diff --git a/ansible/docker-registry.yml b/ansible/docker-registry.yml
index adf9deba6..d7ae8d3db 100644
--- a/ansible/docker-registry.yml
+++ b/ansible/docker-registry.yml
@@ -7,7 +7,7 @@
 # action: One of deploy, destroy, pull, reconfigure, upgrade
 
 - name: Ensure a local Docker registry is deployed
-  hosts: controllers[0]
+  hosts: docker-registry
   tags:
     - docker-registry
   roles:
diff --git a/etc/kayobe/inventory/groups b/etc/kayobe/inventory/groups
index cb9c90660..a009693e3 100644
--- a/etc/kayobe/inventory/groups
+++ b/etc/kayobe/inventory/groups
@@ -53,6 +53,12 @@ monitoring
 storage
 compute
 
+[docker-registry:children]
+# Hosts in this group will have a Docker Registry deployed. This group should
+# generally contain only a single host, to avoid deploying multiple independent
+# registries which may become unsynchronized.
+seed
+
 ###############################################################################
 # Baremetal compute node groups.
 
diff --git a/kayobe/cli/commands.py b/kayobe/cli/commands.py
index beafc9629..c0fb6a430 100644
--- a/kayobe/cli/commands.py
+++ b/kayobe/cli/commands.py
@@ -367,6 +367,7 @@ class SeedHostConfigure(KollaAnsibleMixin, KayobeAnsibleMixin, VaultMixin,
     * Optionally, create a virtualenv for kolla-ansible.
     * Configure a user account for kolla-ansible.
     * Configure Docker engine.
+    * Optionally, deploy a Docker Registry.
     """
 
     def get_parser(self, prog_name):
@@ -439,6 +440,12 @@ class SeedHostConfigure(KollaAnsibleMixin, KayobeAnsibleMixin, VaultMixin,
         self.run_kayobe_playbooks(parsed_args, playbooks,
                                   extra_vars=extra_vars, limit="seed")
 
+        # Optionally, deploy a Docker Registry.
+        playbooks = _build_playbook_list("docker-registry")
+        extra_vars = {"kayobe_action": "deploy"}
+        self.run_kayobe_playbooks(parsed_args, playbooks,
+                                  extra_vars=extra_vars, limit="seed")
+
 
 class SeedHostPackageUpdate(KayobeAnsibleMixin, VaultMixin, Command):
     """Update packages on the seed host."""
diff --git a/kayobe/tests/unit/cli/test_commands.py b/kayobe/tests/unit/cli/test_commands.py
index 52c0b9714..95c18373e 100644
--- a/kayobe/tests/unit/cli/test_commands.py
+++ b/kayobe/tests/unit/cli/test_commands.py
@@ -344,6 +344,14 @@ class TestCase(unittest.TestCase):
                 limit="seed",
                 extra_vars={'pip_applicable_users': [None]},
             ),
+            mock.call(
+                mock.ANY,
+                [
+                    "ansible/docker-registry.yml",
+                ],
+                limit="seed",
+                extra_vars={'kayobe_action': 'deploy'},
+            ),
         ]
         self.assertEqual(expected_calls, mock_run.call_args_list)
 
diff --git a/releasenotes/notes/docker-registry-on-seed-2eb4fb643d6fda9a.yaml b/releasenotes/notes/docker-registry-on-seed-2eb4fb643d6fda9a.yaml
new file mode 100644
index 000000000..81507d462
--- /dev/null
+++ b/releasenotes/notes/docker-registry-on-seed-2eb4fb643d6fda9a.yaml
@@ -0,0 +1,9 @@
+---
+upgrade:
+  - |
+    When enabled, a Docker Registry is now deployed on hosts in the
+    ``docker-registry`` group, which defaults to include the seed. The existing
+    behaviour of deploying on the first controller can be retained by removing
+    the seed group from ``[docker-registry:children]`` in
+    ``$KAYOBE_CONFIG_PATH/inventory/groups` and creating a
+    ``[docker-registry]`` group including the name of the first controller.