diff --git a/examples/rhel-ubi/Containerfile b/examples/rhel-ubi/Containerfile
new file mode 100644
index 0000000..8f3e875
--- /dev/null
+++ b/examples/rhel-ubi/Containerfile
@@ -0,0 +1,77 @@
+# A Warewulf node image built from the Red Hat Universal Base Image (UBI).
+#
+# The UBI base image only includes the UBI repositories (ubi.repo), which are
+# a subset of RHEL. To install the full RHEL package set we reuse the build
+# host's Red Hat subscription: on a registered host, podman and buildah
+# automatically expose the subscription to the build and the
+# subscription-manager dnf plugin writes /etc/yum.repos.d/redhat.repo.
+#
+# See README.md for how to provide the host subscription to the build and for
+# the relevant caveats.
+
+FROM registry.access.redhat.com/ubi9/ubi:latest
+
+# The release version of your Red Hat subscription (CDN or Satellite). This may
+# differ from the UBI image's own $releasever (e.g. "9.4" vs "9"), so we set it
+# explicitly to match the repository URLs that subscription-manager configures
+# in /etc/yum.repos.d/redhat.repo.
+ARG RELEASEVER=9
+
+RUN set -eux \
+    # The ubi.repo repositories overlap with the full RHEL BaseOS and AppStream
+    # repositories from the subscription. Remove it and rely on redhat.repo.
+    && rm -f /etc/yum.repos.d/ubi.repo \
+    # Pin $releasever to match the subscription's repository URLs.
+    && mkdir -p /etc/dnf/vars \
+    && echo "${RELEASEVER}" > /etc/dnf/vars/releasever \
+    && dnf clean all \
+    # subscription-manager disables BaseOS and AppStream by default in
+    # container mode; enable all subscribed repositories.
+    && dnf config-manager --set-enabled '*' \
+    && dnf upgrade -y \
+    && dnf install -y --allowerasing \
+      kernel \
+      kernel-core \
+      kernel-modules \
+      coreutils \
+      cpio \
+      dhclient \
+      e2fsprogs \
+      ethtool \
+      findutils \
+      initscripts \
+      ipmitool \
+      iproute \
+      ncurses \
+      net-tools \
+      NetworkManager \
+      nfs-utils \
+      openssh-clients \
+      openssh-server \
+      pciutils \
+      psmisc \
+      rsync \
+      rsyslog \
+      strace \
+      wget \
+      which \
+    && dnf clean all
+
+# Unmask what RHEL masked in the UBI base image.
+# Needed to get an actual login tty.
+RUN rm -f /etc/systemd/system/systemd-logind.service \
+    && rm -f /etc/systemd/system/getty.target \
+    && rm -f /etc/systemd/system/console-getty.service \
+    && rm -f /etc/systemd/system/sys-fs-fuse-connections.mount \
+    && rm -f /etc/systemd/system/systemd-remount-fs.service \
+    && rm -f /etc/systemd/system/dev-hugepages.mount
+
+COPY excludes /etc/warewulf/
+COPY container_exit.sh /etc/warewulf/
+RUN /etc/warewulf/container_exit.sh
+
+CMD [ "/bin/echo", "-e", \
+      "This image is intended to be used with the Warewulf cluster management and", \
+      "\nprovisioning system.", \
+      "\n", \
+      "\nFor more information about Warewulf, visit https://warewulf.org" ]
diff --git a/examples/rhel-ubi/README.md b/examples/rhel-ubi/README.md
new file mode 100644
index 0000000..435b033
--- /dev/null
+++ b/examples/rhel-ubi/README.md
@@ -0,0 +1,53 @@
+# Red Hat Enterprise Linux from the Universal Base Image (UBI)
+
+The Red Hat Universal Base Image (UBI) is freely redistributable, but it only
+includes the UBI repositories, which are a subset of RHEL. This example builds
+a Warewulf node image from a UBI base while installing the full RHEL package
+set, by reusing the build host's Red Hat subscription (from either the Red Hat
+CDN or a Red Hat Satellite server).
+
+On a host registered with `subscription-manager`, podman and buildah
+automatically expose the host's subscription to the build, and the
+subscription-manager dnf plugin (running in "container mode") generates
+`/etc/yum.repos.d/redhat.repo` inside the build. The `Containerfile` then
+removes the overlapping `ubi.repo`, pins `$releasever`, enables the subscribed
+repositories, and installs the desired packages.
+
+```
+podman build . --tag rhel:9
+```
+
+If your host does not expose the subscription automatically, mount the relevant
+files in (as in the [`rhel-9`](../rhel-9) example):
+
+```
+podman build \
+    --volume=/etc/pki/entitlement:/run/secrets/etc-pki-entitlement:ro \
+    --volume=/etc/rhsm:/run/secrets/rhsm:ro \
+    --volume=/etc/yum.repos.d/redhat.repo:/run/secrets/redhat.repo:ro \
+    . --tag rhel:9
+```
+
+For more information, see https://access.redhat.com/solutions/5870841.
+
+## Release version
+
+Set `--build-arg RELEASEVER=...` to match your subscription's release version.
+This is set explicitly because the UBI image's own `$releasever` may differ
+from the value used in the `baseurl` of `redhat.repo` (e.g. `9.4` vs `9`),
+which would otherwise point dnf at the wrong repository URLs.
+
+```
+podman build . --build-arg RELEASEVER=9.4 --tag rhel:9.4
+```
+
+## Caveats
+
+* This example uses the full `ubi` base image, which includes `dnf`. The
+  `ubi-minimal` image ships only `microdnf`, so building from it would first
+  require `microdnf install dnf`.
+
+* If your repositories are "snapshots" (version-frozen, as with Red Hat
+  Satellite), choose a UBI image whose own repositories are **older than or as
+  current as** the snapshot. Otherwise packages already present in the UBI base
+  may be downgraded during the build.
diff --git a/examples/rhel-ubi/container_exit.sh b/examples/rhel-ubi/container_exit.sh
new file mode 100755
index 0000000..3c52e87
--- /dev/null
+++ b/examples/rhel-ubi/container_exit.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+set -x
+LANG=C
+LC_CTYPE=C
+export LANG LC_CTYPE
+dnf clean all
+rm -f /var/lib/dbus/machine-id
+truncate -s0 /etc/machine-id
diff --git a/examples/rhel-ubi/excludes b/examples/rhel-ubi/excludes
new file mode 100644
index 0000000..bf00703
--- /dev/null
+++ b/examples/rhel-ubi/excludes
@@ -0,0 +1,2 @@
+/boot/
+/usr/share/GeoIP