diff --git a/ansible-role-requirements.yml b/ansible-role-requirements.yml
index f18431f7ea..1012782abe 100644
--- a/ansible-role-requirements.yml
+++ b/ansible-role-requirements.yml
@@ -206,3 +206,7 @@
   scm: git
   src: https://git.openstack.org/openstack/openstack-ansible-os_tacker
   version: master
+- name: haproxy_endpoints
+  scm: git
+  src: https://github.com/logan2211/ansible-haproxy-endpoints
+  version: master
diff --git a/group_vars/galera_all.yml b/group_vars/galera_all.yml
index 73c15b7bb5..bcb0959478 100644
--- a/group_vars/galera_all.yml
+++ b/group_vars/galera_all.yml
@@ -26,3 +26,7 @@ galera_container_bind_mounts:
 # Disable PrivateDevices for MariaDB on CentOS 7
 # See https://bugs.launchpad.net/openstack-ansible/+bug/1697531 for details.
 galera_disable_privatedevices: "{{ ((properties.is_metal | default(false)) | bool) | ternary('false', 'true') }}"
+
+# Galera sessions are long lived, so if we do endpoint maintenance we will
+# force kill the sessions to force a failover to the active endpoint.
+haproxy_shutdown_sessions: yes
diff --git a/playbooks/galera-install.yml b/playbooks/galera-install.yml
index 175b72698e..38bd854b06 100644
--- a/playbooks/galera-install.yml
+++ b/playbooks/galera-install.yml
@@ -50,7 +50,15 @@
   max_fail_percentage: 20
   user: root
   roles:
+    - role: haproxy_endpoints
+      haproxy_state: disabled
+      static: no
+      when: "{{ groups['haproxy'] | default([]) | length > 0 }}"
     - role: "galera_server"
+    - role: haproxy_endpoints
+      haproxy_state: enabled
+      static: no
+      when: "{{ groups['haproxy'] | default([]) | length > 0 }}"
     - role: "rsyslog_client"
       rsyslog_client_log_rotate_file: galera_log_rotate
       rsyslog_client_log_dir: "/var/log/mysql_logs"