diff --git a/ci-operator/step-registry/enable-qe-catalogsource/disconnected/enable-qe-catalogsource-disconnected-commands.sh b/ci-operator/step-registry/enable-qe-catalogsource/disconnected/enable-qe-catalogsource-disconnected-commands.sh
index 0152b7a396e92..f6cd38ba28595 100644
--- a/ci-operator/step-registry/enable-qe-catalogsource/disconnected/enable-qe-catalogsource-disconnected-commands.sh
+++ b/ci-operator/step-registry/enable-qe-catalogsource/disconnected/enable-qe-catalogsource-disconnected-commands.sh
@@ -639,7 +639,30 @@ else
     origin_index_image="$OO_INDEX"
 fi
 
+# On C2S/SC2S, mirror_optional_images re-publishes origin_index_image under the
+# canonical aosqe targetCatalog/targetTag, so the catalogsource keeps pointing there.
 mirror_index_image="${MIRROR_PROXY_REGISTRY_QUAY}/openshift-qe-optional-operators/aosqe-index:v${kube_major}.${kube_minor}"
+
+if [[ $OO_INDEX != "" && $mirror -eq 0 ]]; then
+    # Nothing re-publishes the override on a non-C2S cluster, so the catalogsource has
+    # to pull it directly -- which in a disconnected install means going through one of
+    # the pull-through proxies create_settled_icsp configures. Only those registries are
+    # fronted, so match them explicitly and fall back to the canonical index on
+    # anything else rather than building a reference the proxy cannot resolve.
+    case "$OO_INDEX" in
+        quay.io/openshifttest/*|quay.io/openshift-qe-optional-operators/*|quay.io/olmqe/*)
+            mirror_index_image="${MIRROR_PROXY_REGISTRY_QUAY}/${OO_INDEX#quay.io/}" ;;
+        registry.redhat.io/*|brew.registry.redhat.io/*|registry.stage.redhat.io/*|registry-proxy.engineering.redhat.com/*)
+            mirror_index_image="${MIRROR_PROXY_REGISTRY}/${OO_INDEX#*/}" ;;
+        *)
+            # Not a registry the proxy fronts (for example a ci-operator pipeline
+            # pullspec on registry.buildXX.ci.openshift.org). Constructing a proxied
+            # reference for it would not resolve, so keep the previous behaviour of
+            # using the canonical index and say so instead of failing the job.
+            echo "WARNING: OO_INDEX=${OO_INDEX} is not in a registry fronted by the mirror proxy; using ${mirror_index_image}"
+            echo "WARNING: proxied registries are quay.io/{openshifttest,openshift-qe-optional-operators,olmqe}, registry.redhat.io, brew.registry.redhat.io, registry.stage.redhat.io, registry-proxy.engineering.redhat.com" ;;
+    esac
+fi
 echo "origin_index_image: ${origin_index_image}"
 echo "mirror_index_image: ${mirror_index_image}"
 
diff --git a/ci-operator/step-registry/enable-qe-catalogsource/disconnected/enable-qe-catalogsource-disconnected-ref.yaml b/ci-operator/step-registry/enable-qe-catalogsource/disconnected/enable-qe-catalogsource-disconnected-ref.yaml
index 822220c2a8c1e..f282e3f9d3da4 100644
--- a/ci-operator/step-registry/enable-qe-catalogsource/disconnected/enable-qe-catalogsource-disconnected-ref.yaml
+++ b/ci-operator/step-registry/enable-qe-catalogsource/disconnected/enable-qe-catalogsource-disconnected-ref.yaml
@@ -16,6 +16,19 @@ ref:
     default: ""
     documentation: |-
       The index image URL. For example: quay.io/openshift-qe-optional-operators/ocp4-index:v4.17
+      When unset, the index defaults to
+      quay.io/openshift-qe-optional-operators/aosqe-index:v<kube_major>.<kube_minor>,
+      derived from the cluster's Kubernetes version. Set this to pin a specific index,
+      for example when the version-derived tag is unavailable upstream.
+      On C2S/SC2S clusters the index is re-published under the canonical aosqe
+      catalog, so any registry works. On other disconnected clusters the catalogsource
+      pulls the override directly and it must live in a registry fronted by the mirror
+      proxy: quay.io/openshifttest, quay.io/openshift-qe-optional-operators,
+      quay.io/olmqe, registry.redhat.io, brew.registry.redhat.io,
+      registry.stage.redhat.io or registry-proxy.engineering.redhat.com.
+      Any other value (for example a ci-operator pipeline pullspec) is not proxied;
+      the step logs a warning and falls back to the version-derived index, which is
+      the behaviour it had before this override was honored.
   - name: CATALOGSOURCE_NAME
     default: qe-app-registry
     documentation: |-