diff --git a/manifests/site.pp b/manifests/site.pp
index 0d284cc9c3..ac95cd8963 100644
--- a/manifests/site.pp
+++ b/manifests/site.pp
@@ -525,6 +525,16 @@ node /^git\d+\.openstack\.org$/ {
   }
 }
 
+# A machine to drive AFS mirror updates.
+# Node-OS: trusty
+node 'mirror-update.openstack.org' {
+  class { 'openstack_project::mirror_update':
+    bandersnatch_keytab => hiera('bandersnatch_keytab'),
+    admin_keytab        => hiera('afsadmin_keytab'),
+    sysadmins           => hiera('sysadmins', []),
+  }
+}
+
 # Machines in each region to run PyPI mirrors.
 # Node-OS: precise
 node /^pypi\..*\.openstack\.org$/ {
diff --git a/modules.env b/modules.env
index 1336ac0f7e..d0822fba5f 100644
--- a/modules.env
+++ b/modules.env
@@ -90,6 +90,7 @@ INTEGRATION_MODULES["$OPENSTACK_GIT_ROOT/openstack-infra/puppet-ansible"]="origi
 INTEGRATION_MODULES["$OPENSTACK_GIT_ROOT/openstack-infra/puppet-apps_site"]="origin/master"
 INTEGRATION_MODULES["$OPENSTACK_GIT_ROOT/openstack-infra/puppet-askbot"]="origin/master"
 INTEGRATION_MODULES["$OPENSTACK_GIT_ROOT/openstack-infra/puppet-asterisk"]="origin/master"
+INTEGRATION_MODULES["$OPENSTACK_GIT_ROOT/openstack-infra/puppet-bandersnatch"]="origin/master"
 INTEGRATION_MODULES["$OPENSTACK_GIT_ROOT/openstack-infra/puppet-bugdaystats"]="origin/master"
 INTEGRATION_MODULES["$OPENSTACK_GIT_ROOT/openstack-infra/puppet-bup"]="origin/master"
 INTEGRATION_MODULES["$OPENSTACK_GIT_ROOT/openstack-infra/puppet-cgit"]="origin/master"
diff --git a/modules/openstack_project/files/bandersnatch-mirror-update.sh b/modules/openstack_project/files/bandersnatch-mirror-update.sh
new file mode 100644
index 0000000000..f423851a19
--- /dev/null
+++ b/modules/openstack_project/files/bandersnatch-mirror-update.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+# Copyright 2016 IBM Corp.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+echo "Obtaining bandersnatch tokens and running bandersnatch."
+k5start -t -f /etc/bandersnatch.keytab service/bandersnatch -- timeout -k 2m 30m run-bandersnatch
+
+RET=$?
+
+if [ $RET ]; then
+    echo "Bandersnatch completed successfully, running vos release."
+    k5start -t -f /etc/afsadmin.keytab service/afsafdmin -- vos release mirror.pypi
+fi
+
+echo "Done."
diff --git a/modules/openstack_project/manifests/mirror_update.pp b/modules/openstack_project/manifests/mirror_update.pp
new file mode 100644
index 0000000000..87ddfbcfda
--- /dev/null
+++ b/modules/openstack_project/manifests/mirror_update.pp
@@ -0,0 +1,59 @@
+# == Class: openstack_project::mirror_update
+#
+class openstack_project::mirror_update (
+  $sysadmins = [],
+  $bandersnatch_keytab = '',
+  $admin_keytab = '',
+) {
+
+  class { 'openstack_project::server':
+    sysadmins => $sysadmins,
+    afs       => true,
+  }
+
+  class { 'bandersnatch':
+    bandersnatch_source => 'https://bitbucket.org/jeblair/bandersnatch',
+  }
+
+  class { 'bandersnatch::mirror':
+    mirror_root => '/afs/.openstack.org/mirror/pypi',
+    static_root => '/afs/.openstack.org/mirror',
+    hash_index  => true,
+    require     => Class['bandersnatch'],
+  }
+
+  file { '/etc/bandersnatch.keytab':
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0400',
+    content => $bandersnatch_keytab,
+  }
+
+  file { '/etc/afsadmin.keytab':
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0400',
+    content => $bandersnatch_keytab,
+  }
+
+  file { '/usr/local/bin/bandersnatch-mirror-update':
+    ensure  => present,
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0755',
+    source  => 'puppet:///modules/openstack_project/bandersnatch-mirror-update.sh',
+  }
+
+  cron { 'bandersnatch':
+    user        => $user,
+    minute      => '*/5',
+    command     => 'flock -n /var/run/bandersnatch/mirror.lock bandersnatch-mirror-update >>/var/log/bandersnatch/mirror.log 2>&1',
+    environment => 'PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin',
+    require     => [
+       File['/usr/local/bin/bandersnatch-mirror-update'],
+       File['/etc/afsadmin.keytab'],
+       File['/etc/bandersnatch.keytab'],
+       Class['bandersnatch::mirror']
+    ]
+  }
+}