diff --git a/ceph/utils.py b/ceph/utils.py
index c03005b..6b8185a 100644
--- a/ceph/utils.py
+++ b/ceph/utils.py
@@ -1814,6 +1814,13 @@ def _initialize_disk(dev, dev_uuid, encrypt=False,
             '--uuid', dev_uuid,
             dev,
         ])
+        subprocess.check_call([
+            'dd',
+            'if=/dev/zero',
+            'of={}'.format(dm_crypt),
+            'bs=512',
+            'count=1',
+        ])
 
     if use_vaultlocker:
         return dm_crypt
diff --git a/unit_tests/test_utils.py b/unit_tests/test_utils.py
index af525f8..6c66d64 100644
--- a/unit_tests/test_utils.py
+++ b/unit_tests/test_utils.py
@@ -851,11 +851,14 @@ class CephInitializeDiskTestCase(unittest.TestCase):
                                                 True,
                                                 'vault'),
                          '/dev/mapper/crypt-test-UUID')
-        _check_call.assert_called_once_with(
-            ['vaultlocker', 'encrypt',
-             '--uuid', 'test-UUID',
-             '/dev/sdb']
-        )
+        _check_call.assert_has_calls([
+            call(['vaultlocker', 'encrypt',
+                  '--uuid', 'test-UUID',
+                  '/dev/sdb']),
+            call(['dd', 'if=/dev/zero',
+                  'of=/dev/mapper/crypt-test-UUID',
+                  'bs=512', 'count=1']),
+        ])
 
     @patch.object(utils, '_luks_uuid')
     @patch.object(utils.subprocess, 'check_call')