@ -141,7 +141,7 @@ in an ``instance_info`` variable, for example:
         },
         "instance_info": {
           "image_source": "http://image.server/image.qcow2",
-          "image_checksum": "<md5 checksum>",
+          "image_checksum": "<md5/sha256/sha512 checksum>",
           "configdrive": {
             "meta_data": {
               "public_keys": {"0": "ssh-rsa ..."},
diff --git a/playbooks/roles/bifrost-deploy-nodes-dynamic/tasks/main.yml b/playbooks/roles/bifrost-deploy-nodes-dynamic/tasks/main.yml
index 3fb391e4d..9736532f1 100644
--- a/playbooks/roles/bifrost-deploy-nodes-dynamic/tasks/main.yml
+++ b/playbooks/roles/bifrost-deploy-nodes-dynamic/tasks/main.yml
@@ -82,7 +82,7 @@
           stat:
             path: "{{ deploy_image_path }}"
             get_checksum: yes
-            checksum_algorithm: md5
+            checksum_algorithm: sha256
           register: test_deploy_image
           become: yes
 
diff --git a/playbooks/roles/bifrost-ironic-install/tasks/bootstrap.yml b/playbooks/roles/bifrost-ironic-install/tasks/bootstrap.yml
index 7ab3e9fc5..49748421c 100644
--- a/playbooks/roles/bifrost-ironic-install/tasks/bootstrap.yml
+++ b/playbooks/roles/bifrost-ironic-install/tasks/bootstrap.yml
@@ -423,7 +423,7 @@
 - when: download_custom_deploy_image | bool
   block:
     - name: "Create a checksum file for the custom deployment image"
-      shell: md5sum {{ deploy_image_filename }} > {{ deploy_image_filename }}.CHECKSUMS
+      shell: sha256sum {{ deploy_image_filename }} > {{ deploy_image_filename }}.CHECKSUMS
       args:
         chdir: "{{ http_boot_folder }}"
     - name: "Ensure the checksum file is readable"
diff --git a/releasenotes/notes/no-md5-38bb5be4da0f8d4a.yaml b/releasenotes/notes/no-md5-38bb5be4da0f8d4a.yaml
new file mode 100644
index 000000000..2ba14cfa8
--- /dev/null
+++ b/releasenotes/notes/no-md5-38bb5be4da0f8d4a.yaml
@@ -0,0 +1,4 @@
+---
+upgrade:
+  - |
+    SHA256 is now used instead of MD5 for any checksums calculated by Bifrost.