diff --git a/nova/notifications/objects/image.py b/nova/notifications/objects/image.py
index d13ff6845f73..575081f4b9df 100644
--- a/nova/notifications/objects/image.py
+++ b/nova/notifications/objects/image.py
@@ -133,9 +133,6 @@ class ImageMetaPropsPayload(base.NotificationPayloadBase):
     # Version 1.13: Added 'hw_virtio_packed_ring' field
     VERSION = '1.13'
 
-    SCHEMA = {
-        k: ('image_meta_props', k) for k in image_meta.ImageMetaProps.fields}
-
     # NOTE(efried): This logic currently relies on all of the fields of
     # ImageMetaProps being initialized with no arguments. See the docstring.
     # NOTE(efried): It's possible this could just be:
@@ -143,7 +140,11 @@ class ImageMetaPropsPayload(base.NotificationPayloadBase):
     #  But it is not clear that OVO can tolerate the same *instance* of a type
     #  class being used in more than one place.
     fields = {
-        k: v.__class__() for k, v in image_meta.ImageMetaProps.fields.items()}
+        k: v.__class__() for k, v in image_meta.ImageMetaProps.fields.items()
+            if k not in ('hw_ephemeral_encryption_secret_uuid',)}
+
+    SCHEMA = {
+        k: ('image_meta_props', k) for k in fields}
 
     def __init__(self, image_meta_props):
         super(ImageMetaPropsPayload, self).__init__()
diff --git a/nova/objects/image_meta.py b/nova/objects/image_meta.py
index 0afb0e31385b..ab486b30705d 100644
--- a/nova/objects/image_meta.py
+++ b/nova/objects/image_meta.py
@@ -195,14 +195,17 @@ class ImageMetaProps(base.NovaObject):
     # Version 1.35: Added 'hw_virtio_packed_ring' field
     # Version 1.36: Added 'hw_maxphysaddr_mode' and
     #                     'hw_maxphysaddr_bits' field
+    # Version 1.37: Added 'hw_ephemeral_encryption_secret_uuid' field
     # NOTE(efried): When bumping this version, the version of
     # ImageMetaPropsPayload must also be bumped. See its docstring for details.
-    VERSION = '1.36'
+    VERSION = '1.37'
 
     def obj_make_compatible(self, primitive, target_version):
         super(ImageMetaProps, self).obj_make_compatible(primitive,
                                                         target_version)
         target_version = versionutils.convert_version_to_tuple(target_version)
+        if target_version < (1, 37):
+            primitive.pop('hw_ephemeral_encryption_secret_uuid', None)
         if target_version < (1, 36):
             primitive.pop('hw_maxphysaddr_mode', None)
             primitive.pop('hw_maxphysaddr_bits', None)
@@ -480,6 +483,8 @@ class ImageMetaProps(base.NovaObject):
         # encryption format to be used when ephemeral encryption is enabled
         'hw_ephemeral_encryption_format':
             fields.BlockDeviceEncryptionFormatTypeField(),
+        # encryption secret uuid string for passphrase in the image
+        'hw_ephemeral_encryption_secret_uuid': fields.UUIDField(),
 
         # boolean - If true, this will enable the virtio packed ring feature
         'hw_virtio_packed_ring': fields.FlexibleBooleanField(),
diff --git a/nova/tests/unit/objects/test_image_meta.py b/nova/tests/unit/objects/test_image_meta.py
index a5ac3f42c86b..0225d45f44b5 100644
--- a/nova/tests/unit/objects/test_image_meta.py
+++ b/nova/tests/unit/objects/test_image_meta.py
@@ -14,6 +14,8 @@
 
 import datetime
 
+from oslo_utils.fixture import uuidsentinel as uuids
+
 from nova import exception
 from nova import objects
 from nova.objects import fields
@@ -570,3 +572,22 @@ class TestImageMetaProps(test.NoDBTestCase):
         # and is absent on older versions
         primitive = obj.obj_to_primitive('1.33')
         self.assertNotIn('hw_viommu_model', primitive['nova_object.data'])
+
+    def test_obj_make_compatible_ephemeral_encryption_secret_uuid(self):
+        """Check 'hw_ephemeral_encryption_secret_uuid' compatibility."""
+        obj = objects.ImageMetaProps(
+            hw_ephemeral_encryption_secret_uuid=uuids.secret)
+
+        primitive = obj.obj_to_primitive('1.37')
+        self.assertIn(
+            'hw_ephemeral_encryption_secret_uuid',
+            primitive['nova_object.data'])
+        self.assertEqual(
+            uuids.secret,
+            primitive[
+                'nova_object.data']['hw_ephemeral_encryption_secret_uuid'])
+
+        primitive = obj.obj_to_primitive('1.36')
+        self.assertNotIn(
+            'hw_ephemeral_encryption_secret_uuid',
+            primitive['nova_object.data'])
diff --git a/nova/tests/unit/objects/test_objects.py b/nova/tests/unit/objects/test_objects.py
index 9c177277cf18..01b771b07801 100644
--- a/nova/tests/unit/objects/test_objects.py
+++ b/nova/tests/unit/objects/test_objects.py
@@ -1105,7 +1105,7 @@ object_data = {
     'HyperVLiveMigrateData': '1.4-e265780e6acfa631476c8170e8d6fce0',
     'IDEDeviceBus': '1.0-29d4c9f27ac44197f01b6ac1b7e16502',
     'ImageMeta': '1.8-642d1b2eb3e880a367f37d72dd76162d',
-    'ImageMetaProps': '1.36-5d06cd527d8d32e6e2b457ce3b9369e0',
+    'ImageMetaProps': '1.37-1e0d70fb51041c0446b00695c5ef0e21',
     'Instance': '2.8-2727dba5e4a078e6cc848c1f94f7eb24',
     'InstanceAction': '1.2-9a5abc87fdd3af46f45731960651efb5',
     'InstanceActionEvent': '1.4-5b1f361bd81989f8bb2c20bb7e8a4cb4',