diff --git a/src/openstack_hieradata.py b/src/openstack_hieradata.py
index fecd7c9b..520d1e8a 100644
--- a/src/openstack_hieradata.py
+++ b/src/openstack_hieradata.py
@@ -81,7 +81,7 @@
 
 ######## Heat
 openstack::heat::password: '$__openstack_password__'
-openstack::heat::encryption_key: ''
+openstack::heat::encryption_key: '$__heat_encryption_key__'
 
 ######## Horizon
 openstack::horizon::secret_key: '$__openstack_password__'
diff --git a/src/server_mgr_puppet.py b/src/server_mgr_puppet.py
index a6942239..8186f4d6 100644
--- a/src/server_mgr_puppet.py
+++ b/src/server_mgr_puppet.py
@@ -588,6 +588,7 @@ def build_openstack_hiera_file(
         mysql_root_password = cluster_params.get("mysql_root_password", "c0ntrail123")
         keystone_admin_token = cluster_params.get("service_token", "contrail123")
         keystone_admin_password = cluster_params.get("keystone_password", "contrail123")
+        heat_encryption_key = cluster_params.get("heat_encryption_key", "notgood but just long enough i think")
         subnet_address = str(IPNetwork(
             openstack_ip + "/" + subnet_mask).network)
         subnet_octets = subnet_address.split(".")
@@ -606,7 +607,8 @@ def build_openstack_hiera_file(
             '__keystone_admin_token__': keystone_admin_token,
             '__keystone_admin_password__': keystone_admin_password,
             '__mysql_allowed_hosts__': (', '.join("'" + item + "'" for item in mysql_allowed_hosts)),
-            '__openstack_password__': keystone_admin_password
+            '__openstack_password__': keystone_admin_password,
+            '__heat_encryption_key__': heat_encryption_key
         }
         data = openstack_hieradata.template.safe_substitute(template_vals)
         outfile = open(hiera_filename, 'w')