diff --git a/manifests/engine.pp b/manifests/engine.pp
index 667e12fb..171d68f4 100644
--- a/manifests/engine.pp
+++ b/manifests/engine.pp
@@ -75,7 +75,7 @@
 #   (optional) Array of trustor roles to be delegated to heat.
 #   This value is also used by heat::keystone::auth if it is set to
 #   configure the keystone roles.
-#   Defaults to ['heat_stack_owner']
+#   Defaults to $::os_service_default. 
 #
 # [*instance_connection_is_secure*]
 #   (Optional) Instance connection to CFN/CW API via https.
@@ -122,7 +122,7 @@ class heat::engine (
   $deferred_auth_method                            = $::os_service_default,
   $default_software_config_transport               = $::os_service_default,
   $default_deployment_signal_transport             = $::os_service_default,
-  $trusts_delegated_roles                          = ['heat_stack_owner'],
+  $trusts_delegated_roles                          = $::os_service_default,
   $instance_connection_is_secure                   = $::os_service_default,
   $instance_connection_https_validate_certificates = $::os_service_default,
   $max_resources_per_stack                         = $::os_service_default,
diff --git a/releasenotes/notes/fix_trusts_delegated_roles-708642a94898d65a.yaml b/releasenotes/notes/fix_trusts_delegated_roles-708642a94898d65a.yaml
new file mode 100644
index 00000000..ff3f33f3
--- /dev/null
+++ b/releasenotes/notes/fix_trusts_delegated_roles-708642a94898d65a.yaml
@@ -0,0 +1,4 @@
+---
+fixes:
+  - Change trusts_delegated_roles to os_service_default, it has
+    changed to [] since Kilo.
\ No newline at end of file
diff --git a/spec/classes/heat_engine_spec.rb b/spec/classes/heat_engine_spec.rb
index 69833ec9..b209acb9 100644
--- a/spec/classes/heat_engine_spec.rb
+++ b/spec/classes/heat_engine_spec.rb
@@ -10,7 +10,7 @@ describe 'heat::engine' do
       :heat_waitcondition_server_url       => 'http://127.0.0.1:8000/v1/waitcondition',
       :heat_watch_server_url               => 'http://128.0.0.1:8003',
       :engine_life_check_timeout           => '<SERVICE DEFAULT>',
-      :trusts_delegated_roles              => ['heat_stack_owner'],
+      :trusts_delegated_roles              => '<SERVICE DEFAULT>',
       :deferred_auth_method                => '<SERVICE DEFAULT>',
       :default_software_config_transport   => '<SERVICE DEFAULT>',
       :default_deployment_signal_transport => '<SERVICE DEFAULT>',